ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “remote-crash”

26 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAll
SeverityAllcritical 0high 0medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-649: (Pwn2Own) OpenAI Codex Improper Neutralization of Control Sequences Remote Code Execution Vulnerability

ZDI published advisory ZDI-26-649 for a CVSS 7.8 remote code execution flaw (CVE-2026-19591) in OpenAI Codex, demonstrated at Pwn2Own.

The Zero Day Initiative published advisory ZDI-26-649 describing a remote code execution vulnerability in OpenAI Codex, tracked as CVE-2026-19591 with a CVSS 7.8 score. The flaw involves improper neutralization of control sequences. Exploitation requires user interaction, as the target must open a malicious folder. The bug was demonstrated at Pwn2Own and disclosed through ZDI.

ZDI Published Advisories · 6d agoVulnerability 4 sourcesCVE-2026-195911

Microsoft: September updates cause RDS failures on Windows Server

Microsoft confirms September 2026 Patch Tuesday updates break Remote Desktop Services on Windows Server 2012+; Group Policy mitigations and rollback workarounds available.

Microsoft confirmed that September 2026 Patch Tuesday security updates cause Remote Desktop Services failures on Windows Server 2012 and later, plus Windows 10 and Windows 11. Symptoms include unstable RDS, RDP connection failures after several minutes, sign-in issues, servers hanging at 'Please wait for the Remote Desktop Configuration,' and unresponsive MMC, RDS Licensing Diagnoser, and File Explorer. Microsoft published per-version Group Policy mitigations (covering KBs such as KB5124008, KB5122880, KB5122878, KB5122871, KB5122882, KB5122876, KB5123099, KB5123065, KB5123066) and suggests restarting affected VMs. Rolling back the updates restores RDS functionality but removes this month's security fixes.

BleepingComputerupdated · 1d agofirst · 2d agoAdvisory 3 sources1

Remote Desktop Services Failures on Windows Servers Following September Update

September 2026 Patch Tuesday updates cause Windows Server 2019/2022/2025 RDS sessions to freeze, forcing administrators to roll back.

Cumulative updates KB5122876 (Windows Server 2019), KB5122882 (2022), and KB5122871 (2025) trigger Remote Desktop Services freezes hours after boot, with RDP connections hanging at 'Connecting…' and Event ID 20498 logged. Administrators trace the fault to an apparent deadlock in RDPSERVERBASE!WDLIB_Close during session teardown; only hard resets restore service and the issue recurs. The same September release patched roughly 973 vulnerabilities, including two actively exploited zero-days (CVE-2026-81963, CVE-2026-85880, both in CISA's KEV) and a critical RDS RCE, CVE-2026-69525 (CVSS 9.8). Workarounds include DISM-based removal of the update or an unofficial FeatureManagement registry key disabling the suspected audio-redirection code path; Microsoft has not yet confirmed the bug.

Cyber Security News · 5d agoVulnerability in the wild 2 sourcesCVE-2026-81963CVE-2026-85880CVE-2026-69525+1 CVEs1

Postfix: SMTP smuggling, remote crash, and hardening fixes in 3.11.7 and related legacy releases

Postfix 3.11.7 and legacy releases 3.10.14 and 3.9.15 fix SMTP smuggling, remote crash, and hardening issues.

Wietse Venema announced the Postfix stable release 3.11.7 alongside legacy releases 3.10.14 and 3.9.15. The releases fix SMTP smuggling, a remote crash vulnerability, and include hardening changes in the widely used mail transfer agent. Administrators running Postfix are advised to update to the patched versions.

oss-security · 6d agoVulnerability

[remote] PCMan 2.0.7 - Buffer Overflow

A remote buffer overflow in PCMan 2.0.7 has a public proof-of-concept exploit published on Exploit-DB.

Exploit-DB listing 52657 discloses a remote buffer overflow vulnerability in PCMan version 2.0.7. A proof-of-concept exploit is publicly available, allowing attackers to potentially crash or compromise affected instances. The listing includes no CVE identifier and reports no observed exploitation in the wild.

Exploit-DB · 29d agoExploit / PoC1

Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update

Microsoft's September 2026 Patch Tuesday updates (KB5124008) can break Remote Desktop Services, causing RDP failures and freezes across Windows clients and servers.

