Alertes de service

OCTOBER 2026

2026-10-26 – SSH Proxy Vulnerabilities (WSA-2026-10-0701 to 0717) – Bastion

2026-10-26 – SSH Proxy Vulnerabilities (WSA-2026-10-0701 to 0717) – Bastion

WSA-2026-10-0701 to WSA-2026-10-0717 · Release date 2026-10-26 · Last updated 2026-10-22 · TLP:WHITE

Overview

This bulletin covers 15 flaws in the WALLIX Bastion SSH proxy, which also carries SFTP, SCP and telnet sessions. WSA-2026-10-0701 was reported through WALLIX support; a WALLIX internal security review found the others, one of which, WSA-2026-10-0702, Synacktiv also reported independently.

They are reached from four positions:

  • Unauthenticated SSH client: anyone who can reach the SSH proxy port (0701, 0702, 0707, 0717; 0710 with a Kerberos ticket).
  • Authenticated Bastion user, during a session they are authorized for.
  • Malicious or compromised target: any server a Bastion user opens a session to can attack the proxy through that session.
  • Attacker on the network path of an SSH connection (0703, 0711, 0712).
Advisory ID Ticket Title CVSS 4.0 CVSS 3.1 Severity Fixed in
WSA-2026-10-0701 WAB-21113 Login without key or password (public key probe) 9.1 9.0 CRITICAL 12.0.27, 12.5.0
WSA-2026-10-0702 WAB-21157 Memory corruption in pre-authentication messages 6.9 8.6 MEDIUM 12.0.27, 12.5.0
WSA-2026-10-0703 WAB-21159 AES-GCM packets not authenticated 7.0 5.9 HIGH 12.0.27, 12.5.0
WSA-2026-10-0704 WAB-21160 Memory corruption in connection and session messages 5.3 7.6 MEDIUM 12.0.27, 12.5.0
WSA-2026-10-0705 WAB-21161 Certificates without principals valid for any user 7.2 8.2 HIGH 12.0.27, 12.5.0
WSA-2026-10-0706 WAB-21162 FIDO keys accepted without user presence 6.3 4.8 MEDIUM 12.5.0
WSA-2026-10-0707 WAB-21163 Disabled methods and username changes accepted 6.3 4.8 MEDIUM 12.0.27, 12.5.0
WSA-2026-10-0708 WAB-21164 Command injection through proxy settings 7.7 7.5 HIGH 12.0.27, 12.5.0
WSA-2026-10-0710 WAB-21244 Pre-auth use-after-free in GSSAPI 7.7 8.8 HIGH 12.0.27, 12.5.0
WSA-2026-10-0711 WAB-21253 Double free on an invalid target host key signature 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0712 WAB-21254 Host key pinning bypass with another key type 7.2 8.0 HIGH 12.5.0
WSA-2026-10-0713 WAB-21255 Terminal emulator memory corruption 7.6 7.5 HIGH 12.0.27, 12.5.0
WSA-2026-10-0714 WAB-21256 Kill/notify rules disabled in Cisco/Huawei modes 6.0 5.3 MEDIUM 12.0.27, 12.5.0
WSA-2026-10-0716 WAB-21258 Resource exhaustion via flow control and telnet 7.1 6.5 HIGH 12.0.27, 12.5.0
WSA-2026-10-0717 WAB-21259 Log injection through peer-supplied text 6.9 5.3 MEDIUM 12.0.27, 12.5.0

By CVSS 4.0 severity: 1 CRITICAL · 8 HIGH · 6 MEDIUM.

The Fixed in column gives the versions that fix each flaw. Upgrading to 12.5.0 closes all 15 flaws. Upgrading to 12.0.27 closes all of them except WSA-2026-10-0706 and WSA-2026-10-0712.

Severity follows the CVSS 4.0 score, and both scores are given for each advisory. Where a flaw is triggered by a malicious or compromised target, the CVSS 4.0 vector sets AT:P (the attacker must control a target) and UI:P (a Bastion user must open a session to it). The crash of one session process counts as VA:L; memory exhaustion of the Bastion host, or code execution, as VA:H.

Behaviour changes after the upgrade: 0705, 0706, 0707, 0708, 0712, 0716. Each of these advisories says so under Compatibility.

WSA-2026-10-0701 — Missing authentication step in the SSH proxy allows login without key or password
Ticket WAB-21113
Severity CRITICAL — CVSS 4.0 9.1 · CVSS 3.1 9.0
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE CWE-304 (Missing Critical Step in Authentication), CWE-287 (Improper Authentication)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Unauthenticated, knowing a user’s login and registered public key
Exposure Primary users (local or LDAP/AD) with an SSH key method plus an interactive method (password, mobile device/MFA, URL redirect/SAML)
Workaround Yes

Issue. The SSH proxy accepted the public key probe sent by the client as proof of the public key step, without checking that the client holds the matching private key. When the user also had an interactive method, the proxy then treated that step as satisfied by an empty password. When the user’s domain has an SSH certificate authority, any certificate signed by that CA passed the same way. A user whose only method is an SSH key is not exposed.

Impact. An attacker who knows a user’s login and registered public key opens a session as that user, without the private key or the password, and reaches every target that user is authorized for, with the credentials the Bastion injects.

Workaround. Remove keyboard-interactive from the SSH authentication methods (only SSH key authentication then works), or remove SSH key authentication. Appliance-wide, disable_password_kbdint_auth = True in the SSH proxy configuration stops the proxy from offering password and keyboard-interactive, with WALLIX support.

Detection. Successful primary authentications, for users with both an SSH key and an interactive method, from addresses those users do not use.

After upgrading. Review the SSH proxy authentication and session logs for users that had both an SSH key and an interactive method. Rotate the credentials of the target accounts those users could reach.

Note. The related acceptance of user certificates without principals is fixed by WSA-2026-10-0705.

WSA-2026-10-0702 — Memory corruption while parsing pre-authentication messages
Ticket WAB-21157
Severity MEDIUM — CVSS 4.0 6.9 · CVSS 3.1 8.6
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Unauthenticated SSH client
Exposure Default configuration
Workaround None

Issue. Malformed key exchange (KEXINIT) and extension (EXT_INFO) messages sent before authentication could corrupt the memory of the session process. A duplicated algorithm name in the configured algorithm lists could also corrupt memory.

Impact. An unauthenticated client can crash the session process or corrupt its memory.

Detection. Unexpected crashes of SSH proxy session processes before authentication.

Credit. WALLIX thanks Synacktiv ( https://www.synacktiv.com) for responsibly reporting this vulnerability, which the WALLIX internal security review had also identified.

WSA-2026-10-0703 — Packets encrypted with AES-GCM were not authenticated
Ticket WAB-21159
Severity HIGH — CVSS 4.0 7.0 · CVSS 3.1 5.9
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE CWE-353 (Missing Support for Integrity Check), CWE-345 (Insufficient Verification of Data Authenticity)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Attacker on the network path of an SSH connection
Exposure Connections negotiating aes128-gcm@openssh.com or aes256-gcm@openssh.com
Workaround Yes

Issue. SSH connections using the AES-GCM ciphers did not verify the integrity of received packets. The encryption still applied, but a modified packet was accepted.

Impact. An attacker on the network path can alter the encrypted traffic without being detected, for example to change the keystrokes relayed to the target.

Workaround. Remove the AES-GCM ciphers from the SSH proxy cipher lists.

Detection. None at the protocol level: altered packets were accepted silently.

WSA-2026-10-0704 — Memory corruption while parsing connection and session messages
Ticket WAB-21160
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 7.6
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user (also a malicious target)
Exposure Default configuration
Workaround None

Issue. Malformed or truncated channel and session requests (terminal requests, fixed-size fields and SFTP long names) caused invalid memory accesses. Forwarding requests with a port above 65535 were truncated instead of refused.

Impact. Crashes of the session process and limited memory corruption.

Detection. Unexpected crashes of SSH proxy session processes during sessions.

WSA-2026-10-0705 — User certificates without principals were valid for any user of the domain
Ticket WAB-21161
Severity HIGH — CVSS 4.0 7.2 · CVSS 3.1 8.2
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE CWE-295 (Improper Certificate Validation)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Holder of any certificate signed by the domain CA
Exposure Domains with an SSH certificate authority that issues certificates without principals
Workaround Yes

Issue. A user certificate with an empty principal list was accepted for any login, unlike OpenSSH, which refuses it. Principals containing a comma or a

NULL character

were not rejected either.

Impact. A user holding a principal-less certificate signed by the domain CA can log in as any user of that domain, and reach their targets.

Workaround. Reissue certificates with the user’s login as principal ( ssh-keygen -s -n …).

Compatibility. Certificates issued without principals are refused, with « lacks a principal list » in the log. Reissue them with the user’s login as principal. As a temporary measure, the advanced global option require_cert_principals can be set to False.

Detection. Certificate logins where the certificate principals do not include the login.

WSA-2026-10-0706 — FIDO security key signatures were accepted without user presence
Ticket WAB-21162
Severity MEDIUM — CVSS 4.0 6.3 · CVSS 3.1 4.8
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE CWE-287 (Improper Authentication)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Malware or user with access to a workstation where the victim’s security key is plugged in
Exposure Users authenticating with FIDO keys ( sk-ecdsa, sk-ed25519)
Workaround None

Issue. Signatures from FIDO security keys were accepted even when the key did not report user presence (a physical touch), unlike OpenSSH.

Impact. Software on a workstation where the security key is plugged in can authenticate as the user without the user touching the key.

Compatibility. Plain FIDO keys generated with -O no-touch-required can no longer authenticate. Use keys that require a touch, or a certificate carrying the no-touch-required extension.

Detection. FIDO logins at times the key owner was not present.

WSA-2026-10-0707 — Disabled authentication methods and username changes were accepted during authentication
Ticket WAB-21163
Severity MEDIUM — CVSS 4.0 6.3 · CVSS 3.1 4.8
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE CWE-287 (Improper Authentication), CWE-863 (Incorrect Authorization)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Unauthenticated SSH client
Exposure Default configuration; methods disabled in the configuration, such as GSSAPI with disable_gssapi_auth
Workaround None

Issue. Authentication methods disabled in the configuration, such as GSSAPI/Kerberos when disable_gssapi_auth is set, were still processed if a client attempted them. The username could also change between authentication steps.

Impact. An administrator’s decision to disable a method did not reduce the exposed attack surface (see WSA-2026-10-0710), and the authentication steps of one user could be mixed with another’s.

Compatibility. Kerberos authentication is really unavailable when disabled. A client that changes username during authentication is disconnected, as with OpenSSH.

Detection. GSSAPI attempts on an appliance where GSSAPI is disabled.

WSA-2026-10-0708 — Command injection on the Bastion through connection policy proxy settings
Ticket WAB-21164
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 7.5
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE CWE-78 (OS Command Injection)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Administrator of connection policies, or a user whose directory login is used through ${user}
Exposure Connection policies with an SSH proxy (jump) host configured
Workaround Partial

Issue. The proxy host and login of a connection policy were inserted into a shell command line with an incomplete character filter. A login provisioned from a directory and used through the ${user} token reached the same command line.

Impact. Execution of commands on the Bastion host, with the rights of the SSH proxy.

Workaround. Do not use the ${user} token in proxy logins when directory logins can contain shell characters, and limit who can edit connection policies.

Compatibility. In 12.5.0, proxy hosts and logins containing characters other than letters, digits and ._@%+=:,/- are refused. In 12.0.27, those containing backticks, whitespace, backslashes or a leading – are refused. In both versions, the port must be between 1 and 65535.

Detection. Connection policy proxy settings containing shell characters, and unexpected processes started by the SSH proxy.

WSA-2026-10-0710 — Pre-authentication use-after-free and out-of-bounds read in GSSAPI
Ticket WAB-21244
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.8
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE CWE-416 (Use After Free), CWE-415 (Double Free), CWE-125 (Out-of-bounds Read)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Holder of a valid Kerberos ticket for the Bastion (no Bastion account needed)
Exposure Kerberos SSO configured on the SSH proxy (GSSAPI is offered by default)
Workaround Yes

Issue. In GSSAPI authentication, a second MIC message, or a keyboard-interactive request after the MIC, freed the GSSAPI context again. When no client mechanism matched, the proxy sent a mechanism read past its array. A new GSSAPI request reused the previous attempt’s state.

Impact. Use-after-free and double free before authentication, which crash the session process; code execution is not ruled out.

Workaround. Set disable_gssapi_auth when Kerberos authentication of users is not needed. On affected versions, this only takes full effect with the fix of WSA-2026-10-0707.

Detection. Unexpected crashes of SSH proxy session processes during GSSAPI authentication.

WSA-2026-10-0711 — Double free on an invalid target host key signature
Ticket WAB-21253
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-415 (Double Free)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious target, or attacker on the network path to the target
Exposure Default configuration, every SSH target connection
Workaround None

Issue. When connecting to a target, the proxy freed the target host key and signature after verification without clearing the pointers, and freed them again when the verification failed. Signature verification happens before the host key is checked against the stored one.

Impact. Double free in the session process, which crashes the user’s session; code execution is not ruled out.

Detection. Unexpected crashes of SSH proxy session processes when connecting to a target.

WSA-2026-10-0712 — Target host key pinning bypass through a different key type
Ticket WAB-21254
Severity HIGH — CVSS 4.0 7.2 · CVSS 3.1 8.0
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE CWE-295 (Improper Certificate Validation)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Attacker on the network path between the Bastion and the target
Exposure Default configuration ( server_pubkey_check = 1)
Workaround Yes

Issue. A target was treated as new when no key of the negotiated type was stored. An attacker could present another key type: the proxy accepted and stored it, although a key of a different type was already pinned. Key types stored for one port were also offered for another port of the same host, and long key paths were truncated.

Impact. An attacker between the Bastion and the target can read the target credentials the Bastion injects and the session data, and alter the session.

Workaround. Store the host keys of all targets, then set server_pubkey_check to 0.

Compatibility. A target that legitimately changes its host key type is refused until its stored key is removed.

Detection. Host keys of a new type stored for targets that already had a key.

After upgrading. Review the host keys stored since the period the appliance ran an affected version, and rotate the credentials of target accounts used over untrusted network paths.

WSA-2026-10-0713 — Memory corruption in the terminal emulator from session output
Ticket WAB-21255
Severity HIGH — CVSS 4.0 7.6 · CVSS 3.1 7.5
CVSS 4.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read), CWE-457 (Use of Uninitialized Variable)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user, or a malicious target
Exposure Default configuration, shell sessions
Workaround None

Issue. The session process feeds all shell output to a terminal emulator, for live view and for transcripts. Combining characters, wide characters on a one-column screen, extended-character table compaction, screen shrinking and resize sequences without a column count caused out-of-bounds writes and reads.

Impact. Crashes and heap data disclosed in transcripts and live view; code execution is not ruled out. Writes are limited to character cells.

Detection. Unexpected crashes of SSH proxy session processes, or corrupted transcripts.

WSA-2026-10-0714 — Command restrictions disabled by the Cisco and Huawei compatibility modes
Ticket WAB-21256
Severity MEDIUM — CVSS 4.0 6.0 · CVSS 3.1 5.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE CWE-636 (Not Failing Securely), CWE-704 (Incorrect Type Conversion or Cast)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user
Exposure cmds_compatibility set to cisco_huawei or huawei_b (advanced, non-default setting)
Workaround None

Issue. With cmds_compatibility set to cisco_huawei or huawei_b, the session analyzer compared the begin sequence with data of the wrong type. The resulting error, raised on the first output and the first keystroke, was logged and the data still forwarded, which disabled the kill and notify rules for the rest of the session.

