4088
Noticias y alertas de seguridad informática. Chat y contacto: t.me/sysadmin24x7chat
CNA: Apache Software Foundation
CVSS 9.8
Published: 2026-05-01
Updated: 2026-05-01
Title: Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
Description
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade.
https://www.cve.org/CVERecord?id=CVE-2026-42779
https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0
Security Advisory: Firmware Update Required — Gen 6, Gen 7, and Gen 8 Firewalls
SonicWall has identified three vulnerabilities (CVEs) affecting Gen 6, Gen 7, and Gen 8 firewall platforms. These vulnerabilities require immediate firmware updates to maintain security posture. One CVE is rated High severity and two are rated medium severity.
Applies To
Gen 8 firewalls — patch available in firmware 8.2.0-8009
Gen 7 firewalls — patch available in firmware 7.3.2-7010
Gen 6 firewalls — patched firmware posted to MySonicWall on April 29, 2026
https://www.sonicwall.com/support/notices/security-advisory-firmware-update-required-gen-6-gen-7-and-gen-8-firewalls/kA1VN000001F03x0AC
Advisory ID SNWLID-2026-0004
First Published 2026-04-29
Workaround true
CVE CVE-2026-0204, CVE-2026-0205, CVE-2026-0206
CWE CWE-1390, CWE-35, CWE-121
CVSS v3 8.0
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0004
CVE-2026-31431
Base Score: 7.8
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
https://nvd.nist.gov/vuln/detail/CVE-2026-31431
Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push
Cybersecurity researchers have disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server that could allow an authenticated user to obtain remote code execution with a single "git push" command.
The flaw, tracked as CVE-2026-3854 (CVSS score: 8.7), is a case of command injection that could allow an attacker with push access to a repository to achieve remote code execution on the instance.
https://thehackernews.com/2026/04/researchers-discover-critical-github.html
Omisión de autenticación en cPanel
Fecha 30/04/2026
Importancia 5 - Crítica
Recursos Afectados
La vulnerabilidad afecta a todas las versiones posteriores a a la 11.40.
Descripción
cPanel ha publicado una vulnerabilidad de severidad crítica que en caso de ser explotada podría permitir a un atacante omitir la autenticación en el software.
Solución
cPanel ha publicado un parche para las siguientes versiones de cPanel y WHM:
11.86.0.41;
11.110.0.97;
11.118.0.63;
11.126.0.54;
11.130.0.19;
11.132.0.29;
11.136.0.5;
11.134.0.20.
Para WP Squared se ha publicado la versión 136.1.7.
Se recomienda seguir las pautas del aviso oficial en lazado en referencias para actualizar a la versión correspondiente.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/omision-de-autenticacion-en-cpanel
VMware Tanzu Data Lake 4.0.0
Advisory ID: TNZ-2026-0258
Severity: Critical
Issue Date: 2026-04-24
CVSS Base Score 10.0
Synopsys
Resolution of multiple vulnerabilities across critical, high, medium, and low severity levels in the controller and runtime bundles.
VMware Tanzu Data Intelligence
VMware Tanzu Data Services
VMware Tanzu Data Services Solutions
VMware Tanzu Data Suite
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37404
CVE-2026-40970: Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification
MEDIUM | APRIL 23, 2026 | CVE-2026-40970
Description
When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.
Affected Spring Products and Versions
Spring Boot:
4.0.0 - 4.0.5
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
https://spring.io/security/cve-2026-40970
Oracle Critical Patch Update Advisory - April 2026
https://www.oracle.com/security-alerts/cpuapr2026.html
Post Mortem: axios npm supply chain compromise
Are you affected?
Check your lockfile:
grep -E "axios@(1\.14\.1|0\.30\.4)|plain-crypto-js" package-lock.json yarn.lock 2>/dev/null
If anything comes back, treat that machine as compromised:
1. Downgrade to axios@1.14.0 (or 0.30.3 for 0.x users)
2. Delete node_modules/plain-crypto-js/
3. Rotate every secret, token, and credential on that machine
4. Check your network logs for connections to sfrclak[.]com or 142.11.206.73 on port 8000
5. If this happened on a CI runner, rotate any secrets that were injected during the affected build
If you were already pinned to a clean version and didn't run a fresh install between 00:21 and 03:15 UTC on March 31, you're fine.
https://github.com/axios/axios/issues/10636
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Date: 2026-April-15
Security risk: Critical
CVE IDs: CVE-2026-6365
Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which which can lead to a cross-site scripting (XSS) vulnerability.
https://www.drupal.org/sa-core-2026-001
Cisco Identity Services Engine Remote Code Execution Vulnerabilities
Advisory ID: cisco-sa-ise-rce-4fverepv
First Published: 2026 April 15 16:00 GMT
Version 1.0: Final
Cisco Bug IDs: CSCwq21242 CSCwq22993
CVSS Score: Base 9.9
Vulnerable Products
These vulnerabilities affect Cisco ISE, regardless of device configuration
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv
Múltiples vulnerabilidades en Identity Exposure de Tenable
Fecha 15/04/2026
Importancia 5 - Crítica
Recursos Afectados
Tenable Identity Exposure, versión 3.77.16 y anteriores.
