Vulnerability Management and more

About Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-68820) vulnerability. The Ancillary Function Driver (AFD) is a Windows component that supports Windows Sockets applications and is contained in the afd.sys file. The afd.sys driver runs in kernel mode and manages the Winsock TCP/IP communications protocol. This vulnerability is from the August Microsoft Patch Tuesday. Use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally to SYSTEM level. Successful exploitation requires an attacker to win the race condition. As a result, the attacker can gain full control over the Windows host, execute commands with SYSTEM-level privileges, disable security protections, install malware, and access other users' data. 👾 The vulnerability was already being exploited in the wild when it was disclosed as part of Microsoft's August Patch Tuesday on August 11. That same day, it was added to the CISA KEV catalog. Notably, Microsoft listed the Exploit Code Maturity in the CVSS as "Unproven". 🤷‍♂️ Microsoft credited researchers from Check Point for reporting the vulnerability. Details on how the vulnerability was exploited in attacks were published in a Check Point blog post on August 11. The vulnerability was exploited as part of the "Operation Dream Job" campaign, which targeted organizations worldwide, with a particular focus on the defense sector in Europe and India. The campaign is linked to the Lazarus Group. The campaign begins with targeted phishing messages offering victims attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries. Victims are lured into opening a PDF decoy masquerading as a Lockheed Martin job description. This triggers the execution of a lightweight in-memory loader - MISTPEN. The loader uses the Microsoft Graph API to access OneDrive, from which it retrieves additional modules and runs them in memory. During the initial stages of the infection, the attacker deploys several reconnaissance modules that gather information about the system and running processes. Once the target is deemed of interest, MISTPEN retrieves an additional persistence module, which installs the malware on disk and ensures that MISTPEN is automatically launched after a system reboot. After establishing persistence, MISTPEN loads an in-memory module designed to exploit the CVE-2026-68820 vulnerability. Check Point researchers believe that this vulnerability was already being exploited in the "Operation Dream Job" campaign in early July 2026. Successful exploitation enables the malware to launch FudModule, a Lazarus kernel-level rootkit, with SYSTEM privileges. The final backdoor delivered by MISTPEN - ForestTiger - provides attackers with remote access to the compromised system, allowing them to execute commands, collect host information, and download additional malicious components. 🛠 No public exploits have been observed so far. Some people are offering exploits for sale, but they don't look reliable. ⚙️ Security updates are available for Windows 10, Windows 11, and Windows Server 2019. @avleonovcom #AFDsys #Microsoft #Windows #WindowsKernel #Winsock #WindowsTCPIP #UseAfterFree #RaceCondition #EoP #LPE #PatchTuesday #CheckPoint #Lazarus #MISTPEN #Fudmodule #ForestTiger #LockheedMartin #MicrosoftGraphAPI #OneDrive #malware #APT #ZeroDay #phishing #OperationDreamJob

About Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2026-68820) vulnerability. The Ancillary Function Driver (AFD) is a Windows component that supports Windows Sockets applications and is contained in the afd.sys file. The afd.sys driver runs in kernel mode and manages the Winsock TCP/IP communications protocol. This vulnerability is from the August Microsoft Patch Tuesday. Use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally to SYSTEM level. Successful exploitation requires an attacker to win the race condition. As a result, the attacker can gain full control over the Windows host, execute commands with SYSTEM-level privileges, disable security protections, install malware, and access other users' data. 👾 The vulnerability was already being exploited in the wild when it was disclosed as part of Microsoft's August Patch Tuesday on August 11. That same day, it was added to the CISA KEV catalog. Notably, Microsoft listed the Exploit Code Maturity in the CVSS as "Unproven". 🤷‍♂️ Microsoft credited researchers from Check Point for reporting the vulnerability. Details on how the vulnerability was exploited in attacks were published in a Check Point blog post on August 11. The vulnerability was exploited as part of the "Operation Dream Job" campaign, which targeted organizations worldwide, with a particular focus on the defense sector in Europe and India. The campaign is linked to the Lazarus Group. The campaign begins with targeted phishing messages offering victims attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries. Victims are lured into opening a PDF decoy masquerading as a Lockheed Martin job description. This triggers the execution of a lightweight in-memory loader - MISTPEN. The loader uses the Microsoft Graph API to access OneDrive, from which it retrieves additional modules and runs them in memory. During the initial stages of the infection, the attacker deploys several reconnaissance modules that gather information about the system and running processes. Once the target is deemed of interest, MISTPEN retrieves an additional persistence module, which installs the malware on disk and ensures that MISTPEN is automatically launched after a system reboot. After establishing persistence, MISTPEN loads an in-memory module designed to exploit the CVE-2026-68820 vulnerability. Check Point researchers believe that this vulnerability was already being exploited in the "Operation Dream Job" campaign in early July 2026. Successful exploitation enables the malware to launch FudModule, a Lazarus kernel-level rootkit, with SYSTEM privileges. The final backdoor delivered by MISTPEN - ForestTiger - provides attackers with remote access to the compromised system, allowing them to execute commands, collect host information, and download additional malicious components. 🛠 No public exploits have been observed so far. Some people are offering exploits for sale, but they don't look reliable. ⚙️ Security updates are available for Windows 10, Windows 11, and Windows Server 2019. @avleonovcom #AFDsys #Microsoft #Windows #WindowsKernel #Winsock #WindowsTCPIP #UseAfterFree #RaceCondition #EoP #LPE #PatchTuesday #CheckPoint #Lazarus #MISTPEN #Fudmodule #ForestTiger #LockheedMartin #MicrosoftGraphAPI #OneDrive #malware #APT #ZeroDay #phishing #OperationDreamJob

