Forwarded Taiwan Computer Emergency Response Team/Coordination Center Security Information Alert TWCERTCC-200-202608-00000009
【CVE-2026-18556】N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVSS v4.0: 8.2)
【Whether Exploited by Ransomware: Unknown】 N-able N-central has an authentication bypass vulnerability, which allows attackers to bypass the verification mechanism by using an alternate path or channel.
【CVE-2026-18577】N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVSS v4.0: 8.2)
【Whether Exploited by Ransomware: Unknown】 N-able N-central has an authentication bypass vulnerability, which allows attackers to bypass the verification mechanism through an alternate path or channel, thereby taking over accounts in N-central. This vulnerability originates from an incomplete patch released for CVE-2026-18556.
【CVE-2026-34486】Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (CVSS v3.1: 7.5)
【Whether Exploited by Ransomware: Unknown】 Apache Tomcat has a missing encryption of sensitive data vulnerability, which allows attackers to bypass EncryptInterceptor. This vulnerability can be chained with CVE-2025-24813.
【CVE-2026-9198】IBM Langflow Code Injection Vulnerability (CVSS v3.1: 9.8)
【Whether Exploited by Ransomware: Unknown】 Langflow has a code injection vulnerability, which allows unauthenticated attackers to achieve full remote code execution in default Langflow deployment environments.
【CVE-2026-63077】JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (CVSS v3.1: 9.8)
【Whether Exploited by Ransomware: Unknown】 JetBrains TeamCity has a deserialization of untrusted data vulnerability, which allows attackers to remotely execute code without authentication through the agent polling protocol.
【CVE-2026-8037】Progress LoadMaster Command Injection Vulnerability (CVSS v3.1: 9.6)
【Whether Exploited by Ransomware: Unknown】 Progress LoadMaster has a command injection vulnerability, which allows unauthenticated attackers to execute arbitrary commands on LoadMaster devices by exploiting unsanitized input in multiple command endpoints.
[Impacted Platforms]
【CVE-2026-18556】Please refer to the versions listed as affected by the official source https://uptime.n-able.com/event/201522/
【CVE-2026-18577】Please refer to the versions listed as affected by the official source https://uptime.n-able.com/event/201522/
【CVE-2026-34486】Please refer to the versions listed as affected by the official source https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
【CVE-2026-9198】Please refer to the versions listed as affected by the official source https://www.ibm.com/support/pages/node/7278927
【CVE-2026-63077】JetBrains TeamCity versions prior to 2026.1.3, 2025.11.7
【CVE-2026-8037】Please refer to the versions listed as affected by the official source https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691
[Recommended Measures]
【CVE-2026-18556】The official source has released a security update for the vulnerability. Please update to the relevant version https://uptime.n-able.com/event/201522/
【CVE-2026-18577】The official source has released a security update for the vulnerability. Please update to the relevant version https://uptime.n-able.com/event/201522/
【CVE-2026-34486】The official source has released a security update for the vulnerability. Please update to the relevant version https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
【CVE-2026-9198】The official source has released a security update for the vulnerability. Please update to the relevant version https://www.ibm.com/support/pages/node/7278927
【CVE-2026-63077】The official source has released a security update for the vulnerability. Please update to the relevant version https://www.jetbrains.com/privacy-security/issues-fixed/
【CVE-2026-8037】The official source has released a security update for the vulnerability. Please update to the relevant version https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691