Security Research
CVE-2026-45504 Microsoft Exchange SSRF via File Read
As the HawkTrace team, we have analyzed a server-side request forgery vulnerability affecting Microsoft Exchange that we discovered some time ago. This vulnerability allows an authenticated user to read arbitrary files from the Exchange server
Compromising caniasERP 8.03: Eight CVEs, One Unauthenticated RCE Chain
Eight zero-interaction vulnerabilities in Industrial Application Software caniasERP 8.03 — from unauthenticated session enumeration to full OS command execution via a Java RMI session hijack chain.
cPanel & Threat Actors nuclear
CVE-2026-41940 In the past 48 hours, HawkTrace captured a notable incident in which two threat actors with very different profiles ended up sharing the same compromised host, and eventually turning on each other.
ibWebAdmin Unauthenticated RCE
A technical advisory for ibWebAdmin authentication bypass via session initialization and panel manipulation leading to remote code execution through command injection.
CVE-2025-59287 WSUS Unauthenticated RCE
A technical WSUS advisory for CVE-2025-59287: unauthenticated unsafe deserialization in Windows Server Update Services that allows remote code execution.
CVE-2025-59287 WSUS Remote Code Execution
A technical WSUS advisory for CVE-2025-59287: unsafe deserialization in Windows Server Update Services that allows remote code execution.
CVE-2025-53772 IIS WebDeploy RCE
A detailed technical analysis and research notes on the vulnerability in msdeployagentservice and msdeploy.axd endpoints of Microsoft Web Deploy, where unsafe deserialization of HTTP header contents allows an authenticated attacker to perform remote code execution.
CVE-2024-12106 WhatsUpGold Pre-Auth
Security research on WhatsUpGold LDAP authentication vulnerability enabling pre-authentication exploitation and credential theft.
Showing 8 of 9 posts