5 bugs at CVSS 9.8: Apache MINA's filter bypassed twice, WordPress plugin to admin in one click
Two deserialization bypasses in Apache MINA let attackers slip past the allowlist for RCE, a WordPress privilege escalation hands out admin roles, and a pair of Totolink router command injections have public exploits. All 9.8, none exploited in the wild yet.
Five CVEs today. All scored 9.8. None exploited in the wild yet, but public exploits already exist for the Totolink router bugs, and the two Apache MINA deserialization bypasses are the kind of thing that gets weaponized fast. If you run MINA with IoBuffer.getObject() in your stack, that's your priority.
Today's CVEs
Sorted by urgencyCVE-2026-7122
NVDAn attacker can inject OS commands remotely through the UPnP configuration handler on Totolink A8000RU routers running firmware 7.1cu.643_b20200521. No authentication is needed, and a public exploit already exists. CVSS 9.8, so this is full remote takeover of the device.
- Affected estate
- Anyone running a Totolink A8000RU with firmware 7.1cu.643_b20200521
Evidence trail
- NVD: View source
CVE-2026-7121
NVDSame router, different function. The wizard configuration handler on the Totolink A8000RU also accepts unsanitized input, letting a remote attacker inject arbitrary OS commands. A public exploit is available. CVSS 9.8.
- Affected estate
- Anyone running a Totolink A8000RU with firmware 7.1cu.643_b20200521
Evidence trail
- NVD: View source
CVE-2026-22337
NVDThe Directorist Social Login plugin for WordPress has a privilege escalation bug that lets an attacker promote themselves to a higher role, potentially full admin. No special access is required. CVSS 9.8.
- Affected estate
- WordPress site owners running the Directorist Social Login plugin before version 2.1.4
Evidence trail
- NVD: View source
CVE-2026-41409
NVDThe earlier fix for CVE-2024-52046 in Apache MINA was incomplete. The classname allowlist that's supposed to block dangerous deserialization kicks in too late: a malicious class's static initializer can run before the filter ever checks it. If your app calls IoBuffer.getObject(), a remote attacker can execute arbitrary code. CVSS 9.8.
- Affected estate
- Java developers and teams running applications that use Apache MINA 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, or 2.2.0 through 2.2.5, specifically if the app calls IoBuffer.getObject()
Evidence trail
- NVD: View source
CVE-2026-41635
NVDAnother deserialization bypass in Apache MINA. The resolveClass() method has a code path for static classes and primitives that skips the allowlist entirely, letting an attacker sneak arbitrary classes past the filter and get remote code execution. This is a separate bypass from CVE-2026-41409, fixed in the same release. CVSS 9.8.
- Affected estate
- Java developers and teams running applications that use Apache MINA 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, or 2.2.0 through 2.2.5, specifically if the app calls IoBuffer.getObject()
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom this beat
Read the rest of the field notes →