Derek Haber

Red Team Operator @ Armadin. Opinions expressed here are my own, and not of my employer.

[Armadin @ArmadinSecurity]

Armadin researcher @mhskai2017 has uncovered an authenticated RCE vulnerability in Skype for Business Server (CVE-2026-70297, CVSS 8.8).

An attacker can exploit a path traversal vulnerability to write arbitrary files to the server while holding a valid token that can access any chat room with file-upload feature supported. No user interaction required. Patch immediately.

Updates are available for Skype for Business Server 2019 CU8, 2015 CU13, and Subscription Edition CU1.

Microsoft advisory: https://t.co/AtDO2Tkg9L

[Armadin @ArmadinSecurity]

Armadin researcher @mhskai2017 has uncovered two authenticated RCE vulnerability affecting Dell OpenManage Integration and Lenovo XClarity Integration with Windows Admin Center (CVE-2026-101207 and CVE-2026-65949, both High severity CVSS 8.8).

A domain user credential is enough to gain SYSTEM on the WAC host, hijack admin sessions, and move laterally to every asset it manages. Patch immediately.

Advisory and mitigation details: https://t.co/zxhmewkFsB and
https://t.co/GAWK5NujrQ

[Derek Haber @TheCowboyHacker]

A week from today I’m presenting at @WWHackinFest! I’ll be sharing how offensive security operators can stay irreplaceable in the age of AI.

We’ll cover our Application-First methodology and why humans still catch critical vulns that frontier LLMs miss.

https://t.co/GBCoQoV7V5

[Derek Haber @TheCowboyHacker]

Another CVE from our amazing team. @0xc0ffee_ =🐐

[Armadin @ArmadinSecurity]

Armadin researcher @0xc0ffee_ has uncovered a critical unauthenticated RCE vulnerability affecting all versions of SailPoint IdentityIQ (CVE-2026-12342).

Given IdentityIQ handles sensitive credentials and access, this flaw presents a high risk of secret exposure and lateral movement into internal networks. Patch immediately.

Advisory and mitigation details: https://t.co/SPjXKyFl3L

[Armadin @ArmadinSecurity]

The ARM chain was not the only finding our team turned up this cycle. Two more CVEs landed in SolarWinds Observability Self-Hosted, CVE-2026-28324 and CVE-2026-28325.

Both unauthenticated RCE, both fixed in 2026.2.3. All three were discovered by our senior capability researcher, @mhskai2017.

Note that all three RCEs affect ALL versions.

We'll provide details on these in two weeks.

[Armadin @ArmadinSecurity]

Our team recently discovered Unauthenticated Remote Code Execution inside of SolarWinds ARM (Access Right Manager) by chaining multiple bugs. We are holding the write-up until the vendor's customers are protected.

We'll publish the full chain in two weeks.

[0xc0ffee / Ilyass El Hadi @0xc0ffee_]

Chained multiple vulnerabilities in Cleo Harmony to go from a self-registered low-priv user to code execution on the host. 2 new CVEs, and patched in 5.8.1.11. @ArmadinSecurity

Check out the technical blog post: https://t.co/KmhWmT1KXr

[jotter @jotter_jotter]

Check out my new blog on extracting Primary Refresh Token cookies remotely using InteractiveToken scheduled tasks!

Tool in comments.

https://t.co/BwodRxfa0O

[Derek Haber @TheCowboyHacker]

I will be speaking at @WWHackinFest in Deadwood, SD this year! I'm super excited to share how practitioners can stay relevant, and keep ahead of the AI curve. Below I have my abstract linked. Excited to see y'all there!

https://t.co/GBCoQoV7V5

[Derek Haber @TheCowboyHacker]

New Armadin research is live! @0xc0ffee_ and I chained four weaknesses in ERPNext (Frappe) to go from a heavily restricted customer role all the way to Remote Code Execution.

Full write-up: https://t.co/GxQVpaG0V3

[Armadin @ArmadinSecurity]

Found a CLAUDE.md file sitting publicly readable on a customer's auction site. It's the file devs leave behind for their AI coding assistant, and it leaked the whole app architecture.

That was link one. A broken auth check and SQL injection later, we'd inserted our own admin account and had the server running our code.

Every bug was ordinary on its own. Chained together, full takeover.

Episode 2 of "Kill Chains and Coffee" covers it start to finish: https://t.co/Kx6VST02Oz

[Armadin @ArmadinSecurity]

We found a full sandbox escape in Claude Cowork on Windows: DLL sideloading, then undocumented parameters to reach root access. Anthropic disputes it's a security issue. We think the visibility gap tells a different story: https://t.co/cjp63wEalI

[Nick @kulinacs]

It's always been a dream of mine to write tooling focused on living in a Virtual Machine on target, but Virtual Machines are almost never running on targets.

Claude Cowork changes that!

https://t.co/t1WtfqNMt3

[Derek Haber @TheCowboyHacker]

Our team at Armadin just published new research! Check out Steven and James' post on passback attacks that could lead to domain compromise.

Plus, they came across two XSS findings in the process

https://t.co/YVp2AH76de