#Authentication Bypass

nginx-ui MCP Endpoint Missing Authentication (CVE-2026-33032) Exploited in the Wild, No Patch Available

A CVSS 9.8 authentication bypass in nginx-ui's /mcp_message endpoint lets unauthenticated remote attackers rewrite nginx configurations. Active exploitation confirmed, no patch yet.

CVSS 10.0 authentication bypass on Quest KACE SMA, actual attack confirmed since early March

A CVSS 10.0 authentication bypass vulnerability CVE-2025-32975 was discovered in Quest KACE SMA, and active attack activity was confirmed starting the week of March 9, 2026. The patch was released in May 2025, but systems that have not been patched are being targeted for attacks.