Critical5d ago
GitLab - Unauthenticated GraphQL Code Injection & CSRF (Public Project/Data Deletion)
GitLab is a web-based DevOps platform providing Git repository management, CI/CD pipelines, issue tracking, and project collaboration. The platform exposes a GraphQL API for programmatic access to core functionality.
CVE-2026-19478 — Critical
Code injection flaw in the GraphQL API of GitLab CE and EE, via a GraphQL directive. Under certain conditions, a remote unauthenticated attacker can modify or delete public projects and user data, with no authentication and no user interaction — hence the high severity and the risk of data loss and supply-chain compromise. It affects self-managed installations across several branches (18.2 through 18.11, 19.0, 19.1, 19.2). Fixed on August 17, 2026 in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, shipped as an ad hoc critical patch outside the normal cycle. GitLab.com and GitLab Dedicated already run the patched version and need no action. Worth noting: the fixes do not cover the 18.2 through 18.10 branches, which remain within the affected range — those installations must migrate to a patched branch.
CVE-2026-19650 — High
CSRF (cross-site request forgery) flaw in the GraphQL multiplex query handler. Improper request validation allows GraphQL mutations to be triggered via GET requests, even though these state-changing operations should not be reachable that way. Unlike the critical flaw, this one requires victim interaction: a targeted user must be lured into opening a specially crafted request, which narrows its scope — but it can still lead to unauthorized state-changing operations server-side. Fixed in the same versions (19.2.4, 19.1.6, 19.0.8, 18.11.11).
Paths / attack surface:
/api/graphql — the GraphQL API endpoint. Both flaws live here: the critical one via a crafted GraphQL directive, the CSRF one via the multiplex query handler accepting mutations over GET.
GitLabGitLab
Critical5d ago
Multiple vulnerabilities in Adobe Campaign Classic - Unauthenticated SQL Injection to RCE & Unauthenticated Incorrect Authorization to RCE & 2 x Unauthenticated Auth Bypass to RCE
Adobe Campaign Classic is an enterprise marketing automation platform that enables organizations to design, execute, and manage multi-channel customer campaigns at scale.
CVE-2026-71398: Incorrect Authorization
Critical authorization bypass vulnerability in Adobe Campaign Classic that allows unauthenticated remote attackers to execute arbitrary code without any user interaction. The vulnerability stems from improper authorization checks in a network-accessible endpoint. An attacker can craft a malicious request to an exposed interface that should be restricted to authenticated and privileged users, but the application fails to properly validate whether the caller possesses the required permissions.
Attack Vector:
The vulnerability is exploitable over the network with low complexity. An attacker requires no credentials, no pre-authentication, and no user interaction. The attacker can send a specially crafted HTTP/HTTPS request directly to the vulnerable endpoint, bypassing all authorization controls. The scope of impact extends beyond the vulnerable component itself, affecting the entire Adobe Campaign Classic system.
Impact:
A successful exploitation grants the attacker complete control over the Adobe Campaign Classic instance with administrative privileges. The attacker can access the underlying customer database, read sensitive customer records and campaign data, modify campaign configurations and targeting rules, execute arbitrary SQL commands, and potentially pivot to connected systems. The confidentiality, integrity, and availability of the entire system are compromised.
CVE-2026-27302
Critical authorization bypass vulnerability affecting Adobe Campaign Classic. Similar to CVE-2026-71398, it allows remote unauthenticated attackers to bypass authorization controls and execute arbitrary code. However, this vulnerability specifically affects campaign management and workflow orchestration functionality within the platform.
Attack Vector:
This vulnerability is network-accessible and requires no authentication, credentials, or user interaction. An attacker can remotely exploit this flaw by sending crafted requests to the affected endpoint. The low complexity of exploitation makes this vulnerability particularly dangerous, as script-based attacks can be automated and deployed at scale.
Impact:
Exploitation allows attackers to modify active marketing campaigns, alter customer segmentation rules, inject malicious logic into automated workflows, and redirect customer data to attacker-controlled infrastructure. An attacker could also disable or delete critical campaigns, disrupt customer communications, and compromise the integrity of all campaign-related data. The scope of the vulnerability extends beyond the direct component, affecting customer data flows and business operations.
