Author

Stephen Fewer

Stephen is a Senior Principal Researcher at Rapid7, with a focus on software vulnerabilities and exploitation.

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

Rapid7 Analysis: Check Point SmartConsole Authentication Bypass (CVE-2026-16232)

CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)

CVE-2026-0826: Critical unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones (FIXED)

CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)

Jonah Burgess, Stephen Fewer

CVE-2026-2329: Critical Unauthenticated Stack Buffer Overflow in Grandstream GXP1600 VoIP Phones (FIXED)

Defend Smarter, Not Harder: The Power of Curated Vulnerability Intelligence

Rapid7 at Pwn2Own: Raising the Bar in Vuln Intel

CVE-2025-61882: Critical 0day in Oracle E-Business Suite exploited in-the-wild

Stephen Fewer, Christiaan Beek

CVE-2025-10035 - Critical unauthenticated RCE in GoAnywhere MFT

CVE-2025-7775: Critical NetScaler vulnerability exploited in-the-wild

CVE-2025-6543: Zero Day Exploitation of NetScaler ADC and NetScaler Gateway

Multiple Brother Devices: Multiple Vulnerabilities (FIXED)

CVE-2025-32756 Exploited in the Wild, Affecting Multiple Fortinet Products

Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes

Multiple Zero-Day Vulnerabilities in Broadcom VMware ESXi and Other Products

CVE-2025-1094: PostgreSQL psql SQL injection (FIXED)