VulnCheck added this CVE to its known-exploited catalog today while a weaponized public exploit script is already available, so any internet-facing Web Help Desk instance still on 12.8.8 HF1 or below can be compromised without credentials by anyone who copies the script.
SolarWinds Web Help Desk deserializes untrusted data in a way that lets a remote attacker run commands on the host machine without any authentication. All versions up to and including 12.8.8 HF1 are affected, and a public exploit script from watchTowr is available.
Affected: SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions
How to Test
Confirm the installed Web Help Desk version — anything at or below 12.8.8 HF1 is vulnerable. Review web server and application logs on the Web Help Desk host for unexpected POST requests and for command execution or child processes spawned by the Web Help Desk service, and treat any internet-exposed unpatched instance as potentially compromised.
How to Patch
Upgrade to SolarWinds Web Help Desk 12.8.8 HF2 or to the Web Help Desk 2026.1 release, both of which fix the deserialization flaw per the SolarWinds advisory. Until upgraded, restrict network access to the Web Help Desk web interface so it is not reachable from the internet.
SecurityWeek reported today that exploitation of this authentication bypass began just days after its August 28 disclosure, so teams that delay patching risk an unauthenticated attacker gaining full administrative control of their artifact repository and poisoning their software supply chain.
An authentication weakness in Artifactory under default configuration allows an unauthenticated attacker with network access to obtain administrative privileges. Administrative control over an artifact repository lets an attacker tamper with or replace hosted packages, making this a direct software supply-chain risk.
Affected: JFrog Artifactory < 7.111.21; JFrog Artifactory 7.117.0 – 7.117.27; JFrog Artifactory 7.125.0 – 7.125.19; JFrog Artifactory 7.133.0 – 7.133.28; JFrog Artifactory 7.146.0 – 7.146.36 (fixed in 7.146.38); JFrog Artifactory 7.161.0 – 7.161.19
How to Test
Confirm your self-managed Artifactory version against the affected ranges (below 7.111.21, or the 7.117, 7.125, 7.133, 7.146, and 7.161 lines before their fixed builds). Audit for unexpected administrative accounts, new access tokens, permission changes, and recently modified or uploaded artifacts, and review access logs for unauthenticated requests that resulted in privileged actions.
How to Patch
Upgrade to the fixed release for your line — 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 or later — per JFrog's security advisory. Until upgraded, restrict network access to the Artifactory instance so it is not reachable from untrusted networks.
VulnCheck added this flaw to its known-exploited catalog on 2026-08-31 on the back of Patchstack's exploitation report, and any site still running the plugin at 4.4.1 or below is exposed to unauthenticated webshell uploads.
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions up to and including 4.4.1) allows unauthenticated upload of files with dangerous types, which on a WordPress site translates directly to remote code execution via a planted PHP file. The CVSS 10.0 vector requires no privileges and no user interaction.
Affected: WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.1
How to Test
Check the installed plugin version in the WordPress admin (the plugin slug is gdpr-cookie-consent) and confirm whether it is 4.4.1 or lower; review wp-content/uploads and other writable directories for unexpected PHP or executable files, and inspect web server access logs for anomalous unauthenticated POST requests hitting the plugin's upload handling.
How to Mitigate
No fixed release is cited in the available evidence for versions through 4.4.1, so deactivate and remove the plugin until the vendor ships an update above 4.4.1; Patchstack offers a virtual-patch mitigation for subscribers. If a compromise indicator is found, treat the site as breached and rotate credentials.the plugin should only be re-enabled once a fixed version is confirmed.
VulnCheck added this flaw to its known-exploited catalog on 2026-08-31 citing Patchstack's exploitation report, and stores running 2.2.3 or below can have attackers grant themselves privileged roles with a single unauthenticated checkout request.
Versions up to and including 2.2.3 accept an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persist it in order meta, and pass it straight to WP_User::add_role() when the order completes. An unauthenticated attacker can thereby assign themselves an arbitrary role, including administrator, on the target store.
Affected: Addify Custom User Registration Fields for WooCommerce <= 2.2.3
How to Test
Confirm whether the installed plugin version is 2.2.3 or lower; audit recent order meta for unexpected afreg_select_user_role values, review the user table for newly created or recently modified accounts holding administrator or other privileged roles, and check access logs for unauthenticated POSTs to /wc/store/v1/checkout carrying role parameters.
How to Mitigate
No fixed release is cited in the available evidence for versions through 2.2.3, so deactivate the plugin until the vendor publishes an update above 2.2.3; in the meantime remove any unexpected privileged accounts and rotate administrator credentials if suspicious role assignments are found.
Horizon3 published a disclosure today reporting observed active exploitation of this flaw, so teams running unpatched Switchvox systems face unauthenticated remote compromise if they do not update or restrict access now.
The /pa endpoint of Switchvox SMB Edition concatenates the user-controlled PhoneIP value from submitted XML directly into PostgreSQL queries without sanitization. A single crafted unauthenticated request can execute arbitrary SQL against the backend database, including operations that lead to remote code execution on the appliance.
Affected: Sangoma Switchvox SMB Edition >= 8.3 (104997) and < 8.4.0.2
How to Test
Check the Switchvox version — anything from 8.3 (104997) up to but not including 8.4.0.2 (105309) is vulnerable. Review web access logs for crafted XML POST requests to the /pa endpoint, especially those containing anomalous or SQL-syntax content in the PhoneIP field, and verify whether the appliance's web interface is reachable from the internet.
How to Patch
Update to Switchvox version 8.4.0.2 (105309), which resolves the SQL injection per Sangoma's release notes; note that Sangoma's 8.0.1 release notes contain important prerequisites for updating from 7.9.5.2 to 8.x. Until patched, block internet access to the Switchvox web interface, including the /pa endpoint.