[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQEfOfbycCDMeydgNOsXUhhHeKDnFNXA44lnLZhRJYyg":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8c5b1b01-50ec-40b9-8674-8098af8e82d3","Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars","hackers-used-default-admin-admin-credentials-to-exploit-forgerock-rce-and-remote-f2e461","Researchers used default admin:admin credentials as part of a vulnerability chain that let them run code on two automakers’ production ForgeRock servers and remotely unlock connected cars. Found in early 2026 and disclosed on November 7, the flaws also exposed vehicle locations and supported remote engine commands. The findings came from controlled security research, not […] The post Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars appeared first on Cyber Security News.","Security researchers discovered a vulnerability chain in ForgeRock Access Management and OpenIDM used by two unnamed automakers, exploiting default admin:admin credentials and URL parsing mismatches to gain remote code execution on production servers. The attack allowed them to access vehicle APIs, unlock cars, start engines, and expose location data. Both automakers patched within two hours of disclosure on November 7, 2026.","Researchers exploited ForgeRock default credentials and RCE to remotely unlock connected cars at two automakers.","https:\u002F\u002Fcybersecuritynews.com\u002Fforgerock-attack-chain\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FForgeRock-Attack-Chain.webp","2026-11-09T13:12:03+00:00","2026-11-09T14:00:29.851893+00:00",9,[17,20,22,24,27],{"name":18,"type":19},"ForgeRock Access Management","product",{"name":21,"type":19},"ForgeRock OpenIDM",{"name":23,"type":19},"Apache Felix Web Console",{"name":25,"type":26},"Jetty web server","technology",{"name":28,"type":29},"Ping Identity","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[52],{"type":53,"value":54,"context":55},"malware","Groovy code execution payload","OpenIDM scheduled task used to install Java component for RCE",[28,18,21],{"controls":58,"vendors":145},[59,87,116],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":60,"product_name":84,"url":85,"description":86},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":88,"name":89,"problem":90,"products":91},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":117,"name":118,"problem":119,"products":120},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":158},"default-credentials-and-parsing-flaws-let-hackers-remotely-unlock-cars","Default Credentials and Parsing Flaws Let Hackers Remotely Unlock Cars","Attackers exploited a combination of unchanged default admin:admin credentials and URL parsing mismatches in ForgeRock Access Management and OpenIDM deployed by two automakers, ultimately achieving remote code execution on production identity servers. This gave them direct access to vehicle APIs, enabling remote unlocking, engine starts, and exposure of real-time location data. The incident illustrates how a single failure to change a default password in a production environment — a basic hardening step — can cascade into catastrophic physical-world consequences. It also highlights the danger of deploying identity and access management platforms without thorough post-installation hardening reviews. The fact that both vendors patched within two hours of responsible disclosure underscores how preventable this was with proactive credential management.",[151,152,153,154,155,156,157],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","GDPR Article 32",{"GDPR Article 32":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":164,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":165},"The exposure of vehicle location data and the ability to physically track individuals constitutes a failure to implement appropriate technical measures to protect personal data, triggering obligations under Article 32.","SI-2 requires organizations to identify, report, and correct information system flaws; a formal flaw remediation process covering ForgeRock components would have patched the URL parsing vulnerability before it was weaponized.","Running ForgeRock components with unpatched parsing flaws and unmodified default configurations is a direct instance of using vulnerable components in a production environment, which OWASP A06 specifically addresses.","Regular authenticated scanning of the ForgeRock deployments would have identified both the unpatched URL parsing vulnerability and the presence of default credentials before attackers could exploit them.","This control mandates timely identification and remediation of technical vulnerabilities, including hardening of deployed software against known default-credential risks documented in vendor guidance.","This control explicitly requires changing default credentials and hardening configurations before deploying systems to production, which would have directly prevented the admin:admin exploitation.","This function requires that credentials be managed, unique, and appropriately protected — a mandate that default admin:admin credentials on a production identity server fundamentally violate."]