Июльский Linux Patch Wednesday

Leave a reply

Июльский Linux Patch Wednesday

July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed (539 in the Linux kernel and 504 in Chromium). For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have already been addressed 2.5 weeks before the August LPW. 🤷‍♂️ But for now, let's take a closer look at the July report. Only one vulnerability shows signs of exploitation in the wild:

🔻 RCE - Gogs (CVE-2025-8110). Gogs is a self-hosted web service for managing Git repositories, similar in purpose to GitHub or GitLab. An attacker can achieve remote code execution by manipulating the .git/config file through symbolic link bypasses and injecting commands via sshCommand. Multiple public exploits are available on GitHub. The vulnerability has been added to the CISA KEV catalog.

There are also 178 vulnerabilities with public exploits available or indications that they exist, but there are currently no signs of exploitation in the wild. For comparison, last month there were 109 such vulnerabilities. Among them, the following stand out:

🔸 RCE - NGINX (CVE-2026-42533). NGINX is a web server and software for handling network requests, which is often used as a reverse proxy, load balancer, and gateway for web applications. An unauthenticated attacker can exploit this vulnerability for remote code execution by sending crafted HTTP requests.

🔸 RCE - libssh2 (CVE-2026-55200). libssh2 is a C library that implements the SSH-2 protocol and allows applications to establish secure SSH connections, execute commands, and transfer files via SFTP/SCP. A remote attacker can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

🔸 RCE - Linux Kernel "RefluXFS" (CVE-2026-64600). An attacker with an ordinary local account can exploit the vulnerability to overwrite protected files on disk and gain root privileges on affected systems, including installations running SELinux in Enforcing mode. In practice, the vulnerability allows an attacker to set an empty root password.

🔸 RCE - Gogs (CVE-2025-64111). Due to an insufficient patch for CVE-2024-56731, it is still possible to modify files in the .git directory and achieve remote command execution. Based on the exploit code, authentication is required for exploitation.

🔸 CodeInj - MediaWiki (CVE-2026-58025). MediaWiki is a free and open-source web platform for creating and managing wiki websites, powering Wikipedia and other collaborative content editing projects. An attacker with the importupload or import permission (default: sysop group) can craft a malicious XML import file containing serialized PHP objects in params fields, triggering arbitrary object instantiation and potentially leading to remote code execution through gadget chains.

🔸 RCE - FFmpeg (CVE-2026-8461). FFmpeg is a free and open-source collection of libraries and utilities for processing audio and video data. An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

🔸 RCE - 7-Zip (CVE-2026-14266). 7-Zip is a free and open-source file archiver that allows users to create and extract archives in various formats, including its native 7z format, ZIP, RAR, and others. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

🔸 MemCor - Linux Kernel (CVE-2026-53359). This is essentially a KVM vulnerability. KVM (Kernel-based Virtual Machine) is a virtualization technology built into the Linux kernel that allows multiple isolated virtual machines to run on a single physical server. A KVM escape vulnerability lets a guest escape to the host in a KVM/x86 environment. It is triggerable on both Intel and AMD.

🗒 Full Vulristics report

July Microsoft Patch Tuesday

Leave a reply

July Microsoft Patch Tuesday

July Microsoft Patch Tuesday. In the second week of July, I was on vacation in St. Petersburg. After that, I got caught up with a bunch of other tasks, so I'm only publishing this roundup now. Better late than never, especially considering how unusual this MSPT turned out to be. 😉 In total, 571 vulnerabilities were addressed - almost three times (❗️) more than in June. There are four vulnerabilities that have been reported as exploited in the wild:

🔻 RCE - Microsoft SharePoint (CVE-2026-58644). An attacker with Site Owner privileges or higher can remotely inject and execute arbitrary code on the SharePoint Server.

🔻 RCE - Microsoft SharePoint (CVE-2026-50522). The vulnerability description is identical to CVE-2026-58644. According to ZDI, the CVE-2026-50522 vulnerability was successfully demonstrated at Pwn2Own Berlin. Despite this, Microsoft rates its Exploit Maturity as "Unknown", even though researchers have already provided a working exploit to the company. This once again shows that organizations should not rely solely on software vendors' assessments and should instead perform their own risk evaluation. If you have Internet-facing SharePoint servers, you should test and deploy the patch addressing this vulnerability as soon as possible.

🔻 EoP - Microsoft SharePoint Server (CVE-2026-56164). Missing authentication for a critical function in Microsoft Office SharePoint could allow an unauthenticated attacker to elevate privileges over a network. Microsoft mentioned in the advisory that enabling the Antimalware Scan Interface (AMSI) on the server and setting the Request Body Scan mode to Full can help mitigate this flaw.