September Microsoft Patch Tuesday. A total of 973 vulnerabilities were addressed - more than twice as many as in August. Seven products had 20 or more vulnerabilities fixed: Windows Biometric Service (64), Microsoft SQL Server (54), Windows DHCP Server (36), Microsoft Office Word (35), Windows NTFS (29), Microsoft Excel (28), and Windows Win32k (24). Vulnerabilities affecting these products account for just under one-third of the total. Two vulnerabilities are known to have been exploited in the wild: 🔻 EoP - Windows Update Stack (CVE-2026-81963). A link following flaw in the Windows Update Stack (CWE-59) may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. 🔻 EoP - Windows Advanced Local Procedure Call (ALPC) (CVE-2026-85880). A heap-based buffer overflow flaw in Windows ALPC (CWE-122) may allow an authenticated attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. There are no vulnerabilities with public exploits yet. Of the remaining vulnerabilities, the following can be highlighted: 🔹 RCE - Microsoft Exchange (CVE-2026-55007). A remote, unauthenticated attacker could achieve code execution on a vulnerable Exchange server by sending an email containing a malicious Visio attachment. The code is executed when the server processes the message, without requiring the victim to open it or use the Preview Pane. 🔹 RCE - Remote Desktop Services (CVE-2026-69525). Successful exploitation of this flaw would allow an unauthenticated attacker to execute arbitrary code by exploiting a use-after-free flaw. 🔹 RCE - Windows DNS Server (CVE-2026-69730). According to the advisory, an unauthenticated, remote attacker could send a crafted packet to exploit a use-after-free flaw in Windows DNS in order to achieve remote code execution. 🔹 RCE - Windows USB Mass Storage Class Driver (CVE-2026-68839). Successful exploitation of this vulnerability could allow an attacker the ability to gain remote code execution via an in-network attacker calling arbitrary endpoints. 🔹 RCE - Windows Kerberos (CVE-2026-69676). An authentication-bypass flaw via capture-replay in Windows Kerberos may allow an authenticated attacker to execute code over a network. 🔹 RCE - Windows Key Distribution Center (CVE-2026-69712). A use-after-free flaw in the Windows Key Distribution Center may allow an authenticated attacker to execute code over a network. 🔹 EoP - Microsoft Exchange (CVE-2026-69380). An authenticated attacker with access to a mailbox through a low-privileged user account could exploit this vulnerability to gain access to other mailboxes. Successful exploitation would allow the attacker to send and receive emails on behalf of other Exchange users as well as access attachments. 🗒 Full Vulristics report @avleonovcom #Microsoft #PatchTuesday #MicrosoftOffice #MicrosoftWord #MicrosoftExcel #MicrosoftExchange #Visio #Windows #WindowsUpdate #WindowsBiometricService #SQLServer #DHCPServer #NTFS #Win32k #ALPC #RemoteDesktopServices #DNS #USBMassStorage #Kerberos #KDC #UseAfterFree #HeapOverflow #CaptureReplay #Vulristics

About Remote Code Execution - TeamCity (CVE-2026-63077) vulnerability. TeamCity is a proprietary solution developed by JetBrains for automating software build, testing, and deployment processes. TeamCity uses a central server to coordinate builds and separate build agents to execute them. An agent can communicate with the server through the agent polling protocol: it registers with the server, requests the next command, and reports whether the command succeeded or failed. The vulnerability allows an unauthenticated remote attacker with HTTP(S) access to a TeamCity On-Premises server to execute arbitrary operating system commands with the privileges of the TeamCity Server process through the agent polling protocol. The vulnerability is caused by insecure deserialization of XML data (CWE-502). Depending on the privileges of the TeamCity Server process, successful exploitation may allow an attacker to access TeamCity data, configurations, and stored credentials, modify the server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines. ⚙️ A notice about this critical vulnerability was published on the JetBrains blog on July 27. The vulnerability affects all versions of TeamCity On-Premises. To remediate the vulnerability, users should upgrade to version 2025.11.7 or 2026.1.3. As a compensating measure, a security patch plugin can be installed on TeamCity 2017.1 and later to prevent exploitation of the vulnerability. For TeamCity 2017.1-2018.1, the server must be restarted after installing the plugin. Starting with TeamCity 2018.2, the plugin can be enabled without restarting the TeamCity server. As a longer-term security measure, the vendor recommends limiting network access to TeamCity servers to trusted networks, including restricting access to the TeamCity login page and REST API. It is also recommended to run the TeamCity server under an operating system account with the minimum privileges required for normal operation. TeamCity servers should be deployed on dedicated hosts separate from build agents, as described in the documentation. 👾 The vulnerability was added to the CISA KEV on August 5. On August 7, JetBrains published a report confirming exploitation of the vulnerability in the wild. The vendor recommended checking TeamCity logs for com.thoughtworks.xstream.converters.ConversionException messages, which may indicate successful exploitation of the vulnerability and warrant further investigation. After updating the server or installing the security patch plugin, logs can be checked for com.thoughtworks.xstream.security.ForbiddenClassException messages, which indicate that an exploitation attempt was blocked. Unauthorized build agents, particularly those with names beginning with scan, may also indicate exploitation attempts. 🛠 A technical analysis of the vulnerability and a link to a public exploit were published on the Rapid7 blog on August 7. A Metasploit module for simplified exploitation of the vulnerability has been available since August 28. 🌐 According to JetBrains, TeamCity is used by more than 30,000 organizations worldwide across government, technology, financial services, healthcare, and other sectors, including some Fortune 500 companies. As of July 30, Censys had detected approximately 4,500 TeamCity installations exposed to the Internet. Of these, 450 were running versions 2025.11.7 or 2026.1.3. Most of the remaining installations were running earlier versions or did not disclose version information. @avleonovcom #TeamCity #JetBrains #Deserialization #CISA #CISAKEV #Exploit #Metasploit #Rapid7 #CICD #DevSecOps #REST #XML #BuildAgents #Censys

