watchTowr

2026, the year of the AI-driven attacker that could do back flips, they said.

Meanwhile, there's a magic number that allows Auth Bypass against Ivanti EPM (CVE-2026-1603)

something about a pledge 🙄

~150 S3 abandoned buckets. 8M+ requests. Two months. Software updates, binaries, VMs and more.

This week, AWS rolled out namespaces for new S3 buckets - finally.

This is why offensive security research is so important - to move the needle.

https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/

whoever bought http://a-fun-hostname-for-f5-to-mark-as-an-ioc.com and redirected it to our blog post - please reach out, we love you

speak soon

The Internet is falling down, falling down, falling down

Welcome back to another disaster - this time, an Auth Bypass in cPanel/WHM, tracked as CVE-2026-41940

Enjoy with us..
https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

What number CitrixBleed are we on?

Join us, yet again, for part 2 of our analysis of Citrix NetScaler CVE-2026-3055 - which now appears to be multiple vulnerabilities bundled into one.

Sigh.

https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2

Someone knows Bash disgustingly well, and we love it.

Here's our analysis of the Ivanti EPMM Pre-Auth RCE vulnerabilities - CVE-2026-1281 & CVE-2026-1340.

This research fuels our technology, enabling our clients to accurately determine their exposure.

https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340

speak next week friends

Happy weekend! Enjoy our analysis of CVE-2026-3055 - yet another 'Memory Overread' vulnerability in Citrix NetScaler appliances.

https://labs.watchtowr.com/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread

🫡 We’re back.

Today, we’re publishing vulnerabilities we discovered, disclosed, and chained to achieve pre-auth RCE against Progress ShareFile.

Enjoy the journey with us, while you sob into your hands 🫠

https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/

ugh, speak soon

while we’re eating our best writing crayons and using finger paint to finish our latest research, we’ve decided to take this opportunity to share research from the archives with new followers 🙂

happy Friday… for now 🥹

https://labs.watchtowr.com/we-spent-20-to-achieve-rce-and-accidentally-became-the-admins-of-mobi/

(Yes this is not new don’t @ us)

CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services are enabled) was fun to reproduce and load into the watchTowr Platform.

Our friends @ @HacktronAI are publishing their analysis this week, so we won’t be publishing. Looking forward to it 🚀

Earlier this month, we reported a zero-day auth. bypass in the SmarterTools SmarterMail email solution.

Someone has reversed the patch (released on 15th Jan) and begun exploiting it in the wild.

Read our analysis and please, ASSUME BREACH + PATCH NOW.

https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/

In 2025, we achieved pre-auth RCE against another solution in a ransomware gang favourite category. Today, we finally click publish.

Join us as we walk through a chain of vulnerabilities we identified in BMC’s FootPrints ITSM solution.

Enjoy!

https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/

watchTowr Intel is detecting active reconnaissance against NetScalers for CVE-2026-3055 through our Attacker Eye honeypot network.

Exploitation is likely imminent. Patch now.

watchTowr clients already have access to internal mechanisms to confidently identify their exposure.

Can you feel it too?

Join us today for our analysis of Juniper's recent pre-auth RCE - CVE-2026-21902 - affecting a very specific set of devices. Curious?

https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

It's Monday! We are currently rapidly reacting to CVE-2026-3055 - yet another unauth memory overread vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances.

Active watchTowr Platform clients have been made aware of their exposure - reach out for support.

we're stuck in a blizzard, which means one thing - a watchTowr Labs blogpost is imminent.

in other news, we're at WT-2026-0030 for "impactful 0days reported in 2026"
https://labs.watchtowr.com/disclosed-vulnerabilities/

later, nerdz

🚨The watchTowr Platform has autonomously deployed Active Defense mitigation rules into client envs for the currently exploited in-the-wild Fortinet FortiClient EMS zero-day, now tracked as CVE-2026-35616.

If you need support, please reach out directly or via our website.

We are currently rapidly reacting to cPanel Authentication Bypass Vulnerability, a security flaw that allows attackers to bypass authentication mechanisms affecting cPanel & WHM.
Active watchTowr Platform clients have been made aware of their exposure. Reach out for support.

The watchTowr team will be at VulnCon in Scottsdale next week!

Come find us to discuss how the watchTowr Platform, our Preemptive Exposure Management technology, helps organizations rapidly react to emerging threats, validate real-world exposure, and mitigate risk.

And, we're back - analyzing CVE-2025-52691, a pre-auth RCE in SmarterTools SmarterMail mail server solution.

Speak soon (:^)) and enjoy..

https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertools-smartermail-pre-auth-rce-cve-2025-52691/

🚨 The watchTowr team is rapidly reacting to CVE-2026-1281 & CVE-2026-1340 - unauth RCE vulnerabilities within Ivanti's Endpoint Manager Mobile (EPMM).

Active watchTowr Platform clients have been made aware of their exposure - reach out via the watchTowr website for support.

Rapid reaction gets you ahead. 6 days before CISA added CVE-2026-3055 to KEV, a Citrix NetScaler Memory Overread (CitrixBleed++) vulnerability, watchTowr clients were aware of their exposure.

Reach out via our website if you need support.

Rapid reaction gets you ahead.

1 day before CISA added CVE-2026-41940 to KEV, an Authentication Bypass vulnerability in cPanel & WHM, watchTowr clients were aware of their exposure.

Reach out via our website if you need support.

What's new is old, and what's old is new - as is relentlessly proven.

Join us in our analysis of CVE-2026-32746, the recent pre-auth RCE in inteutils' Telnetd.

Speak soon.

https://labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746

@cR0w@infosec.exchange we don’t eat red

🎄 As we near Christmas, on behalf of the watchTowr team, we want to wish all of our friends, industry colleagues, clients, and partners a happy Christmas! 🚀

We're looking for new colleagues to join the phorce to work on "Project Red", our autonomous, LLM-driven N-day reproduction and 0-day discovery capability.

We're having fun, we promise ;-)

https://careers.watchtowr.com/jobs/7629309-ai-vulnerability-research-engineer

Rapid reaction gets you ahead. 67 days before CISA added CVE-2026-21643 (Fortinet FortiClientEMS SQL Injection) to KEV, watchTowr clients were aware of their exposure.

Reach out via our website if you need support.

@da_667@infosec.exchange

Rapid reaction gets you ahead. 4 days before CISA added CVE-2026-33017 (Langflow RCE) to KEV, watchTowr clients were already aware of their exposure.

Reach out via our website (watchTowr.com) if you need support.