Skip to content
Threat Feed
Subscribe

Tag

Bloodhound

3 briefs RSS
high advisory

CVE-2026-59255: Missing Authorization in BloodHound Custom Node API

An authenticated attacker can exploit CVE-2026-59255, a missing authorization vulnerability in BloodHound versions through 9.4.0's custom-nodes API endpoints, to modify the global graph schema by creating, updating, or deleting custom node types, affecting all users and tenants.

BloodHound vulnerability authorization api-exploitation
4t 1c
high advisory

BloodHound Data Collection Activity

Adversaries may use the SharpHound tool to collect Active Directory data, saving it into default JSON files for BloodHound analysis, potentially leading to privilege escalation or lateral movement.

Active Directory bloodhound active-directory reconnaissance privilege-escalation
2r 6t
medium advisory

BloodHound Suite User-Agent Detected in Entra ID Sign-ins

Detection of BloodHound tools like AzureHound and SharpHound being used to enumerate Microsoft Entra ID and Microsoft 365 environments, potentially indicating reconnaissance activity by red teams or malicious actors.

Microsoft Azure +2 azuread bloodhound enumeration discovery
3r 6t