Practical IT guides, comparisons, explainers and news — curated by practitioners.
Browse articles tagged Remote Code Execution.
ServiceNow fixed four vulnerabilities in its AI Platform and Now Platform, three of them rated CVSS v4.0 10.0 and exploitable without credentials. The fourth, a sandbox escape first published as high severity, has since been upgraded to critical.
HPE Networking has fixed CVE-2026-73749, a CVSS 9.8 buffer overflow in an ArubaOS-CX daemon that lets an unauthenticated attacker run code with elevated privileges on enterprise switches. It headlines an advisory covering 34 CVEs.
WordPress shipped forced updates 6.9.5 and 7.0.2 on July 17, 2026, closing a pre-auth remote code execution flaw named wp2shell that an anonymous HTTP request can trigger against a default core install with no plugins. The bug affects 6.9.0-6.9.4 and 7.0.0-7.0.1.
Canada's Cyber Centre warns that attackers are exploiting CVE-2026-48282, a maximum-severity Adobe ColdFusion vulnerability that allows unauthenticated remote code execution. Adobe patched the flaw days earlier and urged admins to update within 72 hours.
CISA added Microsoft SharePoint Server flaw CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog, citing active exploitation and setting a July 4, 2026 remediation deadline for U.S. federal agencies.
Microsoft's June 2026 security update KB5094128 patches multiple critical vulnerabilities in Windows Server 2022, including an unauthenticated NFS remote code execution flaw (CVE-2026-26001, CVSS 9.8), a Task Scheduler privilege escalation bug, an AD CS authentication bypass, and a Windows kernel memory corruption issue. The update raises the OS build to 20348.5256 and requires a restart.