Impact. An authorized user can run commands that kill patterns forbid, without the matching session events.

Detection. Analyzer errors in the SSH proxy logs on sessions that use these compatibility modes.

WSA-2026-10-0716 — Resource exhaustion through channel flow control and telnet data
Ticket WAB-21258
Severity HIGH — CVSS 4.0 7.1 · CVSS 3.1 6.5
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE CWE-400 (Uncontrolled Resource Consumption), CWE-835 (Infinite Loop)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user (also a malicious target)
Exposure Default configuration (channel window); telnet targets for the subnegotiation loop
Workaround None

Issue. Data received beyond the granted channel window was buffered without limit. On telnet sessions, an unterminated subnegotiation kept the session process spinning while target data grew the buffer. Window adjustments could also overflow.

Impact. An authenticated user or a target can exhaust memory and CPU on the Bastion host, affecting the other sessions.

Compatibility. As in OpenSSH, data past the window is buffered up to a tenth of the largest window granted; beyond that, the session ends.

Detection. SSH proxy session processes with abnormal memory or CPU use.

WSA-2026-10-0717 — Log injection through text supplied by clients and targets
Ticket WAB-21259
Severity MEDIUM — CVSS 4.0 6.9 · CVSS 3.1 5.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE CWE-117 (Improper Output Neutralization for Logs), CWE-150 (Improper Neutralization of Escape Sequences)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Unauthenticated SSH client, or a target
Exposure Default configuration
Workaround None

Issue. Disconnect messages, banners and service names from clients (before authentication) and from targets were written unescaped into the SSH proxy logs and session errors. rsyslog escaping covers only the syslog output, not the proxy file and console output.

Impact. An attacker can forge log entries, and send terminal escape sequences to anyone viewing the logs in a terminal.

Detection. Log lines from the SSH proxy containing control characters or forged entries.

Common information
CVE Not assigned
Exploitation WALLIX Bastion is not known to be under attack through these vulnerabilities.
Public disclosure No public exploit or disclosure was known at publication time.
Credits Found by the WALLIX internal security review. WSA-2026-10-0701 was reported through WALLIX support. WSA-2026-10-0702 was also reported independently by Synacktiv, whom WALLIX thanks for its responsible disclosure.
Distribution TLP:WHITE

Workarounds reduce exposure; they do not replace the fix.

References

Revision history

Revision Date Change
1 2026-10-16 Initial draft.
2 2026-10-21 Fixed versions corrected to the fixes actually shipped.
3 2026-10-22 Credit to Synacktiv added for WSA-2026-10-0702; wording of WSA-2026-10-0705.
4 2026-10-22 12.0.27 added to the advisories it fixes.

Contact & support. Customers can open a ticket on the WALLIX support portal, quoting the advisory ID.

Down-bold Down-bold DOWNLOAD ADVISORY

OCTOBER 2026

2026-10-26 – REST API Authorization Flaws (WSA-2026-10-0501 to 0507) – Bastion

2026-10-26 – REST API Authorization Flaws (WSA-2026-10-0501 to 0507) – Bastion

WSA-2026-10-0501 to WSA-2026-10-0507 · Release date 2026-10-26 · Last updated 2026-10-15 · TLP:WHITE

Overview

This bulletin covers seven flaws in the WALLIX Bastion REST API. In each case, an authenticated user reaches an API operation without holding the profile right that the web interface requires for the same operation. A WALLIX internal security review of REST API permission enforcement found all seven.

Each flaw needs a valid Bastion account. Any authentication method accepted by the REST API works: password, API key, X.509, Kerberos, SAML or OIDC. A user with the default user profile is enough for every flaw except the modification case of WSA-2026-10-0506, which needs view rights on groups.

Advisory ID Ticket Title CVSS 4.0 CVSS 3.1 Severity 12.0.x 12.X
WSA-2026-10-0501 WAB-20216 Any user can set or rotate target account credentials 9.4 9.9 CRITICAL 12.0.27 12.5.0
WSA-2026-10-0502 WAB-20290 Subprotocol list returned without the required right 5.3 4.3 MEDIUM Not affected 12.5.0
WSA-2026-10-0503 WAB-20285 Profile write endpoints reveal whether a profile exists 5.3 4.3 MEDIUM 12.0.27 12.5.0
WSA-2026-10-0504 WAB-20238 Authentication domain configuration readable without the right 5.3 4.3 MEDIUM 12.0.27 12.5.0
WSA-2026-10-0505 WAB-20236 License endpoint discloses Bastion user names 5.3 4.3 MEDIUM Not affected 12.5.0
WSA-2026-10-0506 WAB-20235 Group restrictions created and changed without the right 7.1 7.1 HIGH 12.0.27 12.5.0
WSA-2026-10-0507 WAB-20239 Session transferred files downloadable without the audit right 5.3 4.3 MEDIUM Not affected 12.5.0

The 12.0.x and 12.X columns give the version that fixes each flaw. Upgrading to 12.0.27 or 12.5.0 closes all seven flaws.

Severity follows the CVSS 4.0 score, and both scores are given for each advisory. CVSS 4.0 no longer has the Scope metric of CVSS 3.1, so the two scores can differ for the same flaw.

Four of the fixes refuse REST calls that used to be accepted: 0501, 0502, 0505 and 0507. Each advisory says so under Compatibility.

WSA-2026-10-0501 — Any user can set or rotate the credentials of target accounts

Ticket WAB-20216
Severity CRITICAL — CVSS 4.0 9.4 · CVSS 3.1 9.9
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CWE CWE-862 (Missing Authorization)
Affected → fixed 12.0.0 to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Endpoint `PUT /api/accountchangepassword/{account_id}/{password
Right required after the fix Devices: Modify
Workaround Partial

Issue. The endpoint changes the credential of a target account. With a request body it sets the value the caller supplies; with an empty body it rotates to a generated value. No right of the caller is checked, only the appliance’s Password Manager license. The web interface requires Devices: Modify for the same operation.

Exposure. The domain of the account has password change configured. The account is visible to the caller: if the caller’s profile has no target-group limitation, every account is visible.

Impact.

  • The attacker sets a credential of their choice on a privileged target account, such as root on a production host. Repeated on each visible account, this gives the attacker the current vault secret of all of them.
  • The Bastion writes the new value onto the target with its own plugin credentials. The attacker can then connect to the target directly, outside the Bastion and without recording, wherever the network allows it.
  • Automatic rotation locks legitimate users and processes out of shared or administrative accounts. Repeated across every visible account, it causes a broad outage.

Detection.

  • PUT /api/accountchangepassword/… calls from users without Devices: Modify, in the REST API logs.
  • Credential changes that match no scheduled rotation and no change by an administrator, in the Bastion audit logs.
  • Direct logins on targets with accounts the Bastion manages.

Workaround.

  • Configure a target-group limitation on low-privilege profiles. This reduces the scope; it does not close the flaw.
  • Remove the password change configuration from domains that do not need rotation. Side effect: credential changes stop working on those domains.

Compatibility. REST integrations that rotate credentials need a profile with Devices: Modify. Scheduled rotations performed by the Bastion are not affected.

After upgrading.

  • Review the credential change history over the period the appliance ran an affected version.
  • Rotate again, from an administrator account, every credential changed by a user without Devices: Modify.
  • Look for logins made outside the Bastion on the matching targets.

