Overzicht van binnengekomen advisories.
2014 resultaten gevonden
A critical CVSS 10.0 vulnerability tracked as CVE-2026-93952 has been discovered in on-premises VeloCloud Orchestrator (VCO), the server responsible for managing Edge devices in VeloCloud SD-WAN deployments. Arista disclosed the flaw on September 22, 2026. The vulnerability allows a remote unauthenticated attacker to access privileged internal functions and potentially compromise the VCO host. Only orchestrators configured to authenticate their Edge devices using certificates are affected by this flaw. Active exploitation has been confirmed in the wild, making this a high-priority patching target for affected organizations. The maximum CVSS score of 10.0 underscores the severity and ease of exploitation of this vulnerability.
Bekijk origineel advisory →A critical vulnerability tracked as CVE-2026-89775 has been discovered in the Linux kernel's KVM virtualization subsystem affecting ARM64 processors. The flaw exposes freed host memory to guest virtual machines when nested virtualization is enabled. An attacker with access to a guest VM can exploit this bug to read and write host kernel memory. The vulnerability can potentially be leveraged to escape the guest VM environment entirely and execute arbitrary code on the host machine. This represents a severe hypervisor escape scenario with significant implications for cloud and virtualization environments running ARM64-based KVM hosts.
Bekijk origineel advisory →A SharePoint Server vulnerability, CVE-2026-65660, was initially classified by Microsoft as a spoofing flaw with a CVSS score of 6.5. However, Viettel Cyber Security researcher Dinh Ho Anh Khoa published full technical details revealing the flaw actually enables authenticated remote code execution. The vulnerability affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft has released patches for the affected versions. The misclassification highlights the importance of thorough vulnerability analysis beyond vendor-assigned severity ratings. The authenticated RCE capability makes this significantly more dangerous than the original spoofing classification suggested.
Bekijk origineel advisory →Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, publicly released a new zero-day exploit targeting Microsoft Defender (Windows Defender). The exploit is capable of blocking antivirus definition and software updates, potentially leaving systems unprotected against new threats. This is not the first zero-day released by Naceri, who has a history of disclosing Microsoft vulnerabilities publicly. The vulnerability poses a significant risk as it can be used to prevent security tools from receiving critical updates. If exploited by threat actors, this could be used as a precursor to deploying malware or ransomware on systems with outdated antivirus signatures. No CVE identifier was mentioned in the article. Microsoft had not yet issued a patch at the time of publication. The public release of a working exploit increases the urgency for a fix from Microsoft.
Bekijk origineel advisory →CISA has issued a directive ordering federal agencies to patch a high-severity vulnerability in Zyxel GS1900 series switches. The flaw is being actively exploited by attackers for data theft purposes. The directive comes with a deadline of Thursday, reflecting the urgency of the threat. Zyxel GS1900 series switches are network infrastructure devices commonly used in enterprise environments. The active exploitation of this vulnerability poses significant risk to organizations that have not yet applied available patches. CISA's mandate applies to federal civilian agencies but serves as a strong recommendation for all organizations using affected Zyxel hardware.
Bekijk origineel advisory →Security researcher Patrick Wardle demonstrated a proof-of-concept attack showing how malware already running on a Mac can hijack Meta's Muse AI assistant. The attack exploits a hidden configuration setting that redirects voice prompts dictated by the user to an attacker instead of Meta's servers. By modifying this obscure setting, attackers can leverage the broad system permissions already granted to the Muse app to conduct malicious activity. The vulnerability essentially turns the AI assistant into a backdoor, exploiting user trust and app permissions. The proof-of-concept was released on September 21, 2026, highlighting risks associated with AI assistants and their broad system access.
