CVE-2026-68503
Critical · 9.8CVSS
9.8
EPSS
0.8%
Published
Jul 30, 2026
CISA due date
—
The record
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
- CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
- CVE-2026-46386 OpenProject is open-source, web-based project management software. CWE-1392
- CVE-2026-44273 Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default… CWE-1392
- CVE-2026-32652 Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials"… CWE-1392
- CVE-2026-50005 Brickcom cameras ship with default credentials that allows any unauthenticated remote… CWE-1392
- CVE-2026-9844 Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology… CWE-1392
- CVE-2026-42941 The Danelec MacGregor Voyage Data Recorder device includes a default username and… CWE-1392