ManageEngine ADAudit Plus CVSS 10: unauth RCE through the agent API

An authenticated attacker can exploit a deserialization bug in M365 Copilot to execute code over the network. CVSS 9.9. The attacker needs some level of authorization first, but once they have it, they can run code in your M365 Copilot environment. This is a cloud-side vulnerability, so the fix is on Microsoft's end, but you should verify your tenant is updated.

Affected estate

Anyone with M365 Copilot enabled in their Microsoft 365 tenant

How to check

Check the Microsoft 365 admin center Message Center and Service Health dashboard for advisories related to this CVE. Review your tenant's Copilot license assignments.

Included because

CVSS 9.9; deserialization to RCE; widely deployed cloud product

Action

Verify the fix is deployed in your tenant via the M365 admin center. Audit Copilot activity logs for signs of exploitation. Consider temporarily restricting Copilot access if the fix isn't confirmed.

Why it matters

An authorized user (including a compromised account) can escalate to arbitrary code execution in your M365 Copilot environment.

Source

Microsoft Security Response Center

The Appriss Insights (Equifax) VINE victim notification applications have an authentication bypass that lets an unauthenticated attacker skip the login page entirely, steal other users' credentials, take over accounts, and dump sensitive PII from the database. CVSS 9.8. If you operate or integrate with VINE, this is a full compromise scenario with real PII exposure risk.

Affected estate

Anyone operating or hosting Appriss Insights (Equifax) VINE applications, and government or criminal justice agencies that integrate with VINE

How to check

Identify any VINE application instances in your environment. Check with your vendor contact for the current version and whether the patch has been applied.

Included because

unauthenticated; authentication bypass; PII exposure; database dump; CVSS 9.8

Action

Apply the vendor-supplied fix. If the fix isn't available yet, take the application offline or restrict public access. Audit database and access logs for unauthorized queries or credential harvesting.

Why it matters

Unauthenticated attackers can bypass login, steal credentials, take over accounts, and dump sensitive PII including victim notification data.

Source

CVE listing / Appriss Insights advisory

The web console (odh-dashboard) in Red Hat OpenShift AI binds to the wrong network interface, letting any attacker inside the cluster bypass authentication by passing an arbitrary access token. From there they can impersonate any user, hit the Kubernetes API, run code, and escalate privileges. CVSS 8.8. The attacker needs to already be inside the cluster, so this isn't internet-facing, but any compromised pod or rogue workload can exploit it.

Affected estate

Anyone running Red Hat OpenShift AI (RHOAI) with the odh-dashboard component

How to check

Run 'oc get pods -n redhat-ods-applications' (or your RHOAI namespace) to confirm odh-dashboard is deployed. Check the image tag or version against Red Hat's advisory to see if you're running a vulnerable build.

Included because

authentication bypass; privilege escalation; Kubernetes API access; CVSS 8.8

Action

Update the odh-dashboard component to the patched version from Red Hat. Audit Kubernetes API server logs for unusual impersonation or token-based access.

Why it matters

Any workload in the cluster can impersonate any user and access the Kubernetes API with full privileges, turning a low-privilege pod compromise into a full cluster takeover.

Source

Red Hat Security Advisory

The eRoom WordPress plugin (versions 1.7.1 and earlier) has a SQL injection vulnerability that any user with Contributor-level access can exploit. CVSS 8.5. An attacker needs a low-privilege WordPress account, but once they have one, they can read or modify your database directly. If you allow user registrations or have untrusted Contributors, this is a real risk.

Affected estate

WordPress site operators using the eRoom plugin version 1.7.1 or earlier

How to check

In the WordPress admin dashboard, go to Plugins and check the eRoom version. Alternatively, check wp-content/plugins/eroom/ for the plugin's readme or version file.

Included because

SQL injection; low-privilege authenticated; common CMS platform; CVSS 8.5

Action

Update eRoom to the latest version above 1.7.1. If no patched version exists, deactivate and remove the plugin. Audit your WordPress user list for unnecessary Contributor accounts.

Why it matters

Any Contributor-level user can run arbitrary SQL queries against your WordPress database, potentially dumping credentials and sensitive data.

Source

WordPress plugin advisory / NVD