28 results for “Rapid7”

CVE-2026-102764 is an unauthenticated RCE in BeyondTrust Remote Support, already exploited and in CISA KEV. Rapid7 published an analysis and opened a Metasploit pull request on 30 October 2026, showing code execution on version 24.1.2 via a forged "local" message origin, the native file-transfer service and a PHP file written to the web root. BT26-05 (CVSS 4.0 9.3) is fixed by patch BT26-05-RS; SaaS was patched by 9 October.

x.comthreadAdded 1 Nov 2026, published 31 Oct 2026🛡️ Security

SecurityWeek summarises Rapid7's Q3 2026 threat landscape report. High-severity vulnerabilities were exploited within an average of three days of disclosure, and 71% within seven days. The Gentlemen (342 claimed incidents) and Qilin (339) led ransomware, and the US took 60% of attacks. AI was an operational component in only 8% of tracked incidents. The report also covers 15 APT groups, a new DPRK Linux toolkit named 'ted', and access-broker listings.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

Social post describing CVE-2026-97229, a CVSS 10 unauthenticated RCE in GitLab CE/EE. A crafted .gitlab-ci.yml with a UTF-8 path passes validation under US-ASCII, then is recompiled by the Onigmo regex engine, where an integer wraps at INT_MAX. That gives attacker-controlled VM ops and system() execution as the git user. The chain is to push a payload to a public project, then call unauthenticated GET /api/v4/projects/:id/ci/lint. It links a Rapid7 PoC and writeup and lists fixed self-managed versions 19.2.8, 19.3.5 and 19.4.2. GitLab.com is already patched.

x.comthreadAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

S2W post on CVE-2026-97229, a CVSS 10.0 remote code execution flaw in the GitLab CE/EE CI/CD regex compiler, disclosed October 13, 2026. Insufficient regex validation plus an integer overflow during encoding conversion lets an attacker who can add CI/CD config use a malicious regex and a UTF-8 repository path to run commands as the git user. Affects self-managed 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Rapid7 published analysis and a public PoC exists, with no in-the-wild exploitation confirmed as of October 15. No workaround exists, so patch or restrict access to a management network or VPN.

x.comadvisoryAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Orca Security analysis of CVE-2026-97229, a CVSS 10.0 flaw in GitLab CE/EE. An integer overflow (CWE-190) in the CI/CD regular expression compiler gives memory corruption and code execution as the git user. It is triggered by a crafted regex in .gitlab-ci.yml combined with a UTF-8 repository path, with no authentication needed on instances that allow public project creation or self-registration. Lists affected branches (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2), the absence of a workaround, interim mitigations, and a Rapid7 PoC against GitLab CE 19.4.1 with ASLR on. Notes a prior max-severity GitLab bug (CVE-2026-85706) was probed in the wild within hours and later added to CISA KEV.

orca.securityadvisoryPublished and added 14 Oct 2026🛡️ Security

ThreatWire post on CVE-2026-97229, an integer overflow in the GitLab CI/CD regex compiler. GitLab rates it CVSS 3.1 10.0 and says it can allow unauthenticated code execution under certain conditions, in both CE and EE. Fixes are in 19.2.8, 19.3.5 and 19.4.2 (not 19.3.4), released Oct 12; GitLab-hosted instances are already patched. The post credits joaxcar via HackerOne and says a Rapid7 researcher published a lab PoC on GitHub, which ThreatWire has not run or verified. It also says the CVE is not in CISA KEV and has no known exploitation.

x.comthreadAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Rapid7's analysis of Microsoft's October 2026 Patch Tuesday, which covers 1,413 vulnerabilities, 1,102 of them in Windows. It highlights the exploited Windows Shell Mark of the Web bypass (CVE-2026-96951) and the publicly disclosed .NET Framework WDAC bypass (CVE-2026-108398). It also covers five no-interaction Outlook preview-pane RCEs, the Edge advisories that list no CVEs, and end-of-support dates for Server 2012/2012 R2, Office 2021, Exchange 2016/2019 and Windows 11 24H2. The page text is truncated, so the later CVE tables are not seen.

