Search: “ikeext.dll”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 2 Exploit / PoC 1 Ransomware 1

SeverityAll critical 2 high 1 medium 1 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...

ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.

Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.

Web discovery (articles for new exploits & KEV entries)Sep 7, 19:06 UTC · 9d agoVulnerability CVE-2026-33824

Critical RCE flaw in Windows IKE Extension now actively exploited

CISA warns CVE-2026-33824, a critical unprivileged RCE in Windows IKE Extension, is now actively exploited.

CVE-2026-33824 is a critical remote code execution vulnerability in the Windows IKE Extension affecting all supported Windows 10, Windows 11, and Windows Server releases. The flaw allows unprivileged attackers to gain code execution on affected systems. CISA has flagged the vulnerability as actively exploited in attacks, indicating a KEV addition and urgent patching priority for Windows environments.

Web discovery (articles for new exploits & KEV entries)Aug 19, 06:07 UTC · 28d agoExploit / PoC in the wildCVE-2026-33824

From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.

The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.

Elastic Security LabsAug 28, 00:00 UTC · 19d agoTools in the wild

CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited

CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.

CISA's KEV addition, dated August 18, covers CVE-2026-33824 in Windows IKE Service Extensions, CVE-2026-55040 in on-premises Microsoft SharePoint Server, CVE-2026-59310 in Broadcom VMware vCenter, and CVE-2026-65400 in Apple macOS Screen Sharing. KEV listing confirms observed exploitation in the wild. Three of the four products are frequently deployed as high-value enterprise infrastructure, including remote-access endpoints and collaboration platforms.

Web discovery (articles for new exploits & KEV entries)Sep 8, 10:37 UTC · 8d agoExploit / PoC in the wildCVE-2026-33824 CVE-2026-55040 CVE-2026-59310+1 CVEs

VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability

OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.

CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.

CERT/CC Vulnerability NotesAug 10, 14:47 UTC · Aug 10, 2026Vulnerability CVE-2026-184121

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability NotesAug 25, 16:11 UTC · 22d agoVulnerability

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-securitySep 4, 21:23 UTC · 11d agoVulnerability

ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.

ZDI-26-603 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13127 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-13127

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-securitySep 5, 12:16 UTC · 11d agoVulnerability CVE-2026-86137 CVE-2026-86138

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabz15:13 UTC · 4h agoThreat actor in the wild

ZDI-26-595: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57254, CVSS 7.8) allowing remote code execution when a user opens a malicious file or page.

ZDI-26-595 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-57254 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-57254

CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.

CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.

oss-securitySep 14, 15:09 UTC · 2d agoVulnerability CVE-2026-725241

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabzupdated Sep 11, 09:12 UTC · 5d agofirst Sep 10, 14:43 UTC · 6d agoMalware in the wild 3 sources

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

oss-securitySep 6, 23:14 UTC · 9d agoVulnerability CVE-2026-86304

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commitsSep 8, 19:22 UTC · 8d agoTools

ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.

ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-13126

ZDI-26-613: (0Day) pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI published ZDI-26-613, an unpatched memory corruption flaw in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-613, a memory corruption vulnerability in pdfforge PDF Architect's PDF file parsing that allows remote code execution on affected installations. User interaction is required, meaning the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 7.8 and classifies the issue as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

[webapps] CubeCart 6.7.4 - Stored XSS

A proof-of-concept stored cross-site scripting exploit targeting CubeCart 6.7.4 was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit for a stored cross-site scripting (XSS) vulnerability in CubeCart 6.7.4, a PHP-based e-commerce web application. The listing demonstrates injection of attacker-controlled script that persists in the application, but no exploitation in the wild or CVE assignment is reported in the provided text.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC1

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.

Two flaws in the open-source GeoNetwork catalog chain into unauthenticated RCE: a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS 8.6) and an unsafe Saxon XSLT processor configuration allowing Java execution (CVE-2026-58400, CVSS 9.1). Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31. Ethiack fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89% tied to government or military agencies. No exploitation in the wild or KEV listing was reported at disclosure.