Descripción
Tenable ha publicado un aviso donde informa de 19 vulnerabilidades, 1 de severidad crítica, 10 altas, 6 medias y 3 bajas. En caso de ser explotadas podrían permitir la lectura de ficheros sensibles, entre otras acciones.
Solución
Actualizar el producto a la versión 3.77.17.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-identity-exposure-de-tenable
Múltiples vulnerabilidades en productos de Adobe
Fecha 15/04/2026
Importancia 4 - Alta
Recursos Afectados
Acrobat DC, versiones 26.001.21411, 26.001.21367 y anteriores;
Acrobat Reader DC, versiones 26.001.21411, 26.001.21367 y anteriores;
Acrobat 2024, versión 24.001.30356 y anteriores:
Acrobat 2024 Windows, versión 24.001.30362 y anteriores;
Acrobat 2024 Mac, versión 24.001.30360 y versiones anteriores;
Adobe InDesign, versiones ID21.2, ID20.5.2 y todas las anteriores;
Adobe InCopy , versiones 21.2, 20.5.2 y anteriores;
Adobe Experience Manager (AEM) Screens, versiones 6.5 Service Pack 24, Feature Pack 11.7 o anteriores;
Adobe FrameMaker, actualización de lanzamiento 8 de 2022 y versiones anteriores;
Adobe Connect, versión 12.10 y anteriores;
Aplicación de escritorio Adobe Connect, versión 2025.3 y anteriores;
ColdFusion 2025, actualización 6 y versiones anteriores;
ColdFusion 2023, actualización 18 y versiones anteriores;
Adobe Bridge, versiones 15.1.4 (LTS), 16.0.2 y anteriores;
Photoshop 2026, versión 27.4 y anteriores;
Adobe DNG Software Development Kit (SDK), SDK de DNG 1.7.1 compilación 2502 y versiones anteriores;
Illustrator 2025, versión 29.8.5 y anteriores;
Ilustrador 2026, versión 30.2 y versiones anteriores.
https://www.incibe.es/empresas/avisos/multiples-vulnerabilidades-en-productos-de-adobe
Microsoft - April 2026 Security Updates
https://msrc.microsoft.com/update-guide/releaseNote/2026-Apr
CVE-2026-34040 Detail
Description
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
https://nvd.nist.gov/vuln/detail/CVE-2026-34040
https://explore.alas.aws.amazon.com/CVE-2026-34040.html
https://github.com/moby/moby/releases/tag/docker-v29.3.1
Pi-hole
Local privilege escalation via config-controlled path in root-executed service hooks
Package Pi-hole Core and FTL
Affected versions
>= v6.0
Patched versions
Core >=v6.4.2 FTL >=v6.6.1
https://github.com/pi-hole/pi-hole/security/advisories/GHSA-6w8x-p785-6pm4
High Vulnerability in the Linux Kernel ("Copy Fail")
Temporary Mitigation
Disable the algif_aead kernel module persistently on all affected systems until a patched kernel is available:
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
This workaround does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. It may affect applications explicitly configured to use the afalg engine or that bind aead/skcipher/hash sockets directly. Exposure can be assessed with lsof | grep AF_ALG.
https://github.com/advisories/GHSA-64fw-jx9p-5j24
Читать полностью…
Contaminación de prototipos en n8n
Fecha 30/04/2026
Importancia 5 - Crítica
Recursos Afectados
Las siguientes versiones de n8n:
2.18.0;
Desde la 2.17.0 hasta la 2.17.3;
Menores a la 1.123.32.
Descripción
a-tallat y simonkoeck han descubierto 2 vulnerabilidades de severidad crítica que, en caso de ser explotadas, podrían permitir la ejecución de código en remoto.
Solución
Actualizar el producto a las siguientes versiones respectivamente:
2.18.1;
2.17.4;
1.123.32.
En caso de que no se sea posible instalar la actualización inmediatamente, se pueden aplicar, de forma temporal, las siguientes contramedidas:
Limitar los permisos de creación y edición de flujos de trabajo ( workflows) a solo usuarios en los que se confíe plenamente.
