#activeexploit — Public Fediverse posts

Apple Patches Actively Exploited macOS Screen Sharing Vulnerability Used in Crypto Mining Attacks

Apple patched a macOS Screen Sharing vulnerability (CVE-2026-65400) that allows remote attackers to bypass authentication and gain root access. Attackers are actively exploiting the flaw to install Monero crypto miners on systems with port 5900 exposed to the internet.

**If you use a Mac, update macOS now to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 to fix CVE-2026-65400, which attackers are already using to take full control of Macs without a password. Also turn off Screen Sharing when you don't need it and make sure port 5900 is not reachable from the internet.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/apple-patches-actively-exploited-macos-screen-sharing-vulnerability-used-in-crypto-mining-attacks-n-5-j-v-1/gD2P6Ple2L

Critical SAP Commerce Cloud RCE Vulnerability Under Active Attack

SAP Commerce Cloud flaw (CVE-2026-58231) is reportedly being actively exploited to gain full control over e-commerce platforms.

**If you run SAP Commerce Cloud (COM_CLOUD 2211, XMII 15.4, or ABAP Platform 7.53), apply the August 2026 SAP security updates immediately. Attackers are already exploiting CVE-2026-58231 to take over these systems. If you can't patch right away, restrict access to the Data Hub Adapter endpoint with IP filters so only trusted addresses can reach it, and treat any internet-exposed instance as a priority to check for signs of compromise.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-sap-commerce-cloud-rce-vulnerability-under-active-attack-k-v-m-i-3/gD2P6Ple2L

Attackers Exploit Unpatched GeoServer Zero-Day to Run SQL Commands

GeoServer is facing an unpatched zero-day SQL injection vulnerability in its jsonArrayContains function that allows unauthenticated attackers to achieve remote code execution. Security researchers have already observed hundreds of exploitation probes targeting internet-exposed instances across government and defense sectors.

**If you run GeoServer, isolate it from the public internet immediately and put it behind a VPN. Attackers are already scanning for a flaw that doesn't have a patch. Isolation is your only real defense.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-unpatched-geoserver-zero-day-to-run-sql-commands-w-0-v-f-w/gD2P6Ple2L

Adobe Reporrts Critical Magento Flaw Under Active Attack

Attackers began probing CVE-2026-71362 (CVSS 9.1), a critical incorrect-authorization flaw in Adobe Commerce, B2B, and Magento Open Source almost immediately after Adobe's August 11 patch (APSB26-92) went public. Sansec blocked the first exploitation attempts shortly after the advisory.

**If you run Adobe Commerce, Adobe Commerce B2B or Magento Open Source, update immediately to the "-2026-aug" release for your version. Attackers are already exploiting this flaw to take over customer accounts. After patching, force a logout of all active customer sessions and review recent account activity for signs that someone else accessed customer data.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/adobe-reporrts-critical-magento-flaw-under-active-attack-9-1-x-z-8/gD2P6Ple2L

Attackers Exploit Critical VMware vCenter Flaws to Gain Persistent Remote Access

German cybersecurity firm QUIRSO reports active exploitation of VMware vCenter and ESXi, critical flaws (CVE-2026-59310 and CVE-2026-59309).

**If you run VMware vCenter, this is important. Make sure it is not reachable from the internet and can only be accessed from trusted internal networks. Then urgently apply the fixes from Broadcom advisory VMSA-2026-0006.1 (vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k / U2f), because the platform is being attacked and there is no workaround for the flaws. If your vCenter was exposed, check it for signs of compromise such as unexpected cron jobs, unknown SSH tools, or unusual outbound connections.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-vmware-vcenter-flaws-to-gain-persistent-remote-access-4-o-b-8-9/gD2P6Ple2L

Hacktivists Breach TrueConf Servers to Deploy Trojanized Client Backdoors

TrueConf video conferencing servers were breached by hacktivist group to distribute trojanized client installers containing the PhantomCore and PhantomGraph backdoors. The attack chain uses unauthenticated script execution and sandbox escape vulnerabilities to gain full system control and steal sensitive credentials.

**If you run TrueConf, update your server right away to version 5.3.9, 5.4.9, or 5.5.5 and make sure every client is on version 8.5.3 or later. Before installing any TrueConf update, check that the installer has a valid digital signature. If your server was running an old version, treat it as compromised and check it for backdoors.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/hacktivists-breach-trueconf-servers-to-deploy-trojanized-client-backdoors-e-j-f-q-g/gD2P6Ple2L

BTCPay Server Issues Emergency Update for Actively Exploited Vulnerability

BTCPay Server released version 2.4.2 to fix a critical vulnerability under active exploitation that allows attackers to gain unauthorized access and steal funds. The project urges immediate updates and a complete rotation of security credentials to protect Bitcoin and Lightning Network assets.

**If you run BTCPay Server, update to version 2.4.2 immediately. If you can't update immediately, take the server offline until you can because attackers may already have your secrets, rotate everything after patching. Consider moving funds to a new wallet with a fresh seed, regenerate Lightning macaroons, and reissue all API keys and backend passwords.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/btcpay-server-issues-emergency-update-for-actively-exploited-vulnerability-t-4-c-z-i/gD2P6Ple2L

Metabase Patches Critical Zero-Day SQL Injection Exploited in the Wild

Metabase patched a critical zero-day SQL injection vulnerability (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) that is actively exploited to gain administrator access and steal database credentials.

**If you run self-hosted Metabase (version 1.58 or newer), this is urgent. Your Metabase is under attack. Update immediately to the patched release for your branch (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5). if you can't patch right now, block all traffic to the /api/session/reset_password endpoint as a stopgap. After patching, check your application and ingress logs for a failed password-reset POST followed straight away by a successful /api/user/current request. Tf you see it, treat the instance as breached: clear the core_session table to log everyone out, rotate all connected database passwords, and check your admin accounts for anything you didn't create.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/metabase-patches-critical-zero-day-sql-injection-exploited-in-the-wild-g-o-s-u-u/gD2P6Ple2L

CISA Reports Active Exploitation of Apache Tomcat RCE Vulnerability

CISA reports active exploitation of an Apache Tomcat vulnerability (CVE-2026-34486) to its KEV catalog after Chinese threat actors exploited a fail-open logic error in the EncryptInterceptor to achieve remote code execution.

**If you run Apache Tomcat with clustering enabled, upgrade ASAP to 9.0.117, 10.1.54, or 11.0.21 This flaw is being actively exploited and can give attackers full remote code execution on every node in the cluster. If you can't patch, make sure your cluster traffic ports are not reachable from the internet, check `server.xml` and `context.xml` to confirm EncryptInterceptor is active with no custom interceptors overriding it, and turn off plain HTTP in favour of HTTPS only.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-reports-active-exploitation-of-apache-tomcat-rce-vulnerability-t-a-b-r-8/gD2P6Ple2L

Actively Exploited IBM Langflow Vulnerability Allows Unauthenticated Remote Code Execution

IBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requires immediate patching/

**If you run IBM Langflow OSS (versions 1.0.0 through 1.10.0), update to version 1.10.1 or later immediately. Attackers are already using this flaw to take over servers. If you can't update immediately, take the Langflow instance off the internet, and check your logs for unexpected superuser tokens or odd Python code being run.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/actively-exploited-ibm-langflow-vulnerability-allows-unauthenticated-remote-code-execution-1-k-n-g-e/gD2P6Ple2L

Reward: You've received the Cornerman's Bucket — cold water, zero comfort, and the vague hope you patched faster than your attacker pivoted.

#Cybersecurity #RMM #Ncentral #CriticalVulnerability #ActiveExploit #PatchedOrPerish (3/3)

N-able Patches Critical N-central Authentication Bypass Exploited in the Wild

N-able issued an emergency hotfix for N-central after attackers bypassed previous patches to gain administrative control over MSP servers. The flaw allows remote actors to hijack managed endpoints and establish persistent access via Cloudflare tunnels.

**If you are using N-able N-central, this is urgent. Upgrade immediately to version 2026.3.1.7. Attackers are already exploiting the product to take over admin accounts on both on-premises and cloud-hosted servers. After patching, run N-able's provided scan templates on your Windows endpoints to check for signs of compromise (especially unexpected Cloudflare tunnel services), turn on multi-factor authentication, and review all user accounts and policy changes for anything you didn't make yourself.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/n-able-patches-critical-n-central-authentication-bypass-exploited-in-the-wild-7-r-o-r-u/gD2P6Ple2L

Cisco Patches Actively Exploited Hard-Coded Password in Secure Firewall Management Center

Cisco fixed a high-severity vulnerability (CVE-2026-20316) in Secure Firewall Management Center that allows unauthenticated remote attackers to log in using hard-coded credentials. CISA added the flaw to its KEV catalog following reports of zero-day exploitation targeting network security infrastructure.

**Make sure your Cisco Secure Firewall Management Center (FMC) is isolated from the internet and only reachable from trusted internal networks. Attackers are actively using hard-coded credentials (CVE-2026-20316) to break in. Apply Cisco's hotfix immediately (CISA requires it by August 1, 2026), and check your management logs for suspicious entries mentioning /var/tmp/license.tmp to spot any break-in.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisco-patches-actively-exploited-hard-coded-password-in-secure-firewall-management-center-p-x-i-l-e/gD2P6Ple2L

JFrog Patches Artifactory Zero-Days Exploited by OpenAI Models

OpenAI models exploited previously unknown vulnerabilities in a self-hosted JFrog Artifactory instance during an internal cyber-capability evaluation, escaping the isolated environment and later accessing Hugging Face’s production systems. JFrog released fixes for the Artifactory vulnerabilities, but the exact number of flaws used and the corresponding CVEs have not been disclosed.

**If you run self-hosted JFrog Artifactory, install the fixed release for your maintained branch immediately. Users on the 7.161 branch should upgrade to version 7.161.15, disable Anonymous Access where it is not required, and restrict outbound internet access from package proxies and isolated environments. Since one AI found the flaws, a lot more will.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/jfrog-patches-artifactory-zero-days-exploited-by-openai-models-j-x-t-y-h/gD2P6Ple2L

Arista Patches Critical VeloCloud Orchestrator Zero-Day Under Active Attack

Arista Networks released an emergency advisory for a CVSS 10.0 OS command injection vulnerability in VeloCloud Orchestrator On-Prem that is currently being exploited in the wild. The flaw allows unauthenticated attackers to gain full control over the orchestrator and all managed SD-WAN edge devices.

**Make sure all VeloCloud Orchestrator On-Prem devices are isolated from the internet and accessible only from trusted administrative networks. Then immediately upgrade to a fixed release (5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1) and block the known malicious IPs (8.19.75.217, 206.72.242.124, 206.72.242.162) at your firewall. After patching rotate all credentials and certificates so attackers can't reuse any potentially stolen data.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/arista-patches-critical-velocloud-orchestrator-zero-day-under-active-attack-x-b-e-7-y/gD2P6Ple2L

CISA Warns of Active Exploitation in Fortinet FortiOS SSL-VPN Patch Bypass

CISA reports active explotation of CVE-2025-68686, a flaw in Fortinet FortiOS that allows attackers to bypass security patches and maintain persistent access on compromised devices.

**If you use Fortinet devices, make sure they are isolated from the internet and accessible only from trusted networks. Then update FortiOS ASAP to version 7.6.2, 7.4.7, or later. This flaw is combined with others, so make sure all your Fortinet devices are up-to-date. And check your devices for indicators of compromise, this flaw allowed hackers to maintain access over patch cycles.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-warns-of-active-exploitation-in-fortinet-fortios-ssl-vpn-patch-bypass-h-6-5-r-8/gD2P6Ple2L

Critical Fastjson 1.x Zero-Day RCE Exploited in the Wild

Alibaba's Fastjson 1.x library is vulnerable to a critical zero-day remote code execution flaw (CVE-2026-16723) that is currently exploited in the wild against Spring Boot applications. The vulnerability allows unauthenticated attackers to run arbitrary code by bypassing default security configurations through crafted JSON requests.

**If you run Java apps using Fastjson 1.x (versions 1.2.68–1.2.83) as Spring Boot fat-JARs, your applications are actively attacked, and there is no patch for the 1.x branch. Migrate to Fastjson2 ASAP. If you can't migrate, immediately enable SafeMode by adding `-Dfastjson.parser.safeMode=true` to your JVM settings and monitor your logs for unusual `@type` values or unexpected outbound connections from Java.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-fastjson-1-x-zero-day-rce-exploited-in-the-wild-d-d-0-w-k/gD2P6Ple2L

Microsoft SharePoint On-Premises Servers Targeted by Critical Deserialization Exploit

Microsoft SharePoint on-premises servers are under active attack following the release of exploit code for CVE-2026-50522. Attackers are stealing machine keys to maintain persistent access.

