ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-11-09
•5 min read
Brief Summary: SAP NetWeaver CVE-2026-109795 Code Injection via Missing Authorization Check (CVSS 9.9)
A brief summary of CVE-2026-109795, a CVSS 9.9 code injection flaw in SAP software where missing authorization checks and insufficient input validation in remotely enabled functionality can let a low-privileged attacker execute arbitrary code. We review the root cause, the documented attack model and the listed affected S4CRM, S4CEXT and BBPCRM releases.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•7 min read
Overview of CVE-2026-109803: SAP NetWeaver Knowledge Management XML Forms XSL Transformation Code Injection (CVSS 9.9)
A brief summary of CVE-2026-109803, a CVSS 9.9 code injection flaw in SAP NetWeaver Knowledge Management XML Forms. An authenticated user could cause an unauthorized XSL transformation to be processed, potentially leading to code execution in the application context.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•7 min read
Brief Summary: SAP Message Server CVE-2026-109804 Unauthenticated Information Disclosure (CWE 908)
A brief summary of CVE-2026-109804, an unauthenticated network information disclosure in SAP NetWeaver Message Server rated CVSS 7.5. We cover the disclosed root cause class, the affected release labels, and what the public record does and does not establish.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: SAP NetWeaver IGS CVE-2026-109806 Unauthenticated Denial of Service via Integer Overflow
A brief summary of CVE-2026-109806, a CVSS 7.5 flaw in SAP NetWeaver Internet Graphics Service where malformed image data in an unauthenticated request triggers an integer overflow and repeated worker process termination.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: Confection WordPress Cable CVE-2026-115252 Unauthenticated PHP Code Execution
A brief summary of CVE-2026-115252, an unauthenticated remote code execution flaw in the Confection WordPress Cable plugin versions 0.4.0 through 0.4.7, where an unprotected setting is written unmodified into a served PHP file. No fixed release is currently documented.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•10 min read
Overview of CVE-2026-119079: Quadratic ASN.1 Decoding Lets Unauthenticated Clients Exhaust MIT Kerberos KDC CPU
A brief summary of CVE-2026-119079, an unauthenticated CPU exhaustion flaw in the MIT krb5 ASN.1 SEQUENCE OF decoder that affects KDCs accepting Kerberos over TCP. Covers the root cause, the upstream fix, interim mitigations and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: CVE-2026-120008, an Unauthenticated Out-of-Bounds Write in SAP NetWeaver Internet Graphics Service
A brief summary of CVE-2026-120008, a CVSS 8.2 out-of-bounds write in SAP NetWeaver Internet Graphics Service. An unauthenticated attacker can trigger it with a crafted request to corrupt worker process memory or make the process terminate repeatedly.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: SAP Message Server CVE-2026-120010, an Unauthenticated Heap Buffer Overflow Causing Denial of Service
A brief summary of CVE-2026-120010, an incorrect buffer size calculation in SAP NetWeaver Application Server (SAP Message Server) that lets an unauthenticated HTTP request trigger a heap buffer overflow and abort the component. SAP rates it CVSS 3.1 7.5 with availability impact only.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: CVE-2026-120017, a SAML2 Authentication Bypass in SAP NetWeaver AS ABAP and ABAP Platform
A brief summary of CVE-2026-120017, a CVSS 10.0 flaw in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform. Insufficient verification of authentication assertions can let an unauthenticated attacker impersonate arbitrary users under certain configurations.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Overview of CVE-2026-76964: Unauthenticated Memory Corruption in SAP NetWeaver AS ABAP Internet Communication Manager
A brief summary of CVE-2026-76964, a CVSS 10.0 input validation flaw in the SAP NetWeaver AS ABAP Internet Communication Manager that could let an unauthenticated attacker corrupt memory and execute arbitrary code. We review the disclosed mechanism, the eight affected version entries and the current exploitation status.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: SAP NetWeaver AS ABAP CVE-2026-76965, Missing Authorization Checks Leading to OS Command Execution
A brief summary of CVE-2026-76965, a CVSS 9.9 flaw in SAP NetWeaver Application Server ABAP and ABAP Platform where missing authorization checks on internal functionality let a low-privileged attacker execute arbitrary operating system commands. We review the published vector, the affected version strings, and what the public record does not yet disclose.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•5 min read
Brief Summary: SAP NetWeaver Kernel CVE-2026-76966, Unauthenticated RFC Memory Corruption
A brief summary of CVE-2026-76966, a High-severity flaw in the SAP Kernel used by Application Server ABAP where a crafted RFC request from an unauthenticated attacker can cause memory corruption. We review the disclosed root cause, CVSS vector, affected kernel entries, and current exploitation status.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•7 min read
Brief Summary: SAP Gateway CVE-2026-89103, a Default ACL Broken Access Control Flaw Scored CVSS 10.0
A brief summary of CVE-2026-89103, a CVSS 10.0 incorrect authorization flaw in SAP Gateway where the default Access Control List can classify an unauthenticated external host as an internal application server. The post covers the root cause, affected kernel lines, and patch information for SAP Security Note 3798345.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•6 min read
Brief Summary: CVE-2026-89119, Administrative CSRF in SAP Web Dispatcher and NetWeaver ICM
A brief summary of CVE-2026-89119, a CVSS 9.6 cross-site request forgery issue in SAP Web Dispatcher and the NetWeaver ABAP Internet Communication Manager. It requires a logged-on administrator to visit a malicious link and could lead to compromise of the underlying operating system.
Gaurav Sarraf
CVE Analysis
•2026-11-09
•7 min read
Brief Summary: SAP Web Dispatcher CVE-2026-89126 Heap Buffer Overflow Allowing Unauthenticated Code Execution
A brief summary of CVE-2026-89126, a CVSS 10.0 heap buffer overflow in SAP Web Dispatcher that an unauthenticated attacker could trigger with crafted network traffic. It covers the documented attack conditions, affected release lines, exploitation status and how SAP Security Note 3778556 delivers the fix.
Gaurav Sarraf
CVE Analysis
•2026-11-08
•11 min read
Brief Summary: Kyverno CVE-2026-124440, apiCall Namespace Clamp Bypass to Cluster Admin
A summary of CVE-2026-124440, an authorization bypass in Kyverno 1.19.1 that lets a namespace tenant escalate to cluster admin through a malformed percent-escape in apiCall urlPath. Includes the advisory PoC and patch details from v1.19.2.
Gaurav Sarraf
CVE Analysis
•2026-11-08
•12 min read
Brief Summary: Kyverno CVE-2026-124441 Authorization Bypass via Variable Generate Target Kind (with PoC)
A summary of CVE-2026-124441, an authorization bypass in Kyverno before 1.19.2 that lets namespaced tenants steer the privileged background controller into writing resources in other namespaces. Includes the maintainer PoC, patch analysis, and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-08
•11 min read
OpenEMR CVE-2026-124445: OneTimeAuth Token Replay and PIN Brute Force, with PoC Analysis
CVE-2026-124445 is a critical authentication flaw in OpenEMR's OneTimeAuth component that allows token replay and PIN brute force. This covers the proof of concept details and the patch in OpenEMR 8.4.0.
Gaurav Sarraf
CVE Analysis
•2026-11-08
•11 min read
Brief Summary: OpenEMR CVE-2026-124450 Broken Access Control and Path Traversal in the fax/sms disposeDocument Action (with PoC)
A summary of CVE-2026-124450, an authenticated arbitrary file read and write flaw in OpenEMR's fax/sms module. Includes a public PoC and patch analysis for the OpenEMR 8.3.0 fix.
Gaurav Sarraf
CVE Analysis
•2026-11-07
•8 min read
CVE-2026-116751: Unauthenticated Time-Based SQL Injection via Tag Array Keys in Amelia Pro for WordPress
CVE-2026-116751 is an unauthenticated time-based SQL injection in Amelia Pro 4.0 through 9.9.1, where unescaped tag array keys defeat a strtr()-based placeholder binder. This includes patch information for the fixed 9.9.2 release.
Gaurav Sarraf
