ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “CERT-EU”

11 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 12Vulnerability 10Data breach 7Ransomware 3Threat actor 3Malware 1
SeverityAllcritical 24high 12medium 0low 0info 0

2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")

Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.

Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.

CERT-EU Advisoriesupdated · 9d agofirst · Apr 29, 2026Exploit / PoC 6 sourcesCVE-2026-31431

2026-009: Critical Vulnerabilities in Microsoft SharePoint

WatchTowr observed active exploitation of SharePoint RCE CVE-2026-50522 (CVSS 9.8), part of an ongoing wave of exploited on-prem SharePoint flaws patched by Microsoft.

On 14 July 2026 Microsoft released updates for critical SharePoint Server RCE flaws, including CVE-2026-50522 (CVSS 9.8), a deserialisation vulnerability possibly exploitable without authentication. On 20 July 2026 WatchTowr published PoC exploit code and observed active exploitation of CVE-2026-50522, prompting CISA to urge SharePoint hardening. The advisory also covers recently fixed SharePoint flaws: CVE-2026-32201 (6.5, spoofing), CVE-2026-45659 (8.8, authenticated RCE), CVE-2026-56164 (9.8, unauthenticated privilege escalation), and CVE-2026-58644 (9.8, unauthenticated RCE). Affected products include SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016; CERT-EU recommends immediate patching, credential rotation, and compromise assessments.

CERT-EU Advisoriesupdated · 9d agofirst · Jul 22, 2026Exploit / PoC in the wild 3 sourcesCVE-2026-50522CVE-2026-32201CVE-2026-45659+2 CVEs

2026-002: Multiple Vulnerabilities in Cisco Products

Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.

On 25 February 2026 Cisco released advisories for multiple flaws in Catalyst SD-WAN Controller and SD-WAN Manager, potentially granting administrative access to attackers. CVE-2026-20127 (CVSS 10.0) is an authentication bypass in the Controller's peering authentication mechanism, exploited in the wild since 2023, allowing unauthenticated admin access via NETCONF, rogue device injection, and persistent access. SD-WAN Manager flaws include CVE-2026-20129 (9.8, unauthenticated API auth bypass to netadmin), CVE-2026-20126 (7.8, local privesc to root), CVE-2026-20133 (7.5, info disclosure), CVE-2026-20122 (7.1, arbitrary file overwrite), and CVE-2026-20128 (5.5, DCA info disclosure). CERT-EU recommends patching, capturing forensic evidence, IOC hunting, and restricting management-plane internet exposure.

CERT-EU Advisories · Feb 10, 2026Exploit / PoC in the wildCVE-2026-20127CVE-2026-20129CVE-2026-20126+3 CVEs