Attackers exploit CVE-2026-28318 and Zip Slip in Collibra Agent

A critical security vulnerability, CVE-2026-28318, has been detected in the Collibra Platform Agent, allowing remote code execution without authentication. The issue stems from inadequate handling of REST endpoints that expose sensitive functionalities. A separate Zip Slip vulnerability (CVE-2026-10621) enables attackers to exploit file extraction processes to manipulate files outside intended directories. To mitigate these risks, urgent software updates are required for both SaaS and on-premise installations. Administrators are advised to restrict REST endpoint access from public networks and consistently monitor access logs.