US Election Assistance Commission Website Disclosed to Have Critical Remote Code Execution Vulnerability

October 31: Cybersecurity firm XBOW disclosed that it found an unauthenticated, critical-severity remote code execution vulnerability in a public web application of the US Election Assistance Commission (EAC). The application is used for resource and logistics calculations and is not a voting machine or voter registration system. The vulnerability could allow attackers to execute code with root privileges in a backend container via crafted web requests, and to access locally protected resources and external networks. XBOW said it reported the issue in accordance with the vulnerability disclosure policy published by the EAC, and that after verification by the EAC team, the vulnerability was fixed before the US federal midterm elections.