CVE-2026-54600Active Exploitation

LOWCVSS 8.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve

Full discourse1 post

NewNormal Security@NewScanTeam46d
Active Exploitation
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 1 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Print-server management bypass, exploited in the wild — unauthenticated requests reach the admin console, then run code (PaperCut MF/NG CVE-2026-81578) 📦 Unauthenticated database import and zip-slip restore — replace the database, or write files outside it, with no login (Wallos CVE-2026-54600, CVE-2026-61639) 📦 File-manager URL upload reaching internal addresses — the server fetches attacker-chosen URLs, and an extract writes a forbidden file type (elFinder CVE-2026-81889, CVE-2026-81891) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM
Post summary
The report highlights that at least one listed CVE (PaperCut MF/NG CVE‑2026‑81578) is being exploited in the wild and provides basic technical details for several vulnerabilities, but offers no PoC, exploit code, patches, or debunking.
0000043
7 followersView on X

Explore more

Back to dashboard