Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Authen-SASL

CVE-2026-86219 is a critical authentication bypass vulnerability in Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100. The flaw allows an attacker to replay a captured authentication response due to the server not verifying the nonce returned by the client against the originally issued nonce. This enables authentication as a legitimate user without knowing their password.

Authen::SASL::Perl::DIGEST_MD5 versions prior to 2.2100 do not properly verify the nonce value returned by the client during the DIGEST_MD5 SASL authentication process. The server generates a fresh nonce in server_start and sends it in the challenge, but server_step does not compare the client's returned nonce against this original value. Instead, it derives the expected digest from the client's parameters, allowing any response with a matching digest and nonce to be accepted. The count table used to prevent replay attacks is keyed on the client-supplied nonce and resets with each new server object, allowing replay of a previously captured valid response with the same nonce count. This violates RFC 2831 which requires the nonce in the response to match the server's challenge nonce. Consequently, an attacker who captures a successful qop=auth exchange can replay it later to authenticate as the same user without the password.

Detailed information about CVE-2026-86219: CWE-294 Authentication Bypass by Capture-replay. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-86219: CWE-294 Authentication Bypass by Capture-replay - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-86219: CWE-294 Authentication Bypass by Capture-replay

libauthen-sasl-perl

CVE-2026-86219 is a high severity vulnerability in libauthen-sasl-perl's Authen::SASL::Perl::DIGEST_MD5 module. It allows replayed authentication responses due to an unverified nonce in the server_step function, potentially enabling attackers to bypass authentication. The issue is fixed by verifying the nonce properly during authentication. Multiple versions prior to certain patched releases are affected. No known exploits have been reported in the wild.

The vulnerability in libauthen-sasl-perl (CVE-2026-86219) involves the acceptance of replayed authentication responses because the nonce used in the server_step function is not verified. This flaw could allow an attacker to reuse authentication messages, potentially bypassing authentication mechanisms. The issue is addressed in a security update that ensures proper nonce verification during the authentication process. The vulnerability carries a CVSS 3.1 score of 9.8, indicating critical impact on confidentiality, integrity, and availability. Affected versions include various releases prior to patched versions such as 2.1500-1ubuntu0.1~esm1 and others as listed. No exploits in the wild are currently known.

Detailed information about Security update for perl-Authen-SASL affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigat

Security update for perl-Authen-SASL - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE ratings

URL of this CSAF notice

URL for SUSE-SU-2026:23913-1

E-Mail link for SUSE-SU-2026:23913-1

SUSE Bug 1279806

SUSE CVE CVE-2026-86219 page

Libauthen sasl perl: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. (CVE-2026-86219)


CVE-2026-86219: CWE-294 Authentication Bypass by Capture-replayCVE-2026-86219 0 CVE-2026-86219 is a critical authentication bypass vulnerability in Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100. The flaw allows an attacker to replay a captured authentication response due to the server not verifying the nonce returned by the client against the originally issued nonce. This enables authentication as a legitimate user without knowing their password. CriticalVulnerability#cve #cve-2026-86219 #cwe-294 Join the discussion	CVE Database V5	09/09/2026, 00:00:00 UTC Added: 09/06/2026, 17:52:45 UTC
Libauthen sasl perl: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. (CVE-2026-86219)CVE-2026-86219 0 CVE-2026-86219 is a high severity vulnerability in libauthen-sasl-perl's Authen::SASL::Perl::DIGEST_MD5 module. It allows replayed authentication responses due to an unverified nonce in the server_step function, potentially enabling attackers to bypass authentication. The issue is fixed by verifying the nonce properly during authentication. Multiple versions prior to certain patched releases are affected. No known exploits have been reported in the wild. MediumVulnerability#gcve #csaf #cve-2026-86219 Join the discussion	GCVE Database	09/06/2026, 18:17:00 UTC Added: 09/30/2026, 15:53:36 UTC

Threats Tagged 'ubuntu-cve-2026-86219'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'ubuntu-cve-2026-86219'

Lead Pen Test Professional