Horizon3.ai (Attack Research / NodeZero)
horizon3-ai · B · active
https://horizon3.ai/attack-research/
Discovered 2026-06-13 via CVE-2026-48558 (SimpleHelp OIDC auth-bypass); Horizon3 was the primary-discovery vendor with public PoC/IOC disclosure; consistent original research on RMM/enterprise-tooling auth bypasses. Fetched 200 this run. Candidate; promote to active after 3 runs with content contribution. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://horizon3.ai/attack-research/ (listing) then webfetch the /attack-research/disclosures/<slug>/ article for body. AVOID: Cadence is sparse (CVE disclosures, not daily); gaps of weeks are normal, not a failure. | 2026-07-05 admiralty audit: B, original vuln discovery/disclosure with PoC/IOC; stays active. Sparse cadence (CVE-driven) is normal, not a failure. | 2026-10-18 (S1): `extract` of the attack-blogs post URL reads the full body; the listing needs WebFetch. | 2026-10-22 (S1): confirmed: WebFetch of https://horizon3.ai/attack-research/ lists dated posts; `extract` of the post URL and of its PoC repository page read cleanly.
Cited in 7 entries
Citation cadence
Citation days per ISO week (20 weeks of coverage span, total 7).
- Fortinet FortiSandbox GUI authentication bypass (CVE-2026-107656, CVSS 9.6) and FortiSIEM 7.5.0 unauthenticated path traversal to code execution (CVE-2026-106173, CVSS 9.4): both critical, fixed 2026-10-13, neither reported exploited2026-10-23
- Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP2026-10-21
- CVE-2026-105133 / CVE-2026-105134, AhsayCBS backup management console: an unauthenticated authentication-bypass and code-execution chain exploited since 7 October to drop webshells and a cryptominer; Ahsay says its earlier patches were incomplete and ships hotfixes 10.3.4.45 and 9.15.2.70 through its partner portal2026-10-10
- CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September; 7.2.2 fixes the root flaw on DEB and RPM installs2026-10-02
- CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped2026-09-03
- CVE-2026-48558: SimpleHelp RMM OIDC authentication bypass (CVSS 3.1 10.0) exploited to plant technician sessions that deliver the TaskWeaver loader and Djinn Stealer2026-06-30
- CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV2026-06-09