Security Digest: June 4, 2026 - 5 Critical Vulnerabilities

Today’s highest-risk issues are concentrated in BOSH and widely deployed web applications, with multiple flaws that can expose credentials, enable command execution, or leak sensitive files. The most urgent threat is the pair of BOSH weaknesses that allow attackers to intercept authentication traffic or trigger shell command execution before validation occurs.

· 7 min read

June 4, 2026: 5 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s highest-risk issues are concentrated in BOSH and widely deployed web applications, with multiple flaws that can expose credentials, enable command execution, or leak sensitive files. The most urgent threat is the pair of BOSH weaknesses that allow attackers to intercept authentication traffic or trigger shell command execution before validation occurs.

Act now: patch BOSH immediately, review exposed WordPress plugins, and assume any unpatched affected system may already be at risk. Prioritize internet-facing systems first, then verify whether any credentials, tokens, or file access logs show signs of abuse.

Critical Vulnerabilities

CVE-2026-41860: BOSH TLS verification disabled in HTTP helper

  • Impact: A local attacker or man-in-the-middle can steal Basic-auth credentials or redirect UAA token requests. That can lead to exposure of director access and downstream compromise.
  • Affected Systems: BOSH versions prior to v282.1.9 (inclusive).
  • Immediate Action: Upgrade to v282.1.9 or later immediately. Treat any BOSH-to-director or BOSH-to-UAA traffic on affected systems as potentially exposed.
  • Mitigation: If you cannot patch immediately, isolate BOSH management traffic, restrict network access to director and UAA endpoints, and rotate any credentials that may have traversed affected paths.

CVE-2026-41011: BOSH package validation flaw enables shell command execution

  • Impact: An attacker can abuse crafted package metadata in an uploaded release to trigger shell execution through an unsafe tar command. This can result in remote code execution on the BOSH component handling the upload.
  • Affected Systems: BOSH versions prior to v282.1.12 (inclusive).
  • Immediate Action: Upgrade to v282.1.12 or later right away. Stop accepting untrusted release uploads until patched.
  • Mitigation: Restrict who can upload releases, inspect recent uploads for suspicious package names, and review system logs for unexpected shell activity or failed package validation.

CVE-2026-41859: BOSH nats-sync TLS bypass exposes director credentials

  • Impact: A network attacker can steal director credentials or UAA client secrets and tamper with the VM list written to the NATS authorization file. Stolen credentials can provide administrative director access.
  • Affected Systems: BOSH versions prior to v282.1.9 (inclusive).
  • Immediate Action: Upgrade to v282.1.9 or later. Rotate any director credentials and UAA secrets that may have been exposed.
  • Mitigation: Segment management networks, limit access to BOSH director endpoints, and verify the integrity of VM list and authorization file generation after patching.

CVE-2026-49771: 10Web Photo Gallery blind SQL injection

  • Impact: Attackers can use blind SQL injection to extract data from the database, potentially including user records, configuration data, and other sensitive content.
  • Affected Systems: 10Web Photo Gallery by 10Web through 1.8.41.
  • Immediate Action: Update to a fixed version as soon as one is available. If the plugin is not essential, disable it until patched.
  • Mitigation: Restrict access to WordPress admin endpoints, review database logs for unusual query patterns, and monitor for repeated requests to plugin functions.

CVE-2026-10737: SP Project & Document Manager unauthorized file access

  • Impact: Unauthenticated attackers can read file metadata and obtain download links for arbitrary files inside project folders. Exposed files may include sensitive business, legal, or operational data.
  • Affected Systems: SP Project & Document Manager for WordPress through 4.71.
  • Immediate Action: Upgrade immediately to a fixed release. If patching is delayed, disable the plugin or block access to admin-ajax.php where feasible.
  • Mitigation: Review exposed project folders, rotate any shared links or secrets found in affected files, and check web logs for repeated POST requests using file IDs.

What to Do Now

  1. Patch BOSH first. Upgrade all affected BOSH environments to v282.1.12 for CVE-2026-41011 and v282.1.9 for CVE-2026-41859 / CVE-2026-41860.
  2. Disable or remove vulnerable WordPress plugins if immediate updates are not available, especially on internet-facing sites.
  3. Rotate credentials that may have been exposed via BOSH management traffic, including director auth and UAA secrets.
  4. Verify exposure by checking recent logs for unusual release uploads, suspicious POSTs to WordPress AJAX endpoints, and unexpected authentication failures.
  5. Contain risk by limiting network access to BOSH director, UAA, and WordPress admin interfaces until remediation is complete.

Verification steps: confirm installed BOSH versions, plugin versions, and whether any affected components are reachable from untrusted networks. Validate that patches were applied successfully and that no vulnerable versions remain in production or staging.

Monitoring recommendations: watch for new admin sessions, unexpected token use, unusual database queries, file download spikes, and changes to BOSH authorization or VM inventory files. Escalate any signs of credential reuse or unauthorized file access immediately.

Related Resources

  • Internal: See the upcoming internal incident-response note and hardening checklist for BOSH and WordPress environments.
  • Official vendor advisories: BOSH release security notes for v282.1.9 and v282.1.12; 10Web Photo Gallery security advisory; SP Project & Document Manager vendor advisory.

Keep reading