Robotic Process Automation (RPA) for penetration testing

We protect your findings with the same rigor we use to find them.

This certification validates that your data is governed by a continuously reviewed system of security controls covering access management, risk assessment, incident response, physical security, and asset management.

For your team, this means audited, third-party proof of our security practices, helping reduce friction during vendor reviews and procurement assessments.

👉 See our certification 👈

We added detection for CVE-2026-1281 (Ivanti Endpoint Manager Mobile RCE) into the Network Vulnerability Scanner and paired it with exploit validation in Sniper.

Why it matters

Unauthenticated. Remote. Full server compromise.

CVE-2026-1281 allows attackers to execute arbitrary commands on exposed Ivanti EPMM servers without credentials. Public reporting confirms active exploitation, and proof-of-concept code is available.

Because EPMM servers often integrate with identity systems and manage mobile fleets, compromise can provide attackers with a direct path into enterprise infrastructure.

How to use

Detect exposed Ivanti EPMM instances with the Network Scanner → validate exploitability with controlled proof-of-concept execution in Sniper → re-scan after patching to confirm remediation

We added an exclusive exploit for CVE-2026-24061 (GNU Inetutils Telnetd) into Sniper and paired it with Network Scanner detection, available exclusively to Pentest-Tools.com customers.

Why it matters

This critical authentication bypass (CVSS 9.8) lets unauthenticated attackers gain immediate root access via a malicious USER environment variable. With over 200,000 instances exposed globally, it is a high-impact target for mass exploitation against legacy and embedded systems.

How to use

Detect with the Network Scanner → validate the risk with a one-click proof-of-concept in Sniper → check for forensic traces of exploitation to assist your post-compromise hunting. 

The Website Scanner and API Scanner already display findings while the scan runs. Scan logs now also record the exact moment when a new finding is added directly in the console output.

This provides a more granular, step-by-step view of discovery as the scan progresses.

Why this matters:

• See the precise moment a vulnerability is identified during longer scans

• Correlate findings with specific scan phases or payloads

• Troubleshoot unexpected behavior with additional context

• Gain better traceability in API-driven or automated workflows

For teams running continuous or automated testing, this adds clearer operational insight during the scan itself, not only after it finishes.

The Network Vulnerability Scanner now detects CVE-2025-62507, a remote code execution vulnerability affecting Redis.

This check helps identify Redis instances that may be exposed to this vulnerability, particularly in internet-facing deployments or misconfigured internal environments.

Why this matters:

• Identify Redis servers vulnerable to remote code execution

• Detect exposed or improperly configured Redis deployments

• Prioritize remediation for systems reachable from external networks

• Add coverage for Redis environments in continuous network scanning

If you run Redis in production or development environments, this detection helps you quickly assess potential exposure.

👉 Know your Redis exposure

You can now filter scan results by tool ID when calling the GET /scans endpoint.

This update allows you to combine tool and start_time filters to return only the scans you care about, making it easier to work with large scan histories and automate downstream workflows.

Use this to:
• Build tool-specific dashboards
• Generate targeted reports
• Reduce post-processing in API consumers

👉 See the updated API documentation 👈