August "In the Trend of VM" (#30): vulnerabilities in ViPNet Client, the Microsoft Windows kernel, and Microsoft SharePoint

Leave a reply

August In the Trend of VM (#30): vulnerabilities in ViPNet Client, the Microsoft Windows kernel, and Microsoft SharePoint

August "In the Trend of VM" (#30): vulnerabilities in ViPNet Client, the Microsoft Windows kernel, and Microsoft SharePoint. I present the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. In the previous July edition, there was just one vulnerability. This time, there are four.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

🔻 RCE - ViPNet Client (BDU:2026-09885). The first trending vulnerability in a Russian-made product since the beginning of 2026. Its exploitation was discovered by Positive Technologies experts.

🔻 EoP - NT OS Kernel (CVE-2026-42980). The vulnerability allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM level.

🔻 EoP - Microsoft SharePoint (CVE-2026-56164) and RCE - Microsoft SharePoint (CVE-2026-58644). Two actively exploited vulnerabilities in a popular platform for building corporate websites, managing documents, and collaborating.

🟥 The full list of trending vulnerabilities is available on the portal

August Microsoft Patch Tuesday

Leave a reply

August Microsoft Patch Tuesday

August Microsoft Patch Tuesday. A total of 401 vulnerabilities were addressed - 170 fewer than in July. One of the vulnerabilities is known to be actively exploited in the wild:

🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2026-68820). A local attacker can exploit this vulnerability to gain SYSTEM-level privileges. There is a contradiction in Microsoft's description: the Exploit Code Maturity in CVSS is marked as "Unproven", while at the same time Microsoft states that the vulnerability is being exploited in the wild. 🤷‍♂️

Public exploits are available for two other vulnerabilities:

🔸 EoP - Windows User Profile Service (CVE-2026-62832). This vulnerability allows an authenticated attacker to elevate privileges to ADMINISTRATOR level. Rapid7 believes this vulnerability is related to the LegacyHive exploit, which was published on July 14.

🔸 EoP - Windows Kernel (CVE-2026-62737). This vulnerability allows an authenticated attacker to elevate privileges to SYSTEM level. An exploit has been publicly available since August 11.

Among the remaining vulnerabilities, the following stand out:

🔹 RCE - Windows DNS Server (CVE-2026-62878). This wormable vulnerability allows a remote unauthenticated attacker to execute code on a vulnerable server with elevated privileges. It is recommended to test and install the update as soon as possible, especially on Internet-facing DNS servers.

🔹 RCE - Windows Deployment Services TFTP Server (CVE-2026-62893). This vulnerability, discovered as part of the ZDI (Zero Day Initiative) program, allows an attacker to execute code without authentication or user interaction. TFTP has no authentication mechanism and is available remotely via UDP port 69. Any WDS server serving Windows Imaging Format (WIM) files via TFTP, which is the standard PXE boot scenario, is vulnerable. The issue results from the lack of validation of the existence of an object before performing operations on it. UDP port 69 should be blocked at the perimeter, but attackers could easily use this vulnerability for lateral movement within an organization. If you're using WDS for deployments, test and install this update quickly.

🔹 RCE - Windows DHCP Server (CVE-2026-62823). Successful exploitation of this vulnerability allows a remote unauthenticated attacker to execute arbitrary code from an adjacent network by sending a specially crafted packet that triggers a heap-based buffer overflow.

🔹 EoP - Microsoft Exchange (CVE-2026-62911). This vulnerability allows a remote authenticated attacker (with Privileges Required: Low according to CVSS) to gain control over the mailboxes of all Exchange users, send and read emails, and download attachments. This vulnerability was demonstrated at Pwn2Own Berlin. ZDI researchers provided Microsoft with working exploits.

🔹 RCE - Microsoft QUIC (CVE-2026-62815). This use-after-free vulnerability allows an unauthenticated attacker to execute arbitrary code on a target system by sending a specially crafted network packet. QUIC is an IETF-standardized transport protocol that runs over UDP instead of TCP and serves as the foundation for HTTP/3. The protocol is used by approximately 13.5 million websites.

🔹 Tampering - Windows Container Isolation FS Filter Driver (unionfs.sys) (CVE-2026-72971). This vulnerability reportedly allows an attacker to overwrite certain files. As a result, an attacker could perform an action within a container that could impact the host system.

🗒 Full Vulristics report

About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability

Leave a reply

About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability

About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability. Information about this vulnerability was published on July 14 as part of the July Microsoft Patch Tuesday. The vulnerability in Microsoft SharePoint Server, caused by a deserialization flaw (CWE-502), allows an attacker with Site Owner privileges or higher to inject and remotely execute arbitrary code on the SharePoint server. This can result in full server compromise, including the exfiltration of corporate documents and data, their modification or deletion, compromise of credentials accessible to the server, and further lateral movement into the organization's internal infrastructure.