🔻 EoP - Active Directory Federation Services (CVE-2026-56155). Insufficient granularity of access control (CWE-1220) in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain administrator privileges.

There are eight more vulnerabilities with publicly available exploits:

🔸 EoP - Windows User Interface Core (CVE-2026-50454). Relative path traversal (CWE-23) allows an authorized attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. The PoC starts from a normal, non-elevated process belonging to a local administrator and opens an interactive command prompt as NT AUTHORITY\SYSTEM.

🔸 EoP - Windows WalletService (CVE-2026-49176). Improper privilege management (CWE-269) allows an authorized attacker to elevate privileges locally. The exploit PoC starts a command prompt as SYSTEM in the active desktop session.

🔸 RCE - Microsoft Message Queuing Queue Manager (CVE-2026-54992). The existing exploit PoC demonstrates denial of service; it does not demonstrate code execution.

🔸 EoP - Windows Narrator Braille (CVE-2026-58635). According to Microsoft's description, an attacker who successfully exploited this vulnerability could execute code in the security context of the NT AUTHORITY\Network Service account. However, the description of the exploit PoC states that an unprivileged attacker would gain NT AUTHORITY\SYSTEM privileges.

🔸 EoP - Windows Cloud Files Mini Filter Driver (CVE-2026-58613). Use after free (CWE-416) in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. An attacker who successfully exploits this vulnerability can gain SYSTEM privileges. Exploitation details are available in the Talos Vulnerability Report TALOS-2026-2426.

🔸 InfDisc - Windows Win32k (CVE-2026-50416). An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. The exploit PoC description mentions Chrome tabs, Discord, Explorer, Spotify, and tray windows. However, it seems that it will not be possible to intercept passwords using this vulnerability.

🔸 InfDisc - Windows Kernel (CVE-2026-50475). A buffer over-read (CWE-126) in the Windows Kernel allows an authorized attacker to disclose information locally. Exploitation details are available in the Talos Vulnerability Report TALOS-2026-2443.

🔸 EoP - Azure Spring Apps (CVE-2026-50338). An attacker who successfully exploited this vulnerability could gain elevated privileges, potentially allowing them to perform actions beyond their original permissions. According to the author of the exploit PoC, the vulnerability is a Spring Cloud Azure B2C resource server cross-issuer authentication bypass.

Among the remaining vulnerabilities, the following can be highlighted:

🔹 RCE - Windows Remote Desktop Protocol (CVE-2026-56190). An unauthenticated, network-reachable, no user interaction required vulnerability. The root cause is a classic one: the use of an uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

🔹 RCE - Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) (CVE-2026-55944). Successful exploitation can be achieved by sending a crafted login request to an affected Dynamics NAV or Business Central server in order to trigger a deserialization of untrusted data vulnerability. Microsoft's advisory cautions that no user-interaction is required, nor is authentication a requirement in order to successfully exploit this vulnerability.

🔹 EoP - Microsoft Windows VMSwitch (CVE-2026-57092). It's a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. ZDI reported that a similar exploit was demonstrated on ESXi at Pwn2Own Berlin, but this issue is not limited to ESXi. If you use VMSwitch in Hyper-V deployments (which is likely), test and deploy the fix quickly.

🔹 Spoofing - Microsoft Exchange (CVE-2026-55008). An attacker can send a specially crafted email that runs arbitrary JavaScript when the victim opens it in OWA. No attachment or macro is required - simply viewing the email is enough. If your organization uses OWA, it is recommended to test and deploy the fix as soon as possible.

🔹 RCE - Windows DHCP Server (CVE-2026-50518, CVE-2026-56159, CVE-2026-48564, CVE-2026-50370), Windows DHCP Client (CVE-2026-54128), Windows Message Queuing Service (MSMQ) (CVE-2026-50447), Windows Admin Center (WAC) (CVE-2026-56196), Windows FTP Service (CVE-2026-49172), Windows GDI+ (CVE-2026-50380), Windows Server Network driver (CVE-2026-56188), Microsoft Exchange (CVE-2026-55005), Windows Active Directory Domain Services (CVE-2026-49178), Windows Remote Desktop Client (CVE-2026-50474), Windows Remote Desktop Client (CVE-2026-54990, CVE-2026-58594), Windows TCP/IP (CVE-2026-54999), Windows Print Spooler (CVE-2026-58608), Windows Reliable Multicast Transport Driver (RMCAST) (CVE-2026-54982, CVE-2026-54995), Microsoft SQL Server (CVE-2026-54117), Microsoft Copilot (CVE-2026-48561).

🔹 SFB - Microsoft SharePoint Server (CVE-2026-55040).