WSA-2026-10-0502 — The subprotocol list is returned without the required right

Ticket WAB-20290
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 4.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-862 (Missing Authorization)
Affected → fixed 12.0.x not affected (endpoint absent) · 12.1.0 to 12.4.x → 12.5.0
Endpoint GET /api/subprotocols (API 3.12)
Right required after the fix Devices: View, or Authorizations: Modify
Workaround None

Issue. When called with a target_group parameter, the endpoint checks view rights on target groups. Without that parameter, it returns the full list and checks nothing.

Impact. The caller learns the names of the subprotocols the Bastion supports, and whether VNC file transfer is enabled. These are product-level facts, the same on every appliance of the same version. No customer configuration is disclosed.

Detection. GET /api/subprotocols calls from users holding neither Devices (View or Modify) nor Authorizations: Modify, in the REST API logs.

Compatibility. Users holding neither Devices (View or Modify) nor Authorizations: Modify are now refused. This includes the default user profile, and profiles whose only right here is Authorizations: View.

WSA-2026-10-0503 — The profile write endpoints reveal whether a profile exists

Ticket WAB-20285
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 4.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-204 (Observable Response Discrepancy), CWE-862 (Missing Authorization)
Affected → fixed 12.0.0 to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Endpoint POST /api/profiles, PUT and DELETE /api/profiles/{profile_id} (API 3.8 and 3.12)
Right required after the fix Users: Modify, or Profiles: Modify, checked before the lookup
Workaround None

Issue. These operations look up the named profile before they check the caller’s rights, and the status code shows the result of that lookup:

Operation Profile exists Profile does not exist
POST 409 403
PUT 403 ( 409 for a built-in profile) 404
DELETE 403 404

Impact. The flaw confirms a guessed profile name; it cannot list profiles, read them or change them. Only custom profile names are new information, since built-in names are public. An attacker can use it for reconnaissance, for example to confirm that a backup operator profile exists before trying to obtain it.

Detection. Bursts of 403, 404 and 409 responses on /api/profiles for users without Profiles or Users rights.

Compatibility. No change for callers that could complete the request.

WSA-2026-10-0504 — An authentication domain’s configuration can be read without the required right

Ticket WAB-20238
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 4.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information)
Affected → fixed 12.0.0 to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Endpoint GET /api/authdomains/{domain_id} (API 3.8 and 3.12)
Right required after the fix Users: View, User groups: View, or Bastion settings: View (the same rule as for listing the domains)
Workaround None

Issue. Listing the domains requires a right. Reading one domain by its identifier or name requires none.

Impact. The response maps out how the Bastion authenticates its users:

  • the domain type
  • the LDAP/AD domain and external authentication references
  • 509 matching rules and search filters
  • attribute mappings and group mappings
  • for Azure domains, the entity_id and the client_id

An attacker can use this to choose an attack path against the identity provider, or to prepare targeted phishing. The endpoint also confirms whether a guessed domain name exists. Client secrets and private keys are masked, so no secret is returned.

Detection. GET /api/authdomains/{domain_id} calls from users holding none of the Users, User groups or Bastion settings rights.

Compatibility. No change for callers that could already list the domains.

WSA-2026-10-0505 — The license endpoint discloses Bastion user names to any user

Ticket WAB-20236
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 4.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information)
Affected → fixed 12.0.x and 12.1 to 12.3 not affected · 12.4.0 to 12.4.x → 12.5.0
Endpoint GET /api/licenseinfo, fields named_user_list, wsm_named_user_list and wsm_user_list (API 3.12)
Right required after the fix Bastion settings: View, for these three fields
Workaround None

Issue. The user lists were added to the license endpoint in 12.4.0, and they are returned without any right being checked.

Impact. A user without any right on users can list the Bastion’s user names, which helps password spraying and mapping the organization. The Web Session Manager list also gives the start and end time of each user’s sessions.

Detection. GET /api/licenseinfo calls that request the user-list fields, from users without Bastion settings.

Compatibility. named_user_list is no longer returned by default and must be requested in fields. The other license data (counts, enabled features, expiry date) stays readable by any authenticated user, as intended.

WSA-2026-10-0506 — Group restrictions can be created and changed without the group administration right

Ticket WAB-20235
Severity HIGH — CVSS 4.0 7.1 · CVSS 3.1 7.1
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE CWE-862 (Missing Authorization), CWE-285 (Improper Authorization), CWE-204 (Observable Response Discrepancy)
Affected → fixed 12.0.0 to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Endpoint POST and `PUT /api/{usergroups
Right required after the fix User groups: Modify or Target groups: Modify, checked before the group lookup
Workaround None

Issue. Before the fix, the restriction endpoints checked the following rights:

Operation Right checked
GET View on the group type
POST none
PUT View on the group type (read-only right)
DELETE Modify on the group type

These endpoints, and the group mapping endpoints of user groups, also answered 403 for an existing group identifier and 404 for an unknown one. A caller without any right could use this to find which group identifiers exist.

Impact.

  • Any user can add a kill restriction on a common command to every user group or target group. Every legitimate session that matches it is then terminated, which denies the Bastion’s core service.
  • With View rights on groups, an attacker can also rewrite existing restrictions and weaken the command controls applied to privileged sessions.

Detection.

  • Restrictions created or modified by users without Modify on the group type, in the Bastion audit logs.
  • Restrictions that no administrator recognizes.
  • Sessions killed by a restriction that no administrator set up.

Workaround. None. Until the upgrade, review the restrictions of all groups regularly.

Compatibility. REST integrations that manage restrictions need Modify on the matching group type.

After upgrading. Review the restrictions of every user group and target group. Remove or restore any restriction that no administrator created or changed.

WSA-2026-10-0507 — Files transferred during sessions can be downloaded without the audit right

Ticket WAB-20239
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 4.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE CWE-862 (Missing Authorization), CWE-204 (Observable Response Discrepancy)
Affected → fixed 12.0.x not affected (endpoint absent) · 12.3.0 to 12.4.x → 12.5.0
Endpoint GET /api/sessions/files/{session_id}[/download/{file_id}] (API 3.12)
Right required after the fix Bastion audit, checked before the session lookup
Workaround None

Issue. No audit right is checked on these endpoints, only session ownership. A user without the audit right can therefore list the files transferred during their own recorded sessions, and download them decrypted. The other session artifact endpoints (snapshots, traces, metadata) all require the audit right. The endpoints also answered 403 or 404 depending on whether a session identifier exists.

Impact. A user can get back, outside any audit workflow, the stored copy of a file they moved through a monitored session. This includes transfers that ICAP or DLP inspection flagged. Files from other users’ sessions are not exposed.

Detection. GET /api/sessions/files/… calls, and download calls in particular, from users without Bastion audit.

Compatibility. Users without Bastion audit can no longer list or download the files of their own sessions.

After upgrading. Where DLP or ICAP inspection is in use, review the downloads of transferred files by non-auditor users over the period the appliance ran an affected version.

Common information

CVE Not assigned
Exploitation WALLIX Bastion is not known to be under attack through these vulnerabilities.
Public disclosure No public exploit or disclosure was known at publication time.
Credits Found by the WALLIX internal security review.
Distribution TLP:WHITE

Workarounds reduce exposure; they do not replace the fix.

References

Revision history

Revision Date Change
1 2026-10-15 Initial draft.

Contact & support. Customers can open a ticket on the WALLIX support portal, quoting the advisory ID.

Down-bold Down-bold DOWNLOAD ADVISORY

OCTOBER 2026

2026-10-26 – RDP Proxy Vulnerabilities (WSA-2026-10-0601 to 0623) – Bastion

2026-10-26 – RDP Proxy Vulnerabilities (WSA-2026-10-0601 to 0623) – Bastion

WSA-2026-10-0601 to WSA-2026-10-0623 · Release date 2026-10-26 · Last updated 2026-10-22 · TLP:WHITE

Overview

This bulletin covers 20 flaws in the WALLIX Bastion RDP proxy and its session recording tools. A WALLIX internal security review found them.

