Security news aggregator

Latest coverage for Unauthenticated

Unauthenticated access lets systems or services be used without verifying identity, increasing the risk of data exposure, tampering, or abuse.

25 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

Unauthenticated describes a request, session, or service that has not verified the requester’s identity. This may be intentional for public content or health checks, but in security reporting the term often highlights an interface that can be reached without credentials, such as an administration panel, API, database, or device-management service. It does not by itself mean the requester is authorized to perform every action; authentication and authorization are separate controls.

Unauthenticated exposure matters when it permits sensitive data retrieval, configuration changes, or exploitation of a vulnerability without a prior login. Security teams should identify such interfaces during asset discovery and vulnerability management, confirm that public access is necessary, and enforce authentication and least-privilege authorization where it is not. Network restrictions, safe defaults, logging, and alerts for unexpected access help reduce exposure and support investigation when an unauthenticated endpoint is abused.

Volume over time

Weekly headline count for the current query.

Showing 20 most recent headlines of 25 Filtered view

CUPS server shown spilling out remote code execution and root access In the latest chapter on leaky CUPS, a security researcher and his band of bug-hunting agents have found two flaws that can be chained to allow an unauthenticated attacker to remotely execute code and achieve root file overwrite on the network.…

The Register 7 Apr 2026, 11:03 a.m. Artificial Intelligence Flaw Linux Remote Code Execution Root Access Unauthenticated

Maximum-severity vuln lets unauthenticated attackers execute code on trusted infra management platform Hewlett Packard Enterprise has told customers to drop whatever they're doing and patch OneView after admitting a maximum-severity bug could let attackers run code on the management platform without so much as a login prompt.…

The Register 20 Dec 2025, 2:03 a.m. Patch Remote Code Execution Unauthenticated

Finish reading this, then patch A maximum-severity flaw in the widely used JavaScript library React, and several React-based frameworks including Next.js allows unauthenticated, remote attackers to execute malicious code on vulnerable instances. The flaw is easy to abuse, and mass exploitation is "imminent," according to security researchers.…

The Register 4 Dec 2025, 10:55 a.m. Abuse Cloud Flaw Framework JavaScript Library Malicious Code Patch Research Unauthenticated Vulnerability
The Register 7 months, 4 weeks ago

Fortinet 'fesses up to second 0-day within a week

Attackers may be joining the dots to enable unauthenticated RCE Fortinet has confirmed that another flaw in its FortiWeb web application firewall has been exploited as a zero-day and issued a patch, just days after disclosing a critical bug in the same product that attackers had found and abused a month earlier.…

The Register 20 Nov 2025, 12:07 p.m. 0-Day Critical Vulnerability Firewalls Flaw Fortinet Patch Remote Code Execution Unauthenticated Web Application Firewall

Three perfect 10s in the last month - ISE, ISE, baby Cisco has issued a patch for a critical 10 out of 10 severity bug in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could allow an unauthenticated, remote attacker to run arbitrary code on the operating system with root-level privileges. …

The Register 18 Jul 2025, 6:44 a.m. Cisco Patch Root Access Unauthenticated

No fix plus a POC exploit equals bad news Details about a critical, 9.9-rated unauthenticated RCE affecting all GNU/Linux systems — and possibly others — will soon be revealed, according to bug hunter Simone Margaritelli, who says there's still no fix for the decade-old flaw he disclosed to developers three weeks ago.…

The Register 27 Sep 2024, 5:34 a.m. Disclosure Exploit Flaw Linux PoC Remote Code Execution Social Media Unauthenticated

Why go to the effort of backdooring code when devs will basically do it for you accidentally anyway SolarWinds left hardcoded credentials in its Web Help Desk product that can be used by remote, unauthenticated attackers to log into vulnerable instances, access internal functionality, and modify sensitive data…

The Register 23 Aug 2024, 10:36 a.m. Credentials SolarWinds Unauthenticated Vulnerability