• Adam Boylan
• David Cash
• 23 Jun, 2026
• • Disclosure
  • Vulnerability
  • Bypass

Microsoft Graph API - Hidden Exclusions with Overly Scoped Permissions

Hidden exclusions in Entra ID Conditional Access policies let attackers bypass MFA and use an overly scoped Graph token to enumerate tenant data.

Read Article

• Richard Warren
• 09 Apr, 2026
• • Vulnerability
  • Disclosure
  • Zscaler
  • ZTNA

Next, Next, SYSTEM: Exploiting NSIS installer bugs to escalate privileges in Zscaler Client Connector

Exploiting NSIS installer bugs to escalate privileges in Zscaler Client Connector

Read Article

• David Cash
• Richard Warren
• 27 Feb, 2026
• • Vulnerability
  • Disclosure
  • Delinea

Delinea Protocol Handler - Return of the MSI: RCE via Custom Launcher

Summary Ok, so there’s no MSI this time but our last Delinea post was titled ‘MSI Strikes Back’ so we thought we’d stay on …

Read Article

• David Cash
• Richard Warren
• 21 Jan, 2026
• • Vulnerability
  • Disclosure

Advisory - Check Point Harmony Local Privilege Escalation (CVE-2025-9142)

Check Point Harmony Local Privilege Escalation (CVE-2025-9142)

Read Article

• David Cash
• 20 Aug, 2025
• • PAM
  • Vulnerability
  • Disclosure
  • Delinea

Delinea Protocol Handler - MSI Strikes Back

Introduction Delinea’s custom URL handler allows the software’s update process to be triggered, downloading and running an MSI from an …

Read Article

• David Cash
• Richard Warren
• 26 Dec, 2024
• • Vulnerability
  • Disclosure
  • PAM

Delinea Protocol Handler - Remote Code Execution via Update Process (CVE-2024-12908)

The Delinea Protocol Handler suffers from a Remote Code Execution vulnerability in the sslauncher URL handler. This could be exploited by a malicious …

Read Article

• Richard Warren
• David Cash
• 26 Nov, 2024
• • Vulnerability
  • Disclosure

Introducing NachoVPN: One VPN Server to Pwn Them All

Is Your Corporate VPN Client Providing Access to More Than Just Your Employees?

Read Article

• Richard Warren
• 08 Oct, 2024
• • Vulnerability
  • Disclosure

Ivanti Connect Secure - Authenticated RCE via OpenSSL CRLF Injection (CVE-2024-37404)

Today, we are releasing the details of CVE-2024-37404, a zero-day vulnerability in the Ivanti Connect Secure product. This vulnerability allows an …

Read Article

• David Cash
• Richard Warren
• 17 Sep, 2024
• • Vulnerability
  • Disclosure

Skeleton Cookie: Breaking into Safeguard with CVE-2024-45488

Join us as we reveal how CVE-2024-45488 can let attackers gain access to your corporate password vault and uncover hidden secrets of Microsoft DPAPI.

Read Article

• David Cash
• Richard Warren
• 04 Sep, 2024
• • Vulnerability
  • Disclosure

One Identity SafeGuard for Privileged Passwords - Authentication Bypass (CVE-2024-45488)

SafeGuard for Privileged Passwords (SPP) virtual appliance images contain a hard-coded cryptographic key (CWE-321). An attacker can exploit this key …

Read Article

• Richard Warren
• David Cash
• 31 Jul, 2024
• • Cato
  • VPN
  • Vulnerability
  • Disclosure

Cato Client - Local Privilege Escalation via OpenSSL Configuration File (CVE-2024-6975)

The OpenSSL implementation in the winvpnclient.cli.exe service executable is configured to load an openssl.cnf file from a location that does not …

Read Article

• Richard Warren
• David Cash
• 31 Jul, 2024
• • Cato
  • VPN
  • Vulnerability
  • Disclosure

Cato Client - Local Privilege Escalation via Self-Upgrade (CVE-2024-6974)

The Cato Client was found to use an insecure temporary folder for downloading and processing updates.

Read Article

• Richard Warren
• David Cash
• 31 Jul, 2024
• • Cato
  • VPN
  • Vulnerability
  • Disclosure

Cato Client - Local Root Certificate Install as Low Privileged User (CVE-2024-6978)

The Cato Client allows a low-privileged, local user to install arbitrary Root CA Certificates in the computer’s certificate store.

Read Article