CVE-2026-28380 — Any Editor could delete any snapshot, even if they have no

title: Editor Deleting Arbitrary Snapshots - CVE-2026-28380
id: scw-2026-05-13-ai-1
status: experimental
level: critical
description: |
  Detects the deletion of files within a '/snapshots/' directory, which is the core behavior of CVE-2026-28380. This allows any user with 'Editor' privileges to delete any snapshot, regardless of their access permissions, leading to data loss or disruption.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-28380/
tags:
  - attack.impact
  - attack.t1537
logsource:
    category: file_event
detection:
  selection:
      TargetObject|contains:
          - '/snapshots/'
      EventType:
          - 'delete'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse