command injection

3 articles · newest first

Rows of networking server racks with status lights in a data center

Arista's SD-WAN box has a bug so bad hackers don't even need a password

CVE-2026-16812 scores a perfect 10, needs zero credentials, and CISA is already watching it get used against real networks.

Ravi Malhotra · Aug 3 · 7 min

NVD detail for CVE-2026-25089 showing a 9.8 FortiSandbox command injection

Software

a 9.8 in Fortinet's FortiSandbox lets anyone run commands with one crafted request — and it's being exploited

CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.

Priya Nair · Jul 28 · 9 min

A dark network security concept image representing an exploited appliance

Software

a perfect 10: the Ivanti Sentry bug that hands an anonymous attacker root, and it's already being backdoored

CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.

Priya Nair · Jul 28 · 7 min