Deshabilitar el nodo XML añadiendo "n8n-nodes-base.xml" a la variable de entorno "NODES_EXCLUDE".
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/contaminacion-de-prototipos-en-n8n
VMware Tanzu Greenplum Platform Extension Framework 8.0.0
Advisory ID: TNZ-2026-0259
Severity: Critical
Issue Date: 2026-04-24
CVSS Base Score 9.8
Synopsis
Fixed 105 CVEs related to Spring Framework/Boot dependencies, Tomcat dependencies, Hadoop and Hive dependencies, Parquet and ORC dependencies, Golang dependencies, PostgreSQL JDBC Driver dependencies, AWS SDK for Java dependencies and some other dependencies.
VMware Tanzu Data Intelligence
VMware Tanzu Data Suite
VMware Tanzu Greenplum
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37405
UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware
A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
https://thehackernews.com/2026/04/unc6692-impersonates-it-helpdesk-via.html
About the security content of iOS 26.4.2 and iPadOS 26.4.2
This document describes the security content of iOS 26.4.2 and iPadOS 26.4.2.
Released April 22, 2026
https://support.apple.com/en-us/127002
ASP.NET Core Elevation of Privilege Vulnerability
CVE-2026-40372
Security Vulnerability
Released: Apr 21, 2026
Metrics CVSS: 9.1
Impact Elevation of Privilege
Max Severity Important
Executive Summary
Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
Supply Chain Compromise Impacts Axios Node Package Manager
Release DateApril 20, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm).1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments.
On March 31, 2026, two npm packages for versions axios@1.14.1 and axios@0.30.4 of Axios npm injected the malicious dependency plain-crypto-js@4.2.1 that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.
https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager
Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities
Advisory ID: cisco-sa-ise-rce-traversal-8bYndVrZ
First Published: 2026 April 15 16:00 GMT
Version 1.0: Final
Cisco Bug IDs: CSCws52717 CSCws52738
CVSS Score: Base 9.9
Vulnerable Products
These vulnerabilities affect Cisco ISE and Cisco ISE-PIC, regardless of device configuration
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ
Cisco Webex Services Certificate Validation Vulnerability
Advisory ID: cisco-sa-webex-cui-cert-8jSZYhWL
First Published: 2026 April 15 16:00 GMT
Version 1.0: Final
Cisco Bug IDs: CSCwt37111
CVSS Score: Base 9.8
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL
Múltiples vulnerabilidades en FortiSandbox
Fecha 15/04/2026
Importancia 5 - Crítica
Recursos Afectados
FortiSandbox 4.4, desde la versión 4.4.0 hasta la 4.4.8.
Solo para la vulnerabilidad CVE-2026-39813 también se ve afectado:
FortiSandbox 5.0, desde la versión 5.0.0 hasta la 5.0.5.
Descripción
Samuel de Lucas Maroto de KPMG Spain y Loic Pantano de Fortinet PSIRT han descubierto 2 vulnerabilidades de severidad crítica que, en caso de ser explotadas, podrían permitir a un atacante ejecutar comandos no autorizados o evitar la autenticación en el sistema.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-fortisandbox
Múltiples vulnerabilidades en Fusion Desktop de Autodesk
Fecha 15/04/2026
Importancia 4 - Alta
Recursos Afectados
Autodesk Fusion Desktop en la versión 2606.0 y todas las anteriores.
Descripción
Abdul-lateef Yusuff Goke de Alpha Aquila y Karim Belfodil de qatada han reportado 3 vulnerabilidades de severidad alta que, en caso de explotarse, podrían facilitar a un atacante leer archivos locales o ejecutar código arbitrario.
Solución
Se recomienda encarecidamente instalar la versión 2702.1.47 o posterior para estar protegido ante estas vulnerabilidades. Para su instalación, consulte el enlace de las referencias.
https://www.incibe.es/empresas/avisos/multiples-vulnerabilidades-en-fusion-desktop-de-autodesk
SAP Security Patch Day - April 2026
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2026.html
SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
Project: SAML SSO - Service Provider
Date: 2026-April-01
Security risk: Critical
Vulnerability: Authentication bypass
Affected versions: <3.1.4
CVE IDs: CVE-2026-5343
Description:
This module enables you to perform SAML-protocol-based single-sign-on (SSO) on a Drupal site.
The module doesn't sufficiently block access, leading to a authentication bypass vulnerability.
Solution:
Install the latest version:
https://www.drupal.org/sa-contrib-2026-031