CVE-2026-48449
Critical authorization vulnerability that was disclosed on July 29, 2026. Like the other authorization bypass flaws, it permits unauthenticated remote code execution within Adobe Campaign Classic. This vulnerability affects builds 7.4.3 and earlier, with a fix released in build 9398 on August 13, 2026.
Attack Vector:
The vulnerability is accessible over the network without authentication or user interaction. The low complexity attack vector means that exploitation requires minimal technical skill and can be easily automated. Attackers can discover vulnerable instances through standard port scanning and web reconnaissance techniques.
Critical Exposure Window:
This vulnerability created a significant security risk window of approximately two weeks between discovery (July 29) and intermediate patching (August 13). Organizations running Adobe Campaign Classic v7.4.3 build 9397 or earlier were exposed to unauthenticated remote code execution during this period. The final comprehensive patch was released as part of security update v7.4.4 build 9400 on August 11, 2026.
Impact:
Successful exploitation grants the attacker root or administrative-level access to the Adobe Campaign Classic instance. Attackers can steal customer lists and personal data, modify campaign content and delivery parameters, create backdoor accounts for persistent access, and disrupt campaign execution and delivery pipelines.
CVE-2026-48381
SQL injection vulnerability in Adobe Campaign Classic caused by inadequate input sanitization. User-controlled input is incorporated into SQL queries without proper escaping or parameterized query mechanisms. An attacker can inject malicious SQL code through specially crafted input, allowing arbitrary database manipulation and code execution within the database engine context.
Attack Vector:
The vulnerability is exploitable over the network without authentication. However, it presents higher complexity compared to the authorization bypass flaws, requiring attackers to understand the application's database schema and SQL syntax to craft effective payloads. Despite this increased complexity, the attack is still feasible for attackers with moderate technical capabilities.
Root Cause:
The vulnerability arises from the application's failure to properly neutralize special characters and SQL metacharacters in user input before constructing dynamic SQL statements. Input validation and output encoding are insufficient, allowing attacker-controlled strings to alter the structure and logic of SQL queries.
Impact:
An attacker exploiting this vulnerability can execute arbitrary SQL commands with the privileges of the Adobe Campaign Classic database user. This allows extraction of sensitive data including customer records, campaign data, configuration details, and authentication credentials from the database. The attacker can also modify or delete critical data, manipulate campaign logic, and potentially execute code within the database engine context (depending on database platform and permissions).
Paths probed:
/nl/jsp/logon.jsp — the console logon endpoint.
/nl/ — the application root.
Matchers (product detection — any one confirms ACC):
Session cookies — NMSUID, NMSESSUID, NMSCOOKIE, AMCGLOBALID in response headers. Strongest signal: specific to the Neolane/Adobe Campaign stack, issued pre-auth on first contact.
Login title — "Adobe Campaign Classic login" in the body. Confirms the Classic product line (vs Adobe-hosted Standard).
System markers — "Adobe Campaign System" / "ACS (Adobe Campaign System)" in the body. Backup confirmation when the title is customized or localized away.
Version extractors (opportunistic enrichment, not primary):
X-Powered-By header — product/version token.
Server banner — primary and secondary product/version tokens.
X-Generator header — version string.
<meta name="generator"> — version in HTML body.
AdobeAdobe Campaign Classic
Critical6d ago
NetScaler ADC & NetScaler Gateway - Pre-Auth Heap Overflow Leading to Full Remote Code Execution
NetScaler is an enterprise-grade application delivery controller (ADC) and gateway solution designed to optimize, secure, and load-balance web applications and remote desktop traffic.
CVE-2026-8452
The critical vulnerability is a pre-authentication heap-based buffer overflow stemming from an XML normalization flaw during SAML authentication handling. By sending a maliciously crafted SAML request containing an oversized attribute, an unauthenticated remote attacker can corrupt the system's memory. This leads to a complete denial of service through the crash of the core packet processing engine or allows the attacker to bypass operating system protections to achieve remote code execution (RCE) with root privileges.
Specifically, the overflow occurs within the core packet processing engine (nsppe) when parsing the PrefixList attribute inside the <InclusiveNamespaces> tag of a SAML assertion. While a crash typically triggers the pitboss watchdog process to restart the appliance, successful exploitation leverages precise heap grooming to overwrite function pointers, subverting memory mitigations and stabilizing code execution directly within the NetScaler kernel space.
CitrixNetScaler ADCNetScaler Gateway
