All news in category “Security Advisory and Patch Watch”

🔧 Microsoft has deployed a service-side fix for a Family Safety bug that prevented Google Chrome and some other browsers from launching or caused them to crash on Windows 10/11 devices. The problem, first reported in late June 2025, was traced to the service's web-filtering and block-list behavior that misidentified updated browser versions. The rollout began in early February 2026 and should reach affected devices in the coming weeks; users should connect to the Internet to receive the update. Those who cannot go online can enable Activity reporting in Family Safety to receive approval requests and allowlist newer browser versions.

🔴 watchTowr reported the first in-the-wild exploitation of a critical BeyondTrust vulnerability, CVE-2026-1731, with attackers abusing the get_portal_info endpoint to extract the x-ns-company value before establishing a WebSocket channel. The flaw (CVSS 9.9) allows unauthenticated remote code execution by sending specially crafted requests and has been patched in Remote Support (BT26-02-RS, 25.3.2+) and Privileged Remote Access (BT26-02-PRA, 25.1.1+). The rapid weaponization highlights how quickly defenders must patch critical systems. CISA also added four actively exploited flaws to its KEV catalog and set federal remediation deadlines in February and March 2026.

🚨 A critical pre-authentication remote code execution vulnerability, CVE-2026-1731, in BeyondTrust Remote Support and Privileged Remote Access appliances is being actively exploited after a proof-of-concept was published. The flaw affects Remote Support ≤25.3.1 and Privileged Remote Access ≤24.3.4 and allows unauthenticated attackers to execute OS commands as the site user. BeyondTrust automatically patched SaaS instances on Feb 2, 2026; on-premises customers must install vendor updates immediately.

⚠️ Security researcher Wietze Beukema disclosed several techniques at Wild West Hackin' Fest that manipulate Windows .lnk shortcut files to display a benign target in Explorer while executing a different program, including use of malformed LinkTargetIDList and EnvironmentVariableDataBlock fields. These variants can hide command-line arguments and exploit forbidden path characters to show deceptive targets such as "invoice.pdf" while invoking PowerShell or other payloads. Microsoft told the researcher it will not treat the primary finding as a security vulnerability, saying exploitation requires user interaction and pointing to Microsoft Defender, Smart App Control, and built-in warnings for downloaded .lnk files. Beukema published lnk-it-up, an open-source toolkit to generate and detect such shortcuts for testing and research.

🔒 A critical vulnerability in the WPvivid Backup & Migration WordPress plugin (CVE-2026-1357, CVSS 9.8) allowed unauthenticated attackers to upload arbitrary files and achieve remote code execution. The flaw affected all versions up to 0.9.123 but, according to Defiant, only sites with the non-default receive backup from another site option enabled are critically exposed. WPVividPlugins released a patch in v0.9.124 on Jan 28; administrators should upgrade immediately.

🔒 Amazon RDS for PostgreSQL now supports minor versions 18.2, 17.8, 16.12, 15.16, and 14.21. We recommend upgrading to these latest minor versions to remediate known security vulnerabilities and benefit from upstream bug fixes. The release also includes the pg_stat_monitor extension for unified query and performance metrics. Upgrades can be automated via scheduled maintenance, AWS Organizations rollout policies, or Blue/Green deployments to minimize downtime.

⚠️ CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. The new entries are CVE-2024-43468 (Microsoft Configuration Manager SQL injection), CVE-2025-15556 (Notepad++ download of code without integrity check), CVE-2025-40536 (SolarWinds Web Help Desk security control bypass), and CVE-2026-20700 (Apple multiple buffer overflow). CISA cites their frequent use by malicious actors and urges prioritized remediation under BOD 22-01 guidance.

⚠️ Siemens NX contains multiple file-parsing vulnerabilities in its handling of CGM files that can cause application crashes or enable arbitrary code execution when a malicious file is opened. Siemens has released fixes and advises updating to V2512 or later. Do not open untrusted CGM files and apply vendor updates promptly. Follow CISA guidance on network isolation and secure remote access.

🔒 Siemens reports a heap-based buffer overflow in the WIBU CodeMeter Runtime used by Desigo CC and SENTRON Powermanager products. The flaw (CVE-2023-38545) occurs during the SOCKS5 proxy handshake when curl mishandles hostnames longer than 255 bytes and can enable code execution in the context of the affected process. Siemens provides instructions to update the CodeMeter Runtime component and advises upgrading affected systems to V8.0 QU2 or later; follow the vendor's patching guidance promptly.

⚠️ Siemens has published fixes for two local privilege escalation vulnerabilities affecting SINEC NMS and the User Management Component (UMC). A low-privileged user could modify configuration files to force the application to load malicious DLLs, potentially enabling arbitrary code execution with elevated (including SYSTEM) privileges. The issues are tracked as CVE-2026-25655 and CVE-2026-25656 (CWE-427) with a CVSS v3.1 base score of 7.8. Administrators should apply SINEC NMS V4.0 SP2 and UMC V2.15.2.1 or later as provided by Siemens ProductCERT.