About Remote Code Execution - TrueConf Server (CVE-2026-72529, CVE-2026-72530) vulnerability. TrueConf Server is a Russian on-premises corporate messaging and UltraHD video conferencing platform. The attack chain consists of two critical vulnerabilities. The first vulnerability, CVE-2026-72529, is caused by missing authentication for a critical function (CWE-306) and allows an unauthenticated remote attacker with network access to TCP port 4307 (open by default, according to TrueConf documentation) to invoke an undocumented TrueConf Server function and execute an arbitrary script within an isolated environment ("sandbox") where potentially dangerous libraries are unavailable. The second vulnerability, CVE-2026-72530, allows an attacker to perform code injection (CWE-94), escape the isolated environment, and execute arbitrary code on the host operating system with the highest privileges. Among other things, an attacker can delete TrueConf event log entries associated with exploitation activity. ⚙️ Security fixes for these vulnerabilities were released on June 18, 2026. The affected versions are 5.3.x below 5.3.9, 5.4.x below 5.4.9, 5.5.x below 5.5.5, as well as the 5.2 branch and earlier versions (upgrading legacy versions requires contacting technical support). Re-registration of the server is not required when upgrading within the 5.3-5.5 branches. However, the vendor strongly recommends creating a backup before installing the update. If an immediate upgrade is not possible, access to TCP port 4307 should be restricted to trusted networks. 👾 Kaspersky ICS CERT experts have disclosed details of the vulnerability exploitation chain in a post published on August 12. Since July 2026, threat actors have been exploiting CVE-2026-72529 and CVE-2026-72530 in attacks targeting Russian organizations. The attackers first gained network access to TrueConf Server through TCP port 4307 and used CVE-2026-72529 to execute a script within the sandbox. They then exploited CVE-2026-72530 to escape the sandbox and execute code with NT AUTHORITY\SYSTEM privileges. This enabled them to replace one of the TrueConf Server files with a web shell of their own. The attackers then used the web shell to gather information about the organization's IT infrastructure, gain privileged access to the TrueConf Server database, and replace legitimate TrueConf Client installers with malicious versions containing the PhantomCore malware. Users were subsequently prompted to download what appeared to be a new version of the TrueConf Client, which was in fact malicious. IMPORTANT: Even if your organization does not use TrueConf, your employees may have connected to compromised TrueConf servers used by contractors or business partners to participate in online conferences. In doing so, they may have inadvertently installed a malicious version of the TrueConf client on their workstations. The PhantomCore malware, associated with the Head Mare APT group, launches automatically when the system starts and allows attackers to execute arbitrary commands, effectively giving them full control over the compromised host. Kaspersky researchers also identified a new backdoor used in the attacks, which they named PhantomGraph. Both vulnerabilities, CVE-2026-72529 and CVE-2026-72530, were added to the CISA KEV on August 20, 2026. 🛠 A public exploit for CVE-2026-72530 was published on GitHub on August 26. So far, no public exploit for the complete CVE-2026-72529/CVE-2026-72530 exploitation chain has been observed, despite the corresponding flags in the BDU FSTEC vulnerability database. 🌐 TrueConf Server is widely used both in Russia and internationally, including by government agencies, as well as organizations in the financial, industrial, healthcare, and education sectors. @avleonovcom #TrueConf #TrueConfServer #TrueConfClient #Kaspersky #HeadMare #APT #PhantomCore #PhantomGraph #CVE #RCE #Vulnerability #Exploit #PoC #CISA #CISAKEV #FSTEC #BDU #Malware #Backdoor #WebShell #SandboxEscape #CodeInjection #SupplyChain

About Remote Code Execution - Zimbra Collaboration (CVE-2026-73570) vulnerability. Zimbra Collaboration is a collaboration software suite that includes a mail server and web client. In terms of functionality, it is comparable to Microsoft Exchange. The vulnerability allows an unauthenticated attacker to send specially crafted SMTP requests that can result in arbitrary operating system command execution with the privileges of the zimbra user. The vulnerability is caused by the lack of proper sanitization of untrusted input when processing data to generate SNMP notifications. Exploitation requires the optional zimbra-snmp package to be installed, SNMP notifications to be enabled, and the swatchdog service to be running. Successful exploitation allows an attacker to install malware, establish persistence, and use the compromised server as a foothold for further access to the organization's internal infrastructure. An attacker may also gain unauthorized access to corporate emails and other data stored on the system, as well as disrupt Zimbra-related services and business processes. 👾 Experts at CERT Polska reported that the vulnerability was being exploited in the wild on August 17. They recommended checking /var/log/zimbra.log for malicious commands, as well as looking for files created by the zimbra user within the last 30 days in the following directories: /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. The vulnerability was added to the CISA KEV catalog on August 21. 🛠 Public exploits have been available on GitHub since August 24. According to researcher Gabriel P. Lipski's exploit description, an unauthenticated attacker connects to an SMTP port (25, 465, or 587) and sends a standard SMTP session with a command injected into the RCPT TO. Zimbra logs this data in /var/log/zimbra.log regardless of whether the request is accepted or rejected. The swatchdog process then automatically searches the log for lines matching a specific pattern, extracts the attacker-controlled parameter, and passes it to the shell script responsible for sending SNMP notifications without any sanitization. The shell script consequently executes the attacker's command on the host with the privileges of the zimbra operating system user. ⚙️ To remediate the vulnerability, update Zimbra to version 10.1.20 or later. As compensating measures, organizations can disable SNMP notifications, stop the swatchdog service, remove the zimbra-snmp package, and restrict SMTP connections. 🌐 As of August 30, Shadowserver is tracking 5,326 potentially vulnerable hosts, including 172 in Russia. Shadowserver experts also reported the compromise of 274 hosts on August 24. @avleonovcom #Zimbra #SMTP #SNMP #CERTPolska #CISA #CISAKEV #Shadowserver #swatchdog

