As promised, here's our walkthrough of CVE-2026-93616, an unauthenticated root RCE affecting Check Point Security Management and Multi-Domain Management servers! bishopfox.com/blog/weaponi...
One Port to Root: Weaponizing Check Point Management CVE-2026-93616
CVE-2026-93616 is an unauthenticated root RCE on Check Point management servers exploited in the wild. Bishop Fox confirmed the chain end to end.
bishopfox.com
In the meantime, here’s our analysis of an unauthenticated RCE vuln affecting SolarWinds Access Rights Manager. A hard-coded key facilitates an auth bypass that leads to arbitrary code execution as SYSTEM!
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
bishopfox.com
Sneak preview - we fully exploited CVE-2026-93616, an unauthenticated root RCE in Check Point Security Management Server. Blog post coming soon!
Another excellent writeup by my colleague Nate Robb, this one analyzing an auth bypass affecting JFrog Artifactory (CVE-2026-82329)! bishopfox.com/blog/cve-202...
CVE-2026-82329: Unauthenticated Administrative Access in JFrog…
CVE-2026-82329 is a CVSS 9.8 JFrog Artifactory auth bypass where an empty cluster join key grants unauthenticated admin access. KEV-listed, patch now.
bishopfox.com
In my latest blog post examining a NetScaler auth bypass CVE-2026-19490, I break down all the different ways the impact can vary depending on the the appliance configuration – ranging from DoS to full root compromise. bishopfox.com/blog/mind-th...
Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
CVE-2026-19490 is a CVSS 9.3 NetScaler auth bypass reachable in one request. Impact ranges from a dead-end session to root based on configuration.
bishopfox.com
SAML vulns are all the rage these days! Check out this excellent writeup on two bugs in Solarwinds Web Help Desk by my esteemed colleague Ronan Kervella (linkedin.com/in/rkervella).
Signature Optional - Analysis of CVE-2026-28323
CVE-2026-28323 is a CVSS 9.8 SAML auth bypass in SolarWinds Web Help Desk. A single forged POST request grants unauthenticated access to any valid account.
bishopfox.com
A simple agent authentication mistake opens up full unauthenticated RCE - check out our latest blog on two Veeam Service Provider Console vulnerabilities! bishopfox.com/blog/a-guid-...
A GUID is Not a Credential: Unauthenticated RCE in Veeam Service…
Bishop Fox chained two critical Veeam VSPC flaws into unauthenticated RCE on the control plane serving every tenant's backups. Patch to 9.3.0 immediately.
bishopfox.com
Want to know if your NetScaler is vulnerable to the latest RCE chain? We’ve got you covered!
No Crash Required: Verifying the Citrix NetScaler SAML Patch for…
CVE-2026-8452 is an unauthenticated heap overflow in Citrix NetScaler SAML parsing. Bishop Fox covers the patch, safe detection, and exploitation signals.
bishopfox.com
ManageEngine AD360 is vulnerable to account hijacking via predictable SSO tokens. Did we exploit it? Yep. Can an attacker exploit you? Not likely. Here's why: bishopfox.com/blog/millise...
A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
CVE-2026-11374 is a critical ManageEngine account takeover where the SSO ticket is just a timestamp. Bishop Fox breaks down why it's hard to exploit.
bishopfox.com
Some adventures in LLM firmware cracking! bishopfox.com/blog/crackin...
Cracking Firmware with Claude: Senior-Level Skill, Junior-Level…
Bishop Fox gave Claude an encrypted SonicWall firmware image and minimal guidance. With light supervision, it reverse engineered the encryption end to end.
bishopfox.com
Sometimes a DoS really is just a DoS! Here's a look behind the curtain at the less glamorous side of vuln research, discussing (in mostly laypersons' terms) how we tried in vain to turn a memory corruption bug into full RCE. bishopfox.com/blog/a-crash...
A Crash, Not a Shell: SolarWinds Serve-U CVE-2026-28318
Bishop Fox analyzed CVE-2026-28318, a single-request DoS in SolarWinds Serv-U, chased three RCE paths, and proved each one is a dead end. Patch now.
bishopfox.com
Here we GOOOOOO...! Successfully reproduced a full root unauthenticated RCE chain against UniFi OS Server 5.0.6 – with devastating impacts depending on what devices it manages. Check out our newest blog post: bishopfox.com/blog/popping...
