CVE-2026-41103
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to el
CVSS
9.1
Critical
EPSS
5.4%
p93
KEV
—
Exploit Today
28
0-100
Published: May 12, 2026 · Last modified: Oct 26, 2026 · CWE-303
0.8%EPSS · 30 days5.4%
2026-10-062026-11-03
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-842966.8 MED27.4%
——8Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.5dCVE-2026-865895.4 MED17.0%
——5Incorrect implementation of authentication algorithm vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session
expires or is revoked.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.5dCVE-2026-890777.5 HIG40.2%
——12Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.16dCVE-2026-1049397.5 HIG31.7%
——10Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authentication can happen.
Impact
This vulnerability may allow remote attackers
unauthenticated
access to protected
paths. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.20dCVE-2026-839066.5 MED62.6%
——19Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network.6dCVE-2026-859727.4 HIG25.5%
——8Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.20d