🔒 Hitachi Energy has disclosed a default-credentials vulnerability in SuprOS (CVE-2025-7740) affecting versions up to 9.2.1 and 9.2.2.0. Exploitation allows an authenticated local actor to use an admin account created during deployment, risking confidentiality, integrity, and availability. Hitachi Energy recommends applying the vendor update, removing unwanted accounts, and changing default passwords immediately. CISA assigns a CVSS v3.1 score of 8.8 and highlights impacts to critical infrastructure sectors.

⚠️ A PS/IGES Parasolid translator component in Siemens Solid Edge contains an out-of-bounds read when parsing specially crafted IGS files, which can crash the application or permit arbitrary code execution in the context of the running process. Siemens has released a patch; administrators should update to V226.00 Update 03 or later. The issue is tracked as CVE-2025-40936 with a CVSSv3.1 base score of 7.8 (High). Apply the vendor update and follow industrial security best practices to limit exposure.

⚠ Siemens has disclosed a stored cross-site scripting (XSS) vulnerability in Polarion V2404 and V2410 that permits authenticated remote attackers to inject JavaScript into document titles, which can execute in other users' sessions. The flaw is tracked as CVE-2025-40587 and has a CVSS v3.1 base score of 7.6 (High). Siemens advises updating to Polarion V2404.5 or later and V2410.2 or later to remediate the issue. Administrators should prioritize patching, reduce network exposure, and follow Siemens' industrial security guidance.

🔒 Siemens has identified multiple third-party component vulnerabilities in SINEC OS versions prior to V3.3 that affect numerous RUGGEDCOM and SCALANCE industrial network devices worldwide. Siemens ProductCERT published firmware updates (V3.3+) and recommends timely upgrades; CISA republished the vendor advisory. Reported issues originate in libraries such as OpenSSL, libcurl, BusyBox, libpcap and others and include high- and critical-severity flaws (unauthenticated RCEs, buffer overflows, path traversal and improper certificate validation). Administrators should apply vendor patches, restrict network access, isolate control networks, and use secure remote access methods while performing impact analysis.

🔒 Siemens ProductCERT reports a Missing Authorization vulnerability in the Webhooks implementation of Siveillance Video Management Servers that can allow authenticated users with read-only privileges to gain full access to the Webhooks API. Affected releases include V2023 R1–R3, V2024 R1, and V2025 builds older than the specified hotfix revisions. Siemens has published fixes and recommends updating to the listed hotfix revisions. If patching is delayed, audit role settings and limit network exposure to affected devices.

🔒 Airleader GmbH's Airleader Master (<= 6.381) contains a critical file-upload vulnerability (CVE-2026-1358) that permits unauthenticated attackers to place dangerous files on high-privilege pages and potentially obtain remote code execution on the server. CISA assigns CVSS v3.1 9.8 (Critical). The vendor recommends upgrading to 6.386 or later and contacting Airleader for mitigation assistance. Operators should immediately reduce internet exposure and isolate control networks while planning patch deployment.

🔒 Siemens reports multiple vulnerabilities in COMOS across V10.4–V10.6 that could permit arbitrary code execution, cross-site scripting, denial-of-service, credential exposure, and TLS man-in-the-middle attacks. Siemens has published updates for several affected lines (notably V10.4.5 and V10.5.2) and is preparing additional fixes; some issues remain unpatched. Apply vendor updates where available, follow Siemens' countermeasures for unpatched versions, minimize network exposure of COMOS, and contact Siemens ProductCERT for assistance and timelines.

🔄 Amazon Relational Database Service now supports the latest Cumulative Update, CU23 (KB5078297), for SQL Server 2022 on Amazon RDS for SQL Server. We recommend that customers upgrade affected RDS instances to apply this update to obtain fixes and improvements. You can perform the upgrade through the Amazon RDS Management Console or programmatically using the AWS SDK or CLI, and consult the Amazon RDS SQL Server User Guide for detailed upgrade instructions.

🔍 GreyNoise attributes 83% of exploitation attempts against Ivanti Endpoint Manager Mobile (EPMM) to a single IP hosted on PROSPERO bulletproof infrastructure. Between Feb 1–9, 2026 it recorded 417 sessions from eight source IPs, with 346 sessions from 193.24.123[.]42. Activity targeted CVE-2026-1281 (CVSS 9.8), showed automated tooling patterns and DNS OAST callbacks, and involved rotation through 300+ user-agent strings. Defused Cyber also reported a dormant "/mifs/403.jsp" sleeper shell deployed to some EPMM instances.

🔒 Apple released updates for iOS, iPadOS, macOS Tahoe, tvOS, watchOS and visionOS to fix an actively exploited zero-day, tracked as CVE-2026-20700, a memory corruption flaw in dyld that can permit arbitrary code execution when an attacker has memory write capability. Google Threat Analysis Group (TAG) is credited with reporting the issue. Apple said the bug may have been used in extremely sophisticated targeted attacks and also issued related fixes for CVE-2025-14174 and CVE-2025-43529. Patches are available for supported recent devices and additional updates address vulnerabilities in older OS releases.