Bekijk origineel advisory →A critical vulnerability in WordPress core, tracked as CVE-2026-93485 and dubbed 'Comment2Shell', allows anonymous visitors to inject malicious scripts via comments. When a logged-in administrator views the affected page, the script executes and can achieve remote code execution on the server. The attack chain requires no authentication for the initial injection, making it particularly dangerous. WordPress addressed the flaw on September 17 with the release of version 7.1.1. Site owners were urged to update immediately to mitigate risk. The vulnerability represents a stored XSS-to-RCE escalation path exploiting privileged admin sessions.
Bekijk origineel advisory →CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability affecting Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog. The flaw carries a CVSS score of 8.8 and can result in arbitrary operating system command execution. A separate Veeam vulnerability is also referenced as being under active exploitation. Both vulnerabilities grant attackers elevated access, including SYSTEM-level privileges. The article highlights the urgency for organizations to apply available patches. Active exploitation evidence prompted CISA's inclusion of these flaws in the KEV catalog. The Zyxel flaw is a now-patched buffer overflow in network switch firmware. Organizations using affected Zyxel GS1900 series switches and Veeam products are urged to remediate immediately.
Bekijk origineel advisory →A critical improper certificate validation vulnerability has been identified in Check Point Security Gateway and Check Point Spark Firewall products. The flaw affects configurations using Site to Site VPN or Remote Access VPN. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the affected Gateway. The vulnerability is tracked as CVE-2026-85102 and has been listed by CISA. It is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under CISA implementation guidance. Organizations using affected Check Point products should apply vendor patches immediately.
Bekijk origineel advisory →A critical path traversal vulnerability has been identified in multiple Check Point products including Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on affected systems. This represents a significant risk as no authentication is required to exploit the flaw. The vulnerability is tracked as CVE-2026-93616 and has been listed by CISA, indicating active concern at a federal level. It is also referenced under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Organizations using affected Check Point products are urged to apply patches immediately and conduct forensic triage as outlined in the BOD 26-04 implementation guidance.
Bekijk origineel advisory →F5 BIG-IP APM contains a heap-based buffer overflow vulnerability that is triggered when an access policy and an OAuth profile are configured on a virtual server. An unauthenticated remote attacker can exploit this vulnerability to achieve remote code execution. CISA has flagged this vulnerability under BOD 26-04 for prioritized remediation. As a temporary mitigation, administrators are advised to apply the vendor-provided iRule to enable proactive forensic triage. The final remediation requires installing the official vendor patch as soon as possible. Additional forensic triage requirements are outlined in CISA's BOD 26-04 implementation guidance. The vulnerability is tracked as CVE-2026-94127 and details are available via NVD and F5's support portal.
Arista VeloCloud Orchestrator (VCO) on-premises deployments contain an improper input validation vulnerability tracked as CVE-2026-93952. A remote attacker could exploit this flaw to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data it manages. The vulnerability is listed in CISA's known exploited vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Organizations running on-prem VCO deployments are urged to apply security updates as prioritized by CISA directive. Arista has published a security advisory with remediation guidance. Forensics triage requirements have also been outlined under BOD 26-04 implementation guidance.
Bekijk origineel advisory →CISA has issued an alert warning that threat actors are actively exploiting three vulnerabilities in the Linux kernel, with at least one rated as critical severity. The agency is urging organizations to apply patches promptly to mitigate risk. The exploitation of these flaws poses significant risk to systems running affected Linux kernel versions. CISA's warning underscores the urgency for system administrators to prioritize patching. Active exploitation in the wild increases the likelihood of widespread impact across enterprise and government environments. The advisory highlights the ongoing targeting of Linux-based infrastructure by malicious actors. Organizations are advised to review CISA's Known Exploited Vulnerabilities catalog and act accordingly.
Bekijk origineel advisory →A new cross-site request forgery (CSRF) vulnerability nicknamed 'Click2Shell' has been disclosed affecting WordPress Core. Technical details and a proof-of-concept exploit have been published, raising the risk of active exploitation. The flaw allows attackers to trick authenticated users into triggering malicious requests, ultimately enabling remote PHP code execution on the server. As it affects WordPress Core rather than a specific plugin or theme, the attack surface is extremely broad. The availability of a public PoC significantly increases the likelihood of exploitation in the wild. WordPress site administrators are advised to apply patches or mitigations as soon as they become available.
