CVE-2026-85706

CVE: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
CWE: CWE-35
Published: GitLab | Community Edition and Enterprise Edition
Link: https://www.cve.org/CVERecord?id=CVE-2026-85706

Threat Analysis (GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.)

  1. Impact: Unauthenticated attackers can read arbitrary files on the host, compromising Confidentiality (exfiltration of secrets, credentials). Integrity and Availability are not directly affected.

  2. Affected Components & Attack Surface: The vulnerability resides in the repository commits API (/api/v4/projects/:id/commits) of both GitLab Community Edition and Enterprise Edition. Access is remote via the web UI; no local code changes required.

  3. Exploitation Prerequisites: No authentication or elevated privileges are needed; an unauthenticated user can send a crafted commit request containing a path component with “..” (e.g., ..../etc/passwd).

  4. Detection Ideas & Indicators:
    • Logs in /var/log/gitlab/commits.log showing requests with “..” in the path.
    • ATT&CK T1060 – Data Exfiltration Over Command Line.
    • Unusual file‑content in API response containing source‑code or system files.

  5. Mitigations & Workarounds: Apply the vendor patch (commit cve-2026-85706-fix). Harden the API by enforcing authentication, sanitizing path components, and disabling public commit visibility.

  6. Verification Steps: Using curl, send a request to /api/v4/projects/<id>/commits with ..../etc/passwd in the path; the response should return a 403/404 or sanitized data, not the full file. Compare against the patched version to confirm the fix.

  7. Attack‑Path Sequence:
sequenceDiagram
    User->>Browser: GET /api/v4/projects/:id/commits?path=..../etc/passwd
    Browser->>GitLab API: Path traversal request
    GitLab API->>Host: Executes path traversal check (bypass)
    Host->>File System: Reads /etc/passwd
    File System-->>GitLab API: Returns file content
    GitLab API-->>Browser: Sends exfiltrated data
    Browser-->>User: Displays file contents

CVE-2026-42018

CVE: JFrog Artifactory Improper Authentication Vulnerability: JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CWE: CWE-287
Published: JFrog | Artifactory
Link: https://www.cve.org/CVERecord?id=CVE-2026-42018

Threat Analysis (JFrog Artifactory Improper Authentication Vulnerability: JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.)

  1. Impact: The vulnerability could allow an unauthenticated caller to retrieve an internal anonymous‑user token, compromising confidentiality of sensitive resources and potentially enabling integrity tampering; availability is not directly affected.

  2. Affected Components & Attack Surface: JFrog Artifactory server (remote HTTP endpoint). The vulnerability is triggered when anonymous access is disabled locally; no local execution or privileged code is required.

  3. Exploitation Prerequisites: The attacker must have access to the Artifactory HTTP interface, the anonymous‑access setting must be disabled, and the request must be sent to the token‑return endpoint. No special tools or elevated privileges are needed.

  4. Detection Ideas & Indicators: Logs showing a token header (e.g., X-Artifactory-Token) returned to an unauthenticated request; MITRE ATT&CK T1110 (Exploit Public‑Facing Application); CVE‑2026‑42018 ID appears in error/response logs.

  5. Mitigations & Workarounds: Apply the vendor patch, re‑enable proper authentication, restrict anonymous access, and enforce IAM policies that prevent token leakage.

  6. Verification Steps: Send a GET request to the token endpoint without credentials; inspect the response for the internal token and confirm it can be used to access resources.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>Artifactory: GET request (no auth)
 Artifactory->>Attacker: Returns internal anonymous token
 Attacker->>Artifactory: Uses token to access resources

CVE-2026-42016

CVE: JFrog Artifactory Incorrect Authorization Vulnerability: JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CWE: CWE-863
Published: JFrog | Artifactory
Link: https://www.cve.org/CVERecord?id=CVE-2026-42016

Threat Analysis (JFrog Artifactory Incorrect Authorization Vulnerability: JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.)

  1. Impact: Privilege escalation to arbitrary admin actions, compromising confidentiality and integrity of the repository.

  2. Affected Components & Attack Surface: Artifactory server (Java‑based REST API) and its token‑validation service; exposure via HTTP GET/POST endpoints.

