---
title: "Security digest: March 4, 2026"
url: https://erroneo.us/security/2026-03-04/
description: "March 4, 2026 vulnerability digest: 1 brief (Cisco FMC CVE-2026-20079: Exploited Pre-Auth…); 9 critical advisories (crates.io (Rust), Go, Maven). What to…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-03-04
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 4, 2026

1 editorial brief and 9 critical advisories.

## Take stock

- Act now: Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass . Every organization running on-premises Cisco Secure Firewall Management Center, most urgently where the FMC web interface is reachable from the internet or from broad internal networks.
- crates.io (Rust): 4 critical advisories ( dnp3times , time_calibrators , time_calibrator , zeptoclaw ). Check with cargo audit .
- Go: 3 critical advisories ( github.com/zitadel/zitadel , github.com/zitadel/zitadel/v2 , github.com/filebrowser/filebrowser/v2 , github.com/siyuan-note/siyuan/kernel ). Check with govulncheck ./... .
- Maven: 2 critical advisories ( org.pac4j:pac4j-jwt , org.apache.activemq:artemis-server , org.apache.artemis:artemis-server ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass](https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/index.md): If you run an on-prem Cisco Secure FMC that is not on a September 2026 hardening release, upgrade now and check it for compromise; state and ransomware actors are using this bug to take root on the box that controls your firewalls.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-xhw7-jhmp-j62j](https://erroneo.us/security/ghsa/GHSA-xhw7-jhmp-j62j/index.md) `dnp3times` was removed from crates.io due to malicious code — crates.io (Rust) dnp3times >= 0 → no fix
- [GHSA-wf45-3gpw-vrqv](https://erroneo.us/security/ghsa/GHSA-wf45-3gpw-vrqv/index.md) `time_calibrators` was removed from crates.io due to malicious code — crates.io (Rust) time_calibrators >= 0 → no fix
- [CVE-2026-29191](https://erroneo.us/security/cve/CVE-2026-29191/index.md) ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint — Go github.com/zitadel/zitadel >= 4.0.0, < 4.12.0 → 4.12.0; Go github.com/zitadel/zitadel/v2 >= 4.0.0, < 4.12.0 → 4.12.0
- [CVE-2026-29000](https://erroneo.us/security/cve/CVE-2026-29000/index.md) pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT — Maven org.pac4j:pac4j-jwt >= 6.0.4.1, < 6.3.3 → 6.3.3; Maven org.pac4j:pac4j-jwt >= 5.0.0-RC1, < 5.7.9 → 5.7.9; Maven org.pac4j:pac4j-jwt < 4.5.9 → 4.5.9
- [CVE-2026-27446](https://erroneo.us/security/cve/CVE-2026-27446/index.md) Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions — Maven org.apache.activemq:artemis-server >= 2.11.0, <= 2.44.0 → no fix; Maven org.apache.artemis:artemis-server >= 2.50.0, < 2.52.0 → 2.52.0
- [CVE-2026-29188](https://erroneo.us/security/cve/CVE-2026-29188/index.md) File Browser's TUS Delete Endpoint Bypasses Delete Permission Check — Go github.com/filebrowser/filebrowser/v2 <= 2.61.0 → 2.61.1
- [GHSA-77xj-rrh3-wx3v](https://erroneo.us/security/ghsa/GHSA-77xj-rrh3-wx3v/index.md) `time_calibrator` was removed from crates.io due to malicious code — crates.io (Rust) time_calibrator >= 0 → no fix
- [CVE-2026-29183](https://erroneo.us/security/cve/CVE-2026-29183/index.md) SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260304034809-d68bd5a79391 → 0.0.0-20260304034809-d68bd5a79391
- [GHSA-5wp8-q9mx-8jx8](https://erroneo.us/security/ghsa/GHSA-5wp8-q9mx-8jx8/index.md) zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards — crates.io (Rust) zeptoclaw <= 0.6.1 → 0.6.2

---
Source page: https://erroneo.us/security/2026-03-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt