[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAA9Es-sVBZk5UCWeNa_99H3X9lK_HgMXgDzaWphPXoY":3},{"article":4,"iocs":44,"watch_terms":64,"solutions":65,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d20b05b4-f88b-4954-8390-134fa11c13df","Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug","veeam-terraform-mcp-django-patch-critical-flaws-led-by-cvss-10-0-cross-tenant-bu-bf1271","HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant flaw in HashiCorp's MCP server that lets one user's Terraform token be reused for later users'","Veeam, HashiCorp, and the Django Software Foundation have released patches for a total of 11 vulnerabilities across their respective products. The most critical include a CVSS 10.0 cross-tenant bug in HashiCorp's Terraform MCP Server allowing token reuse, a CVSS 9.5 unauthenticated credential theft flaw in Veeam Service Provider Console, and a GeoDjango vulnerability enabling file writes and potential code execution. Updates are available for all affected products.","Veeam, HashiCorp Terraform MCP, and Django patch critical vulnerabilities, including a CVSS 10.0 cross-tenant bug.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fveeam-terraform-mcp-django-patch.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiGDed_n3TJGLHvhq2MkwkQTsKgIv_rOw24MRfYCoHnHiOK7r-VbitMrwXXF9H_Gwbegba20Dla1FLyK70-OQRVxiHfikBFrz6jei3QK5u4ApbR4aYuLikQj1YHU2IzA1V4fnR7Wgcp8H1NoYzSeTTOUd4dNTuE71jNUNq-P4yk0H9FkW55wivMDdNe0nE\u002Fs1600\u002Fveeam.jpg","2026-08-05T14:27:30+00:00","2026-08-05T16:00:11.193987+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Terraform MCP Server","product",{"name":21,"type":19},"Veeam Service Provider Console",{"name":23,"type":19},"Django",{"name":25,"type":19},"GeoDjango",{"name":27,"type":28},"HashiCorp","vendor",{"name":30,"type":28},"Veeam","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,52,55,58,61],{"type":46,"value":47,"context":48},"cve","CVE-2026-58073","Veeam Service Provider Console critical vulnerability (CVSS 9.5) for impersonating managed agents and obtaining credentials.",{"type":46,"value":50,"context":51},"CVE-2026-58072","Veeam Service Provider Console critical vulnerability (CVSS 9.0) for arbitrary file write leading to RCE.",{"type":46,"value":53,"context":54},"CVE-2026-58067","Veeam Service Provider Console high-severity vulnerability for unauthenticated memory-exhaustion DoS.",{"type":46,"value":56,"context":57},"CVE-2026-58071","Veeam Service Provider Console high-severity vulnerability exposing proxied appliance API.",{"type":46,"value":59,"context":60},"CVE-2026-16498","HashiCorp Terraform MCP Server critical vulnerability (CVSS 10.0) for cross-tenant credential reuse.",{"type":46,"value":62,"context":63},"CVE-2026-32998","Previous Veeam RCE vulnerability (CVSS 9.4) related to alarm script execution.",[27,30,18],{"controls":66,"vendors":150},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":126,"name":127,"problem":128,"products":129},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[130,135,143],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":131,"product_name":132,"url":133,"description":134},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":145,"url":148,"description":149},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[151,156],{"slug":152,"name":27,"logo_path":153,"roles":154},"hashicorp","\u002Fvendor-logos\u002Fhashicorp.png",[155],"affected",{"slug":157,"name":30,"logo_path":158,"roles":159},"veeam","\u002Fvendor-logos\u002Fveeam.png",[155],{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":175},"critical-flaws-in-veeam-terraform-mcp-and-django-demand-immediate-patching","Critical Flaws in Veeam, Terraform MCP, and Django Demand Immediate Patching","Three major software vendors — Veeam, HashiCorp, and the Django Software Foundation — disclosed a combined 11 vulnerabilities, including a maximum-severity CVSS 10.0 cross-tenant token reuse bug in Terraform MCP Server that could allow attackers to pivot across customer environments. The Veeam flaw enables unauthenticated credential theft, a particularly dangerous vector given Veeam's role in managing backup infrastructure. These vulnerabilities highlight the persistent risk of delayed patching, especially in widely deployed enterprise tools where exploitation can cascade across multiple tenants or customers. When critical infrastructure software like backup solutions and cloud provisioning tools carries unpatched flaws, the blast radius of a successful attack can be organization-wide or even supply-chain-wide.",[165,166,167,168,169,170,171,172,173,174],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","ITIL Change Management: Emergency Change procedures for critical patches","GDPR Article 32: Security of processing — obligation to patch known vulnerabilities promptly",{}]