They are reached from four positions:

  • Unauthenticated RDP client: anyone who can reach the RDP proxy port (0601, 0602).
  • Authenticated Bastion user, during a session they are authorized for.
  • Malicious or compromised target: any RDP server a Bastion user opens a session to can attack the proxy through that session.
  • Attacker on the network path, between the user and the Bastion or between the Bastion and the target (0612, 0613).
Advisory ID Ticket Title CVSS 4.0 CVSS 3.1 Severity Fixed in
WSA-2026-10-0601 WAB-21210 Pre-auth memory corruption from Connect Initial and Client Info 9.3 9.8 CRITICAL 12.0.27, 12.5.0
WSA-2026-10-0602 WAB-21215 Pre-auth out-of-bounds read and glyph cache overrun 6.9 8.6 MEDIUM 12.0.27, 12.5.0
WSA-2026-10-0603 WAB-21216 Channel array overflow with the proxy’s own channels 5.3 5.4 MEDIUM 12.0.27
WSA-2026-10-0604 WAB-21217 RemoteApp stack overflow when forwarding program fields 7.7 8.8 HIGH 12.0.27, 12.5.0
WSA-2026-10-0605 WAB-21218 Memory corruption in glyph caching and rasterization 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0606 WAB-21219 Out-of-bounds write in RDP 6.0/6.1 bulk decompression 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0607 WAB-21220 Out-of-bounds write in RemoteFX decoding 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0608 WAB-21221 Heap writes in session capture from drawing orders 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0609 WAB-21222 Heap write from Palette and Bitmap Update PDUs 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0611 WAB-21224 Heap overflow in Server Redirection processing 7.7 8.3 HIGH 12.0.27, 12.5.0
WSA-2026-10-0612 WAB-21225 Target TLS failure lets negotiation continue in cleartext 7.2 7.4 HIGH 12.0.27, 12.5.0
WSA-2026-10-0613 WAB-21226 Standard RDP Security accepted cleartext PDUs and bad MACs 4.9 5.9 MEDIUM 12.5.0
WSA-2026-10-0614 WAB-21227 Bypass of drive redirection read/write authorizations 5.1 6.9 MEDIUM 12.5.0
WSA-2026-10-0615 WAB-21228 Bypass of channel policies and clipboard DLP checks 7.1 6.5 HIGH 12.5.0
WSA-2026-10-0617 WAB-21230 Out-of-bounds reads and writes in clipboard and drive channels 5.3 7.6 MEDIUM 12.0.27, 12.5.0
WSA-2026-10-0619 WAB-21232 Target-triggered denial of service 6.0 6.1 MEDIUM 12.5.0
WSA-2026-10-0620 WAB-21233 Authenticated client denial of service 7.1 6.5 HIGH 12.5.0
WSA-2026-10-0621 WAB-21234 Incomplete or corrupted transfer audit records 5.3 4.3 MEDIUM 12.5.0
WSA-2026-10-0622 WAB-21235 Session secrets and file names in proxy logs 6.8 5.5 MEDIUM 12.5.0
WSA-2026-10-0623 WAB-21236 Recording tools: out-of-bounds reads and checksum bypass 5.2 4.6 MEDIUM 12.5.0

By CVSS 4.0 severity: 1 CRITICAL · 10 HIGH · 9 MEDIUM.

The Fixed in column gives the versions that fix each flaw. Upgrading to 12.5.0 closes all of them except WSA-2026-10-0603. Upgrading to 12.0.27 closes WSA-2026-10-0601 to WSA-2026-10-0609, WSA-2026-10-0611, WSA-2026-10-0612 and WSA-2026-10-0617.

Severity follows the CVSS 4.0 score, and both scores are given for each advisory. Where a flaw is triggered by a malicious or compromised target, the CVSS 4.0 vector sets AT:P (the attacker must control a target) and UI:P (a Bastion user must open a session to it). The crash of one session process counts as VA:L; memory exhaustion of the Bastion host, or code execution, as VA:H.

One fix changes behaviour after the upgrade: WSA-2026-10-0603, under Compatibility.

WSA-2026-10-0601 — Pre-authentication memory corruption in the RDP front from Connect Initial and Client Info PDUs
Ticket WAB-21210
Severity CRITICAL — CVSS 4.0 9.3 · CVSS 3.1 9.8
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Unauthenticated RDP client
Exposure Default configuration
Workaround None

Issue. The RDP front accepted several network data blocks in the MCS Connect Initial PDU. Each block added channels to a fixed 32-entry list, so a client could overwrite adjacent session memory with channel names and options it chose. Separately, a Client Info PDU without auto-logon kept a password length of up to 65535 bytes, and the proxy then copied up to about 64 KiB past the password buffer. Both PDUs are processed before the user authenticates.

Impact. An unauthenticated client can corrupt the memory of the RDP session process, with plausible code execution on the Bastion. The second flaw crashes the session process right after the copy.

Detection. Unexpected crashes of RDP proxy session processes, in particular for connections that never reached authentication.

WSA-2026-10-0602 — Pre-authentication out-of-bounds read and glyph cache overrun from client capabilities
Ticket WAB-21215
Severity MEDIUM — CVSS 4.0 6.9 · CVSS 3.1 8.6
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Unauthenticated RDP client (also a malicious target)
Exposure Default configuration
Workaround Partial

Issue. Capability sets shorter than their fixed fields were read past the end of the received data. The same parser handles target capabilities, so a target can trigger it too. A client advertising 255 glyph cache entries made the front glyph cache index past its 254 entries. Capabilities are processed before the user authenticates.

Impact. Out-of-bounds read and a limited write inside the session process, causing crashes or limited memory corruption.

Workaround. Setting [client] transform_glyph_to_bitmap (default off) prevents the glyph cache overrun. No workaround exists for the out-of-bounds read.

Detection. Unexpected crashes of RDP proxy session processes before authentication.

WSA-2026-10-0603 — Channel array overflow when forwarding client channels to the target
Ticket WAB-21216
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 5.4
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE CWE-787 (Out-of-bounds Write), CWE-121 (Stack-based Buffer Overflow)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27
Attacker Authenticated Bastion user
Exposure Default configuration (Session Probe enabled)
Workaround None

Issue. When opening the target connection, the proxy copied the client channels into a 32-entry channel array, together with the channels it adds itself (drive and sound redirection, Session Probe, clipboard launcher), without enforcing the array bound. A client announcing the maximum of 30 channels in a single network data block was enough to overflow it with the default configuration.

Impact. Out-of-bounds write in the session process with channel entries the proxy itself injects, which crashes the attacker’s own session.

Compatibility. Client connections whose channels, together with those the proxy adds, exceed the 32-channel limit are refused.

Detection. Unexpected crashes of RDP proxy session processes when a session opens to a target.

WSA-2026-10-0604 — Stack overflow when forwarding RemoteApp program fields to the target
Ticket WAB-21217
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.8
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE CWE-121 (Stack-based Buffer Overflow), CWE-787 (Out-of-bounds Write)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user (RemoteApp)
Exposure RemoteApp sessions with [mod_rdp] use_client_provided_remoteapp enabled (default off)
Workaround Yes

Issue. The proxy forwards the RemoteApp program, working directory and arguments sent by the client to the target, through a 16 KiB stack buffer. Fields of maximum length overran it by about 670 bytes. Long rail_exec arguments from the authorization configuration overran a smaller buffer through the same code.

Impact. Stack buffer overflow in the session process, causing a crash with plausible code execution.

Workaround. Keep [mod_rdp] use_client_provided_remoteapp disabled (default).

Detection. Unexpected crashes of RDP proxy session processes on RemoteApp sessions.

