U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog

CVE-2018-14634 is an integer overflow in the Linux kernel's create_elf_tables() function, the code that builds the ELF auxiliary tables when a new program is launched. An unprivileged local user can trigger the overflow by executing a SUID or otherwise privileged binary, corrupting kernel memory and escalating their privileges. A successful attacker gains full root-level control of the affected host, compromising the confidentiality, integrity, and availability of that system. Any system running a Linux kernel in the 2.6.x, 3.10.x, or 4.14.x series is affected, including products from Red Hat, Canonical, Palo Alto Networks (PAN-OS), F5 (BIG-IP), and NetApp that ship those kernels. CISA added this flaw to its Known Exploited Vulnerabilities catalog on 2026-01-26, confirming it is being actively exploited, and EPSS estimates a 14.7% chance of exploitation within 30 days (96th percentile).

Do: Apply the kernel updates published by Red Hat, Canonical, and other distributors and upgrade affected appliances (PAN-OS and BIG-IP) to the patched releases cited in each vendor's advisory for CVE-2018-14634, per the CISA KEV required action. Inventory hosts and appliances running Linux kernels in the 2.6.x, 3.10.x, or 4.14.x series and verify patched versions are installed. Because this is a local privilege escalation with no network-level mitigation, restrict unprivileged local accounts and limit access to SUID binaries on hosts where patching is delayed.

SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr.

Do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines.

CVE-2026-21509 is a security feature bypass in Microsoft Office caused by reliance on untrusted input when making a security decision (CWE-807): Office trusts attacker-controlled data when deciding whether a protection applies, allowing an unauthorized local attacker to bypass that security feature. Exploitation is local and requires user interaction (per the CVSS vector), most plausibly by getting a user to open a crafted file or document, and the flaw carries high confidentiality, integrity, and availability impact. Anyone running Microsoft Office, Microsoft 365 Apps, or Office Long Term Servicing Channel is in scope, giving the flaw a potential audience in the hundreds of millions of seats. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, Microsoft issued an emergency patch, and headlines attribute in-the-wild use to Russian state hackers targeting Ukrainian and EU organizations, including the maritime and transport sectors (a related APT28 campaign was tied to a separate Office/MSHTML 0-day, CVE-2026-21513). EPSS estimates a 72.6% probability of exploitation within the next 30 days (99th percentile).

Do: Apply Microsoft's emergency Office update and the follow-on February 2026 Patch Tuesday fixes across Microsoft 365 Apps, Office, and Office LTSC, checking Microsoft's advisory for the exact affected builds since no version ranges are given in the source data. Given the KEV listing, federal agencies must patch per CISA BOD 22-01 timelines (or follow cloud-service guidance). Hunt for exploitation per vendor guidance — headlines report Russian state use against EU/Ukrainian and maritime/transport targets — and prioritize endpoints where users open untrusted files.

SmarterTools SmarterMail builds prior to 9511 contain an authentication bypass (CWE-288) in the password reset API: the force-reset-password endpoint accepts anonymous requests and, when targeting a system administrator account, never verifies the existing password or requires a reset token. An unauthenticated remote attacker simply submits a target administrator username and a new password, taking over the system administrator account with no privileges or user interaction required. Because SmarterMail's system administrator role can execute operating system commands through built-in management functionality, this escalation effectively yields SYSTEM/root-level access on the underlying mail server host, making it a path to full server and network compromise. All SmarterMail deployments running builds older than 9511 are affected, with roughly 6,000+ likely vulnerable servers observed exposed to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26 with known ransomware use (including Storm-1175 and Warlock activity), and public PoCs exist from WatchTowr and Huntress.

Do: Immediately upgrade SmarterMail to build 9511 or later, prioritizing internet-exposed instances. Given known ransomware exploitation and the host-level access this flaw grants, check logs for anonymous calls to the force-reset-password endpoint, unexpected system administrator password changes, and signs of OS command execution or lateral movement on affected hosts. If patching is delayed, restrict or firewall access to the SmarterMail API/web interface, and follow CISA BOD 22-01 guidance for cloud-hosted deployments.

GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd.

Do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears.