Exploited & Unpatchable

Missing authentication for critical function in the web management interface: under specific conditions, unauthenticated remote requests targeting administrative functions trigger backend actions before access validation completes, letting an unauthenticated remote attacker modify certain system configurations. Chains with CVE-2026-82078 (unsafe dynamic class loading) into pre-auth remote code execution. (Missing authentication for critical function (CWE-306))

Unsafe dynamic class loading in the database connection utilities: the application instantiates database driver classes from configurable driver names without an allowlist, letting an attacker who can modify configuration execute arbitrary Java bytecode on the classpath under the PaperCut server process. Chains with CVE-2026-81578 (unauthenticated configuration modification) into pre-auth remote code execution. (Unsafe reflection / dynamic class loading (chained to pre-auth RCE))

libuser /etc/passwd race condition - a local authenticated user can corrupt /etc/passwd via a libuser-compiled application (such as userhelper), causing denial of service; chained with CVE-2015-3245 (fixed in the same errata pair) it escalates privileges to root. CISA's KEV entry describes the outcome as denial of service or privilege escalation. (Race condition (CWE-367))

OS command injection in the SNMP monitoring component (optional zimbra-snmp package, SNMP notifications enabled): unauthenticated attacker sends specially crafted SMTP requests that result in arbitrary OS command execution as the zimbra user. Active exploitation campaign confirmed by CERT Polska 2026-08-17. (OS command injection (CWE-78))

Unauthenticated full-read server-side request forgery in webhook delivery; URL validation bypassed via unvalidated HTTP redirects or DNS rebinding, reaching internal and cloud metadata services (Server-side request forgery (SSRF))

Unauthenticated remote code execution via the agent polling protocol (Deserialization of untrusted data)

Symlink-based persistence that survives patching — a post-exploitation weakness abused after a threat actor has already exploited a separate filesystem-level vulnerability. KEV-listed by CISA. (Improper link resolution / persistence)

Remote code execution via the Jolokia JMX-HTTP bridge — effectively unauthenticated on the 6.0 and 6.1 lines (the console's Jolokia endpoint sits outside the security constraints per CVE-2024-32114), and authenticated on the 5.x lines (Exposure of a management interface (JMX via Jolokia))

Authenticated remote code execution via PHP object deserialization in the file-upload handler (the _from request parameter). The vulnerable code path had been present in the codebase for roughly a decade. (Deserialization of untrusted data (RCE))

Out-of-bounds read in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server - insufficient input validation lets unauthenticated requests leak memory contents, including session tokens usable for session hijacking (the 'CitrixBleed 2' pattern). Widely exploited against internet-facing appliances. (Out-of-bounds read / memory over-read (CWE-125))

Path traversal in the D-Link DIR-859 (firmware 1.06B01) HTTP POST handler /hedwig.cgi: manipulating the 'service' argument reads arbitrary files such as the DHCP configuration, exposing credentials and enabling further compromise. NVD scores it 9.8; the CVE record itself is marked 'UNSUPPORTED WHEN ASSIGNED' with the note that the vendor 'confirmed immediately that the product is end-of-life. It should be retired and replaced.' CISA added it to the KEV catalog on 2025-06-25. (Improper limitation of a pathname to a restricted directory / path traversal (CWE-22))

Stack-based buffer overflow in Ivanti Connect Secure / Pulse Connect Secure allowing a remote unauthenticated attacker to achieve remote code execution on the VPN appliance. Initially triaged by Ivanti as a non-exploitable product bug, later confirmed exploitable 'through sophisticated means' with active exploitation in the wild. (Stack-based buffer overflow (CWE-121))

Path-equivalence flaw in the default servlet's partial PUT handling. Under specific configurations an unauthenticated remote attacker can view or inject content into uploaded files; with file-based session persistence at the default location plus a deserialization-gadget library on the classpath, it escalates to remote code execution. Exploitation requires writes enabled on the default servlet (disabled by default) and partial PUT support (enabled by default) - not every default install is exposed, but exploitation in the wild is established (KEV). CISA notes it can be chained with CVE-2026-34486. (Path equivalence (CWE-44); deserialization on the RCE path (CWE-502))

Command injection in the web-based management interface of the Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 routers: improper validation of user input in incoming HTTP packets lets an authenticated, remote attacker send a crafted request and execute arbitrary commands with root-level privileges. Valid administrative credentials are required, which is why NVD rates it 7.2 rather than 9.8; CISA confirmed exploitation in the wild when it added the CVE to the KEV catalog on 2025-03-03, and CISA's required action includes 'discontinue use of the product if mitigations are unavailable.' (Improper neutralization of special elements used in a command (CWE-77))

Active Directory integration authentication bypass — a member of a domain group named 'ESX Admins' gains full host administrative access. Exploited in the wild by ransomware operators (Akira, Black Basta). (Authentication bypass)

Improper authorization allowing an unauthenticated attacker to reset Confluence and create an administrator account, leading to full compromise. Mass-exploited (including ransomware) since November 2023. (Improper authorization)

Remote command execution in the D-Link DIR-820L (firmware 1.05B03, the last release): an unauthenticated HTTP POST to the get/set ccp handler injects OS commands (CWE-78). NVD scores it 9.8. CISA added it to the KEV catalog on 2022-09-08 with the required action 'The impacted product is end-of-life and should be disconnected if still in use.' (OS command injection (CWE-78))

Unauthenticated OGNL injection allowing remote code execution. Mass-exploited in the wild since June 2022. (OGNL expression injection (RCE))

Improper validation of the recipient address in deliver_message() allowing remote command execution as root ('Return of the WIZard'). Mass-exploited in the wild. (Improper input validation (RCE))

Remote code execution via the DataImportHandler dataConfig request parameter, which accepts a full DIH configuration including a script transformer. (Unsafe configuration accepted at request time (RCE))

Unauthenticated OGNL injection allowing remote code execution. Widely exploited since 2021 and on CISA's KEV catalog. (OGNL expression injection (RCE))

Forced OGNL double-evaluation of attacker-supplied input allowing remote code execution (S2-061). (OGNL expression injection (RCE))

Remote code execution via the VelocityResponseWriter when params.resource.loader.enabled is set, allowing a Velocity template to be supplied and executed. (Server-side template injection (RCE))