Search: “IKE Extension”

Critical RCE flaw in Windows IKE Extension now actively exploited

CISA warns CVE-2026-33824, a critical unprivileged RCE in Windows IKE Extension, is now actively exploited.

CVE-2026-33824 is a critical remote code execution vulnerability in the Windows IKE Extension affecting all supported Windows 10, Windows 11, and Windows Server releases. The flaw allows unprivileged attackers to gain code execution on affected systems. CISA has flagged the vulnerability as actively exploited in attacks, indicating a KEV addition and urgent patching priority for Windows environments.

Web discovery (articles for new exploits & KEV entries)·Aug 19, 06:07 UTC · 28d agoExploit / PoC in the wildCVE-2026-33824

Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...

ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.

Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 19:06 UTC · 9d agoVulnerabilityCVE-2026-33824

CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited

CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.

CISA's KEV addition, dated August 18, covers CVE-2026-33824 in Windows IKE Service Extensions, CVE-2026-55040 in on-premises Microsoft SharePoint Server, CVE-2026-59310 in Broadcom VMware vCenter, and CVE-2026-65400 in Apple macOS Screen Sharing. KEV listing confirms observed exploitation in the wild. Three of the four products are frequently deployed as high-value enterprise infrastructure, including remote-access endpoints and collaboration platforms.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 10:37 UTC · 8d agoExploit / PoC in the wildCVE-2026-33824CVE-2026-55040CVE-2026-59310+1 CVEs

U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog

CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8), CVE-2026-55040 (SharePoint JWT authentication bypass, CVSS 9.1), CVE-2026-59310 (VMware vCenter Syslog path traversal, CVSS 9.8), and CVE-2026-65400 (macOS Screen Sharing improper authentication). The SharePoint flaw combines four weaknesses including alg:none JWT forging to impersonate any user, with Defused researchers observing attackers using Rapid7's PoC against honeypots. The Dutch NCSC confirmed active exploitation of the macOS Screen Sharing flaw on August 15, 2026. Federal agencies must patch by August 21, 2026.

Security Affairs·Aug 19, 07:19 UTC · 28d agoExploit / PoC in the wildCVE-2026-33824CVE-2026-55040CVE-2026-59310+1 CVEs

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commits·Sep 8, 19:22 UTC · 8d agoTools

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 8d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-security·Sep 4, 21:23 UTC · 12d agoVulnerability

July 2026 CVE Landscape

Recorded Future·Aug 7, 00:00 UTC · Aug 7, 2026Ransomware in the wildCVE-2025-3248CVE-2008-4128CVE-2017-17215+78 CVEs1

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future·Sep 8, 00:00 UTC · 8d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs1

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

Cisco patched an ASA/FTD IKEv2 certificate authentication flaw letting unauthenticated remote attackers crash the IKEv2 process and reload devices with crafted certificates.

A logic error during the certificate authentication phase of IKEv2 connection setup in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to crash the IKEv2 process. Exploitation involves attempting to establish an IKEv2 VPN connection with a crafted certificate, causing a denial of service through an unexpected device reload. Cisco has released software updates.

Cisco Security Advisories·16:00 UTC · 6h agoAdvisory 9 sources

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.

CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.

The Hacker News·Aug 19, 15:26 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400CVE-2026-55040CVE-2026-59310+1 CVEs

[Control Systems] Siemens security advisory (AV26-864)

Siemens fixed a vulnerability in Element maps-ng V47-V49 (SSA-682041); Canada's Cyber Centre urges administrators to apply the updated releases.

Siemens advisory SSA-682041 addresses a vulnerability affecting Element maps-ng V47 prior to V47.12.3, V48 prior to V48.11.3, and V49 prior to V49.16.1. Canada's Cyber Centre republished the notice (AV26-864) encouraging users and administrators to review the vendor links and apply the necessary updates. No CVSS score or exploitation details were provided in the bulletin.

Canadian Centre for Cyber Security·Aug 31, 15:59 UTC · 16d agoAdvisory

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker News·Sep 3, 15:52 UTC · 13d agoVulnerabilityCVE-2026-20212CVE-2026-20274CVE-2026-20279+5 CVEs

Best Practices for Good Endpoint Hardening | Huntress

Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.

Huntress published defensive guidance on endpoint hardening for small and mid-sized businesses, drawing on observations from its SOC. The post describes common intrusion vectors: internet-exposed RDP brute-forced by automated scanners, phishing emails delivering attacker-controlled remote monitoring and management (RMM) tools, with Huntress reporting a 277% spike in RMM abuse in 2025, and ClickFix attacks using fake CAPTCHA pages that trick users into running malicious commands. Recommended controls include scanning for exposed RDP, SSH, and VPN interfaces, removing unneeded local admin rights, enabling Windows Defender tamper protection, disabling SMBv1, and standardizing on one approved remote access tool, guided by CIS and NIST frameworks.

Huntress·Sep 10, 15:00 UTC · 6d agoAdvisory

[webapps] Ray 2.56.0 - Directory Traversal & Local File Inclusion

Public exploit released for directory traversal and local file inclusion in Ray 2.56.0, the widely used distributed ML framework.

Exploit-DB entry 52635 publishes a web application exploit targeting Ray 2.56.0, the distributed computing framework from Anyscale commonly used for ML workloads. The PoC demonstrates a directory traversal and local file inclusion condition, allowing attackers to read files outside the intended path on an exposed Ray instance. Ray dashboard instances exposed to the internet could leak sensitive files such as credentials and configuration.

Exploit-DB·Aug 11, 00:00 UTC · Aug 11, 2026Exploit / PoC

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News·Sep 8, 12:10 UTC · 8d agoThreat actor in the wild

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto

Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.

Socket researcher Karlo Zanki documented a cluster of 18 Chrome and one Edge extensions with wallet secret stealing and cryptocurrency draining capabilities, tracked as campaign Superior and possibly active since February 2024. The actor created 14 extensions and bought five legitimate ones, later pushing malicious updates; the largest, Enable Right Click & Copy, has roughly 80,000 installs across both browsers. The extensions maintain WebSocket C2 connections with endpoint rotation, strip CSP headers, and load 16 modules including multi-chain wallet drainers, hardware-wallet seed-phrase harvesters, credential grabbers, and ClickFix-style lures.

The Hacker News·Aug 28, 15:27 UTC · 19d agoMalware in the wild

ZDI-26-615: (0Day) pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Zero Day Initiative disclosed an uncontrolled search path flaw in pdfforge PDF Architect's update service, allowing local privilege escalation (CVSS 7.8).

ZDI published advisory ZDI-26-615 describing a local privilege escalation vulnerability in the activation-service Update Service of pdfforge PDF Architect. An uncontrolled search path element lets local attackers escalate privileges, but they must first be able to execute low-privileged code on the target. ZDI rated the issue 7.8 and tagged it as a 0-day disclosure.

ZDI Published Advisories·Aug 31, 05:00 UTC · 16d agoVulnerability

[dos] Nmap 7.99 - Extension Header Integer Underflow

A proof-of-concept denial-of-service exploit for Nmap 7.99 leverages an integer underflow in extension header parsing to crash the scanner.

Exploit-DB lists a denial-of-service proof of concept targeting Nmap version 7.99. The flaw is an integer underflow when handling extension headers, which can crash the scanner. No exploitation in the wild or patch details are mentioned in the listing.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-security·Sep 5, 12:16 UTC · 11d agoVulnerabilityCVE-2026-86137CVE-2026-86138

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.

TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.

The Hacker News·Sep 7, 11:20 UTC · 9d agoExploit / PoCCVE-2026-13181CVE-2026-13182CVE-2026-13183+5 CVEs1

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published Advisories·Aug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-50696, a CVSS 8.1 integer underflow in Windows IKEv2 AES-GCM decryption enabling unauthenticated remote code execution on specific IPsec configurations.

The Zero Day Initiative published ZDI-26-622 describing a remote code execution vulnerability in Microsoft Windows' IKEv2 AES-GCM decryption path, caused by an integer underflow. Authentication is not required for exploitation, but only systems using specific IPsec configurations are affected. ZDI assigned the vulnerability a CVSS score of 8.1 and the identifier CVE-2026-50696.

ZDI Published Advisories·Sep 8, 05:00 UTC · 8d agoAdvisoryCVE-2026-506961

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published Advisories·Aug 31, 05:00 UTC · 16d agoAdvisory

[remote] D-Link DNS_340L - OS Command Injection

An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.

Exploit-DB published exploit #52643 for the D-Link DNS-340L network-attached storage device. The vulnerability is an OS command injection, which could allow arbitrary command execution on affected devices. The disclosure text does not report exploitation in the wild.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

Memory-safety defects in the upstream (abandoned) AOSP OpenCORE AAC decoder, shipped unpatched by Samsung TizenRT

Abandoned AOSP OpenCORE AAC decoder has out-of-bounds-write and wild-pointer flaws reachable from attacker-controlled frames, unpatched in Samsung TizenRT.

The OpenCORE AAC decoder in AOSP's abandoned external/opencore tree contains memory-safety defects of the out-of-bounds-write and wild-pointer class. The code is still vendored and built by multiple projects, most notably Samsung's widely deployed TizenRT embedded RTOS. The defects are reachable from untrusted media because an AAC frame is attacker-controlled. The researcher is requesting a CVE ID for the issue.

oss-security·Sep 10, 01:12 UTC · 6d agoVulnerability1

automatic module_metadata_base.json update

Automated Metasploit Framework commit refreshes module_metadata_base.json with no new exploit content or vulnerability details.

An automated commit updated module_metadata_base.json in the Rapid7 Metasploit Framework repository. The change reflects routine metadata maintenance and introduces no new modules, exploits, or vulnerability information.

Metasploit Framework commits·Sep 1, 18:53 UTC · 15d agoTools

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker News·Aug 19, 15:27 UTC · 28d agoThreat actor in the wildCVE-2026-12569

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

oss-security·Sep 6, 23:14 UTC · 9d agoVulnerabilityCVE-2026-86304

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.

Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.

Rapid7 Blog·Aug 14, 21:27 UTC · Aug 14, 2026ToolsCVE-2026-46300

ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.

ZDI-26-603 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13127 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerabilityCVE-2026-13127

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42·Aug 17, 12:35 UTC · Aug 17, 2026VulnerabilityCVE-2024-22278

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.

Two flaws in the open-source GeoNetwork catalog chain into unauthenticated RCE: a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS 8.6) and an unsafe Saxon XSLT processor configuration allowing Java execution (CVE-2026-58400, CVSS 9.1). Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31. Ethiack fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89% tied to government or military agencies. No exploitation in the wild or KEV listing was reported at disclosure.

The Hacker News·Sep 2, 09:18 UTC · 14d agoVulnerabilityCVE-2026-63219CVE-2026-58400CVE-2024-36401+1 CVEs

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 12d agoThreat actor in the wild1

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).

CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-security·Sep 14, 15:31 UTC · 2d agoVulnerabilityCVE-2026-73579