PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 78 By PatchDayAlert

FortiWeb auth bypass, two 9.9 Kubernetes privescs, and a zero-auth Android takeover

FortiWeb lets anyone log in with any credentials (CVE-2026-26035, CVSS 9.8). Two CVSS 9.9 bugs in Red Hat MCE and RHACM let namespace-scoped users escalate to full cluster compromise. Microsoft's UFO framework exposes unauthenticated device control on two open ports.

Patch now
1
Within 24h
3
This week
1
Exploited
0
Red Hat MCECluster Curator ControllerLinuxCloudRed Hat ACMMulticloud Operators SubscriptionFortinet FortiWebNetwork ApplianceUpSnapWindowsMicrosoft UFO

Five CVSS 9.4+ entries today and none of them are small. The one that should make you move fastest: CVE-2026-26035 is a full authentication bypass in FortiWeb where literally any username and password combo grants admin access. If your FortiWeb management interface is internet-facing, lock it down right now. The rest of the list is ugly too: two Red Hat multicluster privilege escalations, a command injection in UpSnap, and a zero-auth remote control bug in Microsoft's UFO framework.

Today's CVEs

Sorted by urgency

01

CVE-2026-73268

NVD
9.9
CVSS
Patch within 24h CRITICAL
Red Hat MCECluster Curator ControllerLinuxCloud

A tenant who can create or update ClusterCurator resources in multicluster engine (MCE) can inject a custom Job spec that runs with the controller's elevated privileges. That means arbitrary code execution at the controller level, with access to cluster-wide secrets. The attacker needs existing create/update permissions on ClusterCurator CRs, but from there it's a straight privilege escalation to full cluster compromise.

Affected estate
Anyone running Red Hat multicluster engine (MCE) with multi-tenant access to ClusterCurator resources
How to check
Check the running image tag of the cluster-curator-controller pod in your MCE namespace. Review any ClusterCurator CRs for spec.install.overrideJob fields with unexpected Job specs.
Included because
CVSS 9.9; privilege escalation; multi-tenant Kubernetes environments; cluster-wide secret exposure
Action
Update cluster-curator-controller to the patched release from Red Hat. Review and restrict RBAC for ClusterCurator create/update permissions.
Why it matters
A tenant with moderate permissions can escalate to full cluster admin and read every secret in the cluster.
Source
Red Hat advisory

Evidence trail

02

CVE-2026-72508

NVD
9.9
CVSS
Patch within 24h CRITICAL
Red Hat ACMMulticloud Operators SubscriptionLinuxCloud

A namespace-scoped admin in RHACM can create Subscription Custom Resources that piggyback on a highly privileged ServiceAccount. This confused-deputy attack lets them deploy arbitrary cluster-scoped resources, effectively escalating from namespace admin to full cluster control. No special tooling required: just the ability to create Subscription CRs in your namespace.

Affected estate
Anyone running Red Hat Advanced Cluster Management (RHACM) with multi-tenant namespaces
How to check
Check the running image version of multicloud-operators-subscription pods. Review Subscription CRs across tenant namespaces for references to cluster-scoped resources.
Included because
CVSS 9.9; privilege escalation; confused-deputy pattern; multi-tenant Kubernetes clusters
Action
Apply the patched RHACM release. Audit and tighten RBAC for Subscription CR creation in tenant namespaces.
Why it matters
A namespace admin can silently escalate to cluster admin and deploy anything cluster-wide.
Source
Red Hat advisory

Evidence trail

03

CVE-2026-26035

NVD
9.8
CVSS
Patch now CRITICAL
Fortinet FortiWebNetwork Appliance

An authentication bypass in FortiWeb lets a remote, unauthenticated attacker log into the GUI or CLI with any random username and password. That's not a typo: any credentials work. If your FortiWeb management interface is reachable, an attacker has full admin access right now.

Affected estate
Anyone running Fortinet FortiWeb 7.0.x through 7.0.12, 7.2.x through 7.2.12, 7.4.x through 7.4.11, 7.6.x through 7.6.6, or 8.0.x through 8.0.2
How to check
Run 'get system status' on the FortiWeb CLI or check the firmware version in the GUI dashboard. Verify whether the management interface (HTTPS/SSH) is exposed to untrusted networks.
Included because
CVSS 9.8; unauthenticated; internet-facing; complete auth bypass; common network appliance
Action
Upgrade FortiWeb to the fixed firmware version per Fortinet's advisory. As an interim step, restrict management access to trusted source IPs via firewall rules or local-in policies.
Why it matters
Complete authentication bypass on an internet-facing WAF gives an attacker full administrative control of the appliance and visibility into all protected traffic.
Source
Fortinet advisory

Evidence trail

04

CVE-2026-49481

NVD
9.6
CVSS
Patch this week CRITICAL
UpSnapLinuxWindows

UpSnap, the wake-on-LAN web app, has an OS command injection bug in its device management. The IP and MAC fields in wake/shutdown command templates aren't sanitized, so a low-privileged user who can create or edit devices can inject arbitrary shell commands. Those commands run as the UpSnap service account on the host OS.

Affected estate
Anyone running UpSnap versions prior to 5.4.0 on Linux or Windows
How to check
Check the UpSnap version in the web UI footer or application release notes. Review device records for unusual characters in IP and MAC fields.
Included because
CVSS 9.6; authenticated RCE; command injection; low-privilege user sufficient
Action
Update UpSnap to 5.4.0. Audit existing device entries for injected commands.
Why it matters
An authenticated user with basic device permissions can run arbitrary OS commands on the server hosting UpSnap.
Source
UpSnap GitHub advisory

Evidence trail

05

CVE-2026-73296

NVD
9.4
CVSS
Patch within 24h CRITICAL
Microsoft UFOLinuxWindows

Microsoft's UFO automation framework exposes two HTTP services on TCP ports 8020 and 8021 with zero authentication. Any remote attacker who can reach those ports can take screenshots, read the UI tree, tap, swipe, type text, launch apps, and press keys on any ADB-connected Android device. Full remote control of the device, no credentials needed.

Affected estate
Anyone running Microsoft UFO framework versions prior to 3.0.8 with mobile MCP servers enabled
How to check
Check whether TCP ports 8020 or 8021 are listening on the host (e.g., 'ss -tlnp | grep 802' on Linux or 'netstat -an | findstr 802' on Windows). Verify the UFO version in the project's configuration or release metadata.
Included because
CVSS 9.4; unauthenticated; network-accessible; full device control; data disclosure
Action
Upgrade to UFO 3.0.8. As a workaround, firewall off ports 8020 and 8021 from untrusted networks immediately.
Why it matters
Unauthenticated remote access to connected Android devices lets an attacker steal screen data, exfiltrate information, and control the device.
Source
Microsoft UFO GitHub advisory

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →