Threats tagged 'command-injection'

CVE-2026-88771 is a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway. Exploitation involves attacker-controlled usernames triggering command execution, payload retrieval, reverse shell deployment, web shell installation, privileged account creation, and attempted exfiltration of configuration data. Two second-stage payloads, main.py and update_c08937.pl, facilitate persistent access and data theft. Post-exploitation artifacts include creation of superuser accounts and system binary modifications. Public exploit code is available via Metasploit. No patch or remediation details are provided.

CVE-2026-73570 is an unauthenticated OS command injection vulnerability in the SNMP notification path of Zimbra Collaboration Suite mail servers. It was actively exploited between July and August 2026. Attackers used this flaw to deploy JSP webshells and reverse shells without authentication, escalate privileges via PAM configuration abuse, and maintain persistence through systemd services. Post-exploitation activities included lateral movement across clusters using Zimbra SSH keys, theft of authentication secrets and mailbox data, and attempts to exfiltrate data using cloud storage tools. Multiple organizations across various regions and industries were targeted through automated and manual attacks on internet-facing Zimbra mail servers.