The authentication requirement, of course, makes exploitation of the vulnerability more difficult. However, an attacker could potentially leverage the previously disclosed EoP vulnerability CVE-2026-56164. At the same time, there is currently no confirmation that these vulnerabilities have been exploited together as part of a single attack chain.

👾 Microsoft experts flagged this vulnerability as being exploited in the wild on the day of Patch Tuesday. Two days later, on July 16, the vulnerability was added to the CISA KEV catalog. Details of the attacks are not yet known.

🛠 No public exploits have been observed so far.

⚙️ Updates are available for Microsoft SharePoint Server 2016, 2019, and Subscription Edition.

About Elevation of Privilege - Microsoft SharePoint (CVE-2026-56164) vulnerability.

Leave a reply

About Elevation of Privilege - Microsoft SharePoint (CVE-2026-56164) vulnerability.

About Elevation of Privilege - Microsoft SharePoint (CVE-2026-56164) vulnerability. The vulnerability was disclosed in the July Microsoft Patch Tuesday release on July 14. The vulnerability, related to missing authentication for a critical function (CWE-306), allows an unauthenticated attacker to remotely elevate their privileges.

It is quite interesting that the CVSS scores for the vulnerability differ significantly between Microsoft's website and the NVD.

🔹 Microsoft: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (5.3 MEDIUM)

🔹 NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 CRITICAL)

As can be seen, the difference is that Microsof's experts consider the impact of successful exploitation on integrity to be low, while the NVD rates the impact on confidentiality, integrity, and availability as high. This once again highlights the subjective nature of CVSS as a vulnerability prioritization tool. 😉

👾 Microsoft experts flagged this vulnerability as being exploited in the wild on the day of Patch Tuesday. The vulnerability was also added to the CISA KEV catalog on the same day. Microsoft credited Mandiant Incident Response for reporting this vulnerability, which suggests that Mandiant may have been involved in identifying the exploitation activity. There are currently no publicly available details regarding the attacks. However, according to Bleeping Computer, this vulnerability may have been exploited in an attack against the Swiss Federal Office of Information Technology, Systems and Telecommunication (BIT) reported on July 28. During the incident, credentials for around 200 user and technical accounts were compromised on Internet-facing SharePoint servers. The investigation did not reveal any other data breaches. According to BIT, SharePoint vulnerabilities from the July Microsoft Patch Tuesday were exploited on the servers, although the specific CVEs were not disclosed.

🛠 An exploit for the vulnerability has been available on GitHub since August 6. According to the exploit author's description, the vulnerability allows a remote unauthenticated attacker to elevate privileges to the level of Farm Administrator. By abusing request processing and routing mechanisms, an attacker can force a vulnerable server to fall back to an elevated security context instead of rejecting an unauthenticated request. This enables the attacker to access information about site collections, users, and server configuration, add administrators, and execute commands.

⚙️ Updates are available for Microsoft SharePoint Server 2016, 2019, and Subscription Edition. In addition to installing the updates, Microsoft experts recommend enabling the AMSI antimalware scanning interface on the server and setting the Request Body Scan mode to Full to reduce the risk of exploitation.

About Elevation of Privilege - NT OS Kernel (CVE-2026-42980) vulnerability

Leave a reply

About Elevation of Privilege - NT OS Kernel (CVE-2026-42980) vulnerability

About Elevation of Privilege - NT OS Kernel (CVE-2026-42980) vulnerability. Information about this vulnerability was disclosed as part of the June Microsoft Patch Tuesday on June 9. The vulnerability was not specifically highlighted in Microsoft Patch Tuesday reviews published by VM vendors. This Microsoft Windows NT OS Kernel elevation of privilege vulnerability is caused by improper handling of integer values during data construction in the Windows Management Instrumentation (WMI) subsystem, resulting in an out-of-bounds write. Successful exploitation allows a local attacker with low privileges (a standard user account) to escalate privileges to NT AUTHORITY\SYSTEM. Obtaining NT AUTHORITY\SYSTEM privileges grants full control over the affected host, enabling an attacker to execute arbitrary commands, modify security settings, access protected data, and use the compromised host as a foothold for further lateral movement within the target environment.

🛠 On July 7, a detailed write-up describing the exploitation of this vulnerability was published. A public proof-of-concept (PoC) exploit is also available on GitHub.

👾 There is currently no evidence of in-the-wild exploitation of this vulnerability.