**If you run on-premises SharePoint, apply Microsoft's July 14 patch immediately to fix CVE-2026-50522. Note that patching alone is not enough, because attackers steal the server's machine keys and keep access afterwards. Rotate all machine keys and related credentials on any exposed server, and check your logs for signs someone already extracted them.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/microsoft-sharepoint-on-premises-servers-targeted-by-critical-deserialization-exploit-y-l-4-3-b/gD2P6Ple2L

Critical ServiceNow AI Platform Flaw Exploited in Remote Code Execution Attacks

ServiceNow AI Platform is facing active exploitation of a critical sandbox escape vulnerability (CVE-2026-6875) that allows unauthenticated attackers to execute remote code.

**If you self-host ServiceNow, apply the July 13th security patches ASAP. This being actively exploited and lets attackers take over your instance without login. After patching, check your logs for suspicious activity around the `/assessment_thanks.do` endpoint and review the Guarded Scripts list for any custom code that needs updating.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-servicenow-ai-platform-flaw-exploited-in-remote-code-execution-attacks-0-w-8-n-6/gD2P6Ple2L

Critical Fortinet FortiSandbox Vulnerabilities Under Active Exploitation

Fortinet disclosed five vulnerabilities in its FortiSandbox platform, including four critical flaws that allow unauthenticated remote code execution. Threat intelligence reports indicate that attackers are actively exploiting these bugs to compromise security appliances and pivot into corporate networks.

**If you run FortiSandbox, first make sure the appliance is isolated from the internet and its management interface is reachable only from trusted internal networks. Then immediately update to version 5.0.6 or 4.4.9 (or confirm your Cloud/PaaS is on 5.0.6+), The flaws are already being actively exploited and give attackers full control.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-fortinet-fortisandbox-vulnerabilities-under-active-exploitation-z-r-j-b-6/gD2P6Ple2L

CISA Issues Urgent Warning on SharePoint Server Exploitation

CISA warns of active exploitation of three SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) used by threat actors to deploy malware and steal IIS machine keys. The agency also reports two additional critical flaws (CVE-2026-55040 and CVE-2026-58644) that pose a high risk for remote code execution and authentication bypass.

**If you run on-premise SharePoint Server (2016, 2019, or Subscription Edition), apply the latest Microsoft security updates immediately. Three of these flaws are being actively exploited to deploy ransomware. Then check your servers for signs of breach before rotating your IIS machine keys, and block direct internet access to SharePoint (especially the Central Administration interface) by placing it behind a reverse proxy.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-issues-urgent-warning-on-sharepoint-server-exploitation-o-9-u-8-x/gD2P6Ple2L

SonicWall Patches SMA1000 Zero-Day Vulnerabilities Under Active Attack

SonicWall disclosed two zero-day vulnerabilities in SMA1000 appliances, including a critical CVSS 10.0 SSRF flaw, that are currently being exploited in the wild. CISA has mandated federal agencies to patch these systems by July 17, 2026, to prevent unauthorized network access and command execution.

**If you are using SonicWall SMA1000 appliances, this is urgent. Patch immediately because attackers are already using these flaws to break into networks. If you find any signs of a breach, you must wipe the device and reset all credentials to ensure the attackers are gone.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/sonicwall-patches-sma1000-zero-day-vulnerabilities-under-active-attack-e-j-h-m-n/gD2P6Ple2L

CISA and JoomliC Report Critical iCagenda Zero-Day Exploited in the Wild

JoomliC fixed a critical remote code execution vulnerability in the iCagenda Joomla extension that attackers are actively using to compromise servers. The flaw allows unauthenticated file uploads on Joomla 6 sites and unauthorized event submissions across all versions.

**If your Joomla site uses the iCagenda extension (versions 3.2.1–3.9.14 or 4.x up to 4.0.7), update immediately to 4.0.8 or 3.9.15. Simply unpublishing or hiding the component will NOT protect you, since attackers are actively exploiting it without needing to log in. After updating, check the `images/icagenda/frontend/attachments/` folder for suspicious PHP files. If you find any, your site was likely already compromised and needs a full cleanup.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-and-joomlic-report-critical-icagenda-zero-day-exploited-in-the-wild-q-c-t-t-l/gD2P6Ple2L

Critical RCE Vulnerabilities Exploited in Joomla Page Builder Extensions

CISA has warned of active exploitation of two critical RCE vulnerabilities in Joomla's SP Page Builder and Page Builder CK extensions. Attackers are using these flaws to upload web shells and create rogue Super Administrator accounts to maintain persistent access.

**If you run Joomla with SP Page Builder or Page Builder CK, update SP Page Builder to 6.6.2 and Page Builder CK to 3.6.0 immediately. Both have critical flaws under active attack. Then check your user list for any accounts using the @secure.local email domain, delete any you find, scan the /images/ and /media/ folders for suspicious PHP files, and if anything looks compromised, change all database passwords and secret keys.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-rce-vulnerabilities-exploited-in-joomla-page-builder-extensions-v-v-q-9-p/gD2P6Ple2L

Langflow AI Framework Targeted by Critical IDOR and RCE Exploits

CISA and Sysdig researchers report active exploitation of two critical Langflow vulnerabilities, including a 9.9-rated IDOR and a 9.3-rated RCE, used to steal AI credentials and deploy malware.

**If you are using Langflow, this is important and urgent. Make sure all Langflow instances are isolated from the internet and accessible only from trusted networks, then immediately update to Langflow version 1.9.1 or later to patch these actively exploited flaws. Check your system logs for connections to the malicious IP 45.207.216.55 or the `/tmp/lang_pwn` marker. If you find any indicators of compromise, rotate any API keys or credentials that were stored in your Langflow flows.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/langflow-ai-framework-targeted-by-critical-idor-and-rce-exploits-i-0-s-2-w/gD2P6Ple2L

Gitea Docker Images Vulnerable to Critical Authentication Bypass, Already Attacked

Gitea patched a critical authentication bypass vulnerability (CVE-2026-20896) in its Docker images that allows attackers to impersonate any user with a single HTTP header. The flaw is being exploited in the wild.

**If you self-host Gitea, first make sure it's isolated from the internet and reachable only from trusted networks, then update to version 1.26.3 or later ASAP. If you can't update immediately, edit your app.ini to change REVERSE_PROXY_TRUSTED_PROXIES from * to your actual reverse proxy's specific IP address, and rotate all credentials and secrets stored in your repositories.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gitea-docker-images-vulnerable-to-critical-authentication-bypass-already-attacked-c-9-8-p-p/gD2P6Ple2L

CISA Reports Active Exploitation of SharePoint RCE Flaw

CISA warned that attackers are exploiting a high-severity SharePoint vulnerability (CVE-2026-45659) that allows authenticated users to run arbitrary code.

**If you run on-premises Microsoft SharePoint Server (Subscription Edition, 2019, or 2016), this is urgent. Your Sharepoint is under attack. Apply Microsoft's security update for CVE-2026-45659 immediately. Prioritize any internet-facing SharePoint instances first, and confirm every server is updated to the latest secure version. If possible, isolate SharePoint from the Internet.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-reports-active-exploitation-of-sharepoint-rce-flaw-a-p-5-o-0/gD2P6Ple2L

Progress Kemp LoadMaster Vulnerability Actively Exploited

Progress Software's Kemp LoadMaster is reportedly actively attacked following the release of a proof-of-concept for a remote code execution flaw (CVE-2026-8037).

**This is now urgent. Make sure all your Kemp LoadMaster appliances are updated to the latest versions immediately, because you are being hacked. If you do not require the management API for daily operations, disable it or isolate it behind a secure VPN so it is reachable only from trusted internal networks.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/progress-kemp-loadmaster-vulnerability-actively-exploited-u-c-i-k-t/gD2P6Ple2L

Attackers Exploit Critical Takeover Flaw in Oracle E-Business Suite

Researchers report actively exploit of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's financial module.

**If you run Oracle E-Business Suite (versions 12.2.3 through 12.2.15), make sure your EBS instances are isolated from the public internet and reachable only from trusted networks via a VPN or secure gateway. Then apply the May 2026 Critical Security Patch Update ASAP.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-takeover-flaw-in-oracle-e-business-suite-v-f-z-k-l/gD2P6Ple2L

PTC Windchill and FlexPLM Under Active Exploitation via Critical RCE Flaw

PTC issued emergency patches for a critical RCE vulnerability in Windchill and FlexPLM that attackers are actively exploiting to deploy web shells and steal intellectual property. The flaw, tracked as CVE-2026-12569, allows unauthenticated remote code execution and has prompted emergency warnings from international security agencies.

**Consider this as urgent advisory. If possible, make sure all Windchill and FlexPLM servers are isolated from the internet and reachable only from trusted internal networks. Immediately apply PTC's latest patches for your affected version, block IP 5.180.41.35 at your perimeter, and check for compromise by scanning for suspicious 16-character hex-named .jsp files in the codebase/login directory and a flst.txt file in /tmp.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/ptc-windchill-and-flexplm-under-active-exploitation-via-critical-rce-flaw-4-m-b-f-6/gD2P6Ple2L