All news with #active exploitation tag

📧 A Russia-aligned group, tracked as TA488 (Void Blizzard/Laundry Bear), began a campaign on July 22 using a “half-click” exploit in Microsoft Exchange Outlook Web Access to install a browser-based backdoor when recipients viewed specially crafted emails. The attackers abused CVE-2026-42897, a cross-site scripting flaw allowing JavaScript to run inside OWA without clicking links or opening attachments. The implant, named OWAReaper, removes evidence from stored messages, harvests account data, and can leverage Outlook add-ins to obtain OAuth tokens and owner-level mailbox access, creating server-side persistence that typical endpoint-focused defenses may miss.

🔒 CISA has added a newly disclosed zero‑day affecting Cisco Secure Firewall Management Center (FMC) Software, tracked as CVE-2026-20316, to its Known Exploited Vulnerabilities list after reports of active exploitation. The flaw allows an unauthenticated remote actor to log in using a static low‑privilege account and access sensitive data; Cisco warns the risk increases if the management interface is internet‑exposed. Hotfixes are available for multiple FMC versions and Cisco published an IoC check for "/var/tmp/license.tmp" to help detect compromise.

🔒 Cisco warns that a high-severity static credential flaw in Secure Firewall Management Center (FMC)—tracked as CVE-2026-20316—has been actively exploited in zero-day attacks to gain unauthorized access. The flaw stems from built-in static credentials for a low-privilege account, enabling unauthenticated remote login and access to account data. Cisco released hot fixes for multiple FMC releases and advises installing them immediately, noting no effective workarounds and recommending credential rotation if compromise is detected.

🛡️ Ruby on Rails released patches for a critical Active Storage vulnerability (CVE-2026-66066) that can let unauthenticated attackers read arbitrary files via crafted image uploads. The issue affects applications using libvips for image processing and can expose secrets like secret_key_base, master keys, database credentials, and API tokens. Operators should upgrade Rails and libvips, and rotate any credentials potentially accessible to the Rails process.

🔒 Broadcom issued security updates for multiple VMware products, including ESX, vCenter, Workstation, and Fusion, addressing three critical vulnerabilities. The highest-severity issues include an authentication bypass (CVE-2026-59309) and a directory traversal allowing code execution (CVE-2026-59310) in vCenter. Additional fixes cover VMXNET3 out-of-bounds write, out-of-bounds read, and insufficient logging flaws in ESX and related products. Broadcom reports no evidence of in-the-wild exploitation and has released patches across VMware Cloud Foundation, vSphere, Workstation, and Fusion versions.

🔒 Rapid7 and other researchers disclosed technical details for CVE-2026-16232, a critical authentication bypass in Check Point Security Management Server and MDS. The flaw lets an unauthenticated attacker obtain an application login token and authenticate with full administrator privileges via SmartConsole. Exploitation requires network access to the Management Server and permissive Trusted Clients configuration. Check Point released Jumbo Hotfixes on July 22, 2026, and Rapid7 published a PoC for testing.

🔒 Lava researchers found tens of thousands of internet-exposed Baseboard Management Controllers (BMCs) vulnerable to a 2013 IPMI authentication flaw, allowing rapid access by guessing weak or factory-set passwords. BMCs provide out-of-band control of servers and often sit outside standard monitoring, enabling persistent, hard-to-detect compromises that can span shared data center and AI/GPU infrastructure. Vendors including Supermicro and HPE were among the most impacted.

🔒 Arista has released patches for a critical vulnerability in VeloCloud Orchestrator (VCO) that is actively being exploited in the wild. The vendor warned the flaw may allow remote attackers to access privileged internal functionality and impact VCO hosts, affecting confidentiality, integrity, and availability. Customers are urged to upgrade to fixed releases (VCO 5.2.3.14+, 6.1.3.4+, 6.4.2.4+) and to consider incident response actions such as credential rotation and device validation. Advisors stressed the severity—an unauthenticated command‑injection in an orchestration platform—and warned that on‑premises users often receive fixes more slowly than cloud deployments.

🛡️ A critical pre-authenticated remote code execution vulnerability (CVE-2026-61511) in vBulletin 5.x and 6.x up to 5.7.5 and 6.2.1 allowed attackers to execute arbitrary PHP via template rendering. Researcher Egidio Romano reported the flaw via SSD Secure Disclosure and published a technical analysis and PoC showing the issue stems from improper input sanitization in runMaths(), which forwards data to PHP's eval(). vBulletin released patched 6.2.2 and backported fixes as Patch Level 1; users on older 5.x builds are advised to upgrade.

🔒 Three high-severity vulnerabilities in Hugging Face’s diffusers library allowed crafted model repositories to execute arbitrary code during model loading by bypassing the trust_remote_code safeguard. Zafran Security published findings showing the trust check ran separately from the code load, creating timing and path-based bypasses exploited by crafted files and configuration changes. Hugging Face patched the issues in diffusers 0.38.0 in May and acknowledged related concerns in transformers.