August Linux Patch Wednesday. A total of 3,060 vulnerabilities. For comparison, there were 2,017 in July. That's a 52% increase and another new record. This time, there are 1,354 vulnerabilities in the Linux Kernel and 447 in Chromium. For 3 vulnerabilities, there are signs of exploitation in the wild: 🔻 RCE - Jenkins (CVE-2026-53435). Jenkins is a development automation server used to build, test, and deploy software. The vulnerability allows a remote authenticated attacker to use the Script Console to execute arbitrary code and read files from the Jenkins controller. The vulnerability was added to the VulnCheck KEV on June 15 and fixed in RedOS on August 12. 🔻 CodeInj - WordPress (CVE-2026-60137). WordPress is a popular open-source CMS for creating websites and blogs. The vulnerability leads to a blind SQL injection in the WordPress core, allowing a remote unauthenticated attacker to read user accounts and password hashes from the WordPress database. Code execution is then possible by installing a malicious plugin. Multiple public exploits are available. The vulnerability was added to the CISA KEV catalog on July 21. A fix for the wordpress package in the Debian repository was released on July 23. 🔻 RCE - SPIP (CVE-2026-77647). SPIP is an open-source CMS for creating and collaboratively editing websites. The vulnerability allows an unauthenticated remote attacker to execute arbitrary PHP code. The vulnerability was added to the VulnCheck KEV on August 20. A fix for the spip package in the Debian repository was released on August 18. Strictly speaking, the report contains one more vulnerability RCE - WinRAR (CVE-2025-8088) that is being exploited in the wild. The vulnerability was fixed in the clamav package in the Alt Linux repository. However, exploitation is only possible on Windows, so it is out of scope. Another 127 vulnerabilities are not known to be exploited in the wild, but public exploits are available for them, or there are indications that such exploits exist. Notable examples include: 🔸 RCE - Action Pack "KindaRails2Shell" (CVE-2026-66066). Action Pack is a component of Ruby on Rails responsible for handling web requests, routing, and generating responses. An attacker can upload a specially crafted image to a vulnerable application and achieve remote code execution. 🔸 RCE - WordPress "XSS2Shell" (CVE-2026-64638). The attack chain allows an unauthenticated XSS on the login page to be escalated to arbitrary PHP code execution. 🔸 CodeInj - PHP (CVE-2026-17543). Improper escaping of backslashes in attacker-controlled parameters can lead to a trivial SQL injection in PHP. 🔸 EoP - Linux Kernel "Zapscape" (CVE-2026-64561). This KVM escape vulnerability allows an attacker to break out of a virtual machine in KVM/x86 environments and execute commands on the host with root privileges. 🔸 EoP - Linux Kernel "OVSwrap" (CVE-2026-64531), Linux Kernel "SCTPhantom" (CVE-2026-64564), Linux Kernel "Ubuntu PPPoL2TP" (CVE-2026-68398). These vulnerabilities allow a local attacker to escalate privileges to root. 🔸 AuthBypass - Traefik (CVE-2026-48020). Traefik is an HTTP reverse proxy and load balancer. A high-severity vulnerability in the StripPrefix middleware allows an unauthenticated attacker to bypass route-level authentication and authorization. 🗒 Full Vulristics report @avleonovcom #LinuxPatchWednesday #LinuxKernel #Chromium #Jenkins #WordPress #SPIP #PHP #Traefik #CISAKEV #KEV #SQLi #Exploit #Vulnerability #Vulnerabilities #Linux #CMS #RedOS #Debian #VulnCheckKEV #Vulristics #SQLInjection #KVM #KVMEscape #RubyOnRails #ActionPack #KindaRails2Shell #XSS2Shell #Zapscape #OVSwrap #SCTPhantom #UbuntuPPPoL2TP #WinRAR #ClamAV

