ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-11-06
•9 min read
Brief Summary: IBM API Connect CVE-2026-17360 Hardcoded Credentials Allow Full Administrative Control
A brief summary of CVE-2026-17360, a CVSS 9.8 hardcoded credentials flaw (CWE-798) in IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 that could allow a remote attacker to gain full administrative control. Includes IBM's patch information for the fixed 12.1.1.3 release.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•8 min read
Overview of CVE-2026-17362: Missing Authorization Lets Remote Attackers Create, Modify, or Delete Tenants in IBM API Connect V12
A brief summary of CVE-2026-17362, a CVSS 9.8 missing authorization flaw in IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 that could let a remote attacker create, modify, or delete tenants. Covers IBM's CVSS assessment, what is and is not publicly known, and the fix in 12.1.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•7 min read
Brief Summary: IBM API Connect CVE-2026-17379 Signature Verification Flaw Allows Authentication Bypass and Arbitrary Role Assignment
A brief summary of CVE-2026-17379, a CVSS 7.4 improper cryptographic signature verification flaw in IBM API Connect that could let a remote attacker bypass authentication and assign arbitrary roles. Covers affected versions and IBM patch information for the V10 and V12 release streams.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•7 min read
Brief Summary: IBM API Connect CVE-2026-17399 Authenticated Upload Validation Flaw Leading to Code Execution
A brief summary of CVE-2026-17399, a CVSS 9.9 flaw in IBM API Connect where insufficiently validated uploaded content could let an authenticated, low-privileged user run code on the server. Covers affected releases, the IBM fixed versions 10.0.8.13 and 12.1.1.3, and current exploitation status.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•8 min read
Brief Summary: IBM API Connect CVE-2026-17402 OS Command Injection Rated 9.9
A brief summary of CVE-2026-17402, an authenticated OS command injection in IBM API Connect 10.0.8 and 12.1 that IBM rates 9.9. It covers the root cause as disclosed, the affected versions, and IBM's fixed releases 10.0.8.13 and 12.1.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•8 min read
Brief Summary: IBM API Connect CVE-2026-17403 Hard-Coded Credentials Enabling Administrative Control
A brief summary of CVE-2026-17403, a CVSS 9.0 hard-coded credentials weakness (CWE-798) in IBM API Connect. It covers the published CVSS vector, the affected 10.0.8 and V12 version ranges, and IBM's fixed releases 10.0.8.13 and 12.1.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•7 min read
Brief Summary: IBM API Connect CVE-2026-17408, an Unauthenticated OS Command Injection Rated CVSS 9.8
A brief summary of CVE-2026-17408, a CVSS 9.8 OS command injection (CWE-78) in IBM API Connect 10.0.8 and V12 OnPrem. It covers the published attack conditions, the affected version ranges and IBM's fixed releases, 10.0.8.13 and 12.1.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•7 min read
Brief Summary: IBM API Connect CVE-2026-17409 Case-Sensitivity Access Control Bypass
A brief summary of CVE-2026-17409, a CVSS 9.4 flaw in IBM API Connect where access controls are not applied consistently to case variations of a request, so an unauthenticated remote attacker can reach restricted administrative operations. Includes affected versions and IBM's fixed releases.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•9 min read
Brief Summary: IBM API Connect CVE-2026-17150, Custom Module Validation Flaw Enabling Cross-Tenant Code Execution
A brief summary of CVE-2026-17150, a CVSS 9.9 input validation flaw in IBM API Connect where uploaded custom module content could let an authenticated user run code beyond their own tenant. Covers root cause, affected versions, and IBM's fixed builds 10.0.8.13 and 12.1.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•7 min read
Brief Summary: IBM API Connect CVE 2026 17313 Authentication Bypass via Alternate Path Exposing Gateway Configuration
A brief summary of CVE 2026 17313, a CVSS 9.8 authentication bypass (CWE 288) in IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 that can expose sensitive information and gateway configuration. The post covers the published technical details, the affected versions and IBM's fix in release 12.1.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•8 min read
Brief Summary: IBM API Connect CVE-2026-17340 Unauthenticated Path Traversal Leading to Remote Code Execution
A brief summary of CVE-2026-17340, a CVSS 9.8 path traversal flaw in IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 that IBM says could allow unauthenticated remote code execution. Includes patch information for the fixed 12.1.1.3 release and current exploitation status.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•8 min read
Brief Summary: IBM API Connect CVE-2026-18838 Authentication Bypass by Spoofing Enables User Impersonation
A brief summary of CVE-2026-18838, a CVSS 9.4 authentication bypass by spoofing in IBM API Connect V12 OnPrem 12.1.0.0 through 12.1.1.2 that allows a remote caller to impersonate another user. The post covers the published technical details, the fixed release 12.1.1.3, and related IBM disclosures.