WSA-2026-10-0605 — Memory corruption in glyph caching, rasterization and order serialization
Ticket WAB-21218
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Default configuration
Workaround None

Issue. Malformed Cache Glyph and Glyph Index orders from the target caused stack and heap writes outside proxy buffers: oversized glyphs exceeded the rasterization buffer, order sizes overflowed, and cache identifiers and indexes were not checked. [mod_rdp] disabled_orders only changes the advertised capabilities; these orders were processed anyway.

Impact. Memory corruption in the session process, causing crashes with plausible code execution. Out-of-bounds data can reach the client or the session recording.

Detection. Unexpected crashes of RDP proxy session processes during sessions to a given target.

WSA-2026-10-0606 — Out-of-bounds write in RDP 6.0 and 6.1 bulk decompression
Ticket WAB-21219
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Default configuration
Workaround None

Issue. The RDP 6.0 and 6.1 (MPPC) bulk decompressors did not bound the match codes and history offsets sent by the target. Reads and writes went outside the 64 KiB history window and past the output buffer. The target chooses the decompressor for each packet; [mod_rdp] rdp_compression only sets what the proxy advertises.

Impact. Memory corruption in the session process, with plausible code execution.

Detection. Unexpected crashes of RDP proxy session processes during sessions to a given target.

WSA-2026-10-0607 — Out-of-bounds write in RemoteFX decoding
Ticket WAB-21220
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-190 (Integer Overflow), CWE-400 (Uncontrolled Resource Consumption)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure [mod_rdp] enable_remotefx enabled (default off)
Workaround Yes

Issue. The RemoteFX decoder accepted tile indexes outside the grid, region rectangles taller than the surface, dimensions truncated to 16 bits, empty surfaces and unbounded dimensions.

Impact. Reads and writes outside the decoding surface, with plausible code execution, and allocations of arbitrary size.

Workaround. Keep [mod_rdp] enable_remotefx disabled (default).

Detection. Unexpected crashes of RDP proxy session processes on sessions using RemoteFX.

WSA-2026-10-0608 — Out-of-bounds heap writes in session capture from target drawing orders
Ticket WAB-21221
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-190 (Integer Overflow)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Sessions with capture active (recording or OCR)
Workaround None

Issue. The clipping rectangle sent by the target was not intersected with the capture surface. LineTo, Polyline, EllipseSC and Mem3Blt orders then wrote outside the framebuffer, and rectangle edges computed on 16 bits wrapped past 32767. The same code runs when a recording is replayed.

Impact. Heap write in the session process at an offset and with a colour chosen by the target, with plausible code execution.

Detection. Unexpected crashes of RDP proxy session processes on recorded sessions, or of recording replay.

WSA-2026-10-0609 — Heap write from Palette Update and Bitmap Update PDUs
Ticket WAB-21222
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-190 (Integer Overflow)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Default configuration
Workaround None

Issue. The Palette Update parser used the 32-bit colour count sent by the target as an unchecked loop bound, writing entries past the palette on the heap. Bitmap widths from 65533 to 65535 made the aligned width wrap to zero, so no pixel storage was allocated before the write.

Impact. Heap memory corruption with data chosen by the target, with plausible code execution.

Detection. Unexpected crashes of RDP proxy session processes during sessions to a given target.

WSA-2026-10-0611 — Heap overflow in Server Redirection PDU processing
Ticket WAB-21224
Severity HIGH — CVSS 4.0 7.7 · CVSS 3.1 8.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-787 (Out-of-bounds Write), CWE-170 (Improper Null Termination)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Default configuration
Workaround None

Issue. The load-balance information of a Server Redirection PDU was copied at its wire length, up to 1024 bytes, into a 512-byte buffer. Host, user and domain names filling their buffer lacked a terminator but were read as strings. The PDU is parsed whatever the value of [mod_rdp] server_redirection_support.

Impact. Heap write with plausible code execution; out-of-bounds data reaches the authorization layer and the logs.

Detection. Unexpected crashes of RDP proxy session processes during sessions to a given target.

WSA-2026-10-0612 — A TLS failure towards the target lets the RDP negotiation continue in cleartext
Ticket WAB-21225
Severity HIGH — CVSS 4.0 7.2 · CVSS 3.1 7.4
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE CWE-319 (Cleartext Transmission of Sensitive Information), CWE-295 (Improper Certificate Validation)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Attacker on the network path between the Bastion and the target
Exposure Default configuration ( [server_cert] server_cert_check default value)
Workaround None

Issue. When the target certificate was rejected or the TLS handshake failed, the proxy kept the connection open and went on with the MCS and CredSSP exchanges in cleartext. With the default certificate check, presenting a rejected certificate is enough to reach this path.

Impact. An attacker between the Bastion and the target can intercept and alter the session, including the authentication exchange in which the Bastion injects the target credentials.

Detection. Target certificate rejections in the RDP proxy logs that were followed by a session instead of an error.

After upgrading. Rotate the credentials of the target accounts used over network paths you do not trust, since they may have crossed in cleartext.

WSA-2026-10-0613 — Standard RDP Security accepted cleartext client PDUs and ignored MACs
Ticket WAB-21226
Severity MEDIUM — CVSS 4.0 4.9 · CVSS 3.1 5.9
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE CWE-345 (Insufficient Verification of Data Authenticity), CWE-353 (Missing Support for Integrity Check)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Attacker on the network path between the user and the Bastion
Exposure [client] tls_fallback_legacy enabled (default off)
Workaround Yes

Issue. With legacy Standard RDP Security (RC4), the front accepted unencrypted client PDUs and did not verify the MAC of encrypted ones.

Impact. An attacker between the user and the Bastion can inject logon information, keyboard and mouse input and channel data into the session, and so run commands on the target as the user.

Workaround. Keep [client] tls_fallback_legacy disabled (default).

Detection. Clients connecting with Standard RDP Security instead of TLS, in the RDP proxy logs.

WSA-2026-10-0614 — Bypass of read and write authorizations on redirected client drives
Ticket WAB-21227
Severity MEDIUM — CVSS 4.0 5.1 · CVSS 3.1 6.9
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
CWE CWE-863 (Incorrect Authorization)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Drive redirection authorized in read-only or write-only mode
Workaround Partial

Issue. When writes to redirected client drives were denied, the target could still create, overwrite, truncate, rename or delete files, change metadata and use unclassified functions. Denied reads and writes also went through on already open handles, and unknown devices or fragmented requests skipped the checks.

Impact. The target can modify the files of a drive the user shared read-only, and read files despite a denied read right.

Workaround. Deny both read and write drive rights in the authorization, which disables drive redirection.

Detection. File operations on redirected drives that the authorization should have refused, in the session audit records.

WSA-2026-10-0615 — Bypass of virtual channel policies and clipboard DLP checks
Ticket WAB-21228
Severity HIGH — CVSS 4.0 7.1 · CVSS 3.1 6.5
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:L/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE CWE-863 (Incorrect Authorization), CWE-436 (Interpretation Conflict)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user (also a malicious target)
Exposure Default configuration, where channel, clipboard or DLP policies are set
Workaround None

Issue. A dynamic virtual channel creation request split across two chunks bypassed the deny list. Compressed chunks were relayed without inspection. A malformed clipboard capability set desynchronized the proxy from both ends. A DLP verdict for one transfer released text held for another.

Impact. A user can bypass the configured channel and clipboard policies and the antivirus/DLP analysis of transfers.

Detection. Channel or clipboard activity on sessions whose policy should forbid it.

