19th October – Threat Intelligence Report

A path traversal flaw (CWE-35) in the Windows version of WinRAR allows attackers to achieve arbitrary code execution by delivering a specially crafted archive file that writes outside the expected location when it is opened or processed. Because the CVSS 4.0 vector indicates a local attack requiring user interaction, victims are typically infected by extracting or previewing a malicious archive received via phishing, a malicious download, or another delivery channel. A successful attacker gains the privileges of the user running WinRAR, providing an initial foothold that has been used for both espionage and ransomware operations. Anyone running the Windows version of WinRAR — one of the most widely deployed Windows desktop utilities — is affected, and CPE data additionally lists dtSearch as an affected vendor. Exploitation is confirmed in the wild by nation-state actors (e.g., the China-linked Amaranth-Dragon group per related reporting) and criminal actors including ransomware operators; the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-12 and carries a near-maximal 94.6% EPSS score.

Do: Update WinRAR to the latest patched release from RARLAB on all Windows endpoints, prioritizing remediation per CISA KEV and BOD 22-01 requirements, and verify that dtSearch deployments bundling the affected component are also updated. Because exploitation requires a user to open or extract a crafted archive, warn users to treat unexpected archive files delivered by email or download with suspicion. Given confirmed ransomware use, hunt across user workstations — not just exposed servers — for suspicious archive-based infections and confirm the patched WinRAR version is installed.

CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.

Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote, unauthenticated attacker can spoof authentication on affected gateways and then execute arbitrary commands. Impact is high confidentiality loss with lower integrity and availability impact (CVSS 3.1 base 8.6; network, low complexity, no privileges or user interaction). It affects Connect Secure builds before 25.1.3.0 and does not affect 22.7R2.14 or earlier. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after reported zero-day attacks; ransomware use is listed as unknown, public proof-of-concept references exist, and EPSS is about 26% (98th percentile).

Do: Upgrade Ivanti Connect Secure to 25.1.3.0 or later. Builds at 22.7R2.14 and earlier are not affected. Because this is in CISA’s KEV catalog, apply the vendor’s mitigations, follow BOD 26-04 and CISA forensics-triage guidance, and treat internet-exposed appliances as potentially compromised until reviewed.

CVE-2026-35029 is a broken access control flaw (CWE-863, CWE-425) in LiteLLM, an open-source proxy server (AI Gateway) for calling LLM APIs, in which the /config/update endpoint fails to enforce admin-role authorization in versions prior to 1.83.0. Any user who is already authenticated to the proxy can call this network-accessible endpoint without admin rights and modify the proxy configuration and environment variables. Through this, an attacker can achieve remote code execution by registering pass-through endpoint handlers that point to attacker-controlled Python code, read arbitrary server files by setting UI_LOGO_PATH and fetching the file via /get_image, and take over other privileged accounts by overwriting the UI_USERNAME and UI_PASSWORD environment variables; related security coverage also highlights that vulnerable LiteLLM gateways can be turned into root-level code execution and cloud credential theft. Any organization running a LiteLLM proxy older than v1.83.0 is affected, particularly deployments where non-admin users hold authenticated accounts. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile), signaling elevated near-term risk.

Do: Upgrade to LiteLLM v1.83.0 or later. Until patched, restrict network access to /config/update so only administrators can reach it, and limit how many non-admin accounts hold API/UI credentials on the proxy. Audit configuration and environment variables for tampering (especially UI_USERNAME, UI_PASSWORD, UI_LOGO_PATH, and registered pass-through handlers), and rotate cloud credentials stored in the gateway's environment if compromise is suspected.

LiteLLM Proxy versions before 1.83.9 let an authenticated caller who already has a valid virtual key bypass request-body checks by nesting api_base inside user_config. The check is_request_body_safe blocked top-level api_base and base_url but did not inspect or reject that nested field. Because user_config builds the outbound router, the proxy then makes a server-side request to an internal or external host chosen by the caller, which can reveal endpoints the caller could not reach directly (CWE-918). Organizations running a LiteLLM AI gateway on those versions are affected. It is fixed in 1.83.9; it is not listed in CISA KEV and no public proof-of-concept is known.

Do: Upgrade the LiteLLM Proxy to 1.83.9 or later. Until then, restrict who can hold virtual keys, limit the proxy's network reach to internal services, and review logs for user_config values that set api_base or similar outbound destinations.

CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known.

Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.

GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.