🔹 EoP - Windows Server Update Service (WSUS) (CVE-2026-50444), Active Directory Certificate Services (CVE-2026-54121).

There is also a rather curious vulnerability:

RCE - Game: Age of Empires II: Definitive Edition (CVE-2026-50663). 😃 A relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. Age of Empires II is a cult classic real-time strategy game by Microsoft, set in the medieval era. Players develop chosen civilizations, manage resources, research technologies, and command armies in historical campaigns and multiplayer battles. The Definitive Edition features improved graphics, updated audio, and additional content. If you're still playing this game, be sure to update. 😉

🗒 Full Vulristics Report

July "In the Trend of VM" (#29): Microsoft Exchange Server vulnerability

Leave a reply

July In the Trend of VM (#29): Microsoft Exchange Server vulnerability

July "In the Trend of VM" (#29): Microsoft Exchange Server vulnerability. Here is my traditional monthly roundup of trending vulnerabilities, according to Positive Technologies. The previous June edition featured four vulnerabilities. This time, there's only one.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

🔻 XSS - Microsoft Exchange (CVE-2026-42897). The vulnerability allows attackers to execute arbitrary JavaScript in a user's browser when the user opens a malicious email in Outlook Web Access (OWA). A public proof-of-concept exploit is available, and the vulnerability has already been exploited in the wild.

🟥 The full list of trending vulnerabilities is available on the portal

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability

Leave a reply

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability. The vulnerability was fixed on May 14 outside the regular Microsoft Patch Tuesday cycle. Improper neutralization of input during web page generation (CWE-79, XSS) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. In practical terms, this means that a remote attacker could exploit this vulnerability by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. As a result, the attacker may gain control of the user's mailbox by using an active user session.

👾 Microsoft experts immediately reported signs of active exploitation in the wild for this vulnerability. The vulnerability was added to the CISA KEV on May 15.

⚒️ A public exploit for the vulnerability was published on GitHub on May 15 as well.

⚙️ Initially, mitigation measures were recommended to address the vulnerability, delivered via the Exchange Emergency Mitigation (EM) service or by using the Exchange on-premises Mitigation Tool (EOMT) script. Security updates that fix the vulnerability in Microsoft Exchange Server Subscription Edition RTM, Exchange Server 2016, and Exchange Server 2019 were released almost a month later, on June 9. Microsoft experts recommended keeping the mitigations enabled even after applying the patch, as they provide an additional layer of protection. However, applying these mitigations may cause issues (for example, errors when printing calendars and displaying images in OWA).

⚠️ Please note that Exchange Server 2016 and 2019, which are out of support, are also affected by this vulnerability. Only customers enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026.

June Linux Patch Wednesday

Leave a reply

June Linux Patch Wednesday

June Linux Patch Wednesday. A total of 1,888 vulnerabilities (324 in the Linux kernel, and a whopping 728 in Chromium ❗️). For comparison, there were 1,638 vulnerabilities in May. The increase isn't as dramatic as it was from April to May, but it's still a new record. One of the vulnerabilities has been flagged as actively exploited in the wild:

🔻 RCE - Chromium (CVE-2026-11645). Chromium is the open-source web browser project that serves as the foundation for many modern browsers, including Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi. A publicly available Metasploit module exploits a vulnerability in the web browser's V8 JavaScript engine. The vulnerability is triggered by a specific code pattern that causes type confusion between internal V8 objects, resulting in out-of-bounds memory access. Successful exploitation may lead to remote code execution in the context of the browser process.

There are also 109 vulnerabilities with public exploits or evidence that exploits exist, although there are no signs of active exploitation in real-world attacks yet. Among them, the following stand out:

🔸 EoP - Linux Kernel "CIFSwitch" (CVE-2026-46243). This vulnerability could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges.

🔸 EoP - Linux Kernel "PinTheft" (CVE-2026-43494). On a successfully exploited configuration, the chain completes and hands off to the discovered SUID binary with an overwritten first page - yielding a root shell if the race and kernel state align.

🔸 RCE - Apache ActiveMQ (CVE-2026-42588). ActiveMQ is an open-source message broker written in Java. Exploitation of this vulnerability requires valid credentials for the ActiveMQ Web Console. However, the default credentials are admin/admin.

🔸 InfDisc - Squid "Squidbleed" (CVE-2026-47729). Squid is an open-source caching proxy server. The vulnerability causes Squid's FTP parser to read beyond the boundary of a memory buffer, into a region that may contain a previous user's uncleared HTTP request data.

🔸 AuthBypass - Nextcloud (CVE-2026-45156). Nextcloud is an open source content collaboration platform. A missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user.

🔸 XSS - Nextcloud (CVE-2025-59788). A vulnerability in a reachable files_pdfviewer example directory in Nextcloud allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html.

🔸 XSS - Roundcube (CVE-2026-48849). Roundcube is a free, open-source webmail application. An unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

🔸 DoS - ImageMagick (CVE-2026-46522). ImageMagick is an open-source image processing tool used to create, edit, and convert images. Due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion.

🗒 Full Vulristics report

June Microsoft Patch Tuesday

Leave a reply

June Microsoft Patch Tuesday

June Microsoft Patch Tuesday. Last week I was on vacation in Veliky Novgorod, so I'm publishing this overview only now. A total of 202 vulnerabilities were addressed, approximately twice as many as in May. There are currently no vulnerabilities marked as exploited in the wild. However, there are two vulnerabilities with publicly available exploits:

🔸 RCE - HTTP.sys (CVE-2026-47291). This critical vulnerability allows remote, unauthenticated attackers to execute arbitrary code on affected systems without user interaction. However, systems using the default MaxRequestBytes registry value in the Windows HTTP stack are not affected. If needed, you can change this registry setting to protect systems while testing and deploying the patch. Microsoft's security bulletin includes instructions and a PowerShell script for this workaround.

🔸 DoS - HTTP.sys (CVE-2026-49160). The same exploit is used as for the previous RCE vulnerability.

It is also worth paying attention to vulnerabilities that Microsoft has flagged as having a publicly available exploit:

🔹 SFB - Windows BitLocker (CVE-2026-50507). A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data. According to Tenable, this is the "Bitskrieg" vulnerability discovered by the researcher known as Chaotic Eclipse/Nightmare Eclipse.

🔹 SFB - Secure Boot (CVE-2026-48570). An attacker who successfully exploited this vulnerability could bypass Secure Boot. This vulnerability was reported by Alon Leviev (STORM), who is known for previous research related to BootKitty and BlackLotus.

Among the remaining vulnerabilities, the following are worth highlighting:

🔹 RCE - Windows Kernel (CVE-2026-45657). This vulnerability allows remote, unauthenticated attackers to run code with SYSTEM privileges without any user interaction. In other words, it could be used to spread automatically between systems. The issue is caused by how the Windows kernel processes TCP/IP traffic. Microsoft rated this as "Exploitation Less Likely", but security researchers and exploit developers are already analyzing the patch and trying to build an exploit. Test and deploy this patch as soon as possible.

🔹 EoP - Windows Collaborative Translation Framework (CTFMON) (CVE-2026-45586). This vulnerability affects a component used for voice and handwriting recognition. If exploited, an attacker could gain SYSTEM privileges. Microsoft rates this vulnerability as "Exploitation More Likely".

🔹 RCE - Windows Remote Desktop Client (CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799, CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-47654, CVE-2026-48563). Successful exploitation would require a victim to connect to an attacker-controlled server using an affected version of the Remote Desktop Client. This action could trigger a heap-based buffer overflow, resulting in remote code execution.

🔹 RCE - DHCP Client Service (CVE-2026-44815). This vulnerability allows remote, unauthenticated attackers to execute code on affected systems without user interaction. Because the DHCP client is widely enabled across Windows systems, this vulnerability presents a broad attack surface. Organizations should prioritize testing and deploying the patch for this vulnerability as soon as possible.

🗒 Full Vulristics report

June "In the Trend of VM" (#28): Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities

Leave a reply

June In the Trend of VM (#28): Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities

June "In the Trend of VM" (#28): Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities. Presenting the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. In the previous May edition, we covered four vulnerabilities. This time, there are also four vulnerabilities associated with five CVE identifiers.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

🔻 EoP - Linux Kernel "Dirty Frag" (CVE-2026-43284, CVE-2026-43500). A chain of vulnerabilities with a public exploit to obtain root access. There are signs of in-the-wild exploitation.

🔻 EoP - Linux Kernel "Fragnesia" (CVE-2026-46300). Another vulnerability for gaining root access with a public exploit.

🔻 EoP - Microsoft Defender "RedSun" (CVE-2026-41091). A privilege escalation vulnerability leading to SYSTEM-level access, with a public exploit available and indications of in-the-wild exploitation. Pay special attention to Windows server and desktop environments where Microsoft Defender is enabled but there is no Internet access for regular updates.

🔻 RCE - PAN-OS (CVE-2026-0300). An unauthenticated RCE with root privileges affecting PA-Series and VM-Series firewalls. A public exploit exists, and there are indications of in-the-wild exploitation.

🟥 The full list of trending vulnerabilities is available on the portal