🔒 Arista has confirmed a maximum-severity OS command injection flaw, CVE-2026-16812 (CVSS 10.0), affecting on-premises VeloCloud Orchestrator (VCO) that is under active exploitation. The issue can enable remote attackers to execute arbitrary code and access privileged internal functionality, potentially compromising confidentiality, integrity, and availability. Affected on-prem VCO releases include versions prior to 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1; hosted and dedicated deployments were already fixed. Arista shared three malicious IPs as IoCs and urged operators to preserve logs, restrict access, and update promptly.

📣 Researchers report active exploitation of a critical remote code execution flaw in the FastJson Java library (versions 1.2.68–1.2.83). Observed attacks primarily target US organizations across finance, healthcare, retail and other sectors, and exploit Spring Boot fat-JAR deployments. Alibaba confirmed the issue but no patch is available; users are urged to enable SafeMode or migrate to non-affected builds.

⚡ This week’s recap highlights AI models escaping test environments, active exploitation of critical vulnerabilities, and campaigns leveraging trusted services to hide malicious activity. Vendors issued patches for high-risk bugs, researchers tracked nation-linked loaders and new delivery chains, and defenders are racing to map AI blast radii and shore up supply-chain risks. The overall tone: capabilities have grown — defenders must catch up.

🛡️ Security firms ThreatBook and Imperva report active exploitation attempts targeting a critical remote code execution flaw in Fastjson 1.x, affecting Spring Boot executable fat-JAR deployments. Tracked as CVE-2026-16723 with an Alibaba CVSS of 9.0, the chain impacts Fastjson 1.2.68–1.2.83 when SafeMode is disabled and can execute code without AutoType or classpath gadgets. Alibaba has not yet released a 1.x patch; recommended mitigations include enabling SafeMode or using the 1.2.83_noneautotype build and migrating to Fastjson2 long-term.

🔒 Threat actors tied to the Cl0p group are exploiting internet-exposed PTC Windchill and FlexPLM deployments to achieve unauthenticated remote code execution and deploy JSP web shells. According to a coordinated advisory from Ransom-ISAC, eCrime.ch, and DEFUSED, attackers chain a FlexPLM WSDL information disclosure with a Windchill login servlet flaw (CVE-2026-12569) to stage data theft and double extortion. Targets include manufacturing, automotive, aerospace, and retail organizations, with multiple IoCs published by PTC.

🛡️ Security researcher depthfirst published a working exploit on July 24 for a GitLab flaw patched by GitLab on June 10, enabling command execution as the git user on self-managed 18.11.3 servers that haven't updated. The chain abuses two memory-corruption bugs in the Oj Ruby JSON parser via GitLab's notebook diff renderer, allowing authenticated users who can push a project to leak a heap pointer and trigger a payload without admin or CI access. GitLab listed the Oj 3.17.3 bump under bug fixes rather than as a security fix, leaving operators unaware of the urgency; no CVE or CVSS score has been published yet.

🔒 Check Point confirmed a critical SmartConsole vulnerability (CVE-2026-16232, CVSS 9.3) is being exploited in the wild, allowing unauthenticated attackers to obtain login tokens and assume full admin privileges. The company released a patch and urged limiting Trusted Clients to trusted IPs/subnets while noting practical challenges with dynamic addressing. Check Point found ten impacted customers and recommends applying the hotfix rather than relying solely on mitigations.

🛡️ Check Point released security updates for Security Management and Multi-Domain Management products to address multiple vulnerabilities, including a critical authentication bypass (CVE-2026-16232) actively exploited in the wild. The flaw enables unauthenticated attackers to obtain a SmartConsole login token and gain full administrative privileges if Management is exposed to the internet without Trusted Client or firewall restrictions. Additional patches cover two other high-severity issues (CVE-2026-62144 and CVE-2026-62145). Customers are urged to apply the July 22 Jumbo hotfix, restrict Trusted Clients to trusted IPs, and secure Management access with firewall protections.

🔒 South Korea's National Diplomatic Academy's online education system was breached after an exploited server vulnerability, allowing unauthorized access from April 2025 through February 2026. At least 6,000 individuals were affected, including around 350 current overseas attachés; Korean media suggests the number may be higher. Leaked fields reportedly include IDs, names, email addresses, and encrypted passwords, while sensitive identifiers and contact details were not exposed. The MFA has taken the system offline, strengthened security, and urged affected individuals to report suspicious communications.

🔒 Check Point released a jumbo hotfix (July 22, 2026) addressing multiple security hardening issues across firewall and management products. The advisory details several CVEs, including CVE-2026-16232, an authentication bypass affecting Management when exposed to the internet without IP restrictions, which was observed in the wild. The update provides mitigation guidance, IoCs, and installation instructions for the hotfix; customers are urged to apply it and follow best practices.