The Vulners team has released nmap-vulners 2.0. This plugin (an NSE script) turns the popular Nmap port scanner into a black-box vulnerability scanner. Simply run $ nmap -sV --script vulners <target> to get a prioritized report on vulnerabilities and exploits. And all of this is available for free with no limitations. 🆓😉 How exactly does this plugin work? To find vulnerabilities, the software is identified first: 🔹 The service's CPE identifier may be provided by Nmap itself (using the -sV option). 🔹 If Nmap fails to identify the service, the plugin attempts to determine the CPE identifier from the raw banner using rules for FTP, SMTP, SSH, MySQL, DNS, NTP, LDAP, and other services. Starting with version 2.0, the fingerprint catalog is updated weekly based on Recog, Wappalyzer, WhatWeb, FingerprintHub, and nuclei-templates. The latest catalog is automatically fetched when the plugin runs. 🔹 If an HTTP service is detected, nmap-vulners also attempts to identify the web stack, including the framework, CMS, or PHP version behind a reverse proxy. It analyzes Server and X-Powered-By headers, cookies, the page title, meta tags, filenames in script src, and page content. The plugin includes more than 700 rules. In version 2.0, the number of HTTP path fingerprints increased from 125 to 939, while parallelization kept the processing time at around 6 seconds per port. 🔹 If a product is identified but its version is unknown, the plugin makes a single request to a known file that contains version information, such as /CHANGELOG.txt for Drupal or /administrator/manifests/files/joomla.xml for Joomla. This works with Concrete5, Drupal, Jira, Joomla, Apache Tomcat, and WordPress. 🔹 Finally, if a service cannot be identified, Smart Audit can be used. The raw banner is sent to the Vulners server, which identifies the software and its version and then looks for related vulnerabilities. This is the only paid feature! Each unique request costs 1 credit, and results are cached. The number of requests is limited by the vulners.max_items parameter, which defaults to 32. Smart Audit can be disabled entirely with --script-args vulners.max_items=0. The service data is then sent to the Vulners server, which returns a prioritized vulnerability report. For each vulnerability or exploit, the report includes its ID, SEVERITY level, CVSS and EPSS scores, Vulners AI score, KEV and EXP flags, and a link to its page on the Vulners website. So, is an API key actually required? 🔹 The plugin can work without an API key. However, detection will use the legacy endpoint, and some vulnerability and exploit data will not be available. 🔹 Adding an API key, even without credits, enables the "EXP" flag for vulnerabilities and the "KEV" flag for both vulnerabilities and exploits. It also adds an EPSS score column, providing more complete prioritization: KEV → CISA SSVC Exploitation Active → exploits → EPSS → CVSS. So, an API key is recommended. 😉 🔹 If your API key has credits, the Smart Audit feature is also available (see above). Installation To install the plugin, simply run the one-line script. The installer automatically finds Nmap and its NSE script directory, installs the latest vulners.nse version, and removes old 1.x files. It then runs nmap --script-updatedb and verifies the installation. The --user and --prefix options let you specify the installation directory, while --uninstall removes the plugin. If needed, the installer prompts for a Vulners API key, validates it, and saves it to ~/.nmap/vulners.key with permissions set to 600. @avleonovcom #Nmap #Vulners #CPE #CVSS #EPSS #KEV #exploit #API #Fingerprinting #HTTP #CMS #PHP #ReverseProxy #ApacheTomcat #WordPress #Drupal #Joomla #Jira #Nuclei #AIScore #Prioritization

The Vulners team has released an updated version of Getsploit. The utility allows you to search for public exploits in the Vulners.com database. It supports both an online mode (search queries are executed on the Vulners server) and a fully offline mode (exploit data from Vulners is downloaded to a local SQLite FTS5 index, which is then used for subsequent searches). I find the second option particularly interesting and useful. 😉 The data can be downloaded with a single command, getsploit --update, and the resulting database is ~1.7 GB in size. You can then search for exploits locally, either by CVE or using full-text search: $ getsploit --local CVE-2024-3094 $ getsploit --local "wordpress 4.7 remote code execution" As a result, you get information about the exploits in the following format: ID, Title, and URL on the Vulners website. If you use the "--mirror" option, the full text of the found exploits will be saved to separate files. This works with all Vulners exploit databases except githubexploit and gitee. Why would you want to search for exploits in the first place? This can be very useful for enriching vulnerability data in your VM solution and, consequently, for better prioritization. It can also be quite useful for red teamers to keep track of new exploitation tools as they emerge. 😉 How much does it cost? Each getsploit update uses 10 credits. According to the pricing, the free plan currently includes 100 credits per month. So, if you update the exploit data once every 3 days, you can use it completely free of charge. 🆓 For $600, you can get 600 credits per month, which is enough to update getsploit roughly twice a day. @avleonovcom #Getsploit #Vulners #exploit #VulnerabilityIntelligence #RedTeam #Pentest #Prioritization

August "In the Trend of VM" (#30): vulnerabilities in ViPNet Client, the Microsoft Windows kernel, and Microsoft SharePoint. I present the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. In the previous July edition, there was just one vulnerability. This time, there are four. 🗞 Post on Habr (rus) 🗒 Digest on the PT website (rus) 🔻 RCE - ViPNet Client (BDU:2026-09885). The first trending vulnerability in a Russian-made product since the beginning of 2026. Its exploitation was discovered by Positive Technologies experts. 🔻 EoP - NT OS Kernel (CVE-2026-42980). The vulnerability allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM level. 🔻 EoP - Microsoft SharePoint (CVE-2026-56164) and RCE - Microsoft SharePoint (CVE-2026-58644). Two actively exploited vulnerabilities in a popular platform for building corporate websites, managing documents, and collaborating. 🟥 The full list of trending vulnerabilities is available on the portal @avleonovcom #PositiveTechnologies #TrendVulns #ViPNet #ViPNetClient #ViPNetAdministrator #InfoTeCS #MFTP #DLLHijacking #PathTraversal #Itcsrvup64exe #wtsapi32dll #Donnect #ShadowRelay #PTESC #Microsoft #Windows #WindowsKernel #NTOSKernel #WMI #KernelExploit #PrivilegeEscalation #SharePoint #CVSS #CISA #CISAKEV #NVD #Mandiant #AMSI #BleepingComputer #BIT #KEV #PatchTuesday #Deserialization

