CVE Watch8 sept 2026

CVE-2026-77103

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 8 sept 2026 · Última mod.: 8 sept 2026 · CWE-288

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

Referencias oficiales

documentation.commvault.comhttps://documentation.commvault.com/securityadvisories/CV_2026_08_5.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-835278.1 ALT

—

———An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.7h CVE-2026-626508.8 ALT

—

——0A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.4h CVE-2026-761697.5 ALT

42.8%

——13fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.4h CVE-2026-629169.1 CRÍ

45.7%

——14Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.6h CVE-2026-847777.4 ALT

14.9%

——4Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.5d CVE-2026-811683.7 BAJ

26.4%

——8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.6d