CVE-2026-73570

CVE: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
CWE: CWE-78
Published: Synacor | Zimbra Collaboration Suite (ZCS)
Link: https://www.cve.org/CVERecord?id=CVE-2026-73570

Threat Analysis (Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability: Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.)

  1. Impact: Unauthenticated attackers can execute arbitrary OS commands as the Zimbra user, potentially exfiltrating data (confidentiality breach), modifying system files (integrity breach), or disrupting service (availability breach).

  2. Affected Components & Attack Surface: Zimbra Collaboration Suite (ZCS) server, its SMTP mail subsystem, remote network exposure via SMTP port; no local access required.

  3. Exploitation Prerequisites: Ability to send crafted SMTP messages to the Zimbra mail server; no authentication to Zimbra needed; request must contain an OS command within the message body.

  4. Detection Ideas & Indicators: SMTP connection logs showing unexpected command strings, Zimbra error logs with command execution, ATT&CK T1059.001 (Command and Scripting Interpreter) mapping to ID Zimbra‑OSCommandInjection.

  5. Mitigations & Workarounds: Apply the vendor patch ZC‑2026‑73570, disable remote SMTP injection, enforce strict input validation, and restrict SMTP access with firewalls.

  6. Verification Steps: Send a malicious SMTP request containing an OS command, observe command execution in Zimbra logs or process list, then confirm the fix by checking the patched version and absence of command execution.

  7. Attack-Path Sequence:

    sequenceDiagram
 Attacker->>Zimbra SMTP: Crafted mail with OS command
 Zimbra SMTP->>Zimbra OS: Execute command
 Zimbra OS->>Zimbra User: Execute command as user

    CVE-2026-72529

CVE: TrueConf Server Missing Authentication for Critical Function Vulnerability: TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
CWE: CWE-306
Published: TrueConf | Server
Link: https://www.cve.org/CVERecord?id=CVE-2026-72529

Threat Analysis (TrueConf Server Missing Authentication for Critical Function Vulnerability: TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.)

  1. Impact: Confidentiality and integrity are compromised, as an attacker can execute arbitrary scripts on the TrueConf server. Availability may be degraded if the script crashes the service.

  2. Affected Components & Attack Surface: The vulnerability resides in the TrueConf Server (no specific version given). The attack surface is remote, reachable via TCP port 4307.

  3. Exploitation Prerequisites: Network access to port 4307 is required; the function lacks authentication, so a crafted request suffices to trigger arbitrary script execution.

  4. Detection Ideas & Indicators: Unusual connections to port 4307, script execution logs, ATT&CK T1059.001, CWE‑306 events, and firewall alerts on the port.

  5. Mitigations & Workarounds: Deploy the vendor patch, disable the vulnerable service, or block port 4307 at the firewall; do not leave the function exposed.

  6. Verification Steps: Use a tool (e.g., curl) to send a request to the server on port 4307 and confirm that an arbitrary script is executed; compare results with the patched server.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>TrueConf: TCP connect port 4307
 TrueConf->>TrueConf: Execute script (no auth)
 TrueConf->>Attacker: Script output

CVE-2026-72530

CVE: TrueConf Server Code Injection Vulnerability: TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
CWE: CWE-94
Published: TrueConf | Server
Link: https://www.cve.org/CVERecord?id=CVE-2026-72530

Threat Analysis (TrueConf Server Code Injection Vulnerability: TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.)

  1. Impact: The vulnerability compromises Confidentiality, Integrity, and Availability. An attacker can break the isolated TrueConf environment and run arbitrary code on the host, potentially exfiltrating data, altering system state, or disrupting services.

  2. Affected Components & Attack Surface: The vulnerability resides in the TrueConf Server software (exact version unspecified). The attack surface is remote, reachable via TCP port 4307.

  3. Exploitation Prerequisites: A network‑accessible attacker who can send a specially crafted script to port 4307; no authentication or additional configuration is required.

  4. Detection Ideas & Indicators: Log entries for inbound connections on port 4307, execution of non‑standard scripts, alerts for CVE‑2026‑72530 or CWE‑94, and ATT&CK T1059 (Command and Scripting Interpreter) activity.

  5. Mitigations & Workarounds: Install the latest TrueConf Server patch, disable or firewall port 4307 if unused, segment the server from the network, and enforce least‑privilege isolation.

  6. Verification Steps: Run the vendor patch verification tool, attempt a script injection via telnet/ssh to port 4307, and confirm whether the server executes arbitrary commands or shows exploit‑related logs.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>TrueConf Server: Send crafted script (TCP 4307)
 TrueConf Server->>TrueConf Server: Execute script
 TrueConf Server->>Host OS: Run arbitrary code
 Host OS->>Attacker: Return success / data

CVE-2026-64849

CVE: MLflow Server-Side Request Forgery Vulnerability: MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
CWE: CWE-918
Published: MLflow | MLflow
Link: https://www.cve.org/CVERecord?id=CVE-2026-64849

Threat Analysis (MLflow Server-Side Request Forgery Vulnerability: MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.)

  1. Impact: The vulnerability compromises confidentiality by exposing internal metadata, may alter integrity via tampered response_status/response_body, and can disrupt availability if requests cause service errors.

  2. Affected components & attack surface: MLflow server runtime and its metadata services; exposed via remote HTTP GET/POST endpoints.

  3. Exploitation prerequisites: Ability to send HTTP requests to the MLflow metadata endpoint; no authentication required, minimal network access.

  4. Detection ideas & indicators: Server logs showing unexpected metadata calls; anomalous response_status or body values; ATT&CK T1071/T1105; repeated requests without auth headers.

  5. Mitigations & workarounds: Apply latest MLflow patch, restrict endpoint to internal traffic only, enforce API authentication (token/key).

  6. Verification steps: Issue a crafted request to the metadata endpoint, compare the response to a patched server; verify logs show no anomalous data.

  7. Attack-Path Sequence:

    sequenceDiagram
 Attacker->>MLflow Server: HTTP request to metadata endpoint
 MLflow Server->>Metadata Service: Process request
 Metadata Service->>MLflow Server: Return response_status/response_body
 MLflow Server->>Attacker: Deliver response

CVE-2026-65400

CVE: Apple macOS Improper Authentication Vulnerability: Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
CWE: CWE-287
Published: Apple | macOS
Link: https://www.cve.org/CVERecord?id=CVE-2026-65400

Threat Analysis (Apple macOS Improper Authentication Vulnerability: Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.)

  1. Impact: Unauthorized remote authentication to Screen Sharing can expose confidential data, tamper with integrity, and disrupt availability by hijacking the session.

  2. Affected Components & Attack Surface: macOS kernel/OSX Server, Screen Sharing subsystem, network stack; software version unspecified (all macOS). Attack surface: remote network (TCP 5935/5936).

  3. Exploitation Prerequisites: Network connectivity to the macOS host, attacker on the same LAN; no additional privileges or client configuration needed.

  4. Detection Ideas & Indicators: Authentication‑failure logs (/var/log/auth.log), abnormal screen‑share connection attempts from unknown IPs, MITRE ATT&CK T1086.001, repeated failed login attempts.

  5. Mitigations & Workarounds: Apply Apple security patch, disable Screen Sharing, enforce VPN, network segmentation, and 2FA.

  6. Verification Steps: Capture screen‑share traffic with Wireshark; confirm authentication bypass; verify patch installation via security update check.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>macOS: Crafted packet
 macOS->>Screen Sharing: Bypasses auth
 Screen Sharing->>Attacker: Established session
 Attacker->>Data: Exfiltrates session