---
title: "Security digest: June 30, 2026"
url: https://erroneo.us/security/2026-06-30/
description: "June 30, 2026 vulnerability digest: 2 briefs (NetScaler CVE-2026-8452: DoS Bug Exploited as…); 4 critical advisories (Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-06-30
date_modified: 2026-08-26
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 30, 2026

2 editorial briefs and 4 critical advisories.

## Take stock

- Act now: NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE . Owners of customer-managed NetScaler ADC or Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or using SAML, on builds older than 14.1-72.61 or 13.1-63.18.
- Check exposure: ColdFusion CVE-2026-48282: Exploited RDS Path Traversal . Anyone running ColdFusion 2025 Update 9 or 2023 Update 20 and earlier, most urgently servers where Remote Development Services (RDS) is enabled, unauthenticated, and reachable from untrusted networks.
- Go: 4 critical advisories ( github.com/fission/fission ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE](https://erroneo.us/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/index.md): Any NetScaler configured as a Gateway or AAA server that is still below the June 30 builds needs patching today and a check for web shells; the bug the vendor called DoS is a public pre-auth RCE under attack.
- **Check exposure** [ColdFusion CVE-2026-48282: Exploited RDS Path Traversal](https://erroneo.us/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/index.md): Every ColdFusion 2023/2025 server should already be on the June updates; if RDS was enabled without authentication and reachable, assume the box may be compromised and hunt.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2026-50545](https://erroneo.us/security/cve/CVE-2026-50545/index.md) Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover — Go github.com/fission/fission <= 1.23.0 → 1.24.0
- [CVE-2026-50563](https://erroneo.us/security/cve/CVE-2026-50563/index.md) Fission Container Executor Function PodSpec Injection Leading to Node Escape — Go github.com/fission/fission <= 1.23.0 → 1.24.0
- [CVE-2026-50566](https://erroneo.us/security/cve/CVE-2026-50566/index.md) Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation — Go github.com/fission/fission <= 1.23.0 → 1.24.0
- [CVE-2026-50564](https://erroneo.us/security/cve/CVE-2026-50564/index.md) Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape — Go github.com/fission/fission <= 1.23.0 → 1.24.0

---
Source page: https://erroneo.us/security/2026-06-30/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt