CVE-2026-73570

CVE: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CWE: CWE-78
Published: Synacor | Zimbra Collaboration Suite (ZCS)
Link: https://www.cve.org/CVERecord?id=CVE-2026-73570

Threat Analysis (Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.)

  1. Impact: An unauthenticated attacker can cause arbitrary OS command execution via SMTP, compromising confidentiality, integrity, and availability of the Zimbra server and its data.

  2. Affected components & attack surface: Zimbra Collaboration Suite (ZCS) email server, SMTP interface; remote web‑based request processing; local OS commands executed as the Zimbra user.

  3. Exploitation prerequisites: No authentication required; attacker must send a crafted SMTP message to the Zimbra mail server; the command must be executable on the host.

  4. Detection ideas & indicators: SMTP logs showing command‑injection attempts, failed authentication, unusual command execution in syslog; ATT&CK T1059.001; error codes in Zimbra mail‑server logs.

  5. Mitigations & workarounds: Apply the Zimbra security patch (CVE‑2026‑73570 fix), disable command execution in SMTP processing, enforce authentication for SMTP, use command‑whitelisting.

  6. Verification steps: Send a crafted SMTP request to the Zimbra mail server, observe execution of a non‑standard command (e.g., /bin/ls or /usr/bin/date) via logs; confirm the command runs as the Zimbra user; verify that the patched version > 2026.04 is in use.

  7. Attack‑path sequence:

    sequenceDiagram
 Attacker->>Zimbra SMTP: Sends crafted command injection request
 Zimbra SMTP->>OS: Executes OS command as Zimbra user
 OS->>Zimbra: Executes command
 Zimbra->>Attacker: Command result logged
 Attacker->>Attacker: Gains OS‑level privileges

CVE-2026-72529

CVE: TrueConf Server Missing Authentication for Critical Function Vulnerability: TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
CWE: CWE-306
Published: TrueConf | Server
Link: https://www.cve.org/CVERecord?id=CVE-2026-72529

Threat Analysis (TrueConf Server Missing Authentication for Critical Function Vulnerability: TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.)

  1. Impact: The missing authentication lets a remote attacker execute arbitrary scripts on the TrueConf server, compromising Confidentiality (data exposure), Integrity (malicious code injection), and Availability (potential denial of service from script failures).

  2. Affected Components & Attack Surface: TrueConf Server (exact version unknown) exposing port 4307/TCP to the Internet; the vulnerability resides in a critical function lacking authentication.

  3. Exploitation Prerequisites: Network access to port 4307, no additional privileges required; a simple TCP request to the vulnerable function triggers script execution.

  4. Detection Ideas & Indicators: Server logs showing script‑related activity, ATT&CK T1059 (Command and Scripting Interpreter), CWE‑306 signatures in logs.

  5. Mitigations & Workarounds: Deploy the official TrueConf patch, disable or firewall port 4307, enforce mandatory authentication for the affected function.

  6. Verification Steps: From an external host, send a crafted request to the critical function; if the server runs the supplied script, the vulnerability is confirmed. The fix should eliminate script execution.

  7. Attack‑Path Sequence

    sequenceDiagram
 participant Attacker
 participant Server
 Attacker->>Server: Scan port 4307
 Server->>Attacker: Accept request to vulnerable function
 Attacker->>Server: Send crafted request
 Server->>Server: Execute script
 Attacker->>Server: Script runs, attacker gains control

CVE-2026-72530

CVE: TrueConf Server Code Injection Vulnerability: TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
CWE: CWE-94
Published: TrueConf | Server
Link: https://www.cve.org/CVERecord?id=CVE-2026-72530

Threat Analysis (TrueConf Server Code Injection Vulnerability: TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.)
  1. Impact: Remote code execution that breaks out of the TrueConf Server’s isolated environment, compromising confidentiality, integrity, and availability of the host system.
  2. Affected Components & Attack Surface: TrueConf Server (any version) exposed via TCP port 4307; attack is remote only.
  3. Exploitation Prerequisites: Network access to port 4307; attacker supplies a crafted script; no elevated host privileges required.
  4. Detection Ideas & Indicators: Logs of port 4307 connections, failed script execution, unexpected process spawns; MITRE ATT&CK T1190 (Exploit Public‑Facing Application).
  5. Mitigations & Workarounds: Apply the TrueConf Server patch, disable remote script execution, restrict port 4307 with firewalls or host‑level ACLs.
  6. Verification Steps: Scan port 4307 with a vulnerability tool using the exploit payload; confirm remote code execution; verify no unauthorized process is running.
  7. Attack-Path Sequence: 
    sequenceDiagram
 attacker->>TrueConf Server: Send crafted script over TCP 4307
 TrueConf Server->>host: Execute script, break isolation
 host->>attacker: Execute arbitrary code

