Security Advisories

Published vulnerabilities and disclosures

In the interest of transparency, we publish advisories for security issues identified and patched in AftPak products — whether found by our own research team or reported through the Bug Bounty Program.

HighPatched

Privilege Escalation via Misconfigured Role Inheritance in ERP Approval Workflows

A misconfigured role-inheritance check in custom approval-workflow builders allowed a low-privilege user to approve their own high-value transactions under specific delegation chains. Patched in the June 2026 release.

AftPak Enterprise ERP · 2026-06-18 · CVE-2026-41022

MediumPatched

Insufficient Authentication in Legacy Ground-Link Telemetry Handshake

A legacy compatibility mode in the ground-link telemetry handshake accepted a weaker authentication path than the primary protocol, under a narrow fallback condition. Patched; legacy mode is now opt-in and logged.

AstroSec Ground Link Module · 2026-04-02 · CVE-2026-38914

MediumPatched

Race Condition in Concurrent Firewall Rule Deployment

Two administrators deploying rule changes to the same firewall cluster within the same short window could, in rare cases, end up with an inconsistent rule set applied to a subset of nodes. Patched with a deployment-lock mechanism.

AftPak Custom Firewalls · 2026-02-11

Found something?

If you've identified a vulnerability in an AftPak system, report it through our Bug Bounty Program or review our Vulnerability Disclosure Policy.