authentication bypass

5 articles · newest first

Networking equipment in a server rack, representative of the appliances NetScaler ADC and Gateway run on

Citrix found two more holes in NetScaler — one skips the login screen completely

Three weeks after the last NetScaler patch-now story, Citrix is back with a critical bug that needs no password and no user interaction at all.

Kernel · Aug 26 · 6 min

A Microsoft office building — CVE-2026-55040 affects on-premises SharePoint Server, not SharePoint Online

Software

a researcher posted SharePoint exploit code on Tuesday. attackers were forging admin access by Thursday

Microsoft patched this JWT flaw back in July. A public proof-of-concept turned it into real attacks in under 48 hours — here's exactly what's broken and how to check if you're exposed.

Kernel · Aug 20 · 6 min

Person checking an email inbox on a laptop in an office

Software

hackers showed microsoft exactly how to read every inbox on your exchange server — live, at a hacking contest

CVE-2026-62911 only scores an 8.0, but it came with working exploit code demonstrated at Pwn2Own Berlin — and it doesn't stop at one mailbox.

Kernel · Aug 17 · 7 min

Check Point SmartConsole security management interface on a monitor

Software

Check Point sells firewalls for a living. hackers got admin on it before there was a patch

A broken identity check let attackers skip the login screen entirely — and Check Point found out because someone was already inside.

Kernel · Aug 1 · 6 min

Lines of code on a dark screen representing a security vulnerability

Software

there's a second WordPress bug this month — and this one has no patch, just a plugin you need to switch off tonight

While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.

Kernel · Jul 22 · 7 min