CVE-2026-64849

CVE: MLflow Server-Side Request Forgery Vulnerability: MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
CWE: CWE-918
Published: MLflow | MLflow
Link: https://www.cve.org/CVERecord?id=CVE-2026-64849

Threat Analysis (MLflow Server-Side Request Forgery Vulnerability: MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.)

  1. Impact: Unauthorized access to MLflow’s internal metadata stores can expose sensitive configuration data (confidentiality breach) and allow modification of metadata (integrity risk); availability impact is minimal.

  2. Affected Components & Attack Surface: MLflow server (Python 3.9+), embedded metadata store (SQLite/PostgreSQL), and any cloud metadata service; exposure vector is remote HTTP POST.

  3. Exploitation Prerequisites: No authentication required; attacker can issue a crafted POST to /mlflow/server/v1.0/metadata with a response_status and response_body payload, triggering the vulnerability.

  4. Detection Ideas & Indicators: Unexpected HTTP POSTs to /mlflow/server/v1.0/metadata in web logs; MITRE ATT&CK T1071.001 (Application Layer Protocol: Web Protocols); presence of non‑standard response_body data in logs.

  5. Mitigations & Workarounds: Apply the latest MLflow security patch; disable the metadata endpoint or restrict access via firewall/WAF; enforce authentication for metadata access.

  6. Verification Steps: Using a known vulnerable MLflow version, send a POST to /mlflow/server/v1.0/metadata and capture the response body; confirm that the body contains unexpected data. Re‑run the same request with the patched version and verify the response is empty.

  7. Attack‑Path Sequence

    sequenceDiagram
 Attacker->>MLflow Server: POST /mlflow/server/v1.0/metadata?response_status=OK&response_body=payload
 MLflow Server->>MLflow Server: Process request without auth, return response_status and response_body
 MLflow Server-->>Attacker: Response containing payload
 Attacker->>Attacker: Extract payload for further use

CVE-2026-65400

CVE: Apple macOS Improper Authentication Vulnerability: Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
CWE: CWE-287
Published: Apple | macOS
Link: https://www.cve.org/CVERecord?id=CVE-2026-65400

Threat Analysis (Apple macOS Improper Authentication Vulnerability: Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.)

  1. Impact: Remote attackers can obtain a valid Screen‑Sharing session without credentials, compromising confidentiality (data exposure), integrity (session tampering), and potentially leading to full system compromise if the session is abused.

  2. Affected Components & Attack Surface: All macOS installations that enable Screen Sharing (client‑side and server‑side). The vulnerability resides in the screen‑sharing daemon on port 5900 (remote TCP) and may be triggered locally if an attacker is already on the machine.

  3. Exploitation Prerequisites: Network presence on the same LAN/Wi‑Fi, ability to send packets to port 5900, and no valid credentials. No elevated privileges are required.

  4. Detection Ideas & Indicators: System logs (e.g., /var/log/system.log or System.log with “Screen Sharing: authentication failed”) showing repeated failed logins; ATT&CK T1071.001 (Valid Accounts) or CVE‑2026‑65400 reference; spikes in authentication‑failure events.

  5. Mitigations & Workarounds: Disable Screen Sharing via System Preferences or System Preferences → Sharing → uncheck Screen Sharing; apply any Apple‑released patch; enforce firewall rules to block inbound traffic on 5900; use strong, unique credentials.

  6. Verification Steps: Capture traffic to 5900 with tcpdump and send a malformed authentication request; confirm the server logs a credential‑failure. Alternatively, run a vulnerability scanner that flags CVE‑2026‑65400.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>Server: Send crafted packet to port 5900
 Server->>Server: Accept request, bypass authentication
 Server->>Attacker: Grant invalid Screen‑Sharing session
 Attacker->>Attacker: Use session to access resources