About Remote Code Execution - ViPNet Client (BDU:2026-09885) vulnerability

Leave a reply

About Remote Code Execution - ViPNet Client (BDU:2026-09885) vulnerability

About Remote Code Execution - ViPNet Client (BDU:2026-09885) vulnerability. The ViPNet Client software suite is designed to protect corporate users' workstations by providing secure data exchange over IP networks, controlling the network activity of applications and operating system components, and performing personal firewall functions (in the ViPNet Client for Windows version). ViPNet Client operates within the ViPNet network ecosystem and integrates with products from the ViPNet Network Security product line. A vulnerability involving a violation of the data protection mechanism (CWE-693) allows an attacker who has gained control of a host running ViPNet Administrator to distribute malicious updates to hosts running ViPNet Client. According to the vendor bulletin, the attackers' objectives include compromising the integrity of the operating environment, escalating privileges, and executing arbitrary code on the system.

👾 On July 16, experts from Positive Technologies reported the exploitation of this vulnerability in the wild. During the attacks, the threat actor transmitted a container file (.ctl) containing the malicious wtsapi32.dll library using the built-in functionality of the MFTP transport protocol. The malicious library was loaded by the Itcsrvup64.exe executable (a component of the ViPNet software update service) using the DLL Hijacking technique and written to the file system through a Path Traversal technique. The research describes various types of malware deployed by the threat actors on compromised hosts, including tools that operate as proxy servers to redirect network traffic, load additional DLL libraries into process memory and execute them, clear InfoTeCS logs, and collect system information (processes, network connections, installed software, etc.). The report also mentions the previously described Donnect loader and ShadowRelay backdoor. According to available data, the attack campaign was active from at least June 1 to July 14, 2026, and affected at least eight organizations.

⚙️ To remediate the vulnerability, certified builds must be updated to ViPNet Client 4 version 4.5.3 (build 65211) or later. For release builds, ViPNet Client 4 must be updated to version 4.5.5 (build 24749) or later. The vendor also recommends updating ViPNet Administrator 4 to version 4.6.11.5114.

🛠 No signs of publicly available exploits for this vulnerability have been observed so far.

Июльский Linux Patch Wednesday

Leave a reply

Июльский Linux Patch Wednesday

July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed (539 in the Linux kernel and 504 in Chromium). For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have already been addressed 2.5 weeks before the August LPW. 🤷‍♂️ But for now, let's take a closer look at the July report. Only one vulnerability shows signs of exploitation in the wild:

🔻 RCE - Gogs (CVE-2025-8110). Gogs is a self-hosted web service for managing Git repositories, similar in purpose to GitHub or GitLab. An attacker can achieve remote code execution by manipulating the .git/config file through symbolic link bypasses and injecting commands via sshCommand. Multiple public exploits are available on GitHub. The vulnerability has been added to the CISA KEV catalog.

There are also 178 vulnerabilities with public exploits available or indications that they exist, but there are currently no signs of exploitation in the wild. For comparison, last month there were 109 such vulnerabilities. Among them, the following stand out:

🔸 RCE - NGINX (CVE-2026-42533). NGINX is a web server and software for handling network requests, which is often used as a reverse proxy, load balancer, and gateway for web applications. An unauthenticated attacker can exploit this vulnerability for remote code execution by sending crafted HTTP requests.

🔸 RCE - libssh2 (CVE-2026-55200). libssh2 is a C library that implements the SSH-2 protocol and allows applications to establish secure SSH connections, execute commands, and transfer files via SFTP/SCP. A remote attacker can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

🔸 RCE - Linux Kernel "RefluXFS" (CVE-2026-64600). An attacker with an ordinary local account can exploit the vulnerability to overwrite protected files on disk and gain root privileges on affected systems, including installations running SELinux in Enforcing mode. In practice, the vulnerability allows an attacker to set an empty root password.

🔸 RCE - Gogs (CVE-2025-64111). Due to an insufficient patch for CVE-2024-56731, it is still possible to modify files in the .git directory and achieve remote command execution. Based on the exploit code, authentication is required for exploitation.

🔸 CodeInj - MediaWiki (CVE-2026-58025). MediaWiki is a free and open-source web platform for creating and managing wiki websites, powering Wikipedia and other collaborative content editing projects. An attacker with the importupload or import permission (default: sysop group) can craft a malicious XML import file containing serialized PHP objects in params fields, triggering arbitrary object instantiation and potentially leading to remote code execution through gadget chains.

🔸 RCE - FFmpeg (CVE-2026-8461). FFmpeg is a free and open-source collection of libraries and utilities for processing audio and video data. An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

🔸 RCE - 7-Zip (CVE-2026-14266). 7-Zip is a free and open-source file archiver that allows users to create and extract archives in various formats, including its native 7z format, ZIP, RAR, and others. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

🔸 MemCor - Linux Kernel (CVE-2026-53359). This is essentially a KVM vulnerability. KVM (Kernel-based Virtual Machine) is a virtualization technology built into the Linux kernel that allows multiple isolated virtual machines to run on a single physical server. A KVM escape vulnerability lets a guest escape to the host in a KVM/x86 environment. It is triggerable on both Intel and AMD.

🗒 Full Vulristics report