Bekijk origineel advisory →North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices across more than 100 countries. The campaign has resulted in the theft of funds or account credentials from over 7,000 cryptocurrency wallets. Total stolen cryptocurrency amounts to approximately $10.71 million. Primary targets include individual web designers, engineers, and cryptocurrency specialists. The findings were released via a joint cybersecurity advisory. The campaign represents a significant and ongoing state-sponsored cyber threat with both financial and espionage motivations. The scale and reach of the operation underscore the sophisticated capabilities of North Korean threat actors in conducting large-scale social engineering and malware campaigns.
Bekijk origineel advisory →Threat actors are using ClickFix-style lures to distribute a previously undocumented remote access trojan (RAT) named ChainScript. The malware has appeared under multiple build names including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams to trick users into execution. ChainScript leverages the Polygon blockchain network to rotate its command-and-control (C2) infrastructure, making takedowns more difficult. The campaign was uncovered and reported by Blackpoint's Adversary Pursuit Group (APG). The use of blockchain for C2 rotation represents an advanced evasion technique increasing the resilience of the malware's infrastructure. ClickFix lures typically trick users into executing malicious scripts under the guise of fixing a software issue. This threat is considered high impact due to its novel infrastructure abuse and active deployment.
Bekijk origineel advisory →North Korean threat actor Jade Sleet has been linked to the compromise of a small India-based IT services organization. The attack involved the deployment of two backdoors named FLATROOF and ROOFDECK. SentinelOne disclosed the activity and attributed it to Jade Sleet. The adversary continues its pattern of targeting developers to gain access to broader networks. The attack reportedly involved Apple-related tooling or lures, though the full content was truncated. This incident highlights the ongoing supply chain and IT services targeting by North Korean APT groups. The breach underscores the risk posed to smaller IT firms that may serve as stepping stones to larger targets.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability (CVE-2026-7273) has been identified in Zyxel GS1900 series switches within the CGI program. The flaw allows a LAN-based, unauthenticated attacker to potentially execute OS commands by sending a crafted HTTP request. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Zyxel has published a security advisory with details and patch information. The vulnerability requires no authentication, lowering the bar for exploitation significantly. Organizations using GS1900 series switches on their networks should prioritize patching immediately. CISA has also outlined forensic triage requirements for affected systems under BOD 26-04 implementation guidance.
Bekijk origineel advisory →Oracle has patched 153 vulnerabilities across multiple Oracle Fusion Middleware products including WebLogic Server, Access Manager, Forms, Internet Directory, and Platform Security for Java. Of these, 66 are rated critical and 78 can be exploited remotely without authentication. Five vulnerabilities (CVE-2026-71133, CVE-2026-83099, CVE-2026-83059, CVE-2026-83020, CVE-2026-83021) carry the maximum CVSS score of 10.0. Successful exploitation can lead to arbitrary code execution, authentication bypass, unauthorized data access, data modification or deletion, and Denial-of-Service. The NCSC advises organizations to prioritize applying security updates for the critical vulnerabilities immediately.
Bekijk origineel advisory →Google released its September 2026 security update addressing 110 vulnerabilities across Pixel devices. Among these, one zero-day vulnerability was identified as actively exploited in targeted attacks. The patches are specifically directed at Google Pixel devices. The zero-day was being leveraged in real-world attacks prior to the patch release. This update underscores the ongoing threat landscape targeting Android mobile devices. Users of Pixel devices are urged to apply the security patches immediately. The scale of the patch batch (110 vulnerabilities) indicates a broad range of security issues addressed. Targeted exploitation of the zero-day suggests possible involvement of sophisticated threat actors.
Bekijk origineel advisory →