And another one for y’all! This week I published some research into a perfect 10 arbitrary file read affecting Ubiquiti UniFi controller software. I suspect we’ll have more to say about UniFi in the near future… bishopfox.com/blog/looting...
Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557
CVE-2026-22557 is a CVSS 10.0 path traversal in UniFi that lets unauthenticated attackers read controller backups and take over all managed devices.
bishopfox.com
Dropped some new research on the blog this week - this time we’re pulling apart a PAN-OS JWT signature bypass. Enjoy! bishopfox.com/blog/detecti...
Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass
Bishop Fox built a detection tool for CVE-2026-0265, a PAN-OS JWT auth bypass affecting CAS-enabled portals. Get a verdict from one HTTP request.
bishopfox.com
We successfully exploited CVE-2026-25075, a denial of service affecting strongSwan VPN servers! Be sure to patch ASAP and check out our blog for a technical analysis: bishopfox.com/blog/strongs...
Our blog post on the Arista XSS to RCE chain is now live! We withheld exploit details because the root cause has not been fully mitigated. Patch now if you haven't already, disable your captive portal to reduce the likelihood of exploitation, and stay tuned for new vulns to be disclosed soon!
Arista Firewall XSS to RCE Chain
Arista NG Firewalls: researchers confirm real-world RCE risk and incomplete patches. Learn impact, affected setups, and mitigation steps.
bishopfox.com
My team confirmed that recently disclosed Arista NGFW vulnerabilities are fully exploitable! RCE is possible with victim interaction. More details coming soon to our blog: bishopfox.com/blog
Just published a new blog about using LLMs to accelerate patch diffing! We developed a semi-automated analysis workflow and benchmarked four high-impact vulns using a few different Claude models. Check out how they performed!
Vulnerability Discovery with LLM-Powered Patch Diffing
Read our most recent research to see how LLMs can assist in scaling patch diffing workflows, saving valuable time in a crucial race against attackers.
bishopfox.com
I made SonicWall’s hall of fame for this one. Patch your firewalls (again), folks! bishopfox.com/blog/sonicwa...
SonicWall Sonicos Versions 7.1.x and 8.0.x
Blog describes how Bishop Fox staff identified a vulnerability in SonicWall SonicOS 7.1.x and 8.0.x in the SSL VPN service and solutions for customers.
bishopfox.com
The DistrictCon talk @noperator.bsky.social and I gave on decrypting SonicWall NSv firmware is up on YouTube now: www.youtube.com/watch?v=FIYK...
DistrictCon 2025 Day 1 Talk 3 - Reverse Engineering Sonicwall Firmware Jon Williams, Caleb Gross
YouTube video by DistrictCon - Live stream Here for day 2
youtube.com
Don’t miss @br4inde4d.bsky.social and @noperator.bsky.social presenting: “Tearing Down (Sonic)Walls: Reverse-Engineering SonicOSX Firmware Encryption” at @districtcon.bsky.social Feb 21 at 1:30p.m. And stop by our Coffee Cart for ☕️ & convo! More: bishopfox.com/events/bisho... #SonicWall #firewall
They got me on camera to talk about my recent SonicWall exploit 😄
SonicWall CVE-2024-53704: SSL VPN Session Hijacking
YouTube video by Bishop Fox
youtube.com
As promised, our blog post on CVE-2024-53704, a session hijacking vulnerability affecting the SSL VPN component of SonicWall firewalls, has been updated to include full exploitation details. Check it out!
SonicWall CVE-2024-53704: SSL VPN Session Hijacking
Security researchers have exploited CVE-2024-53704, an authentication bypass affecting the SSL VPN component of unpatched SonicWall firewalls. Watch demo!
bishopfox.com
Successfully exploited SonicWall CVE-2024-53704, allowing active SSL VPN sessions to be hijacked on affected firewalls. We'll be withholding details for a while because there are still thousands of vulnerable appliances on the public internet.