NEOMSA APIM 4.6.0 Eliminates All Critical and High Vulnerabilities Registered in FSTEC BDU
Neoflex has released NEOMSA APIM 4.6.0, an on-premise API management platform and API Gateway. The main focus of this version is raising the security posture of the product supply chain.
Within the secure development lifecycle (SSDLC), engineers created an SBOM in CycloneDX format, scanned all components and transitive dependencies for known vulnerabilities using Grype, and mapped results to the FSTEC BDU database. After updating vulnerable libraries, the number of registered findings dropped from 57 to 7, with no Critical or High issues remaining in the final build.
Product overview
NEOMSA APIM includes an API Gateway, lifecycle management, authentication and authorization supporting OAuth 2.0, JWT and mTLS, rate limiting, traffic analytics, and a Developer Portal. It works with OpenAPI contracts and deploys on customer infrastructure, including Kubernetes, without sending traffic or metadata to the vendor cloud.
Release verification process
The security check follows a single pipeline:
- Build the release candidate with a frozen set of components.
- Generate the CycloneDX SBOM.
- Scan with Grype against CVE and GHSA databases.
- Map findings to the current FSTEC BDU export and assign severity, risk, and remediation status.
- Apply the Security Gate: the build is blocked until all Critical and High FSTEC BDU entries are resolved.
Medium and Low findings are recorded but do not block release; they are tracked for subsequent dependency updates.
Results
Updates eliminated all 10 Critical and 24 High vulnerabilities. Medium findings fell from 19 to 7, and all 4 Low findings were removed. The final 4.6.0 build contains no Critical or High entries from the FSTEC BDU at the time of the report.
Customers receive a controlled, auditable component list, a consolidated security report, and documented evidence that the product passed a formal security gate before shipment.
Related articles
Cisco Publishes 12 Security Advisories Fixing Critical Flaws in Catalyst SD-WAN and IOS XE
Cisco Systems released 12 new security advisories on August 5, 2026, disclosing a total of 23 vulnerabilities across multiple products. Two advisories covering Cisco Catalyst SD-WAN Software and Cisco IOS XE Software received the highest Critical severity rating. The SD-WAN advisory addresses five issues, including CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, each scoring 9.9 on CVSSv3.1. The IOS XE advisory details seven vulnerabilities, with CVE-2026-20272 rated 9.8 and CVE-2026-20267 rated 9.0. Additional advisories cover flaws in Integrated Management Controller, RoomOS, and Terminal Services Agent. Organizations are urged to apply the hardening releases immediately to mitigate remote exploitation risks.
Head Mare Hackers Exploit TrueConf Servers to Distribute PhantomCore and PhantomGraph Backdoors
Russian organizations have been targeted in a new campaign by the Head Mare group, which compromises unpatched TrueConf servers to deliver backdoors. Attackers chain vulnerabilities KLCERT-26-057 and KLCERT-26-058 to execute arbitrary code with maximum privileges on affected servers. They then replace a server file with a web shell to explore the victim's infrastructure, access the TrueConf database, and substitute the client installer. Victims are tricked via social engineering into downloading the malicious client during video conferences without any suspicious emails. The campaign affects TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases. Kaspersky researchers recommend immediate updates to patched versions 5.3.9, 5.4.9, and 5.5.5 released on 18 June 2026. The threat extends beyond direct TrueConf users, as any employee invited to a compromised server can inadvertently install the backdoor.
Zapscape Flaw in KVM Breaks Nested Virtualization Isolation Allowing L1 Guest Root Code Execution on Linux Host
The Zapscape vulnerability (CVE-2026-64561) affects KVM/x86 in the Linux kernel and enables an attacker with kernel privileges inside an L1 virtual machine to escape to the host and execute code as root. The flaw occurs in the shadow MMU when handling page faults for nested guests, specifically due to an incorrect order of stale root condition checks that leads to a use-after-free condition. This weakens the isolation between the host and L1 guests precisely when nested virtualization is enabled for potentially untrusted tenants. A public proof-of-concept demonstrates the escape by creating a file named /Zapscape owned by root on the host. The issue impacts Linux kernels starting from version 5.9, with fixes already merged into stable branches including 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2 rc5. On Intel systems the attack requires EPT page walk lengths 4 and 5 to be exposed to the L1 guest, while no equivalent condition is documented for AMD. Organizations are advised to apply patches promptly or disable nested virtualization for untrusted workloads.
Cisco Patches Seven Critical IOS XE Vulnerabilities Including CVSS 9.8 Command Injection Flaw
Cisco has released security updates to address seven vulnerabilities in IOS XE, the operating system powering routers, switches, wireless controllers, and other enterprise network devices. The highest-severity issue, tracked as CVE-2026-20272 with a CVSS score of 9.8, stems from improper handling of special elements in commands and could enable remote command injection, unauthorized operations, and full device compromise over the network. Additional flaws impact memory management, resource lifecycle, numeric calculations, execution flow, and input validation, potentially leading to buffer overflows, out-of-bounds writes, crashes, infinite loops, and directory traversal. The vulnerabilities affect IOS XE versions 17.9, 17.12, 17.15, 17.18, and 26.1 in both standalone and controller modes regardless of configuration. Fixed releases include 17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, and 26.1.2, with no available workarounds. The issues were discovered during internal testing that incorporated advanced AI models, and no evidence of public exploitation has been observed.