FlagThis — Daily Cybersecurity Intelligence Briefing

CVE-2024-28995 is a high-severity path traversal vulnerability in SolarWinds Serv-U (versions 15.4.2 HF 1 and prior) that allows unauthenticated remote attackers to read arbitrary files from the host system. The flaw exists in the BuildLocalPath method due to improper validation of the InternalDir and InternalFile parameters, enabling attackers to bypass directory restrictions via crafted GET requests. Given confirmed active exploitation by both automated scanners and manual threat actors, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 17, 2024. Immediate remediation via upgrade to version 15.4.2 HF 2 is required to prevent sensitive system data exfiltration.

CVE-2026-20262 is a path traversal vulnerability in the Web UI of Cisco Catalyst SD-WAN Manager that allows authenticated remote attackers to create or overwrite arbitrary files on the underlying Linux operating system. By utilizing directory traversal sequences (e.g., ../) in HTTP requests, attackers can achieve root privilege escalation, enabling full control over the SD-WAN orchestration layer. This vulnerability is currently weaponized and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation facilitates network-wide compromise, traffic redirection, and persistent backdoor installation via the modification of system binaries or startup scripts.

CVE-2026-41124 is a critical path traversal vulnerability (CWE-22) affecting the Dell PowerProtect Data Domain management interface and API. Attackers can utilize directory traversal sequences (e.g., ../) to bypass restricted directory boundaries, granting unauthorized access to sensitive system files, credential stores, and configuration binaries. This flaw allows an attacker to escalate privileges from a low-privileged or unauthenticated state to administrative or root-level control. Because Data Domain appliances are central to enterprise backup and disaster recovery, this vulnerability poses a severe risk to data availability, potentially enabling threat actors to destroy backup repositories to ensure ransomware success. Remediation is available via Dell Security Advisory DSA-2026-278.