Smart-Grid Auth Bypass Leads Critical Flaws

CISA flagged a critical authentication bypass in the Hubbell Aclara Metrum Cellular Web Interface (CVE-2026-1840) that exposes smart-grid infrastructure to remote takeover. The industrial web interface for Aclara's cellular-connected utility meters ships with zero authentication controls on critical system functions, allowing an unauthenticated attacker to alter operational parameters, exfiltrate configuration data, and potentially pivot into the broader AMI (Advanced Metering Infrastructure) network. CISA's advisory notes the device is used across North American electric, gas, and water utilities. No patch or mitigation has been released by Hubbell, leaving critical infrastructure operators exposed. As CISA reported, the vulnerability carries a CVSS 7.5 and requires network access to the device's web interface, which in many deployments is exposed on internal OT networks or, worse, inadvertently internet-facing.

OpenDJ's JMX RMI connector harbors a critical unauthenticated deserialization flaw (CVE-2026-46495) that grants remote code execution on the identity server. The vulnerability stems from a CWE-502 deserialization of untrusted data in the JMX RMI endpoint, enabling an unauthenticated remote attacker to send crafted Java objects that execute arbitrary code on the server. OpenDJ is widely deployed as a directory service and identity store in enterprise and government environments. Given that JMX RMI is typically bound to a management port, the attack surface is significant in deployments that expose the RMI port to internal networks. No patch details have been released; operators should immediately restrict network access to the JMX RMI port and monitor for exploitation attempts.

A critical OAuth 2.0 / OpenID Connect endpoint flaw (CVE-2026-44203) enables HTML injection via the form_post response mode, potentially leading to credential theft and session hijacking. The authorization endpoint fails to sanitize user-supplied parameters before embedding them into the HTML response generated for the form_post mode. An attacker can craft a malicious authorization request that, when processed, injects arbitrary HTML or JavaScript into the response page rendered in the victim's browser. This opens the door to phishing attacks that steal authorization codes, tokens, or credentials. The vulnerability affects any OIDC-compliant deployment using form_post — a common configuration for single-page applications and mobile clients. Operators should review their authorization server's parameter handling and consider disabling form_post until a patch is available.

The Budibase low-code platform disclosed a critical chain of vulnerabilities (CVE-2026-54352, CVE-2026-54351, CVE-2026-50137, CVE-2026-54353) that together allow unauthenticated attackers to achieve remote code execution and pivot to internal networks. The most severe, CVE-2026-54352, involves a zip-symlink vulnerability in the /api/pwa/process-zip endpoint that lets a builder-uploaded archive escape the extraction directory and overwrite arbitrary server files, leading to RCE. Separately, CVE-2026-54351 exploits a mass-assignment flaw in the public webhook trigger endpoint to overwrite automation parameters, while CVE-2026-50137 enables unauthenticated attachment URL fetching that can be abused for SSRF. Finally, CVE-2026-54353 allows authenticated users with automation permissions to bypass the SSRF blacklist via DNS rebinding. Budibase is used by thousands of organizations to build internal tools rapidly; the attack surface is broad because the webhook endpoint is public by design. No patches have been released; operators should restrict network exposure and audit automation configurations.

A critical XWiki syntax injection vulnerability (CVE-2026-44179) in the excerpt-include macro allows attackers to execute arbitrary content with the macro's privileges. The flaw arises because the macro does not properly escape the title of the included page before processing it, enabling XWiki syntax injection. An attacker who can create or modify a page title can inject malicious wiki macros that execute with the rights of the macro — potentially leading to data exfiltration, privilege escalation, or server-side code execution. XWiki is a popular open-source wiki platform used by enterprises for documentation and collaboration. The vulnerability is particularly dangerous in multi-tenant XWiki instances where any authenticated user can create pages. Administrators should upgrade to the latest patched version and review page creation permissions.

The Mise dev-tool version manager contains a critical command injection vulnerability (CVE-2026-33646) via .tool-versions files processed through the Tera template engine. Mise parses .tool-versions files using the Tera engine with the exec() function registered, enabling arbitrary command execution when a user runs mise in a directory containing a malicious .tool-versions file. Unlike .mise.toml files, .tool-versions files are not subject to sandbox restrictions, making this a straightforward supply-chain or social-engineering attack vector. Mise is widely adopted in the Rust and Node.js ecosystems as a replacement for asdf. An attacker who compromises a popular repository or tricks a developer into cloning a malicious project can achieve code execution on the developer's machine. Users should avoid running mise in untrusted directories and pin their .tool-versions files to known-safe content.