The Hacker NewsSep 2, 09:18 UTC · 14d agoVulnerability CVE-2026-63219 CVE-2026-58400 CVE-2024-36401+1 CVEs

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

Cisco patched an ASA/FTD IKEv2 certificate authentication flaw letting unauthenticated remote attackers crash the IKEv2 process and reload devices with crafted certificates.

A logic error during the certificate authentication phase of IKEv2 connection setup in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to crash the IKEv2 process. Exploitation involves attempting to establish an IKEv2 VPN connection with a crafted certificate, causing a denial of service through an unexpected device reload. Cisco has released software updates.

Cisco Security Advisories16:00 UTC · 4h agoAdvisory 9 sources

[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution

A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit chaining path traversal to remote code execution in Langflow 1.8.4, an open-source tool used to build LLM applications and agents. The chain allows an attacker to write arbitrary files outside the intended directory and achieve code execution on the host. The provided text does not include a CVE identifier or reports of exploitation in the wild, but RCE in a widely deployed AI tooling product is notable for defenders.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC1

ZDI-26-596: Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Foxit PDF Reader out-of-bounds read in PDF parsing (CVE-2026-57253, CVSS 3.3) can leak sensitive information via malicious files.

ZDI-26-596 covers an out-of-bounds read in Foxit PDF Reader's PDF file parsing, tracked as CVE-2026-57253 and rated CVSS 3.3. Successful exploitation allows remote attackers to disclose sensitive information and requires the target to open a malicious file or page. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-57253

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.

CERT/CC issued VU#687587 for CVE-2026-12780, an incorrect permission assignment (CWE-732) in the amwrtdrv.sys kernel driver shipped with AOMEI Backupper 8.4.0. The driver exposes a world-accessible device object without a security descriptor, allowing any unprivileged user to write arbitrary physical disk sectors; with Secure Boot disabled, an attacker can modify the GPT and inject a UEFI payload that executes before the OS loads, bypassing HVCI, EDR, Windows Defender and Hyper-V isolation. On TPM-only BitLocker configurations the attack can capture Volume Master Key material during pre-boot. AOMEI has shipped patches; users who cannot update should uninstall the software or disable the amwrtdrv.sys service, and enabling Secure Boot adds defense in depth.

CERT/CC Vulnerability NotesSep 10, 17:46 UTC · 6d agoVulnerability CVE-2026-127801

ZDI-26-600: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability

Foxit PDF Reader annotation use-after-free (CVE-2026-57237, CVSS 3.3) can disclose sensitive information when users open malicious PDFs.

ZDI-26-600 documents a use-after-free in Foxit PDF Reader annotation handling that allows remote information disclosure, tracked as CVE-2026-57237 with CVSS 3.3. Exploitation requires user interaction such as opening a malicious file or visiting a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-57237

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.

Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.

Rapid7 BlogAug 14, 21:27 UTC · Aug 14, 2026Tools CVE-2026-46300

Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks

MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.

A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.

GBHackersSep 9, 11:34 UTC · 7d agoVulnerability CVE-2026-850611

ZDI-26-601: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability

Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-13129, CVSS 3.3) allowing sensitive information disclosure when a user opens malicious content.

ZDI-26-601 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13129 with a CVSS score of 3.3. Successful exploitation allows remote attackers to disclose sensitive information, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-13129

[webapps] C-MOR 6.0104 - Directory Traversal

A directory traversal proof-of-concept for video surveillance software C-MOR version 6.0104 has been published on Exploit-DB.

Exploit-DB entry 52666 discloses a directory traversal vulnerability in C-MOR version 6.0104, a video surveillance platform. The issue is listed under web application vulnerabilities. No CVE identifier or exploitation evidence is included in the listing.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC