Post · bonfire.cafe

@cR0w@infosec.exchange 7 hr. ago

Cisco with another 0day in SD-WAN.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

1 Boost

0 Likes

@bongoknight@ioc.exchange 7 hr. ago

@cR0w It's literaly the same vuln that occured in GitLab a few days ago, it's a weird vuln class...

2 media files

Gitlab vuln when c from commits in url is encoded

Cisco vuln where you can URL encode one character to trigger it

@cR0w@infosec.exchange 7 hr. ago

@bongoknight URI encoding to bypass controls has been a thing forever though. We should expect better from security products in 2026 but here we are.

@bongoknight@ioc.exchange 6 hr. ago

@cR0w Definitely the current meta x)
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft?hl=en

Same vuln class CWE-177 in PeopleSoft

Google Cloud Blog

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | Google Cloud Blog

This follow-up report details how UNC6240 (ShinyHunters) is mass-exploiting Oracle PeopleSoft (CVE-2026-35273) by bypassing WAF rules via a single URL-encoded character, providing full analysis of the attack pipeline, observed post-exploitation activity, IOCs, and remediation steps.

Cat 🐈🥗 (D.Burch)

@catsalad@infosec.exchange 6 hr. ago

@bongoknight @cR0w WHAT YEAR IS IT?!

3 more replies

Sign in