Microsoft confirmed its September 2026 security updates, including KB5124008 for Windows 11 24H2/25H2, introduced a reliability regression where RDP connections fail after several minutes and servers hang at the 'Please wait for the Remote Desktop Configuration' screen. MMC, RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page may also stop responding. The issue affects Windows 10/11 clients and Windows Server 2012 through 2025; Microsoft marked it Mitigated on September 11 and is developing a permanent fix, with VM restart offered as a temporary workaround.

Cyber Security News · 2d agoAdvisory

[remote] ipTIME A3004T - Remote Code Execution

A remote code execution exploit was published for ipTIME A3004T routers, a flaw relevant to internet-facing devices.

Exploit-DB published exploit #52644 for the ipTIME A3004T router, demonstrating remote code execution. Router RCE flaws are typically exploitable by unauthenticated attackers on exposed devices. The disclosure text does not report exploitation in the wild.

Exploit-DB · Aug 17, 2026Exploit / PoC

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.

Exploit-DB entry 52681 documents a remote code execution vulnerability in FreePBX 17.0.2, a widely used open-source PBX platform. The listing contains no CVE id, authentication requirement, or evidence of in-the-wild exploitation. FreePBX is commonly internet-facing, so unauthenticated RCE would be significant for exposed deployments.

Exploit-DB · 13d agoExploit / PoC2

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 published technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint.

Rapid7 released an analysis covering CVE-2026-63520, a remote code execution flaw affecting Microsoft SharePoint. SharePoint is widely deployed in enterprise environments, making exposed, unpatched servers a likely target for exploitation. Defenders should consult the Rapid7 write-up for exposure checks and patch guidance. The available text does not confirm active exploitation at this time.

Rapid7 Blog · 23d agoVulnerabilityCVE-2026-635201

USN-8563-5: nginx vulnerability

Ubuntu ships improved nginx fix for CVE-2026-42533 after earlier patch regression; flaw allows remote crash and possible code execution.

USN-8563-5 provides a better fix for CVE-2026-42533 after the original fix from USN-8563-1 was backed out in USN-8563-2 because it caused a regression. The flaw stems from nginx incorrectly handling certain map directives using regex matching and capture variables, allowing a remote attacker to crash nginx, causing denial of service, or possibly execute arbitrary code. The original advisory also described a use-after-free in the ngx_http_ssi_module when configured with Server-Side Includes, proxy_pass, and proxy buffering.

Ubuntu Security Notices · 2d agoAdvisoryCVE-2026-42533

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

Cisco patched an ASA/FTD IKEv2 certificate authentication flaw letting unauthenticated remote attackers crash the IKEv2 process and reload devices with crafted certificates.

A logic error during the certificate authentication phase of IKEv2 connection setup in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to crash the IKEv2 process. Exploitation involves attempting to establish an IKEv2 VPN connection with a crafted certificate, causing a denial of service through an unexpected device reload. Cisco has released software updates.

Cisco Security Advisories · 5h agoAdvisory 9 sources

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit-DB published an authenticated remote code execution exploit targeting Metabase version 0.61.0.

A new Exploit-DB entry (ID 52680) describes an authenticated remote code execution vulnerability in Metabase 0.61.0. The listing provides minimal detail, but authenticated RCE in a widely deployed BI tool is notable for defenders running exposed instances. No CVE id or in-the-wild exploitation is mentioned in the listing.

Exploit-DB · 13d agoExploit / PoC1

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.

ZDI-26-684 describes a race condition in the Linux Kernel KSMBD subsystem's Query Directory Request handling that allows unauthenticated remote attackers to execute arbitrary code. Only systems with KSMBD enabled are vulnerable. ZDI assigned a CVSS rating of 9.0 and CVE-2026-64397.

ZDI Published Advisories · 2d agoAdvisoryCVE-2026-64397

ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

ZDI-26-693: authenticated race condition in Linux kernel ksmbd share configuration allows remote code execution on ksmbd-enabled systems; CVSS 8.5.

ZDI advisory ZDI-26-693 discloses a race condition in the Linux kernel's ksmbd share configuration that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires authentication, and only systems with ksmbd enabled are vulnerable. ZDI assigned a CVSS rating of 8.5; no CVE is listed in the advisory text.

ZDI Published Advisories · 2d agoVulnerability1

USN-8764-1: SRT vulnerabilities

Ubuntu fixes two SRT flaws allowing encrypted connection downgrade with content injection and remote crash.

Ubuntu Security Notice USN-8764-1 patches two vulnerabilities in the SRT streaming protocol. CVE-2026-55868 stems from unauthenticated encryption control messages, letting a remote attacker downgrade an encrypted connection to inject content or interrupt media streams. CVE-2026-55869 involves improper validation of control packets during connection setup and key refresh, enabling a remote denial of service.

