[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC8T1KYO6JesKuz2N4oD_5fX1An3jfqGRg7ZralMMCkE":3},{"article":4,"iocs":49,"watch_terms":64,"solutions":65,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"80387e44-9eb4-4c9c-a9c4-c2b6a0f2f48b","ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution","modsecurity-patches-two-high-severity-flaws-allowing-waf-bypass-and-potential-re-5ff883","Two high-severity flaws have been disclosed in ModSecurity, the open-source web application firewall (WAF) used with Apache, IIS, and Nginx. Two GitHub advisories published by maintainer airween on September 30 describe flaws allowing malicious file uploads and server crashes that could lead to remote code execution. ModSecurity inspects web traffic and blocks requests that look […] The post ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution appeared first on Cyber Security News.","ModSecurity, an open-source WAF, has disclosed two high-severity vulnerabilities. The first allows for malicious file uploads and bypasses WAF checks due to improper handling of RFC 2231 encoded filenames, potentially leading to remote code execution in applications using Go, Python, Node.js, and Java Spring. The second vulnerability, related to XML argument parsing, can cause server crashes or RCE when a specific configuration is enabled. While a patch is mentioned for the XML flaw, it's not yet released, and no patch is available for the filename issue, urging developers to implement application-level security measures.","ModSecurity patches two high-severity flaws enabling WAF bypass and potential RCE.","https:\u002F\u002Fcybersecuritynews.com\u002Fmodsecurity-patches-two-high-severity-flaws\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FModSecurity-Patches-Two-High-Severity-Flaws-Allowing-WAF-Bypass-and-Potential-Remote-Code-Execution.webp","2026-11-09T10:31:28+00:00","2026-11-09T11:00:35.438133+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"ModSecurity","product",{"name":21,"type":22},"WAF","technology",{"name":24,"type":22},"Apache",{"name":26,"type":22},"IIS",{"name":28,"type":22},"Nginx",{"name":30,"type":19},"OWASP Core Rule Set","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[50,54,57,61],{"type":51,"value":52,"context":53},"cve","CVE-2026-104269","ModSecurity filename parsing vulnerability",{"type":51,"value":55,"context":56},"CVE-2026-73857","ModSecurity XML parsing vulnerability",{"type":58,"value":59,"context":60},"mitre_attack","T1078","Exploitation of vulnerability for initial access",{"type":58,"value":62,"context":63},"T1505","Server Software Component: Web Shell",[18,30],{"controls":66,"vendors":154},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":126,"name":127,"problem":128,"products":129},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"modsecurity-waf-flaws-expose-applications-to-bypass-and-rce","ModSecurity WAF Flaws Expose Applications to Bypass and RCE","Two high-severity vulnerabilities in ModSecurity—a widely deployed open-source Web Application Firewall—expose applications to WAF bypass via malformed RFC 2231 encoded filenames and potential remote code execution through malicious XML argument parsing. The filename handling flaw is particularly dangerous because it undermines the core purpose of a WAF: inspecting and blocking malicious inputs before they reach the application. What makes this especially critical is that patches are either incomplete or entirely unavailable, leaving organizations reliant on compensating controls. This incident highlights the inherent risk of depending on a single security control, especially when that control itself contains unpatched vulnerabilities.",[160,161,162,163,164,165,166],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":168,"PCI DSS Requirement 6":169,"NIST SP 800-53 SI-2: Flaw Remediation":170,"OWASP A06:2021 Vulnerable and Outdated Components":171,"CIS Control 7: Continuous Vulnerability Management":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":174},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures; deploying a WAF with known unpatched RCE-class vulnerabilities without compensating controls would breach this obligation.","Requirement 6 mandates the development and maintenance of secure systems, including WAF protection and prompt patching of vulnerabilities in security-critical software, making unpatched ModSecurity flaws a direct compliance gap for card-data environments.","SI-2 requires organisations to identify, report, and correct information system flaws; a formal flaw remediation process would have ensured both the patch and interim mitigations were applied promptly to this critical WAF component.","ModSecurity is a third-party security component, and running a version with unpatched high-severity flaws directly maps to OWASP A06, which warns that vulnerable components can undermine application defences entirely.","Regular vulnerability scanning and a disciplined patch cycle would have flagged these high-severity ModSecurity CVEs and triggered prioritised remediation or compensating controls before exploitation could occur.","This control mandates timely identification and treatment of technical vulnerabilities in information systems; applying it to security tooling like ModSecurity would have ensured compensating controls were enacted when no patch was yet available.","The WAF bypass vulnerability circumvents a key protective control; CSF PR.AA emphasises protecting assets through layered access controls, underscoring the need to not rely solely on the WAF as the only gatekeeping mechanism."]