WSA-2026-10-0617 — Out-of-bounds reads and off-by-one writes in clipboard and drive redirection channels
Ticket WAB-21230
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 7.6
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE CWE-125 (Out-of-bounds Read), CWE-170 (Improper Null Termination), CWE-193 (Off-by-one Error), CWE-787 (Out-of-bounds Write)
Affected → fixed 12.0.x up to 12.0.26 → 12.0.27 · 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user (also a malicious target)
Exposure Default configuration (drive items when drive redirection is authorized)
Workaround None

Issue. The clipboard and drive redirection parsers lacked bounds checks on file lists, unterminated 260-character names, path lengths, short capability sets and short channel headers. Full-length paths and names in target directory and rename requests wrote a terminator one byte past their buffer.

Impact. Disclosure of session process memory to the other side or to the logs, crashes, and one-byte or limited writes past fixed buffers.

Detection. Unexpected crashes of RDP proxy session processes during clipboard or drive activity.

WSA-2026-10-0619 — Denial of service of the RDP proxy triggered by the target
Ticket WAB-21232
Severity MEDIUM — CVSS 4.0 6.0 · CVSS 3.1 6.1
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H
CWE CWE-400 (Uncontrolled Resource Consumption), CWE-835 (Infinite Loop), CWE-369 (Divide By Zero), CWE-674 (Uncontrolled Recursion)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Malicious or compromised RDP target
Exposure Default configuration
Workaround None

Issue. Values sent by the target exhausted resources or hung the session process: a 32767×32767 bitmap from a few bytes, a division by zero, glyph recursion, tiling loops during capture, endless file reads, and unbounded announcements. An early end of file on a drive read also desynchronized drive redirection and let the target shrink a file on a writable managed drive.

Impact. Session processes crash or hang. Memory exhaustion on the Bastion host can affect the other sessions.

Detection. Session processes using abnormal memory or CPU, and memory pressure on the Bastion host.

WSA-2026-10-0620 — Denial of service of the RDP proxy by an authenticated client
Ticket WAB-21233
Severity HIGH — CVSS 4.0 7.1 · CVSS 3.1 6.5
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation of Resources Without Limits)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user
Exposure Default configuration (drive item when drive redirection is authorized)
Workaround None

Issue. A client device announcement with a large data length made the proxy allocate a zero-filled buffer of up to 4 GiB per device before any data arrived. At a client screen width of 16 pixels, the on-screen message code accessed an empty array.

Impact. Session processes crash. Memory exhaustion on the Bastion host can affect the other sessions.

Detection. Memory pressure on the Bastion host caused by one RDP session process.

WSA-2026-10-0621 — Incomplete or corrupted file transfer audit records
Ticket WAB-21234
Severity MEDIUM — CVSS 4.0 5.3 · CVSS 3.1 4.3
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE CWE-778 (Insufficient Logging)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Authenticated Bastion user (also a malicious target)
Exposure Default configuration
Workaround None

Issue. Removing a client drive during the session stopped the auditing of its transfers. Leftover bytes from an interrupted clipboard file list corrupted the names and sizes logged for the next transfer.

Impact. File transfer audit records are incomplete or wrong.

Detection. Drive removals during a session followed by file activity, in the session audit records.

WSA-2026-10-0622 — Session secrets and user file names exposed in the RDP proxy logs
Ticket WAB-21235
Severity MEDIUM — CVSS 4.0 6.8 · CVSS 3.1 5.5
CVSS 4.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE CWE-532 (Insertion of Sensitive Information into Log File)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Reader of the proxy logs or of the SIEM
Exposure Default configuration (passwords only with CredSSP/NLA debug traces enabled)
Workaround Partial

Issue. The proxy logged the auto-reconnect cookie of every session at INFO level, and the file names of every client directory listing. With CredSSP or NLA debug traces enabled (off by default), it also logged the credentials sent to the target, passwords included.

Impact. Anyone who can read the proxy logs or the SIEM learns session secrets and user file names, and passwords when debug traces are on.

Workaround. Restrict access to the proxy logs and keep the CredSSP/NLA debug verbosity at 0 (default).

Detection. Auto-reconnect cookies or credential dumps in the RDP proxy logs.

After upgrading. Purge or restrict the proxy logs and SIEM indexes that hold these entries. If CredSSP/NLA debug traces were ever enabled, rotate the credentials of the target accounts used during that period.

WSA-2026-10-0623 — Out-of-bounds reads and checksum bypass on forged session recordings
Ticket WAB-21236
Severity MEDIUM — CVSS 4.0 5.2 · CVSS 3.1 4.6
CVSS 4.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:H
CWE CWE-125 (Out-of-bounds Read), CWE-824 (Access of Uninitialized Pointer), CWE-345 (Insufficient Verification of Data Authenticity)
Affected → fixed 12.1.0 to 12.4.x → 12.5.0
Attacker Local user with write access to the recording storage
Exposure Recordings processed by the Bastion recording tools
Workaround Partial

Issue. The recording readers trusted the bounds of truncated or inconsistent chunks, and one tool used an uninitialised pointer. The recording verification tool let the recording under verification decide whether its hashes were compared at all.

Impact. A forged recording can leak memory into output files, crash the tools, and pass verification as intact after being altered.

Workaround. Restrict write access to the recording storage, and process only recordings that come from it.

Detection. Recording verifications that report no checksum comparison.

After upgrading. Re-verify the recordings whose integrity matters for audit or legal purposes.

Common information
CVE Not assigned
Exploitation WALLIX Bastion is not known to be under attack through these vulnerabilities.
Public disclosure No public exploit or disclosure was known at publication time.
Credits Found by the WALLIX internal security review.
Distribution TLP:WHITE

Workarounds reduce exposure; they do not replace the fix.

References

Revision history

Revision Date Change
1 2026-10-16 Initial draft.
2 2026-10-21 Fixed versions corrected to the fixes actually shipped.
3 2026-10-22 WSA-2026-10-0603 added (fixed in 12.0.27); 12.0.27 added to the advisories it fixes.

Contact & support. Customers can open a ticket on the WALLIX support portal, quoting the advisory ID.

Down-bold Down-bold DOWNLOAD ADVISORY

JULY 2026

WSA-2026-07-0002 Unauthenticated Authentication Bypass in the SAML Service Provider – Access Manager

2026-07-20- Unauthenticated Authentication Bypass in the SAML Service Provider – Access Manager

Release Date: 20 Jul 2026

Last Updated: 20 Jul 2026

Identifiers: WSA-2026-07-0002

Severity: HIGH- CVSS 4.0 Base 8.7 – CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

1. Executive Summary

⚠️ This vulnerability affects any Access Manager with a SAML federation configured.  Depending on the identity provider configuration, it may require no authentication and no user interaction.

A high-severity vulnerability has been identified in the SAML Service Provider of the WALLIX Access Manager portal. A remote attacker with network access to the portal can obtain an authenticated administrator session without valid credentials.

Because the Access Manager brokers access to a fleet of Bastions, an administrator session can reach the targets and privileged credentials the portal is configured to broker – i.e. the capabilities of a malicious Access Manager administrator. It does not grant administration of the Bastions themselves. We strongly urge affected customers to upgrade promptly and to review affected portals for signs of misuse. A security patch is available.

? Coordinated public disclosure – act before September.

The independent security researchers who reported these vulnerabilities intend to publish full technical details in September 2026 Once released, information useful to attackers will be in the public domain. Apply the fixes as soon as they are available and well ahead of the September disclosure.

Do not wait.

2. Affected Products & Scope

Product Impacted Versions Status
WALLIX Access Manager All versions with a SAML federation configured Vulnerable
WALLIX Access Manager Instances with no SAML federation configured Not affected (via this vector)
WALLIX Access Manager 5.1.10, 5.2.7, 6.0.4 and higher Patched

? The defect is present in every reviewed version and no remediation commit exists as of 5.1.9, 5.2.6 or 6.0.3.

? Risk Assessment

Exploitation requires network access to the portal’s SAML Assertion Consumer Service (ACS), exposed by default on 443. The attack surface is enabled as soon as at least one SAML federation domain exists on the portal — a common, documented enterprise deployment.

