Loading story…
Hermes WebUI versions before 0.51.788 contain a critical unauthenticated remote code execution flaw tracked as CVE-2026-58123. The vulnerability stems from missing authentication on embedded terminal API endpoints, allowing a remote attacker to reach privileged functionality without logging in and execute arbitrary shell commands as the server process user. The issue has been classified as CWE-306 and carries high impact across confidentiality, integrity, and availability.
According to the advisory, exploitation requires four sequential unauthenticated HTTP requests: an attacker can create a terminal session, attach a PTY shell, and then send commands through the terminal input endpoint. A fix is available in version 0.51.788, with references pointing to a remediation commit, pull request, and release tag, and organizations running Hermes WebUI are exposed until they upgrade.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A critical unauthenticated remote code execution vulnerability affecting Hermes WebUI versions before 0.51.788 was disclosed. The flaw allows remote attackers to access terminal API endpoints without credentials and execute arbitrary shell commands via four sequential unauthenticated HTTP requests.
Hermes WebUI version 0.51.788 was released with 'embedded-terminal access hardening.' This release appears to introduce the security fix for the later-disclosed unauthenticated RCE affecting versions before 0.51.788.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.
Jun 29, 2026
Erlang/OTP disclosed **CVE-2025-32433** in its SSH implementation as an **unauthenticated remote code execution** vulnerability, tracked in GitHub advisory `GHSA-37cp-fgq5-7wc2`. Public descriptions characterize the issue as a **pre-authentication** flaw tied to improper handling of SSH protocol messages, including malformed `SSH_MSG_CHANNEL_REQUEST` packets, allowing attackers to execute code on exposed Erlang-based SSH servers without valid credentials. Several repositories also describe the weakness as related to missing authentication for a critical function (`CWE-306`). After disclosure, GitHub saw a rapid spread of public exploit material, including proof-of-concept code, remote shell implementations, offensive modules, lab-focused exploit scripts, and later detection tooling. Repositories from multiple authors published exploit variants in Go and other formats, along with testing tools for identifying vulnerable systems, indicating that exploitation knowledge quickly became broadly accessible to both defenders and attackers. The volume and persistence of these repositories suggest that organizations running Erlang/OTP SSH services faced elevated risk of opportunistic scanning and weaponized exploitation soon after the advisory became public.
Jul 11, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 11, 2026