Ubuntu Security Notices · 1d agoAdvisoryCVE-2026-55868CVE-2026-55869

Cisco ASA and FTD DoS Vulnerability Exploited in the Wild (CVE-2026-20349)

Cisco patched actively exploited high-severity flaw CVE-2026-20349 in ASA and FTD SSL VPN services, allowing unauthenticated remote denial-of-service attacks.

Cisco released a security advisory addressing CVE-2026-20349, a high-severity vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software. Successful exploitation by an unauthenticated remote attacker can cause affected devices to crash or reload, causing denial of service. The vulnerability is being exploited in the wild, and patches are available; organizations with internet-exposed ASA/FTD VPN endpoints should prioritize updating.

Qualys ThreatPROTECT · Aug 13, 2026Exploit / PoC in the wildCVE-2026-20349

USN-8754-1: Freeciv vulnerability

Ubuntu patches Freeciv stack overflow where remote attackers crash clients or servers using crafted network packets.

USN-8754-1 fixes a Freeciv vulnerability where certain network packets trigger a stack overflow. A remote attacker could use this to crash Freeciv clients or servers, resulting in denial of service. Ubuntu released updated packages.

Ubuntu Security Notices · 2d agoAdvisory1

ZDI-26-706: (0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability

ZDI discloses unpatched unsafe reflection RCE vulnerability CVE-2026-92206 (CVSS 8.8) in the CrewAI agent framework.

Zero Day Initiative published ZDI-26-706, an unsafe reflection remote code execution vulnerability in the CrewAI framework, tracked as CVE-2026-92206 with a CVSS score of 8.8. Exploitation requires user interaction: the target must load a malicious agent configuration from the repository. As a 0day advisory, no patch is indicated at publication.

ZDI Published Advisories · 16h agoVulnerabilityCVE-2026-922061

[webapps] Grav CMS 2.0.7 - RCE

A proof-of-concept exploit for remote code execution in Grav CMS 2.0.7 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for a remote code execution vulnerability in Grav CMS 2.0.7. The listing is for web applications and provides code defenders can use to reproduce the issue. No exploitation in the wild or CVE assignment is stated in the listing.

Exploit-DB · 15d agoExploit / PoC

CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.

CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-824353

USN-8755-1: libvips vulnerability

Ubuntu patches libvips flaw where crafted TIFF images converted to HEIF cause a crash, enabling denial of service.

USN-8755-1 fixes a libvips vulnerability in which specially crafted TIFF images are incorrectly handled when saved as HEIF, causing the library to crash. The impact is limited to denial of service with no code execution indicated. Ubuntu shipped updated packages.

Ubuntu Security Notices · 2d agoAdvisory

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

Cisco patched an unauthenticated remote DoS in ASA and FTD Remote Access SSL VPN that reloads devices via crafted HTTP requests.

Cisco disclosed a denial-of-service vulnerability in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. Insufficient error checking when processing HTTP requests allows an unauthenticated, remote attacker to send a crafted HTTP request that causes the affected device to reload. Cisco has released software updates addressing the flaw.

Cisco Security Advisories · Aug 11, 2026Advisory

ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.

ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-896881

Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code

Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.

Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.

Cyber Security News · 7d agoVulnerabilityCVE-2026-69485

ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

ZDI disclosed an unpatched code injection RCE (CVE-2026-92207, CVSS 8.8) in MindsDB's OpenBBtable feature, exploitable by authenticated remote users.

ZDI-26-708 describes a code injection remote code execution vulnerability in MindsDB's OpenBBtable functionality. A remote attacker with valid authentication can execute arbitrary code on affected installations. The flaw is rated CVSS 8.8, tracked as CVE-2026-92207, and published as a 0day advisory without a referenced vendor patch.

ZDI Published Advisories · 16h agoVulnerabilityCVE-2026-92207

Re: Retrospective by 'gpg.fail' authors

GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.

Werner Koch replied to the gpg.fail retrospective, noting that GnuPG versions above 2.2 produce garbled stderr or crash when the project's certificates are used with --debug x509 because DER data is passed as a printf format string. Testing the certificates from the researchers' Git repo yielded only a segfault, not demonstrated code execution. Koch states how remote code execution would be achieved is unclear and asks for a real reproducer.

oss-securityupdated · 4h agofirst · 1d agoVulnerability 8 sources