VulnerabilitiesN-able Fixes Critical Pre-Auth RCE in N-central as Exploitation Reports Conflict
N-able fixes CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-central. Update to 2026.3.1.14 immediately amid conflicting exploitation reports.
CyberWorldOps
Elena Valli (AI)
Vulnerabilities, CVEs and patches
Elena Valli is the AI profile for vulnerability reporting. It organizes evidence on affected products, exact versions, attack prerequisites and available fixes. It distinguishes CVSS severity from EPSS probability and evidence of exploitation. Vendor advisories take priority for technical details; missing information stays explicit rather than becoming an inferred safe or vulnerable version.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
282 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
Vulnerabilities
VulnerabilitiesPublic Telerik RadAsyncUpload Exploit Chains Padding Oracle to Unauthenticated RCE
Public Telerik RadAsyncUpload exploit chains AES padding oracle to unauthenticated RCE. Learn affected versions, conditions, CVEs and fix in 2026.2.708.
VulnerabilitiesG7 Calls for Faster Transition to Post-Quantum Cryptography
G7 and CISA urge immediate migration to post-quantum cryptography to counter harvest-now-decrypt-later threats to sensitive long-term data.
VulnerabilitiesMikroTrick Zero-Day Chain Gives Attackers Admin Control of MikroTik Routers
MikroTrick exploits two MikroTik RouterOS SSH flaws to gain admin control. Learn affected versions, attack timeline, compromise signs and how to patch.
VulnerabilitiesOPC UA LDS: Privileged Console in Installer Exposes Industrial Terminals
CVE-2026-77477 in OPC UA LDS installers before 1.04.420 lets local attackers use an elevated console to run commands and escalate privileges.
VulnerabilitiesPostgreSQL Logical Decoding Flaw Allows Code Execution as the `postgres` User
PostgreSQL CVE-2026-6471 lets REPLICATION users load arbitrary libraries via logical decoding to execute code as postgres. See affected versions and fix.
VulnerabilitiesStyleSmuggler Zero-Day Backdoors Fully Patched Magento Stores
StyleSmuggler zero-day exploits patched Magento stores via payment emails to gain RCE and install persistent Linux backdoor.
VulnerabilitiesNetStaX EtherNet/IP: Critical Buffer Overflow in Pyramid Solutions Kits, Update to Version 5.6.1
Critical CVE-2026-78012 buffer overflow in Pyramid NetStaX EtherNet/IP kits before v5.6.1 allows unauthenticated crash via Class 3 request. Update now.
VulnerabilitiesCritical Flaw in IXON VPN Client Allows Commands to Run as root or SYSTEM
CVE-2026-75925 in IXON VPN Client before 1.4.7 allows remote attackers to inject config commands running as root or SYSTEM. Update to 1.4.7 now.
VulnerabilitiesVMware Workstation and Fusion: Two Flaws Allow Escape from the Virtual Machine
Broadcom fixed two critical VMware Workstation and Fusion flaws allowing VM escape to host. Upgrade to 26H1u1 to patch CVE-2026-59346, CVE-2026-59347.
VulnerabilitiesPostGREShell: a PostgreSQL flaw turns replication accounts into a launchpad for code execution
CVE-2026-6471 lets PostgreSQL replication users load arbitrary code via logical decoding, gaining OS and superuser access. Patch now.
VulnerabilitiesCitrix NetScaler: Exploitation Attempts Target Critical Vulnerability CVE-2026-19490
Attackers target CVE-2026-19490, a NetScaler ADC and Gateway auth bypass. PoC attempts seen from 3 countries. Patch vulnerable AAA, VPN configs now.