FreeIPA 9.8: zero-to-admin with no credentials, plus JBoss deser is wide open

An authenticated SuperAdmin on SonicWall NSM On-Prem can inject OS commands through the management interface and get code execution on the underlying host. The auth requirement and SuperAdmin privilege bar limit the blast radius, but if an attacker compromises a SuperAdmin account (or one already exists as an insider threat), they own the box.

Affected estate

SonicWall NSM On-Prem operators who manage their firewall fleet through the local management console

How to check

Log into NSM On-Prem and check the version under System > About, or query the appliance via CLI. Cross-reference against SonicWall's advisory for affected versions.

Included because

CVSS 9.1; authenticated but post-auth RCE on management platform; common in MSP environments

Action

Upgrade NSM On-Prem to the fixed version. Audit SuperAdmin accounts, enforce MFA, and limit management interface exposure.

Why it matters

A compromised or rogue SuperAdmin account leads to full OS-level control of your firewall management platform.

Source

SonicWall advisory

JBoss EAP's Artemis messaging broker ships with deserialization wide open. The allow-list that's supposed to restrict which Java classes can be deserialized is empty by default, so every class passes the security check. Any attacker who can send a crafted ObjectMessage to a broker queue can run arbitrary code on the EAP server.

Affected estate

JBoss EAP operators using Artemis-based JMS messaging with ObjectMessage deserialization (the default config)

How to check

Review your EAP standalone.xml or domain.xml for the messaging-activemq subsystem. Look for 'deserialization-white-list' or 'deserialization-allowed-list' entries. If they're empty or absent, you're exposed.

Included because

CVSS 8.8; deserialization RCE; default-vulnerable config; widely deployed middleware

Action

Patch EAP to the fixed version. If you can't patch immediately, add an explicit deserialization allow-list containing only the classes your application actually needs.

Why it matters

Default-open deserialization is a classic RCE vector. Any message producer with queue access can pop your app server.

Source

Red Hat advisory

389 Directory Server's SELFDN ACI evaluator has a logic bug: it matches an anonymous (empty) bind DN against an empty attribute value, so unauthenticated LDAP clients can pass access control checks that were supposed to require a specific authenticated user. An anonymous client can add or modify directory entries protected by SELFDN ACIs.

Affected estate

Anyone running 389 Directory Server (standalone or as part of FreeIPA/Red Hat IdM) with SELFDN-based ACIs

How to check

Search for SELFDN ACIs: 'ldapsearch -x -b "cn=config" "(aci=*selfdn*)"'. Any results mean you have potentially affected access controls.

Included because

unauthenticated; CVSS 7.5; ACI bypass in core directory service; chains with CVE-2026-76578 for critical impact

Action

Patch 389 Directory Server. Review and tighten SELFDN ACIs. Block anonymous LDAP binds at the firewall if the patch isn't available yet.

Why it matters

Anonymous users can bypass intended access controls and modify directory entries, which is especially dangerous when chained with CVE-2026-76578 for full admin compromise.

Source

Red Hat / 389 Directory Server advisory

A SQL injection bug exists in the CommonController of jaychouchannel's Tourism-Management-System. An attacker can manipulate the table, column, xColumn, or yColumn parameters remotely to inject SQL. A public exploit is already available. This is a niche open-source project with no formal versioning.

Affected estate

Developers or operators running jaychouchannel Tourism-Management-System (a Java-based open-source project)

How to check

Check your git log for commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. If it's not present, you're running vulnerable code. Review CommonController.java for unparameterized SQL in the table/column/xColumn/yColumn arguments.

Included because

public exploit available; remotely exploitable SQL injection; CVSS 7.3; niche product limits broad relevance

Action

Apply the fix commit. If that's not feasible, block or sanitize user input to the affected parameters at the WAF or application layer.

Why it matters

A public exploit exists for this SQL injection, so any internet-facing instance is a target. The niche user base limits broad impact.