August Microsoft Patch Tuesday. A total of 401 vulnerabilities were addressed - 170 fewer than in July. One of the vulnerabilities is known to be actively exploited in the wild: 🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2026-68820). A local attacker can exploit this vulnerability to gain SYSTEM-level privileges. There is a contradiction in Microsoft's description: the Exploit Code Maturity in CVSS is marked as "Unproven", while at the same time Microsoft states that the vulnerability is being exploited in the wild. 🤷‍♂️ Public exploits are available for two other vulnerabilities: 🔸 EoP - Windows User Profile Service (CVE-2026-62832). This vulnerability allows an authenticated attacker to elevate privileges to ADMINISTRATOR level. Rapid7 believes this vulnerability is related to the LegacyHive exploit, which was published on July 14. 🔸 EoP - Windows Kernel (CVE-2026-62737). This vulnerability allows an authenticated attacker to elevate privileges to SYSTEM level. An exploit has been publicly available since August 11. Among the remaining vulnerabilities, the following stand out: 🔹 RCE - Windows DNS Server (CVE-2026-62878). This wormable vulnerability allows a remote unauthenticated attacker to execute code on a vulnerable server with elevated privileges. It is recommended to test and install the update as soon as possible, especially on Internet-facing DNS servers. 🔹 RCE - Windows Deployment Services TFTP Server (CVE-2026-62893). This vulnerability, discovered as part of the ZDI (Zero Day Initiative) program, allows an attacker to execute code without authentication or user interaction. TFTP has no authentication mechanism and is available remotely via UDP port 69. Any WDS server serving Windows Imaging Format (WIM) files via TFTP, which is the standard PXE boot scenario, is vulnerable. The issue results from the lack of validation of the existence of an object before performing operations on it. UDP port 69 should be blocked at the perimeter, but attackers could easily use this vulnerability for lateral movement within an organization. If you're using WDS for deployments, test and install this update quickly. 🔹 RCE - Windows DHCP Server (CVE-2026-62823). Successful exploitation of this vulnerability allows a remote unauthenticated attacker to execute arbitrary code from an adjacent network by sending a specially crafted packet that triggers a heap-based buffer overflow. 🔹 EoP - Microsoft Exchange (CVE-2026-62911). This vulnerability allows a remote authenticated attacker (with Privileges Required: Low according to CVSS) to gain control over the mailboxes of all Exchange users, send and read emails, and download attachments. This vulnerability was demonstrated at Pwn2Own Berlin. ZDI researchers provided Microsoft with working exploits. 🔹 RCE - Microsoft QUIC (CVE-2026-62815). This use-after-free vulnerability allows an unauthenticated attacker to execute arbitrary code on a target system by sending a specially crafted network packet. QUIC is an IETF-standardized transport protocol that runs over UDP instead of TCP and serves as the foundation for HTTP/3. The protocol is used by approximately 13.5 million websites. 🔹 Tampering - Windows Container Isolation FS Filter Driver (unionfs.sys) (CVE-2026-72971). This vulnerability reportedly allows an attacker to overwrite certain files. As a result, an attacker could perform an action within a container that could impact the host system. 🗒 Full Vulristics report @avleonovcom #Microsoft #Windows #PatchTuesday #DNS #DHCP #Exchange #QUIC #WindowsDeploymentServices #TFTP #WDS #PXE #WindowsKernel #Winsock #AFDsys #UserProfileService #ContainerEscape #ContainerSecurity #UnionFS #LegacyHive #ZDI #Pwn2Own #Rapid7 #Vulristics

And once again, there is a typo, "Vulernability", in the description of a Microsoft vulnerability. 😆 This time, it is in CVE-2026-59125. Just like in the previous case, CVE-2026-58601, the vulnerability is in the Virtual Hard Disk (VHD) Miniport Driver. It no longer looks like a coincidence. A working theory is: 1️⃣ Microsoft manually fills in the vulnerability descriptions; 2️⃣ they reuse descriptions from previous vulnerabilities; 3️⃣ the final vulnerability description is not reviewed. 🤷‍♂️ @avleonovcom #fun

About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability. Information about this vulnerability was published on July 14 as part of the July Microsoft Patch Tuesday. The vulnerability in Microsoft SharePoint Server, caused by a deserialization flaw (CWE-502), allows an attacker with Site Owner privileges or higher to inject and remotely execute arbitrary code on the SharePoint server. This can result in full server compromise, including the exfiltration of corporate documents and data, their modification or deletion, compromise of credentials accessible to the server, and further lateral movement into the organization's internal infrastructure. The authentication requirement, of course, makes exploitation of the vulnerability more difficult. However, an attacker could potentially leverage the previously disclosed EoP vulnerability CVE-2026-56164. At the same time, there is currently no confirmation that these vulnerabilities have been exploited together as part of a single attack chain. 👾 Microsoft experts flagged this vulnerability as being exploited in the wild on the day of Patch Tuesday. Two days later, on July 16, the vulnerability was added to the CISA KEV catalog. Details of the attacks are not yet known. 🛠 No public exploits have been observed so far. ⚙️ Updates are available for Microsoft SharePoint Server 2016, 2019, and Subscription Edition. @avleonovcom #Microsoft #SharePoint #KEV #CISAKEV #PatchTuesday #Deserialization

About Elevation of Privilege - Microsoft SharePoint (CVE-2026-56164) vulnerability. The vulnerability was disclosed in the July Microsoft Patch Tuesday release on July 14. The vulnerability, related to missing authentication for a critical function (CWE-306), allows an unauthenticated attacker to remotely elevate their privileges. It is quite interesting that the CVSS scores for the vulnerability differ significantly between Microsoft's website and the NVD. 🔹 Microsoft: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (5.3 MEDIUM) 🔹 NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 CRITICAL) As can be seen, the difference is that Microsof's experts consider the impact of successful exploitation on integrity to be low, while the NVD rates the impact on confidentiality, integrity, and availability as high. This once again highlights the subjective nature of CVSS as a vulnerability prioritization tool. 😉 👾 Microsoft experts flagged this vulnerability as being exploited in the wild on the day of Patch Tuesday. The vulnerability was also added to the CISA KEV catalog on the same day. Microsoft credited Mandiant Incident Response for reporting this vulnerability, which suggests that Mandiant may have been involved in identifying the exploitation activity. There are currently no publicly available details regarding the attacks. However, according to Bleeping Computer, this vulnerability may have been exploited in an attack against the Swiss Federal Office of Information Technology, Systems and Telecommunication (BIT) reported on July 28. During the incident, credentials for around 200 user and technical accounts were compromised on Internet-facing SharePoint servers. The investigation did not reveal any other data breaches. According to BIT, SharePoint vulnerabilities from the July Microsoft Patch Tuesday were exploited on the servers, although the specific CVEs were not disclosed. 🛠 An exploit for the vulnerability has been available on GitHub since August 6. According to the exploit author's description, the vulnerability allows a remote unauthenticated attacker to elevate privileges to the level of Farm Administrator. By abusing request processing and routing mechanisms, an attacker can force a vulnerable server to fall back to an elevated security context instead of rejecting an unauthenticated request. This enables the attacker to access information about site collections, users, and server configuration, add administrators, and execute commands. ⚙️ Updates are available for Microsoft SharePoint Server 2016, 2019, and Subscription Edition. In addition to installing the updates, Microsoft experts recommend enabling the AMSI antimalware scanning interface on the server and setting the Request Body Scan mode to Full to reduce the risk of exploitation. @avleonovcom #Microsoft #SharePoint #CVSS #CISA #CISAKEV #NVD #Mandiant #AMSI #BleepingComputer #BIT