rapid7.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Rapid7 emergency-response analysis of CVE-2026-104935, a CVSS 8.6 authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure that allows unauthenticated remote command execution. It was exploited as a zero-day against a limited number of customers, added to CISA KEV on disclosure day, and Volexity observed it chained with a still-unpatched privilege escalation flaw. Part of the fix shipped in 25.1.3.0 in July 2026, with backports to other supported versions pending. Rapid7 advises emergency patching outside normal cycles and hunting for compromise using Volexity's IOCs, since Ivanti has no reliable ones.

rapid7.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Rapid7 analysis of CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the Onigmo regex compiler used by GitLab CE/EE's CI/CD regex handling. A crafted regex in a .gitlab-ci.yml passes validation as US-ASCII, then is recompiled for a UTF-8 repository path, producing invalid instructions that give code execution as the git user. Rapid7 reproduced it on GitLab CE 19.4.1 with ASLR (patched in 19.4.2); despite the vendor's "unauthenticated" rating, the attacker needs to commit a malicious config to a public project, which self-registration allows. No in-the-wild exploitation is confirmed, and Rapid7 recommends urgent upgrades.

rapid7.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Part 2 of a Rapid7 series on higher-education security examines how four overlapping compliance regimes — FERPA (24-hour Federal Student Aid breach notification), GLBA Safeguards Rule (law-enforcement notification at 500+ affected consumers), HIPAA (60-day HHS breach reporting), and CMMC Level 2 (110 NIST 800-171 practices for DoD-funded research) — collide during a single incident at decentralized, multi-campus university systems. It argues that fragmented data stores and governance make it hard to quickly scope which regulated data (financial aid, health records, CUI) was touched and which reporting clocks have started, and recommends consistent data classification plus centralized visibility/automation to meet overlapping deadlines.

rapid7.comarticlePublished and added 7 Oct 2026🛡️ Security

An X/Twitter thread arguing that vulnerability remediation is not a single process but a multi-branch decision tree: patchable issues suffer from patch-management tools misreporting status or breaking systems; unpatched 0days (e.g. Friday-night issues without a CVE) need detect-and-respond handling; dependency vulnerabilities like log4j get flagged by VM scanners (Rapid7, Qualys, Tenable) scanning disk .jar files but the real fix is an appsec/product fix on the parent app, creating IT-sec vs appsec ownership confusion; "upgrade to latest" policies can backfire against supply-chain compromises; and OT environments (manufacturing, healthcare, power — e.g. Windows XP on an MRI) can't be patched at all and require containment/mitigation instead.

x.comthreadAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

Rapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root — including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.

rapid7.comwriteupPublished and added 7 Oct 2026🛡️ Security

Rapid7 analyzes the ASOS incident, in which attackers sent a hostile push notification through ASOS's own mobile app claiming its Snowflake environment was compromised and directing customers to a Telegram channel; ASOS confirmed unauthorized access to third-party customer-communication platforms and possible exposure of names/contact details, while Snowflake denied any platform compromise. The piece argues that abusing a legitimate, trusted app/channel defeats typical phishing-awareness heuristics (odd sender, wrong domain) and makes the case for MDR that correlates identity, SaaS, and cloud-integration activity across providers to catch misuse of legitimate access rather than relying on known-bad indicators.

rapid7.comarticlePublished and added 7 Oct 2026🛡️ Security

Rapid7 details a new BPFDoor campaign targeting telecom and network-edge appliances (ShareTech, SpamSniper mail gateways) and a six-sample Linux RAT family dubbed AVERAT found on compromised Taiwanese CPE (Synology NAS, a NetKlass device, a Dahua DVR). The writeup reconstructs the Rapid7 BPFDoor controller's HTTP-tunneled trigger mechanism, a fileless ShareTech dropper that stages binaries as ntpdate/udevds and deletes them while processes keep running, a BPF Rekoobe variant that hides inside SMTP port-25 traffic, and AVERAT's RC4-derived config/C2 scheme — tying the infrastructure to the broader China-nexus ORB (Operational Relay Box) device pattern described in CISA/NCSC-UK advisory AA26-113A. It closes with detection guidance for unlinked/deleted process execution, dropper staging artifacts, and port-25 C2 callbacks, plus full IOC and ATT&CK tables.

rapid7.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Rapid7 analysis of CVE-2026-76504, a critical (CVSSv3.1 9.8) unauthenticated API authentication bypass in Cisco Catalyst SD-WAN Manager caused by improper URL-encoding handling (CWE-177), allowing attackers to gain admin-level API access via crafted requests to the j_security_check endpoint. The flaw is being actively exploited in the wild, was added to CISA's KEV list on October 1, 2026 with a remediation deadline of October 3, and follows two earlier 2026 Catalyst SD-WAN peering authentication bypasses (CVE-2026-20127 and Rapid7-discovered CVE-2026-20182). The post gives fixed-release guidance, no-workaround caveats, and log-based IOCs (encoded-character requests like %6a_security_check, viptela-reserved- usernames) for detecting compromise.

rapid7.comadvisoryAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Rapid7 details active zero-day exploitation of two critical Citrix NetScaler ADC/Gateway RCE vulnerabilities (CVE-2026-88771, CVE-2026-88772, both CVSSv4 9.5), both added to CISA KEV on disclosure day, plus a later SAML denial-of-service zero-day (CVE-2026-88779). The post includes Rapid7 MDR's observed exploitation of CVE-2026-88771 in the wild — a command-injection payload that exfiltrates /flash/nsconfig (containing ns.conf admin credentials, SSL private keys, SSH host keys) via the publicly-served /vpn/ path, and a webshell (SHA256 hash provided) found on a compromised appliance — along with vendor patch versions and detection guidance.

rapid7.comadvisoryAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

Rapid7's weekly Metasploit Framework wrap-up detailing five new modules: an unauthenticated arbitrary file read exploit for GitLab CE/EE (CVE-2026-85706, affecting 18.7–19.1.8/19.2.6/19.3.2), native mitm6-style DHCPv6/IPv6 RA DNS-takeover modules (CVE-2026-20929) used as part of a Kerberos authentication relay attack chain, an authenticated RCE exploit for Langflow's custom components (CVE-2026-18729, versions ≤1.11.1), and a cross-platform persistence module for the Kate text editor. It also covers a ZoomEye search-module fix for the v2 API and nine bug fixes to Metasploit's credential, RDP, and encoder internals.

rapid7.comarticleAdded 7 Oct 2026, published 25 Sep 2026🛡️ Security

Rapid7 previews collaborative research with Zimbra that uncovered over 50 vulnerabilities in the Zimbra Collaboration Suite, several of which let attackers impersonate senders without credentials, control inbox visibility, and alter shared documents and calendars, turning classic Business Email Compromise into active manufactured-reality attacks rather than passive mailbox monitoring. It traces the pattern through real exploited Zimbra CVEs in CISA's KEV catalog (CVE-2024-45519 postjournal command injection, CVE-2025-27915 stored XSS via calendar invite used against Brazilian military targets, CVE-2026-73570 SNMP command injection) and earlier 2022 to 2023 zero-days (CVE-2022-27925, CVE-2022-37042 path traversal plus auth bypass, CVE-2023-37580) exploited by multiple threat groups per Google's Threat Analysis Group.

rapid7.comwriteupAdded 7 Oct 2026, published 24 Sep 2026🛡️ Security

Rapid7's ETR writeup covers CVE-2026-94127, a critical heap-based buffer overflow (CVSS 9.8) in F5 BIG-IP Access Policy Manager that allows unauthenticated remote code execution via crafted traffic. Exploitation requires a virtual server with both an APM access policy and an OAuth profile configured, affects the data plane (including Appliance mode), and has been added to CISA KEV; F5 provides hotfixes for the 21.1.0, 17.5.0, and 17.1.0 release trains plus an iRule workaround for those unable to patch immediately.

rapid7.comadvisoryAdded 7 Oct 2026, published 23 Sep 2026🛡️ Security

Rapid7's emerging threat response write-up on CVE-2026-76461, a critical (CVSS 9.8) SQL injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows an unauthenticated remote attacker to achieve root command execution by sending a specially crafted email. Cisco confirmed active zero-day exploitation and the vulnerability was added to CISA's KEV catalog the same day it was disclosed; the post provides mitigation guidance (emergency patching to 16.5.0-780) and a log-grep IOC (searching mail_logs for COPY.*TO PROGRAM) to detect exploitation attempts.

rapid7.comadvisoryAdded 7 Oct 2026, published 15 Sep 2026🛡️ Security

GitLab patched CVE-2026-85706, a critical (CVSS 10.0) path traversal flaw (CWE-22) in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed GitLab CE/EE instances; CISA added it to the KEV catalog on September 11, 2026 due to active exploitation, with a remediation deadline of September 14. The same patch release fixes CVE-2026-87719, a critical insecure deserialization bug (CWE-502) letting an authenticated Duo Chat user exfiltrate Advanced Search configs and credentials via a crafted GraphQL subscription argument, plus 17 other vulnerabilities. Rapid7 recommends emergency patching and post-patch compromise checks given confirmed in-the-wild exploitation.

rapid7.comadvisoryAdded 7 Oct 2026, published 14 Sep 2026🛡️ Security

Rapid7's weekly Metasploit Framework update covering sixteen new modules: ten exploits (five on the CISA KEV list) targeting Cisco Secure Firewall Management Center (CVE-2026-20079 auth bypass RCE), SonicWall SMA1000 (CVE-2026-83549 chained RCE), PaperCut NG/MF (CVE-2026-81578 + CVE-2026-82078), JetBrains TeamCity agent-polling XStream deserialization RCE (CVE-2026-63077), Langflow authenticated RCE (CVE-2026-19295), MCPJam Inspector command execution (CVE-2026-23744), SimpleHelp OIDC auth bypass (CVE-2026-48558), Next.js Windows RCE (CVE-2026-75604), and SPIP SQLi/RCE flaws. It also adds a new native Kerberos relay module exploiting ESC8 (AD CS Web Enrollment) via SMB-to-HTTP coercion, a Metasploit handler-detection scanner, a Linux sandbox-evasion module, two Windows persistence techniques, and several bug fixes to the DNS and module metadata subsystems.

rapid7.comarticleAdded 7 Oct 2026, published 11 Sep 2026🛡️ Security

Rapid7 profiles the current Fraud-as-a-Service marketplace landscape — Xleet, Blackpass (formerly Paysell), Infodig, and Styx — detailing their shift from large hubs to fragmented, invite-gated shops selling compromised accounts, SMTP/RDP/VoIP infrastructure, eSIMs, stolen PII, and cashout/money-laundering services. It also discusses the new MITRE Fraud Fighting Framework (F3), introduced in early 2026, which maps adversary TTPs for fraud/financial-crime monetization, and argues security teams must correlate marketplace monitoring with internal fraud and compliance units to counter account-takeover and laundering schemes.

rapid7.comarticleAdded 7 Oct 2026, published 11 Sep 2026🛡️ Security

Rapid7's September 2026 Patch Tuesday analysis: Microsoft published 974 own-product CVEs (723 in Windows), 999 in total with non-Microsoft fixes, the most it has ever published in one day. Two zero-days are exploited in the wild: CVE-2026-85880 (Windows ALPC elevation of privilege to SYSTEM via out-of-bounds write; not patched on Server 2025 or Windows 11) and CVE-2026-81963 (Windows Update Stack elevation of privilege via improper link resolution). It also flags Microsoft's missing Edge advisory for the exploited Chromium V8 zero-day CVE-2026-85046, lists upcoming end-of-support dates for Windows 11 24H2, Server 2012/2012 R2, Office 2021 and Exchange 2016/2019, and includes per-product CVE tables with exploitation-likelihood ratings. Only the first part of the page was available, so the later tables are not covered.

rapid7.comadvisoryAdded 7 Oct 2026, published 8 Sep 2026🛡️ Security

A vendor buyer's guide from Orca Security that breaks incident response tooling into four distinct jobs (evidence/forensics, case management, telemetry/detection, automation) and compares twelve commercial platforms across them: Magnet Axiom Cyber, Exterro FTK Enterprise, Binalyze AIR, Cortex XSOAR, IBM QRadar SOAR, Swimlane, Microsoft Sentinel, Splunk Enterprise Security, Google Security Operations, Torq, Tines, and Rapid7 InsightConnect. It frames evaluation against NIST SP 800-61 Revision 3 (April 2025), covers M&A shifts affecting the category (Darktrace/Cado Security, OpenText/EnCase, Palo Alto/IBM QRadar SaaS EOL), and closes by positioning Orca's agentless cloud context (SideScanning, Unified Data Model) as complementary to these tools rather than a replacement.

orca.securityarticlePublished and added 31 Jul 2026🛡️ Security

Rapid7's release notes for Metasploit Framework 6.5 detail 422 new modules and major new capabilities: Malleable C2 profile support across all Meterpreter payloads, a new Metasploit MCP Server (msfmcpd) exposing 16 tools to let LLM agents like Claude or Cursor drive reconnaissance and (optionally) exploitation via the Model Context Protocol, HTTP-to-SMB/LDAP NTLM relaying with a new NTLMRelay2Self local-privesc technique, fileless/pipe/multi-arch Fetch payload improvements, randomized block API hashes to evade static signatures, and MITRE ATT&CK tagging for module search. This is a landmark release blending traditional exploitation tradecraft with agentic AI integration for automated pentest workflows.

rapid7.comarticleAdded 7 Aug 2026, published 30 Jul 2026🛡️ Security

Rapid7's MDR team details active zero-day exploitation of SonicWall SMA1000 appliances via CVE-2026-15409 (unauthenticated SSRF in the /wsproxy websocket proxy, CVSS 10.0) chained with CVE-2026-15410 (local privilege escalation via path traversal in the ctrl-service remove_hotfix workflow) to achieve root RCE. The post includes a working Python exploit against the localhost Erlang service on port 1050 (using a hardcoded authentication cookie), an HTTP request PoC for the hotfix path-traversal chain, and extensive observed post-exploitation activity — credential/TOTP theft, VPN-less lateral movement to domain controllers via harvested LDAP service accounts — plus concrete log/IOC signatures and attacker-infrastructure IPs (FNS Holdings Limited ASN 206092) for hunting.

rapid7.comwriteupAdded 10 Sep 2026, published 15 Jul 2026🛡️ Security

Rapid7's ETR write-up on "Ni8mare," an exploit chain against n8n automation software anchored by CVE-2026-21858 (CVSS 10.0), an unauthenticated file read flaw triggered by improper content-type validation on custom webhook file-upload forms that lets an attacker overwrite internal JSON to read arbitrary files and forge admin session tokens. That access can be chained with four authenticated CVEs — CVE-2025-68613 (expression language injection RCE), CVE-2025-68668 (Pyodide Python node command execution), CVE-2025-68697 (legacy Code node file read/write), and CVE-2026-21877 (arbitrary file write RCE, CVSS 9.9) — for full remote code execution. Cyera and researcher Valentin Lobstein published separate technical analyses and PoCs on the same day; Rapid7 lists affected version ranges for each CVE and recommends upgrading self-hosted n8n to 1.121.0+.

rapid7.comadvisoryAdded 26 Sep 2026, published 8 Jan 2026🛡️ Security