  3. Exploitation Prerequisites: A token that passes signature/issuer checks but lacks the required scope (e.g., “write” scope). The attacker can supply such a token to the vulnerable endpoint.

  4. Detection Ideas & Indicators: Token validation logs showing “scope mismatch” errors, ATT&CK T1153 (Phishing) or T1059 (Command‑Line Interface) if command‑line abuse occurs.

  5. Mitigations & Workarounds: Deploy the official Artifactory patch for CVE‑2026‑42016, enforce strict token‑scope validation, and revoke compromised tokens.

  6. Verification Steps: Send a token with a valid signature/issuer but missing the “write” scope to the admin API; monitor for successful admin‑level actions indicating escalation.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>Artifactory: Send token with valid signature/issuer but no “write” scope
 Artifactory->>Artifactory: Passes signature/issuer check (incorrect validation)
 Artifactory->>Attacker: Grants elevated admin actions
 Attacker->>Artifactory: Executes admin operation

CVE-2026-84869

CVE: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.
CWE: CWE-269|
Published: ConnectWise | ScreenConnect
Link: https://www.cve.org/CVERecord?id=CVE-2026-84869

Threat Analysis (ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.)

  1. Impact: Unauthorized remote execution through an active ScreenConnect session can compromise confidentiality (data theft), integrity (malicious code execution), and availability (session disruption or denial of service).

  2. Affected Components & Attack Surface: ScreenConnect software (versions prior to the vendor‑issued patch), accessed via the remote interactive session API; exposure is remote, requiring only a valid session token.

  3. Exploitation Prerequisites: An attacker must have a live ScreenConnect session token; no host confirmation or elevated privileges are needed, and the vulnerability triggers on any file‑transfer request initiated during the session.

  4. Detection Ideas & Indicators: Logs of new session creation without host approval, ATT&CK T1021 (Exploit Public‑Facing Application) or T1105 (Exploit Remote Service), unusual outbound file‑transfer events tied to ScreenConnect, missing Authorization header in session payloads.

  5. Mitigations & Workarounds: Deploy the latest ScreenConnect patch (v2.0+), disable automatic remote‑session creation, enforce mandatory host confirmation, revoke compromised tokens, and isolate ScreenConnect traffic on the network.

  6. Verification Steps: Using a test script, trigger a file‑transfer command from an active session; observe whether the file is created and executed, then confirm token revocation and absence of the file.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>ScreenConnect: Send valid session token + file‑transfer request
 ScreenConnect->>ScreenConnect: Executes request without host confirmation
 ScreenConnect->>Host: Executes malicious command / creates file
 Host->>Attacker: Returns success, attacker gains execution

CVE-2026-67277

CVE: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability: MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
CWE: CWE-306
Published: MikroTik | RouterOS
Link: https://www.cve.org/CVERecord?id=CVE-2026-67277

Threat Analysis (MikroTik RouterOS Missing Authentication for Critical Function Vulnerability: MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.)
  1. Impact: Disclosure of kernel memory compromises confidentiality; the btest service may be forced into denial‑of‑service, reducing availability.
  2. Affected Components & Attack Surface: RouterOS (any version with the btest service enabled); remote HTTP/HTTPS to the btest endpoint; no local access required.
  3. Exploitation Prerequisites: Ability to send an unauthenticated request to the btest service; no elevated privileges or additional configuration needed.
  4. Detection Ideas & Indicators: HTTP 403/500 logs for the btest endpoint; repeated calls; ATT&CK T1071.003 and T1195; monitoring of unusual btest traffic.
  5. Mitigations & Workarounds: Apply the official RouterOS patch; disable or restrict the btest service to trusted IPs; firewall the endpoint.
  6. Verification Steps: Capture traffic with Wireshark, send a request, and confirm kernel memory contents; repeat after patch to ensure no memory disclosure.
  7. Attack-Path Sequence: 
    sequenceDiagram
 client->>RouterOS: HTTP request to btest endpoint
 RouterOS->>RouterOS: Process btest request (no auth)
 RouterOS->>Kernel: Access kernel memory
 Kernel-->>Client: Memory disclosure