About Elevation of Privilege - NT OS Kernel (CVE-2026-42980) vulnerability. Information about this vulnerability was disclosed as part of the June Microsoft Patch Tuesday on June 9. The vulnerability was not specifically highlighted in Microsoft Patch Tuesday reviews published by VM vendors. This Microsoft Windows NT OS Kernel elevation of privilege vulnerability is caused by improper handling of integer values during data construction in the Windows Management Instrumentation (WMI) subsystem, resulting in an out-of-bounds write. Successful exploitation allows a local attacker with low privileges (a standard user account) to escalate privileges to NT AUTHORITY\SYSTEM. Obtaining NT AUTHORITY\SYSTEM privileges grants full control over the affected host, enabling an attacker to execute arbitrary commands, modify security settings, access protected data, and use the compromised host as a foothold for further lateral movement within the target environment. 🛠 On July 7, a detailed write-up describing the exploitation of this vulnerability was published. A public proof-of-concept (PoC) exploit is also available on GitHub. 👾 There is currently no evidence of in-the-wild exploitation of this vulnerability. @avleonovcom #Microsoft #Windows #WindowsKernel #NTOSKernel #WMI #KernelExploit #PrivilegeEscalation

About Remote Code Execution - ViPNet Client (BDU:2026-09885) vulnerability. The ViPNet Client software suite is designed to protect corporate users' workstations by providing secure data exchange over IP networks, controlling the network activity of applications and operating system components, and performing personal firewall functions (in the ViPNet Client for Windows version). ViPNet Client operates within the ViPNet network ecosystem and integrates with products from the ViPNet Network Security product line. A vulnerability involving a violation of the data protection mechanism (CWE-693) allows an attacker who has gained control of a host running ViPNet Administrator to distribute malicious updates to hosts running ViPNet Client. According to the vendor bulletin, the attackers' objectives include compromising the integrity of the operating environment, escalating privileges, and executing arbitrary code on the system. 👾 On July 16, experts from Positive Technologies reported the exploitation of this vulnerability in the wild. During the attacks, the threat actor transmitted a container file (.ctl) containing the malicious wtsapi32.dll library using the built-in functionality of the MFTP transport protocol. The malicious library was loaded by the Itcsrvup64.exe executable (a component of the ViPNet software update service) using the DLL Hijacking technique and written to the file system through a Path Traversal technique. The research describes various types of malware deployed by the threat actors on compromised hosts, including tools that operate as proxy servers to redirect network traffic, load additional DLL libraries into process memory and execute them, clear InfoTeCS logs, and collect system information (processes, network connections, installed software, etc.). The report also mentions the previously described Donnect loader and ShadowRelay backdoor. According to available data, the attack campaign was active from at least June 1 to July 14, 2026, and affected at least eight organizations. ⚙️ To remediate the vulnerability, certified builds must be updated to ViPNet Client 4 version 4.5.3 (build 65211) or later. For release builds, ViPNet Client 4 must be updated to version 4.5.5 (build 24749) or later. The vendor also recommends updating ViPNet Administrator 4 to version 4.6.11.5114. 🛠 No signs of publicly available exploits for this vulnerability have been observed so far. @avleonovcom #ViPNet #ViPNetClient #ViPNetAdministrator #InfoTeCS #ИнфоТеКС #MFTP #DLLHijacking #PathTraversal #Itcsrvup64exe #wtsapi32dll #Donnect #ShadowRelay #PositiveTechnologies #PTESC

July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed (539 in the Linux kernel and 504 in Chromium). For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have already been addressed 2.5 weeks before the August LPW. 🤷‍♂️ But for now, let's take a closer look at the July report. Only one vulnerability shows signs of exploitation in the wild: 🔻 RCE - Gogs (CVE-2025-8110). Gogs is a self-hosted web service for managing Git repositories, similar in purpose to GitHub or GitLab. An attacker can achieve remote code execution by manipulating the .git/config file through symbolic link bypasses and injecting commands via sshCommand. Multiple public exploits are available on GitHub. The vulnerability has been added to the CISA KEV catalog. There are also 178 vulnerabilities with public exploits available or indications that they exist, but there are currently no signs of exploitation in the wild. For comparison, last month there were 109 such vulnerabilities. Among them, the following stand out: 🔸 RCE - NGINX (CVE-2026-42533). NGINX is a web server and software for handling network requests, which is often used as a reverse proxy, load balancer, and gateway for web applications. An unauthenticated attacker can exploit this vulnerability for remote code execution by sending crafted HTTP requests.🔸 RCE - libssh2 (CVE-2026-55200). libssh2 is a C library that implements the SSH-2 protocol and allows applications to establish secure SSH connections, execute commands, and transfer files via SFTP/SCP. A remote attacker can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. 🔸 RCE - Linux Kernel "RefluXFS" (CVE-2026-64600). An attacker with an ordinary local account can exploit the vulnerability to overwrite protected files on disk and gain root privileges on affected systems, including installations running SELinux in Enforcing mode. In practice, the vulnerability allows an attacker to set an empty root password. 🔸 RCE - Gogs (CVE-2025-64111). Due to an insufficient patch for CVE-2024-56731, it is still possible to modify files in the .git directory and achieve remote command execution. Based on the exploit code, authentication is required for exploitation. 🔸 CodeInj - MediaWiki (CVE-2026-58025). MediaWiki is a free and open-source web platform for creating and managing wiki websites, powering Wikipedia and other collaborative content editing projects. An attacker with the importupload or import permission (default: sysop group) can craft a malicious XML import file containing serialized PHP objects in params fields, triggering arbitrary object instantiation and potentially leading to remote code execution through gadget chains. 🔸 RCE - FFmpeg (CVE-2026-8461). FFmpeg is a free and open-source collection of libraries and utilities for processing audio and video data. An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. [ Read the full post on avleonov.com ] 🗒 Full Vulristics report @avleonovcom #LinuxPatchWednesday #Vulristics #Linux #LinuxKernel #Chromium #CISAKEV #Gogs #NGINX #libssh2 #MediaWiki #FFmpeg #7Zip