Depending on your identity provider configuration, exploitation may require no authentication at all, or the ability to observe one legitimate SSO login. In either case the result is a privileged, unauthenticated authentication bypass.

Hardened SAML settings do not mitigate this. Signature verification and IdP certificate pinning are performed and behave correctly; the vulnerability lies elsewhere in the validation flow.

3. Vulnerability Details

Type: CWE-347 (Improper Verification of Cryptographic Signature) ; CWE-290 (Authentication Bypass by Spoofing).

Description: A flaw in the portal’s SAML response validation allows a remote attacker to have a forged SAML response accepted as valid and to be logged in under an attacker-chosen identity and privilege level, including the highest-privileged profile

Technical exploitation details, indicators of compromise, and detection guidance are provided to customers in a dedicated, access-controlled Knowledge Base article ( WSA-2026-07-0002 – Unauthenticated Authentication Bypass in the SAML Service Provider – Access Manager), available through the support portal. They are intentionally withheld from this public advisory to protect customers until patch adoption is sufficiently widespread.

4. Detection

Unlike a silent credential bypass, this attack leaves traces in the portal application logs and in the front-end access logs. Log review is therefore meaningful.

Precise indicators of compromise and log-review guidance are provided to customers in WSA-2026-07-0002 via the support portal.

5. Resolution & Action Plan

✅ Recommended Action: Apply the Security Patch

Upgrade to WALLIX Access Manager 5.1.10, 5.2.7, 6.0.4 or higher. This is the only complete remediation.

The WALLIX ONE REMOTE ACCESS SaaS environments are already up to date.

The WALLIX ONE PAM SaaS environments are currently being updated by WALLIX, in coordination with our customers

After patching, and given that a session obtained through this flaw carries full administrative rights, we strongly recommend:

  • Audit accounts and configurationfor unexpected administrators (federated or local) and unauthorized changes.
  • Rotate Access Manager administrator and API credentials.
  • Because the portal fronts the managed Bastions, review privileged access and, where warranted, rotate secretson Bastions reachable from a compromised portal.
  • Remove any unrecognized JIT-provisioned federated users and invalidate their sessions.

⚠️ Interim Mitigations (until patching)

The SAML surface can be partially fenced:

  • Reduce exposure:disable or remove SAML federation domains that are not in active use; limit which organizations expose a SAML login.
  • Reduce exposure: Remove or rename profile of type Administrator on organizations which need SAML

These reduce risk but do not fully close the flaw. Upgrading remains the priority.

Credits

This vulnerability was discovered and responsibly reported by Fabien J. (SNS-Security). We thank SNS-Security for their coordinated disclosure.

Contact & Support

For assistance with the mitigation steps, please contact our support by opening a ticket on the support portal.

JULY 2026

WSA-2026-07-0001 Unauthenticated Privilege Escalation in REST API – WALLIX Bastion

2026-07-20 – Unauthenticated Privilege Escalation in REST API – Bastion

[SECURITY ADVISORY] Unauthenticated Privilege Escalation in REST API – WALLIX Bastion

Release Date: 20 Jul 2026

Last Updated: 20 Jul 2026

Identifiers: WSA-2026-07-0001

Severity: CRITICAL – CVSS 4.0 Base 10.0 – CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

1. Executive Summary

This vulnerability affects any operational Bastion 12.3 and 12.4.0 in any configuration.

It requires no authentication, no user interaction, and no special settings.

A critical vulnerability has been identified in the WALLIX Bastion REST API. A remote, unauthenticated attacker with network access to the API endpoint can obtain full administrative privileges on the appliance.

Successful exploitation grants complete control over the Bastion, including its configuration, its vault of privileged credentials, and its session recordings. We strongly urge all affected customers to upgrade without delay and to treat affected appliances as potentially compromised. A security patch is available.

? Coordinated public disclosure – act before September.

The independent security researchers who reported these vulnerabilities intend to publish full technical details in September 2026 Once released, information useful to attackers will be in the public domain. Apply the fixes as soon as they are available and well ahead of the September disclosure.

Do not wait.

2. Affected Products & Scope

Product Impacted Versions Status
WALLIX Bastion All versions 12.0.x Not affected
WALLIX Bastion All versions prior to 12.3.0 Not affected
WALLIX Bastion All versions from 12.3.0 to 12.3.6 Vulnerable
WALLIX Bastion Version 12.4.0 Vulnerable
WALLIX Bastion Version 12.3.7
Version 12.4.1 and higher		 Patched

The affected code path was introduced in the 12.3 branch. Versions below 12.3 are not affected.

? Risk Assessment

Exploitation requires only network access to the REST API endpoint (typically exposed on HTTPS / 443) on an operational appliance. No credentials, valid session, or user interaction are needed. Any Bastion actively in service should be considered exposed.

3. Vulnerability Details

Type: CWE-290 (Authentication Bypass by Spoofing) / CWE-287 (Improper Authentication).

Description: Under certain conditions the REST API authentication layer can be induced to grant a privileged administrative session without valid credentials.

Access: Remote, network access to the API endpoint. No authentication required.

Technical exploitation details are intentionally withheld to protect customers until patch adoption is sufficiently widespread.

4. Detection & Indicators of Compromise

State-changing actions are logged. Operations that modify state (creating/editing users, changing configuration) are recorded in /var/log/wabaudit.log. Entries follow this format:

wabengine: [wabaudit] action= » » type= » » object= » » user= » » client_ip= » » infos= »« These informations are also sent to a SIEM system if configured.Primary indicator — administrator creation performed by the internal service account identity. A session obtained through this vulnerability acts as an internal service account principal from the loopback address. Any wabaudit.log entry such as the following is highly suspicious, because a legitimate administrator action is never recorded this way:Jul  4 14:12:07 bastion wabengine: [wabaudit] action= »add » type= »XXX » object= »XXX » user= »XXXX » client_ip= »127.0.0.1″ infos= »cn [‘backdoor’], profile [‘product_administrator’], userPassword [‘********’], userauths [‘local_password’ ] »Look in particular for:

  • client_ip= »127.0.0.1″ on any state-changing action (action= »add », « edit », « delete ») — especially type= »User » creating a product_administrator. This actor/IP pair for administrative changes is the strongest indicator of exploitation.
  • Creation of administrator accounts you did not provision, or configuration/authorization changes with no matching interactive administrator login.

Review scope: examine /var/log/wabaudit.log (and rotated archives) — and, for credential-checkout activity, /var/log/vault-activity.log — across the entire window during which an affected version was network-reachable. Log review can confirm compromise but can never rule it out.Exploitation can be entirely invisible.Control Release of first version affected is 10 Feb 2026 , if you don´t have a logs retention (either on Bastion or in SIEM) before this date or installation of vulnerable version, you will not be able to assert if a exploitation was made.Absence of evidence must not be interpreted as absence of compromise. Treat any affected, network-reachable appliance as potentially fully compromised, including all vault secrets.

5. Resolution & Action Plan

Recommended Action: Apply the Security Patch

Upgrade to WALLIX Bastion 12.4.1 or higher. This is the only effective remediation.The WOPAM SaaS environments are currently being updated by WALLIX, in coordination with our customers.Because exploitation may leave no trace (see §4), after patching we strongly recommend, if you can not assert that no exploitation was made:

  • Rotate all secrets held in the vault(target account passwords, SSH keys, API keys). Assume every secret the appliance stored may have been read.
  • Rotate Bastion administrator and API credentials.
  • Audit accounts and configurationfor unexpected administrators or unauthorized changes, using the indicators in §4.

Credits

This vulnerability was discovered and responsibly reported by Fabien J. (SNS-Security). We thank SNS-Security for their coordinated disclosure.

Contact & Support

For assistance with the mitigation steps, please contact our support by opening a ticket on the support portal.