CVE Watch11 oct 2026

CVE-2026-33272

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default admini

CVSS

4.9

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 9 oct 2026 · Última mod.: 11 oct 2026 · CWE-288

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-10-102026-10-23

Descripción técnica

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-7985010.0 CRÍ

33.1%

——10No description provided17h CVE-2026-7984410.0 CRÍ

33.1%

——10No description provided17h CVE-2026-1147326.8 MED

28.4%

——9Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.2d CVE-2026-963873.8 BAJ

9.5%

——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.1d CVE-2026-963856.5 MED

10.7%

——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.1d CVE-2026-84923—

15.8%

——5Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.2d