Vulnerability Management and more

November Microsoft Patch Tuesday. A total of 1,093 vulnerabilities. For comparison, there were 1,409 in October, a decrease of 22.4%. Ten products had 20 or more vulnerabilities fixed: Microsoft Office Excel (64), Microsoft Office Word (61), Microsoft SQL Server (50), Windows Advanced Rasterization Platform (37), Windows Installer (36), Windows Graphics Kernel (35), Windows Kernel (28), Microsoft Office SharePoint (26), Windows DNS (21), Windows Print Spooler Components (20). Together, these products had 378 vulnerabilities fixed, or slightly more than one-third (34.6%) of the total. One vulnerability is flagged as having been exploited in the wild: 🔻 Spoofing - Microsoft Outlook (CVE-2026-124194). Microsoft Outlook is a Microsoft application for managing email, calendars, scheduling meetings, organizing contacts, and setting reminders. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv2 hash. The attacker can use that hash to authenticate as the user. The Preview Pane is not an attack vector. A public exploit for the vulnerability is available on GitHub. There are two vulnerabilities with public exploits, but no evidence of exploitation in the wild has been observed so far. 🔸 EoP - Microsoft Windows App Store (CVE-2026-119987). Microsoft Store (Windows App Store) is Microsoft's official app store for finding, downloading, and installing applications, games, and other digital content on Windows devices. Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally. A PoC was published on GitHub but later removed. A copy is available on Vulners. 🔸 EoP - Windows AppX Deployment Service (CVE-2026-116714). Windows AppX Deployment Service is a Windows system service responsible for installing, updating, and removing applications. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Other notable vulnerabilities include: 🔹 RCE - Windows LDAP (CVE-2026-119958). Windows LDAP is a service and protocol used to search and manage information about users, computers, and other resources in an enterprise network. An out-of-bounds write vulnerability allows an unauthorized attacker to execute arbitrary code by sending specially crafted LDAP requests over the network. 🔹 RCE - Windows Search / Exchange Server (CVE-2026-116928). An unauthenticated attacker could exploit the Windows Search component used by Microsoft Exchange Server (Microsoft's server platform for managing enterprise email, calendars, contacts, and shared meeting scheduling) by sending an email containing a specially crafted attachment. Exchange automatically processes the attachment for indexing, so the recipient does not need to open the email or attachment. Successful exploitation could allow the attacker to execute code with the permissions of the affected processing service. [ Read the full post on avleonov.com ] 🗒 Full Vulristics report @avleonovcom #Microsoft #PatchTuesday #AD #AppStore #AppX #DNS #Excel #Exchange #exploit #LDAP #NTLM #NTLMrelay #Office #Outlook #Schannel #SharePoint #SQLServer #VFP #Vulners #Vulristics #WindowsGraphics #WindowsARP #Windows #WindowsInstaller #WindowsKernel #WindowsSearch #Word #PrintSpooler

The Vulners team has introduced a new AI-powered product - Cube. The platform provides contextual analysis of vulnerability scan results, correlating technical findings with information about an organization's infrastructure and business processes. Cube is built around three core layers: 📥 Evidence Layer - collects reports from existing vulnerability scanners, including Nessus, OpenVAS, Qualys, Rapid7 InsightVM, Acunetix, and others. It processes the findings and maps them to actual infrastructure assets. 🗺 Context Layer - enriches scan results with infrastructure data from architectural documentation, diagrams, task tracker tickets, cloud environments, and business processes. It builds a contextual model of the infrastructure, including a CMDB and network graph, helping identify affected assets, evaluate their exposure, and understand their role in business operations. 🧠 Decision Layer - uses the CISA SSVC (Stakeholder-Specific Vulnerability Categorization) methodology to prioritize remediation efforts. Unlike CVSS, which focuses on the technical severity of vulnerabilities, SSVC uses a decision tree that takes exploitation conditions and potential business impact into account. The CISA SSVC model defines four possible decision outcomes: 🟢 Track - vulnerability remediation follows the standard Vulnerability Management process. The vulnerability is monitored and addressed according to standard software update timelines. 🟡 Track* - the vulnerability requires closer monitoring, with its assessment revisited as new information or circumstances emerge. 🟠 Attend - the vulnerability requires increased attention from security teams and relevant management. This may involve bringing in additional experts and notifying key stakeholders. Remediation should be accelerated. 🔴 Act - the vulnerability requires escalation to senior management, with response efforts coordinated across departments. A coordinated action plan is developed, the necessary stakeholders are engaged, and remediation is carried out as soon as possible. SSVC therefore determines not only which vulnerabilities should be addressed first, but also the level of organizational response required to address them. Cube provides users with several types of results: 🎯 Risk Cases - grouped findings accompanied by severity ratings and assessments of potential business impact. 🛤 Attack Paths - potential attack paths between assets, aligned with the MITRE ATT&CK framework. 🛡 Threat Profile - an overview of the threat landscape and the current state of the infrastructure. 📋 Decision Rationale - explanations of decisions, linked to the original reports, assessments, and infrastructure data. For example, a vulnerability with a CVSS score of 9.8 on an isolated internal build server may be assigned a lower priority than a vulnerability with a CVSS score of 7.5 on a publicly accessible payment gateway. In the latter case, the potential business impact is significantly greater. The platform is deployed within the customer's own infrastructure (on-premises) and supports any LLM with an OpenAI- or Anthropic-compatible API, including proprietary models running on the customer's GPU servers. This means Cube does not lock customers into a specific AI provider. Vulners does not charge for token usage, leaving customers in control of their LLM costs. According to Vulners, running the model in a medium-sized infrastructure costs approximately $1,000 per month. To summarize, Cube enriches traditional Vulnerability Management by linking technical vulnerabilities to infrastructure assets, operational processes, and potential business impact. @avleonovcom #Vulners #Cube #VulnerabilityPrioritization #Prioritisation #SSVC #CISA #CVSS #CMDB #AssetManagement #AttackPath #MITRE #ATTCK #RiskManagement #onprem #AI #AIAgents #LLM #Anthropic #OpenAI #Jira #Confluence #Acunetix #Nessus #OpenVAS #Qualys #Rapid7 #InsightVM

October Linux Patch Wednesday. There are 4,946 vulnerabilities in total. By comparison, there were 2,653 in September. That's an 86% increase! This time, there are 1,954 vulnerabilities in the Linux Kernel and 814 in Chromium. Together, they make up 56% of all vulnerabilities.Six vulnerabilities show signs of being exploited in the wild: 🔻 RCE - PHP "PHP2Shell" (CVE-2026-109618, CVE-2026-109619). PHP is a popular programming language widely used for web application development. CVE-2026-109618 is an out-of-memory (OOM) handling vulnerability that allows remote code execution when an application receives a specially crafted request. CVE-2026-109619 is a use-after-free vulnerability that allows PHP to access stale references to freed memory, potentially leading to remote code execution. Linux distributions began releasing patches on the day the vulnerabilities were disclosed, October 21. More than 470 links to public exploits are available on GitHub. Both vulnerabilities were added to the CISA KEV on October 26. 🔻 SFB - Linux Kernel "PwnEscape" (CVE-2026-99999). The vulnerability affects the Linux kernel's networking stack and allows an attacker inside a KVM guest virtual machine to corrupt the host kernel's memory. This could expose sensitive host memory contents or cause the host system to crash. Researchers demonstrated a complete escape from a guest VM to the host. Linux distributions began releasing patched packages on October 16, and public exploits appeared on GitHub the same day. The vulnerability was added to the VulnCheck KEV on October 19. 🔻 RCE - WordPress (CVE-2026-87902). WordPress is a popular content management system (CMS) for building websites and blogs. Under certain conditions, this vulnerability allows an unauthenticated attacker to execute arbitrary code remotely on the server. Public exploits have been available on GitHub since September 22. The vulnerability was added to the CISA KEV on September 25. Debian released patched packages on September 28. 🔻 XSS - WordPress "Comment2Shell" (CVE-2026-93485). The vulnerability allows an unauthenticated attacker to inject JavaScript code through a specially crafted comment. The code is executed in the browser when an administrator views the comment, allowing the attacker to hijack his session and potentially execute arbitrary code on the server. The vulnerability was added to the VulnCheck KEV on September 18. Public exploits have been available on GitHub since September 22. Patched packages have been available in Debian since September 28. 🔻 AFR - Gradio (CVE-2026-28414). Gradio is a Python library for quickly building machine learning interfaces. The vulnerability allows unauthenticated attackers to read arbitrary files from a Windows server running Python 3.13 or later, even when Gradio authentication is enabled. A public exploit appeared on February 27. The vulnerability was added to the VulnCheck KEV on May 31. ALT Linux has been providing patched packages since October 1. Another 335 vulnerabilities have no known signs of exploitation in the wild, but public exploits are available for them. Notable examples include: 🔸 EoP - Linux Kernel (CVE-2026-98260). This use-after-free vulnerability in the POSIX CPU timers mechanism allows a local unprivileged user to escalate privileges to root. [ Read the full post on avleonov.com ] 🗒 Full Vulristics report (ZIP; 1.7 MB) @avleonovcom #LinuxPatchWednesday #LinuxKernel #Chromium #PHP #PHP2Shell #PwnEscape #WordPress #Comment2Shell #Gradio #Pillow #KVM #Python #Debian #ALTLinux #Ubuntu #Android #GitHub #CISAKEV #VulnCheckKEV #Vulristics #OOM #UseAfterFree #ContainerEscape #KVMEscape

October "In the Trend of VM" (#32): Windows and Check Point vulnerabilities. Here is the latest edition of Positive Technologies' traditional monthly roundup of trending vulnerabilities. The previous September edition featured six vulnerabilities. This time, there are just two. 🗞 Post on Habr (rus) 🗒 Digest on the PT website (rus) 🔻 EoP - Windows ALPC (CVE-2026-85880). A vulnerability in Windows' interprocess communication mechanism that is exploited in the wild to escalate privileges to SYSTEM. The exploit is included in the BlueMoon exploit kit. 🔻 RCE - Check Point Quantum Security Gateway (CVE-2026-85102). A vulnerability in Check Point's enterprise security gateways that allows an unauthenticated remote attacker to execute arbitrary code. The vulnerability is being actively exploited in the wild, and public exploits are available. 🟥 The full list of trending vulnerabilities is available on the portal @avleonovcom #PositiveTechnologies #TrendVulns #ALPC #AppContainer #BlueMoon #Chromium #CISA #CISAKEV #exploit #ExploitKit #KernelExploit #Microsoft #MSPT #PrivilegeEscalation #Proofpoint #SandboxEscape #V8 #WNF #Windows #WindowsKernel #Indonesia #Singapore #Vietnam #USA #CheckPoint #CheckPointQuantumSecurityGateway #CheckPointSpark #NGFW #KEV #Shodan #IPSec #X509 #Wiz

October Microsoft Patch Tuesday. A total of 1,409 vulnerabilities. For comparison, there were 973 in September, an increase of about 45%. 🙈 Thirteen products had fixes for 20 or more vulnerabilities: Microsoft Office Excel (68), Windows Kernel (46), Role: DNS Server (41), Windows Installer (38), Microsoft Office SharePoint (35), Windows Win32k (31), Windows NTFS (26), .NET (25), Microsoft Windows Search Component (23), Microsoft Office Word (22), Windows Error Reporting (21), Windows Broadcast DVR User Service (20), and Microsoft SQL Server (20). A total of 416 vulnerabilities were fixed in these products. That's 30% of all vulnerabilities. One vulnerability is flagged as exploited in the wild: 🔻 SFB - Windows Shell (CVE-2026-96951). The vulnerability allows an attacker to bypass Mark of the Web (MOTW), a Windows feature that marks files downloaded from the Internet. To exploit it, the attacker must trick the user into opening a malicious file or clicking a malicious link. There are two vulnerabilities with public exploits: 🔸 RCE - Raw Image Extension (CVE-2026-21413). A heap-based buffer overflow in Windows Raw Image Extension allows an attacker to execute arbitrary code remotely using a specially crafted file. A technical write-up of the vulnerability, which NVD classifies as an exploit, was published on the Cisco Talos blog on April 7. 🔸 EoP - Windows Health and Optimized Experiences Service (CVE-2026-85884). Missing authentication for a critical function in Windows Health and Optimized Experiences Service allows a local attacker to gain SYSTEM privileges. A public exploit has been available on GitHub since October 13. Other notable vulnerabilities include: 🔹 RCE - Microsoft Exchange (CVE-2026-70571). An unauthenticated attacker can send a specially crafted email to a vulnerable Exchange server and execute arbitrary code on the server. The attack requires an in-depth understanding of the target environment. No user interaction is required. 🔹 RCE - Microsoft Office Outlook (CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291). An attacker can execute arbitrary code on the victim's device by sending a specially crafted email. To exploit the vulnerability, the victim only needs to view the email in Outlook's reading pane without opening it or taking any further action. 🔹 RCE - Windows Domain Name Service (CVE-2026-96113). A heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. 🔹 SFB - .NET Framework (CVE-2026-108398). An authenticated attacker can place a specially crafted .NET assembly on an affected system and register it to be loaded by a protected process. This allows the attacker to bypass Windows Defender Application Control (WDAC) restrictions and run unauthorized code within the protected process. No user interaction is required. 🔹 Spoofing - Microsoft Exchange (CVE-2026-70279). An attacker can send a specially crafted link to a user and trick them into opening it. No authentication is required. If the user has administrator privileges, the attacker could act as that user and access or modify the organization's data. 🗒 Full Vulristics report @avleonovcom #PatchTuesday #Microsoft #Office #Excel #Word #Exchange #Outlook #SharePoint #SQLServer #Windows #WindowsKernel #WindowsShell #WindowsInstaller #WindowsWin32k #NTFS #WindowsSearch #WindowsErrorReporting #WindowsBroadcastDVR #WindowsHealthService #DNS #dotNET #RawImageExtension #MotW #exploit #Vulristics

About Elevation of Privilege - Windows Advanced Local Procedure Call (ALPC) (CVE-2026-85880) vulnerability. ALPC is an internal Windows mechanism for high-speed message exchange between processes. It is used by Windows system components. This vulnerability was addressed in the September Microsoft Patch Tuesday. An attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system. No additional user interaction is required. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. With SYSTEM privileges, the attacker may attempt to disable or bypass antivirus software and other Windows security tools, steal credentials and authentication tokens, maintain persistence on the system, and expand the attack across the corporate network, including by deploying malware. 👾 Microsoft experts reported evidence of in-the-wild exploitation on the day the September MSPT updates were released (September 8). On the same day, the vulnerability was added to the CISA KEV catalog. On September 9, Proofpoint experts reported on the BlueMoon exploit kit, which had been used in attacks since August 28. BlueMoon exploited three vulnerabilities in sequence: CVE-2026-85046 (a type confusion vulnerability in Chromium V8), CVE-2026-87491 (a V8 sandbox escape), and CVE-2026-85880 (a Windows kernel privilege escalation vulnerability in ALPC, with WNF - the Windows Notification Facility - also involved in exploitation). The exploit kit was used in attacks targeting US non-governmental organizations (NGOs), mining and materials companies, US aerospace companies, an unnamed manufacturing company in Vietnam, and government, consulting, and financial organizations in Indonesia and Singapore. 🛠 No public exploits have been observed so far. ⚙️ Security updates are available for Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows Server 2012, 2012 R2, 2016, 2019, and 2022. @avleonovcom #ALPC #AppContainer #BlueMoon #Chromium #CISA #CISAKEV #exploit #ExploitKit #KernelExploit #Microsoft #MSPT #PrivilegeEscalation #Proofpoint #SandboxEscape #V8 #WNF #Windows #WindowsKernel #Indonesia #Singapore #Vietnam #USA

About Remote Code Execution - Check Point Quantum Security Gateway (CVE-2026-85102) vulnerability. Check Point Quantum Security Gateway is an enterprise security gateway and next-generation firewall (NGFW) designed to protect network infrastructure from cyberattacks and unauthorized access. It provides network traffic filtering, intrusion prevention (IPS), application control, and secure VPN connectivity. Improper validation of trust in an X.509 certificate during VPN negotiation on Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the gateway with the privileges of a system process. An attacker may use the compromised gateway to perform internal network reconnaissance (including port and service scanning), intercept VPN traffic, steal credentials and configuration files, including certificates, IPsec/VPN keys, and administrator credentials, and compromise VPN tunnels connecting the organization's network to branch offices and partner networks. The vulnerability also affects Spark Firewall devices, a family of firewalls developed by Check Point primarily to protect the networks of small and medium-sized businesses, branch offices, and remote locations. ⚙️ Security updates and mitigation measures have been available on the vendor's website since September 9. 👾 Check Point experts began observing exploitation attempts on September 12. On September 22, the vulnerability was added to the CISA KEV catalog. 🛠 A public exploit has been available on GitHub since October 7. 🌐 As of October 12, Shodan had identified 11,849 potentially vulnerable Check Point gateways exposed to the Internet, 143 of them in Russia. @avleonovcom #CheckPoint #CheckPointQuantumSecurityGateway #CheckPointSpark #NGFW #CISA #CISAKEV #KEV #Shodan #IPSec #X509 #Wiz

September Linux Patch Wednesday. There are 2,653 vulnerabilities in total. For comparison, in August, there were 3,060 - 13% more. This time, the Linux Kernel has 812 vulnerabilities, and Chromium has 644. There are signs of exploitation in the wild for 6 vulnerabilities: 🔻 RCE - Gitea (CVE-2026-60004). Gitea is a popular platform for hosting Git repositories on your own servers. An attacker with basic write access to a repository can run arbitrary shell commands as the Gitea OS user. With open registration enabled by default, even an unauthenticated attacker can get the required access by creating an account and a repository. The vulnerability was added to CISA KEV on August 25. A campaign exploiting the vulnerability to install the XMRig cryptominer has been observed. Public exploits have been available on GitHub since July 29. The vulnerability was fixed in ALT Linux packages on August 27. 🔻 AuthBypass - Gitea (CVE-2026-20896). The vulnerability allows a remote attacker to bypass authentication and log in to Gitea as another user, including an administrator. The vulnerability was added to VulnCheck KEV on July 6. Public exploits have been available on GitHub since July 2. The vulnerability was fixed in ALT Linux packages on August 27. 🔻 AuthBypass - Keycloak (CVE-2026-18963). Keycloak is a popular platform for identity and access management (IAM/SSO). A vulnerability in the password reset mechanism allows an unauthenticated remote attacker to reset any user's password and take over their account without email confirmation. The vulnerability was added to VulnCheck KEV on August 25. Public exploits have been available on GitHub since August 20. The vulnerability was fixed in ALT Linux packages on August 20. 🔻 RCE - Chromium (CVE-2026-85046, CVE-2026-87491). Chromium is a web browser project that forms the basis of Google Chrome and other browsers. Vulnerabilities in the V8 JavaScript engine allow a remote attacker to execute arbitrary code within the browser sandbox if a user opens a malicious HTML page. Both vulnerabilities are exploited in the wild and were added to the CISA KEV on September 4 and September 9. Public exploits have been available on GitHub since September 4. The vulnerabilities have been fixed in ALT Linux and Debian packages since September 5. 🔻 RCE - SPIP (CVE-2026-77806). SPIP is an open-source CMS for creating and collaboratively editing websites. The critical vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the server. The vulnerability was added to VulnCheck KEV on August 21. A Metasploit module is available. The vulnerability has been fixed in Debian packages since August 21. For another 205 vulnerabilities, there are currently no signs of exploitation in the wild, but public exploits are available. Among them, the following stand out: 🔸 AuthBypass - FreeIPA (CVE-2026-76578). FreeIPA is a solution for centralized identity and access management in Linux infrastructures (LDAP/Kerberos). A remote, unauthenticated attacker can obtain membership in the FreeIPA administrator group and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. A public exploit has been available on GitHub since September 9. The vulnerability was fixed in ALT Linux packages on September 7. 🔸 RCE - PHP/Adminer (CVE-2026-56705). Adminer is a popular web-based tool for database administration, often deployed alongside PHP applications. The vulnerability allows an unauthenticated remote attacker to write PHP code to the web server's document root and execute it, thereby achieving RCE. A public exploit has been available on GitHub since August 25. The vulnerability has been fixed in Debian packages since September 16. 🗒 Full Vulristics report @avleonovcom #LinuxPatchWednesday #Linux #LinuxKernel #Chromium #GoogleChrome #Gitea #Keycloak #SPIP #FreeIPA #Adminer #PHP #ALTlinux #Debian #GitHub #CISA #CISAKEV #VulnCheck #Vulristics #Metasploit #XMRig #V8 #LDAP #Kerberos #IdM

September "In the Trend of VM" (#31): vulnerabilities in TeamCity, TrueConf, SharePoint, Windows, and Zimbra Collaboration. Here is the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. The previous August edition featured four vulnerabilities. This time, there are six. 🗞 Post on Habr (rus) 🗒 Digest on the PT website (rus) 🔻 RCE - TeamCity (CVE-2026-63077). An actively exploited vulnerability in JetBrains' proprietary solution for automating software build, testing, and deployment. Public exploits are available. 🔻 RCE - TrueConf Server (CVE-2026-72529, CVE-2026-72530). An actively exploited chain of vulnerabilities in a Russian corporate messaging and UltraHD video conferencing platform. 🔻 AuthBypass - Microsoft SharePoint (CVE-2026-55040). An actively exploited vulnerability in Microsoft's web application for deploying corporate intranet portals, managing documents, and collaboration. Public exploits are available. 🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2026-68820). An actively exploited vulnerability in a Windows component that provides support for the Winsock TCP/IP networking protocol. 🔻 RCE - Zimbra Collaboration (CVE-2026-73570). An actively exploited vulnerability in a collaboration software suite that includes a mail server and web client. Public exploits are available. 🟥 The full list of trending vulnerabilities is available on the portal @avleonovcom #PositiveTechnologies #TrendVulns #BuildAgents #Censys #CICD #CISA #CISAKEV #Deserialization #DevSecOps #Exploit #JetBrains #Metasploit #Rapid7 #REST #TeamCity #Vulnerability #XML #APT #Backdoor #BDU #CodeInjection #CVE #FSTEC #HeadMare #Kaspersky #Malware #PhantomCore #PhantomGraph #PoC #RCE #SandboxEscape #SupplyChain #TrueConf #TrueConfClient #TrueConfServer #AgenticAI #AI #AuthBypass #CyberSecurity #JWT #Microsoft #Pwn2Own #Shadowserver #SharePoint #SharePointServer #VulnCheck #CERTPolska #SMTP #SNMP #Swatchdog #Zimbra

About Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-68820) vulnerability. The Ancillary Function Driver (AFD) is a Windows component that supports Windows Sockets applications and is contained in the afd.sys file. The afd.sys driver runs in kernel mode and manages the Winsock TCP/IP communications protocol. This vulnerability is from the August Microsoft Patch Tuesday. Use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally to SYSTEM level. Successful exploitation requires an attacker to win the race condition. As a result, the attacker can gain full control over the Windows host, execute commands with SYSTEM-level privileges, disable security protections, install malware, and access other users' data. 👾 The vulnerability was already being exploited in the wild when it was disclosed as part of Microsoft's August Patch Tuesday on August 11. That same day, it was added to the CISA KEV catalog. Notably, Microsoft listed the Exploit Code Maturity in the CVSS as "Unproven". 🤷‍♂️ Microsoft credited researchers from Check Point for reporting the vulnerability. Details on how the vulnerability was exploited in attacks were published in a Check Point blog post on August 11. The vulnerability was exploited as part of the "Operation Dream Job" campaign, which targeted organizations worldwide, with a particular focus on the defense sector in Europe and India. The campaign is linked to the Lazarus Group. The campaign begins with targeted phishing messages offering victims attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries. Victims are lured into opening a PDF decoy masquerading as a Lockheed Martin job description. This triggers the execution of a lightweight in-memory loader - MISTPEN. The loader uses the Microsoft Graph API to access OneDrive, from which it retrieves additional modules and runs them in memory. During the initial stages of the infection, the attacker deploys several reconnaissance modules that gather information about the system and running processes. Once the target is deemed of interest, MISTPEN retrieves an additional persistence module, which installs the malware on disk and ensures that MISTPEN is automatically launched after a system reboot. After establishing persistence, MISTPEN loads an in-memory module designed to exploit the CVE-2026-68820 vulnerability. Check Point researchers believe that this vulnerability was already being exploited in the "Operation Dream Job" campaign in early July 2026. Successful exploitation enables the malware to launch FudModule, a Lazarus kernel-level rootkit, with SYSTEM privileges. The final backdoor delivered by MISTPEN - ForestTiger - provides attackers with remote access to the compromised system, allowing them to execute commands, collect host information, and download additional malicious components. 🛠 No public exploits have been observed so far. Some people are offering exploits for sale, but they don't look reliable. ⚙️ Security updates are available for Windows 10, Windows 11, and Windows Server 2019. @avleonovcom #AFDsys #Microsoft #Windows #WindowsKernel #Winsock #WindowsTCPIP #UseAfterFree #RaceCondition #EoP #LPE #PatchTuesday #CheckPoint #Lazarus #MISTPEN #Fudmodule #ForestTiger #LockheedMartin #MicrosoftGraphAPI #OneDrive #malware #APT #ZeroDay #phishing #OperationDreamJob

About Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-68820) vulnerability. The Ancillary Function Driver (AFD) is a Windows component that supports Windows Sockets applications and is contained in the afd.sys file. The afd.sys driver runs in kernel mode and manages the Winsock TCP/IP communications protocol. This vulnerability is from the August Microsoft Patch Tuesday. Use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally to SYSTEM level. Successful exploitation requires an attacker to win the race condition. As a result, the attacker can gain full control over the Windows host, execute commands with SYSTEM-level privileges, disable security protections, install malware, and access other users' data. 👾 The vulnerability was already being exploited in the wild when it was disclosed as part of Microsoft's August Patch Tuesday on August 11. That same day, it was added to the CISA KEV catalog. Notably, Microsoft listed the Exploit Code Maturity in the CVSS as "Unproven". 🤷‍♂️ Microsoft credited researchers from Check Point for reporting the vulnerability. Details on how the vulnerability was exploited in attacks were published in a Check Point blog post on August 11. The vulnerability was exploited as part of the "Operation Dream Job" campaign, which targeted organizations worldwide, with a particular focus on the defense sector in Europe and India. The campaign is linked to the Lazarus Group. The campaign begins with targeted phishing messages offering victims attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries. Victims are lured into opening a PDF decoy masquerading as a Lockheed Martin job description. This triggers the execution of a lightweight in-memory loader - MISTPEN. The loader uses the Microsoft Graph API to access OneDrive, from which it retrieves additional modules and runs them in memory. During the initial stages of the infection, the attacker deploys several reconnaissance modules that gather information about the system and running processes. Once the target is deemed of interest, MISTPEN retrieves an additional persistence module, which installs the malware on disk and ensures that MISTPEN is automatically launched after a system reboot. After establishing persistence, MISTPEN loads an in-memory module designed to exploit the CVE-2026-68820 vulnerability. Check Point researchers believe that this vulnerability was already being exploited in the "Operation Dream Job" campaign in early July 2026. Successful exploitation enables the malware to launch FudModule, a Lazarus kernel-level rootkit, with SYSTEM privileges. The final backdoor delivered by MISTPEN - ForestTiger - provides attackers with remote access to the compromised system, allowing them to execute commands, collect host information, and download additional malicious components. 🛠 No public exploits have been observed so far. Some people are offering exploits for sale, but they don't look reliable. ⚙️ Security updates are available for Windows 10, Windows 11, and Windows Server 2019. @avleonovcom #AFDsys #Microsoft #Windows #WindowsKernel #Winsock #WindowsTCPIP #UseAfterFree #RaceCondition #EoP #LPE #PatchTuesday #CheckPoint #Lazarus #MISTPEN #Fudmodule #ForestTiger #LockheedMartin #MicrosoftGraphAPI #OneDrive #malware #APT #ZeroDay #phishing #OperationDreamJob

September Microsoft Patch Tuesday. A total of 973 vulnerabilities were addressed - more than twice as many as in August. Seven products had 20 or more vulnerabilities fixed: Windows Biometric Service (64), Microsoft SQL Server (54), Windows DHCP Server (36), Microsoft Office Word (35), Windows NTFS (29), Microsoft Excel (28), and Windows Win32k (24). Vulnerabilities affecting these products account for just under one-third of the total. Two vulnerabilities are known to have been exploited in the wild: 🔻 EoP - Windows Update Stack (CVE-2026-81963). A link following flaw in the Windows Update Stack (CWE-59) may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. 🔻 EoP - Windows Advanced Local Procedure Call (ALPC) (CVE-2026-85880). A heap-based buffer overflow flaw in Windows ALPC (CWE-122) may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. There are no vulnerabilities with public exploits yet. Of the remaining vulnerabilities, the following can be highlighted: 🔹 RCE - Microsoft Exchange (CVE-2026-55007). A remote, unauthenticated attacker could achieve code execution on a vulnerable Exchange server by sending an email containing a malicious Visio attachment. The code is executed when the server processes the message, without requiring the victim to open it or use the Preview Pane. 🔹 RCE - Remote Desktop Services (CVE-2026-69525). Successful exploitation of this flaw would allow an unauthenticated attacker to execute arbitrary code by exploiting a use-after-free flaw. 🔹 RCE - Windows DNS Server (CVE-2026-69730). According to the advisory, an unauthenticated, remote attacker could send a crafted packet to exploit a use-after-free flaw in Windows DNS in order to achieve remote code execution. 🔹 RCE - Windows USB Mass Storage Class Driver (CVE-2026-68839). Successful exploitation of this vulnerability could allow an attacker the ability to gain remote code execution via an in-network attacker calling arbitrary endpoints. 🔹 RCE - Windows Kerberos (CVE-2026-69676). An authentication-bypass flaw via capture-replay in Windows Kerberos may allow an authenticated attacker to execute code over a network. 🔹 RCE - Windows Key Distribution Center (CVE-2026-69712). A use-after-free flaw in the Windows Key Distribution Center may allow an authenticated attacker to execute code over a network. 🔹 EoP - Microsoft Exchange (CVE-2026-69380). An authenticated attacker with access to a mailbox through a low-privileged user account could exploit this vulnerability to gain access to other mailboxes. Successful exploitation would allow the attacker to send and receive emails on behalf of other Exchange users as well as access attachments. 🗒 Full Vulristics report @avleonovcom #Microsoft #PatchTuesday #MicrosoftOffice #MicrosoftWord #MicrosoftExcel #MicrosoftExchange #Visio #Windows #WindowsUpdate #WindowsBiometricService #SQLServer #DHCPServer #NTFS #Win32k #ALPC #RemoteDesktopServices #DNS #USBMassStorage #Kerberos #KDC #UseAfterFree #HeapOverflow #CaptureReplay #Vulristics

About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability. TeamCity is a proprietary solution developed by JetBrains for automating software build, testing, and deployment processes. TeamCity uses a central server to coordinate builds and separate build agents to execute them. An agent can communicate with the server through the agent polling protocol: it registers with the server, requests the next command, and reports whether the command succeeded or failed. The vulnerability allows an unauthenticated remote attacker with HTTP(S) access to a TeamCity On-Premises server to execute arbitrary operating system commands with the privileges of the TeamCity Server process through the agent polling protocol. The vulnerability is caused by insecure deserialization of XML data (CWE-502). Depending on the privileges of the TeamCity Server process, successful exploitation may allow an attacker to access TeamCity data, configurations, and stored credentials, modify the server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines. ⚙️ A notice about this critical vulnerability was published on the JetBrains blog on July 27. The vulnerability affects all versions of TeamCity On-Premises. To remediate the vulnerability, users should upgrade to version 2025.11.7 or 2026.1.3. As a compensating measure, a security patch plugin can be installed on TeamCity 2017.1 and later to prevent exploitation of the vulnerability. For TeamCity 2017.1-2018.1, the server must be restarted after installing the plugin. Starting with TeamCity 2018.2, the plugin can be enabled without restarting the TeamCity server. As a longer-term security measure, the vendor recommends limiting network access to TeamCity servers to trusted networks, including restricting access to the TeamCity login page and REST API. It is also recommended to run the TeamCity server under an operating system account with the minimum privileges required for normal operation. TeamCity servers should be deployed on dedicated hosts separate from build agents, as described in the documentation. 👾 The vulnerability was added to the CISA KEV on August 5. On August 7, JetBrains published a report confirming exploitation of the vulnerability in the wild. The vendor recommended checking TeamCity logs for com.thoughtworks.xstream.converters.ConversionException messages, which may indicate successful exploitation of the vulnerability and warrant further investigation. After updating the server or installing the security patch plugin, logs can be checked for com.thoughtworks.xstream.security.ForbiddenClassException messages, which indicate that an exploitation attempt was blocked. Unauthorized build agents, particularly those with names beginning with scan, may also indicate exploitation attempts. 🛠 A technical analysis of the vulnerability and a link to a public exploit were published on the Rapid7 blog on August 7. A Metasploit module for simplified exploitation of the vulnerability has been available since August 28. 🌐 According to JetBrains, TeamCity is used by more than 30,000 organizations worldwide across government, technology, financial services, healthcare, and other sectors, including some Fortune 500 companies. As of July 30, Censys had detected approximately 4,500 TeamCity installations exposed to the Internet. Of these, 450 were running versions 2025.11.7 or 2026.1.3. Most of the remaining installations were running earlier versions or did not disclose version information. @avleonovcom #TeamCity #JetBrains #Deserialization #CISA #CISAKEV #Exploit #Metasploit #Rapid7 #CICD #DevSecOps #REST #XML #BuildAgents #Censys

About Remote Code Execution - TrueConf Server (CVE-2026-72529, CVE-2026-72530) vulnerability. TrueConf Server is a Russian on-premises corporate messaging and UltraHD video conferencing platform. The attack chain consists of two critical vulnerabilities. The first vulnerability, CVE-2026-72529, is caused by missing authentication for a critical function (CWE-306) and allows an unauthenticated remote attacker with network access to TCP port 4307 (open by default, according to TrueConf documentation) to invoke an undocumented TrueConf Server function and execute an arbitrary script within an isolated environment ("sandbox") where potentially dangerous libraries are unavailable. The second vulnerability, CVE-2026-72530, allows an attacker to perform code injection (CWE-94), escape the isolated environment, and execute arbitrary code on the host operating system with the highest privileges. Among other things, an attacker can delete TrueConf event log entries associated with exploitation activity. ⚙️ Security fixes for these vulnerabilities were released on June 18, 2026. The affected versions are 5.3.x below 5.3.9, 5.4.x below 5.4.9, 5.5.x below 5.5.5, as well as the 5.2 branch and earlier versions (upgrading legacy versions requires contacting technical support). Re-registration of the server is not required when upgrading within the 5.3-5.5 branches. However, the vendor strongly recommends creating a backup before installing the update. If an immediate upgrade is not possible, access to TCP port 4307 should be restricted to trusted networks. 👾 Kaspersky ICS CERT experts have disclosed details of the vulnerability exploitation chain in a post published on August 12. Since July 2026, threat actors have been exploiting CVE-2026-72529 and CVE-2026-72530 in attacks targeting Russian organizations. The attackers first gained network access to TrueConf Server through TCP port 4307 and used CVE-2026-72529 to execute a script within the sandbox. They then exploited CVE-2026-72530 to escape the sandbox and execute code with NT AUTHORITY\SYSTEM privileges. This enabled them to replace one of the TrueConf Server files with a web shell of their own. The attackers then used the web shell to gather information about the organization's IT infrastructure, gain privileged access to the TrueConf Server database, and replace legitimate TrueConf Client installers with malicious versions containing the PhantomCore malware. Users were subsequently prompted to download what appeared to be a new version of the TrueConf Client, which was in fact malicious. IMPORTANT: Even if your organization does not use TrueConf, your employees may have connected to compromised TrueConf servers used by contractors or business partners to participate in online conferences. In doing so, they may have inadvertently installed a malicious version of the TrueConf client on their workstations. The PhantomCore malware, associated with the Head Mare APT group, launches automatically when the system starts and allows attackers to execute arbitrary commands, effectively giving them full control over the compromised host. Kaspersky researchers also identified a new backdoor used in the attacks, which they named PhantomGraph. Both vulnerabilities, CVE-2026-72529 and CVE-2026-72530, were added to the CISA KEV on August 20, 2026. 🛠 A public exploit for CVE-2026-72530 was published on GitHub on August 26. So far, no public exploit for the complete CVE-2026-72529/CVE-2026-72530 exploitation chain has been observed, despite the corresponding flags in the BDU FSTEC vulnerability database. 🌐 TrueConf Server is widely used both in Russia and internationally, including by government agencies, as well as organizations in the financial, industrial, healthcare, and education sectors. @avleonovcom #TrueConf #TrueConfServer #TrueConfClient #Kaspersky #HeadMare #APT #PhantomCore #PhantomGraph #CVE #RCE #Vulnerability #Exploit #PoC #CISA #CISAKEV #FSTEC #BDU #Malware #Backdoor #WebShell #SandboxEscape #CodeInjection #SupplyChain

About Remote Code Execution - Zimbra Collaboration (CVE-2026-73570) vulnerability. Zimbra Collaboration is a collaboration software suite that includes a mail server and web client. In terms of functionality, it is comparable to Microsoft Exchange. The vulnerability allows an unauthenticated attacker to send specially crafted SMTP requests that can result in arbitrary operating system command execution with the privileges of the zimbra user. The vulnerability is caused by the lack of proper sanitization of untrusted input when processing data to generate SNMP notifications. Exploitation requires the optional zimbra-snmp package to be installed, SNMP notifications to be enabled, and the swatchdog service to be running. Successful exploitation allows an attacker to install malware, establish persistence, and use the compromised server as a foothold for further access to the organization's internal infrastructure. An attacker may also gain unauthorized access to corporate emails and other data stored on the system, as well as disrupt Zimbra-related services and business processes. 👾 Experts at CERT Polska reported that the vulnerability was being exploited in the wild on August 17. They recommended checking /var/log/zimbra.log for malicious commands, as well as looking for files created by the zimbra user within the last 30 days in the following directories: /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. The vulnerability was added to the CISA KEV catalog on August 21. 🛠 Public exploits have been available on GitHub since August 24. According to researcher Gabriel P. Lipski's exploit description, an unauthenticated attacker connects to an SMTP port (25, 465, or 587) and sends a standard SMTP session with a command injected into the RCPT TO. Zimbra logs this data in /var/log/zimbra.log regardless of whether the request is accepted or rejected. The swatchdog process then automatically searches the log for lines matching a specific pattern, extracts the attacker-controlled parameter, and passes it to the shell script responsible for sending SNMP notifications without any sanitization. The shell script consequently executes the attacker's command on the host with the privileges of the zimbra operating system user. ⚙️ To remediate the vulnerability, update Zimbra to version 10.1.20 or later. As compensating measures, organizations can disable SNMP notifications, stop the swatchdog service, remove the zimbra-snmp package, and restrict SMTP connections. 🌐 As of August 30, Shadowserver is tracking 5,326 potentially vulnerable hosts, including 172 in Russia. Shadowserver experts also reported the compromise of 274 hosts on August 24. @avleonovcom #Zimbra #SMTP #SNMP #CERTPolska #CISA #CISAKEV #Shadowserver #swatchdog

August Linux Patch Wednesday. A total of 3,060 vulnerabilities. For comparison, there were 2,017 in July. That's a 52% increase and another new record. This time, there are 1,354 vulnerabilities in the Linux Kernel and 447 in Chromium. For 3 vulnerabilities, there are signs of exploitation in the wild: 🔻 RCE - Jenkins (CVE-2026-53435). Jenkins is a development automation server used to build, test, and deploy software. The vulnerability allows a remote authenticated attacker to use the Script Console to execute arbitrary code and read files from the Jenkins controller. The vulnerability was added to the VulnCheck KEV on June 15 and fixed in RedOS on August 12. 🔻 CodeInj - WordPress (CVE-2026-60137). WordPress is a popular open-source CMS for creating websites and blogs. The vulnerability leads to a blind SQL injection in the WordPress core, allowing a remote unauthenticated attacker to read user accounts and password hashes from the WordPress database. Code execution is then possible by installing a malicious plugin. Multiple public exploits are available. The vulnerability was added to the CISA KEV catalog on July 21. A fix for the wordpress package in the Debian repository was released on July 23. 🔻 RCE - SPIP (CVE-2026-77647). SPIP is an open-source CMS for creating and collaboratively editing websites. The vulnerability allows an unauthenticated remote attacker to execute arbitrary PHP code. The vulnerability was added to the VulnCheck KEV on August 20. A fix for the spip package in the Debian repository was released on August 18. Strictly speaking, the report contains one more vulnerability RCE - WinRAR (CVE-2025-8088) that is being exploited in the wild. The vulnerability was fixed in the clamav package in the Alt Linux repository. However, exploitation is only possible on Windows, so it is out of scope. Another 127 vulnerabilities are not known to be exploited in the wild, but public exploits are available for them, or there are indications that such exploits exist. Notable examples include: 🔸 RCE - Action Pack "KindaRails2Shell" (CVE-2026-66066). Action Pack is a component of Ruby on Rails responsible for handling web requests, routing, and generating responses. An attacker can upload a specially crafted image to a vulnerable application and achieve remote code execution. 🔸 RCE - WordPress "XSS2Shell" (CVE-2026-64638). The attack chain allows an unauthenticated XSS on the login page to be escalated to arbitrary PHP code execution. 🔸 CodeInj - PHP (CVE-2026-17543). Improper escaping of backslashes in attacker-controlled parameters can lead to a trivial SQL injection in PHP. 🔸 EoP - Linux Kernel "Zapscape" (CVE-2026-64561). This KVM escape vulnerability allows an attacker to break out of a virtual machine in KVM/x86 environments and execute commands on the host with root privileges. 🔸 EoP - Linux Kernel "OVSwrap" (CVE-2026-64531), Linux Kernel "SCTPhantom" (CVE-2026-64564), Linux Kernel "Ubuntu PPPoL2TP" (CVE-2026-68398). These vulnerabilities allow a local attacker to escalate privileges to root. 🔸 AuthBypass - Traefik (CVE-2026-48020). Traefik is an HTTP reverse proxy and load balancer. A high-severity vulnerability in the StripPrefix middleware allows an unauthenticated attacker to bypass route-level authentication and authorization. 🗒 Full Vulristics report @avleonovcom #LinuxPatchWednesday #LinuxKernel #Chromium #Jenkins #WordPress #SPIP #PHP #Traefik #CISAKEV #KEV #SQLi #Exploit #Vulnerability #Vulnerabilities #Linux #CMS #RedOS #Debian #VulnCheckKEV #Vulristics #SQLInjection #KVM #KVMEscape #RubyOnRails #ActionPack #KindaRails2Shell #XSS2Shell #Zapscape #OVSwrap #SCTPhantom #UbuntuPPPoL2TP #WinRAR #ClamAV

The Vulners team has released nmap-vulners 2.0. This plugin (an NSE script) turns the popular Nmap port scanner into a black-box vulnerability scanner. Simply run $ nmap -sV --script vulners <target> to get a prioritized report on vulnerabilities and exploits. And all of this is available for free with no limitations. 🆓😉 How exactly does this plugin work? To find vulnerabilities, the software is identified first: 🔹 The service's CPE identifier may be provided by Nmap itself (using the -sV option). 🔹 If Nmap fails to identify the service, the plugin attempts to determine the CPE identifier from the raw banner using rules for FTP, SMTP, SSH, MySQL, DNS, NTP, LDAP, and other services. Starting with version 2.0, the fingerprint catalog is updated weekly based on Recog, Wappalyzer, WhatWeb, FingerprintHub, and nuclei-templates. The latest catalog is automatically fetched when the plugin runs. 🔹 If an HTTP service is detected, nmap-vulners also attempts to identify the web stack, including the framework, CMS, or PHP version behind a reverse proxy. It analyzes Server and X-Powered-By headers, cookies, the page title, meta tags, filenames in script src, and page content. The plugin includes more than 700 rules. In version 2.0, the number of HTTP path fingerprints increased from 125 to 939, while parallelization kept the processing time at around 6 seconds per port. 🔹 If a product is identified but its version is unknown, the plugin makes a single request to a known file that contains version information, such as /CHANGELOG.txt for Drupal or /administrator/manifests/files/joomla.xml for Joomla. This works with Concrete5, Drupal, Jira, Joomla, Apache Tomcat, and WordPress. 🔹 Finally, if a service cannot be identified, Smart Audit can be used. The raw banner is sent to the Vulners server, which identifies the software and its version and then looks for related vulnerabilities. This is the only paid feature! Each unique request costs 1 credit, and results are cached. The number of requests is limited by the vulners.max_items parameter, which defaults to 32. Smart Audit can be disabled entirely with --script-args vulners.max_items=0. The service data is then sent to the Vulners server, which returns a prioritized vulnerability report. For each vulnerability or exploit, the report includes its ID, SEVERITY level, CVSS and EPSS scores, Vulners AI score, KEV and EXP flags, and a link to its page on the Vulners website. So, is an API key actually required? 🔹 The plugin can work without an API key. However, detection will use the legacy endpoint, and some vulnerability and exploit data will not be available. 🔹 Adding an API key, even without credits, enables the "EXP" flag for vulnerabilities and the "KEV" flag for both vulnerabilities and exploits. It also adds an EPSS score column, providing more complete prioritization: KEV → CISA SSVC Exploitation Active → exploits → EPSS → CVSS. So, an API key is recommended. 😉 🔹 If your API key has credits, the Smart Audit feature is also available (see above). Installation To install the plugin, simply run the one-line script. The installer automatically finds Nmap and its NSE script directory, installs the latest vulners.nse version, and removes old 1.x files. It then runs nmap --script-updatedb and verifies the installation. The --user and --prefix options let you specify the installation directory, while --uninstall removes the plugin. If needed, the installer prompts for a Vulners API key, validates it, and saves it to ~/.nmap/vulners.key with permissions set to 600. @avleonovcom #Nmap #Vulners #CPE #CVSS #EPSS #KEV #exploit #API #Fingerprinting #HTTP #CMS #PHP #ReverseProxy #ApacheTomcat #WordPress #Drupal #Joomla #Jira #Nuclei #AIScore #Prioritization

The Vulners team has released an updated version of Getsploit. The utility allows you to search for public exploits in the Vulners.com database. It supports both an online mode (search queries are executed on the Vulners server) and a fully offline mode (exploit data from Vulners is downloaded to a local SQLite FTS5 index, which is then used for subsequent searches). I find the second option particularly interesting and useful. 😉 The data can be downloaded with a single command, getsploit --update, and the resulting database is ~1.7 GB in size. You can then search for exploits locally, either by CVE or using full-text search: $ getsploit --local CVE-2024-3094 $ getsploit --local "wordpress 4.7 remote code execution" As a result, you get information about the exploits in the following format: ID, Title, and URL on the Vulners website. If you use the "--mirror" option, the full text of the found exploits will be saved to separate files. This works with all Vulners exploit databases except githubexploit and gitee. Why would you want to search for exploits in the first place? This can be very useful for enriching vulnerability data in your VM solution and, consequently, for better prioritization. It can also be quite useful for red teamers to keep track of new exploitation tools as they emerge. 😉 How much does it cost? Each getsploit update uses 10 credits. According to the pricing, the free plan currently includes 100 credits per month. So, if you update the exploit data once every 3 days, you can use it completely free of charge. 🆓 For $600, you can get 600 credits per month, which is enough to update getsploit roughly twice a day. @avleonovcom #Getsploit #Vulners #exploit #VulnerabilityIntelligence #RedTeam #Pentest #Prioritization

August "In the Trend of VM" (#30): vulnerabilities in ViPNet Client, the Microsoft Windows kernel, and Microsoft SharePoint. I present the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. In the previous July edition, there was just one vulnerability. This time, there are four. 🗞 Post on Habr (rus) 🗒 Digest on the PT website (rus) 🔻 RCE - ViPNet Client (BDU:2026-09885). The first trending vulnerability in a Russian-made product since the beginning of 2026. Its exploitation was discovered by Positive Technologies experts. 🔻 EoP - NT OS Kernel (CVE-2026-42980). The vulnerability allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM level. 🔻 EoP - Microsoft SharePoint (CVE-2026-56164) and RCE - Microsoft SharePoint (CVE-2026-58644). Two actively exploited vulnerabilities in a popular platform for building corporate websites, managing documents, and collaborating. 🟥 The full list of trending vulnerabilities is available on the portal @avleonovcom #PositiveTechnologies #TrendVulns #ViPNet #ViPNetClient #ViPNetAdministrator #InfoTeCS #MFTP #DLLHijacking #PathTraversal #Itcsrvup64exe #wtsapi32dll #Donnect #ShadowRelay #PTESC #Microsoft #Windows #WindowsKernel #NTOSKernel #WMI #KernelExploit #PrivilegeEscalation #SharePoint #CVSS #CISA #CISAKEV #NVD #Mandiant #AMSI #BleepingComputer #BIT #KEV #PatchTuesday #Deserialization

August Microsoft Patch Tuesday. A total of 401 vulnerabilities were addressed - 170 fewer than in July. One of the vulnerabilities is known to be actively exploited in the wild: 🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2026-68820). A local attacker can exploit this vulnerability to gain SYSTEM-level privileges. There is a contradiction in Microsoft's description: the Exploit Code Maturity in CVSS is marked as "Unproven", while at the same time Microsoft states that the vulnerability is being exploited in the wild. 🤷‍♂️ Public exploits are available for two other vulnerabilities: 🔸 EoP - Windows User Profile Service (CVE-2026-62832). This vulnerability allows an authenticated attacker to elevate privileges to ADMINISTRATOR level. Rapid7 believes this vulnerability is related to the LegacyHive exploit, which was published on July 14. 🔸 EoP - Windows Kernel (CVE-2026-62737). This vulnerability allows an authenticated attacker to elevate privileges to SYSTEM level. An exploit has been publicly available since August 11. Among the remaining vulnerabilities, the following stand out: 🔹 RCE - Windows DNS Server (CVE-2026-62878). This wormable vulnerability allows a remote unauthenticated attacker to execute code on a vulnerable server with elevated privileges. It is recommended to test and install the update as soon as possible, especially on Internet-facing DNS servers. 🔹 RCE - Windows Deployment Services TFTP Server (CVE-2026-62893). This vulnerability, discovered as part of the ZDI (Zero Day Initiative) program, allows an attacker to execute code without authentication or user interaction. TFTP has no authentication mechanism and is available remotely via UDP port 69. Any WDS server serving Windows Imaging Format (WIM) files via TFTP, which is the standard PXE boot scenario, is vulnerable. The issue results from the lack of validation of the existence of an object before performing operations on it. UDP port 69 should be blocked at the perimeter, but attackers could easily use this vulnerability for lateral movement within an organization. If you're using WDS for deployments, test and install this update quickly. 🔹 RCE - Windows DHCP Server (CVE-2026-62823). Successful exploitation of this vulnerability allows a remote unauthenticated attacker to execute arbitrary code from an adjacent network by sending a specially crafted packet that triggers a heap-based buffer overflow. 🔹 EoP - Microsoft Exchange (CVE-2026-62911). This vulnerability allows a remote authenticated attacker (with Privileges Required: Low according to CVSS) to gain control over the mailboxes of all Exchange users, send and read emails, and download attachments. This vulnerability was demonstrated at Pwn2Own Berlin. ZDI researchers provided Microsoft with working exploits. 🔹 RCE - Microsoft QUIC (CVE-2026-62815). This use-after-free vulnerability allows an unauthenticated attacker to execute arbitrary code on a target system by sending a specially crafted network packet. QUIC is an IETF-standardized transport protocol that runs over UDP instead of TCP and serves as the foundation for HTTP/3. The protocol is used by approximately 13.5 million websites. 🔹 Tampering - Windows Container Isolation FS Filter Driver (unionfs.sys) (CVE-2026-72971). This vulnerability reportedly allows an attacker to overwrite certain files. As a result, an attacker could perform an action within a container that could impact the host system. 🗒 Full Vulristics report @avleonovcom #Microsoft #Windows #PatchTuesday #DNS #DHCP #Exchange #QUIC #WindowsDeploymentServices #TFTP #WDS #PXE #WindowsKernel #Winsock #AFDsys #UserProfileService #ContainerEscape #ContainerSecurity #UnionFS #LegacyHive #ZDI #Pwn2Own #Rapid7 #Vulristics