Gaurav Sarraf
CVE Analysis
•2026-11-06
•8 min read
Brief Summary: SonicOS CVE-2026-107155 Permissive Cross-Domain (CORS) Policy in the Management API
A brief summary of CVE-2026-107155, a CWE 942 permissive cross-domain policy flaw in the SonicOS management API rated CVSS 8.8. Covers the root cause, the companion session validation bug, fixed SonicOS 7 and 8 builds, and the post-upgrade configuration checks SonicWall recommends.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•8 min read
Overview of CVE-2026-110932: Unauthenticated Disk Exhaustion via the Keycloak Theme Gzip Cache
A brief summary of CVE-2026-110932, an unauthenticated denial of service in Keycloak where fabricated theme names become keys for a persistent gzip cache on disk, with a short review of the upstream fix shipped in Keycloak 26.8.2 and the current Red Hat status.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•11 min read
FreeSWITCH CVE-2026-116779: SIP MESSAGE to API Command Injection (PoC, Patch, and Detection)
A summary of CVE-2026-116779, a critical FreeSWITCH flaw where an inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands. Covers a public PoC, the upstream patch, and log and process based detection leads.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•8 min read
Brief Summary: FreeSWITCH CVE-2026-116784, an Out-of-Bounds Read in RTCP NACK Feedback Parsing
A brief summary of CVE-2026-116784, an out-of-bounds read in FreeSWITCH's RTCP NACK feedback parser that can crash an instance and terminate every active call. Includes PoC and patch details.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•9 min read
Technical Overview of CVE-2026-116790: FreeSWITCH ICE Authentication Bypass via Unverified STUN Message Integrity
A brief summary of CVE-2026-116790, a FreeSWITCH flaw where inbound ICE connectivity checks were accepted without verifying STUN message integrity, letting a reachable peer redirect RTP and DTLS traffic. We review the root cause, the opt-in patch in version 1.11.2, and affected configurations.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•7 min read
Brief Summary: Keycloak CVE-2026-117691, SAML HTTP Redirect Signature Bypass via Percent-Encoded Parameter Names
A brief summary of CVE-2026-117691, a signature verification bypass in Keycloak's SAML HTTP Redirect binding that can lead to federated account takeover. Covers the parameter name parsing discrepancy behind it and sourced hardening guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•7 min read
Quick Look: Keycloak CVE-2026-97175, Unverified Email Auto Linking in idp-auto-link Enables Account Takeover
A brief summary of CVE-2026-97175, an improper authentication flaw in Keycloak's idp-auto-link authenticator that can link an attacker's brokered identity to a victim's local account using an unverified email address. Red Hat rates it CVSS 3.1 8.8 (High).
Gaurav Sarraf
CVE Analysis
•2026-11-05
•6 min read
Brief Summary: Keycloak CVE-2026-112208 Organization Login Authentication Bypass Enabling Account Takeover
A brief summary of CVE-2026-112208, a CVSS 8.1 authentication bypass in Keycloak's Organization identity first login flow where a stale SSO_AUTH note lets a user in two or more organizations log in as another user. No fixed version or qualifying vendor workaround has been published.
Gaurav Sarraf