July Microsoft Patch Tuesday. In the second week of July, I was on vacation in St. Petersburg. After that, I got caught up with a bunch of other tasks, so I'm only publishing this roundup now. Better late than never, especially considering how unusual this MSPT turned out to be. 😉 In total, 571 vulnerabilities were addressed - almost three times (❗️) more than in June. There are four vulnerabilities that have been reported as exploited in the wild: 🔻 RCE - Microsoft SharePoint (CVE-2026-58644). An attacker with Site Owner privileges or higher can remotely inject and execute arbitrary code on the SharePoint Server. 🔻 RCE - Microsoft SharePoint (CVE-2026-50522). The vulnerability description is identical to CVE-2026-58644. According to ZDI, the CVE-2026-50522 vulnerability was successfully demonstrated at Pwn2Own Berlin. Despite this, Microsoft rates its Exploit Maturity as "Unknown", even though researchers have already provided a working exploit to the company. This once again shows that organizations should not rely solely on software vendors' assessments and should instead perform their own risk evaluation. If you have Internet-facing SharePoint servers, you should test and deploy the patch addressing this vulnerability as soon as possible. 🔻 EoP - Microsoft SharePoint Server (CVE-2026-56164). Missing authentication for a critical function in Microsoft Office SharePoint could allow an unauthenticated attacker to elevate privileges over a network. Microsoft mentioned in the advisory that enabling the Antimalware Scan Interface (AMSI) on the server and setting the Request Body Scan mode to Full can help mitigate this flaw. 🔻 EoP - Active Directory Federation Services (CVE-2026-56155). Insufficient granularity of access control (CWE-1220) in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain administrator privileges. There are eight more vulnerabilities with publicly available exploits: 🔸 EoP - Windows User Interface Core (CVE-2026-50454). Relative path traversal (CWE-23) allows an authorized attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. The PoC starts from a normal, non-elevated process belonging to a local administrator and opens an interactive command prompt as NT AUTHORITY\SYSTEM. 🔸 EoP - Windows WalletService (CVE-2026-49176). Improper privilege management (CWE-269) allows an authorized attacker to elevate privileges locally. The exploit PoC starts a command prompt as SYSTEM in the active desktop session. 🔸 RCE - Microsoft Message Queuing Queue Manager (CVE-2026-54992). The existing exploit PoC demonstrates denial of service; it does not demonstrate code execution. [ Read the full post on avleonov.com ] 🗒 Full Vulristics Report @avleonovcom #Vulristics #PatchTuesday #Microsoft #MSPT #SharePoint #Exchange #Windows #ActiveDirectory #RDP #WSUS #Dynamics365 #Azure #SharePointServer #ADFS #UICore #WalletService #MSMQ #NarratorBraille #CloudFiles #Win32k #WindowsKernel #AzureSpringApps #SpringCloudAzureB2C #DynamicsNAV #BusinessCentral #HyperV #OWA #DHCPServer #DHCPClient #WAC #FTPService #GDIPlus #NetworkDriver #ADDS #RDC #TCPIP #PrintSpooler #RMCAST #RMT #SQLServer #Copilot #WindowsUpdate #ADCS #AoE2 #AoE2DE #Chrome #Discord #Explorer #Spotify #ESXi

I wonder how this typo even happened? 🤔 Does Microsoft actually fill in vulnerability descriptions manually every time, retyping the text from scratch? 🙄 Though I kind of like the word "Vulernability". It sounds like something related to the ability to learn. 😅 If anyone's working on an educational project related to vulnerabilities, consider this a hint. 😉 @avleonovcom

July "In the Trend of VM" (#29): Microsoft Exchange Server vulnerability. Here is my traditional monthly roundup of trending vulnerabilities, according to Positive Technologies. The previous June edition featured four vulnerabilities. This time, there's only one. 🗞 Post on Habr (rus) 🗒 Digest on the PT website (rus) 🔻 XSS - Microsoft Exchange (CVE-2026-42897). The vulnerability allows attackers to execute arbitrary JavaScript in a user's browser when the user opens a malicious email in Outlook Web Access (OWA). A public proof-of-concept exploit is available, and the vulnerability has already been exploited in the wild. 🟥 The full list of trending vulnerabilities is available on the portal @avleonovcom #PositiveTechnologies #TrendVulns #Microsoft #Exchange #Outlook #OWA #XSS #Spoofing #JavaScript #InternetExplorer #Edge #CISA #CISAKEV #KEV #exploit #GitHub #EM #EOMT #ESU