The Curious Engineer

All blogs / Security

watchTowr Labs

labs.watchtowr.com

watchTowr Labs is the epicentre of offensive security expertise at watchTowr - where research, innovation, and real attacker insight power our Preemptive Exposure Management technology.

SecurityReverse engineering

’22’23’24’25’26
Posts
103 from 1 Jul 2022 to 9 Oct 2026
Posting
weekly (28 in the last year)
Kind
company blog
Feed
https://labs.watchtowr.com/rss/

2026 23

  1. Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
  2. You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
  3. Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
  4. Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
  5. Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)
  6. You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
  7. It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)
  8. CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)
  9. Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
  10. Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)
  11. Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)
  12. More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)
  13. The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)
  14. You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)
  15. Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)
  16. The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread)
  17. A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)
  18. The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)
  19. Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE)
  20. Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))
  21. Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340)
  22. Attackers With Decompilers Strike Again (SmarterTools SmarterMail WT-2026-0001 Auth Bypass)
  23. Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691)

2025 34

  1. SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL
  2. Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)
  3. When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446)
  4. Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101)
  5. What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299)
  6. yIKEs (WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242)
  7. More Than DoS (Progress Telerik UI for ASP.NET AJAX Unsafe Reflection CVE-2025-3600)
  8. Well, Well, Well. It’s Another Day. (Oracle E-Business Suite Pre-Auth RCE Chain - CVE-2025-61882)
  9. It's Never Simple Until It Is (Dell UnityVSA Pre-Auth Command Injection CVE-2025-36604)
  10. It Is Bad (Exploitation of Fortra GoAnywhere MFT CVE-2025-10035) - Part 2
  11. Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)
  12. You Already Have Our Personal Data, Take Our Phone Calls Too (FreePBX CVE-2025-57819)
  13. Cache Me If You Can (Sitecore Experience Platform Cache Poisoning to RCE)
  14. The One Where We Just Steal The Vulnerabilities (CrushFTP CVE-2025-54309)
  15. Guess Who Would Be Stupid Enough To Rob The Same Vault Twice? Pre-Auth RCE Chains in Commvault
  16. Should Security Solutions Be Secure? Maybe We're All Wrong - Fortinet FortiSIEM Pre-Auth Command Injection (CVE-2025-25256)
  17. Stack Overflows, Heap Overflows, and Existential Dread (SonicWall SMA100 CVE-2025-40596, CVE-2025-40597 and CVE-2025-40598)
  18. Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257)
  19. How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777)
  20. Is b For Backdoor? Pre-Auth RCE Chain In Sitecore Experience Platform
  21. Expression Payloads Meet Mayhem - Ivanti EPMM Unauth RCE Chain (CVE-2025-4427 and CVE-2025-4428)
  22. SysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain (CVE-2025-2775 And Friends)
  23. SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475)
  24. Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028)
  25. Is The Sofistication In The Room With Us? - X-Forwarded-For and Ivanti Connect Secure (CVE-2025-22457)
  26. XSS To RCE By Abusing Custom File Handlers - Kentico Xperience CMS (CVE-2025-2748)
  27. By Executive Order, We Are Banning Blacklists - Domain-Level RCE in Veeam Backup & Replication (CVE-2025-23120)
  28. Bypassing Authentication Like It’s The ‘90s - Pre-Auth RCE Chain(s) in Kentico Xperience CMS
  29. The Best Security Is When We All Agree To Keep Everything Secret (Except The Secrets) - NAKIVO Backup & Replication (CVE-2024-48248)
  30. 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur
  31. Get FortiRekt, I Am The Super_Admin Now - Fortinet FortiOS Authentication Bypass CVE-2024-55591
  32. Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282)
  33. Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282)
  34. Backdooring Your Backdoors - Another $20 Domain, More Governments

2024 19

  1. Cleo Harmony, VLTrader, and LexiCom - RCE via Arbitrary File Write (CVE-2024-50623)
  2. Where There’s Smoke, There’s Fire - Mitel MiCollab CVE-2024-35286, CVE-2024-41713 And An 0day
  3. Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
  4. Hop-Skip-FortiJump-FortiJump-Higher - Fortinet FortiManager CVE-2024-47575
  5. Visionaries Have Democratised Remote Network Access - Citrix Virtual Apps and Desktops (CVE-2024-8068 and CVE-2024-8069)
  6. Fortinet FortiGate CVE-2024-23113 - A Super Complex Vulnerability In A Super Secure Appliance In 2024
  7. We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI
  8. Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711)
  9. Auth. Bypass In (Un)Limited Scenarios - Progress MOVEit Transfer (CVE-2024-5806)
  10. No Way, PHP Strikes Again! (CVE-2024-4577)
  11. Check Point - Wrong Check Point (CVE-2024-24919)
  12. QNAP QTS - QNAPping At The Wheel (CVE-2024-27130 and friends)
  13. Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)
  14. IBM QRadar - When The Attacker Controls Your Security Stack (CVE-2022-26377)
  15. “To live is to fight, to fight is to live! - IBM ODM Remote Code Execution
  16. Ivanti Connect Secure CVE-2024-22024 - Are We Now Part Of Ivanti?
  17. Form Tools Remote Code Execution: We Need To Talk About PHP
  18. The Second Wednesday Of The First Month Of Every Quarter: Juniper 0day Revisited
  19. Welcome To 2024, The SSLVPN Chaos Continues - Ivanti CVE-2023-46805 & CVE-2024-21887

2023 18

  1. XXE, You Can Depend On Me (OpenCMS CVE-2023-42344 and Friends)
  2. Ghost In The Wire, Sonic In The Wall - Adventures With SonicWall
  3. The Sky Has Not Yet Fallen - Curl (CVE-2023-38545)
  4. Yet More Unauth Remote Command Execution Vulns in Firewalls - Sangfor Edition
  5. 90s Vulns In 90s Software (Exim) - Is the Sky Falling?
  6. Orbeon Forms: The Final Form? On A Journey To RCE
  7. CVE-2023-36844 And Friends: RCE In Juniper Devices
  8. Log4Shell Is Dead! Long Live Log4Shell!
  9. Xortigate, or CVE-2023-27997 - The Rumoured RCE That Was
  10. Fortinet and The Accidental Bug
  11. GitLab Arbitrary File Read (CVE-2023-2825) Analysis
  12. Adobe Commerce (Magento) CVE-2022-24086 : Return Of The Text Interpolation
  13. ProjeQtOr - <10.2.2 Direct Object Injection Vulnerability
  14. What Does This Key Open? - Docker Container Images (4/4)
  15. Learning To Crawl (For DockerHub Enthusiasts, Not Toddlers) - Docker Container Images (3/4)
  16. Layer Cake: How Docker Handles Filesystem Access - Docker Container Images (2/4)
  17. "I don't need no zero-dayz" - Docker Container Images (1/4)
  18. We're Out Of Titles For VPN Vulns - It's Not Funny Anymore (Fortinet CVE-2022-42475)

2022 9

  1. Why It's Not Worth Goading Us On A Friday - CVE-2022-36537 At Scale
  2. Text4Shell++ - Where There’s Smoke, There’s Fire
  3. OpenSSL 3.0.7 - Otherwise Known As, The Hype That Was Not
  4. CVE-2022-44889 - Text4Shell Analysed
  5. Walled Off: Handling DNS Poisoning At Scale
  6. All Around The World: The Common Crawl Dataset
  7. The Perils of Expired Domains: We're Reading Your Email
  8. Seasons In The Abyss - Diving into OpenVPN Access Server
  9. watchTowr Labs - 1x Enterprise IAM vs 1x Slanty Line