A vulnerability in FreeIPA, a system used for managing user identities in Linux domains, allows unauthenticated clients to create their own Kerberos identities. This flaw could enable an attacker to gain access to the administrators group without ever having logged in. The exploit relies on a second vulnerability in the 389 Directory Server, which FreeIPA uses to store identity information. Red Hat has acknowledged the issue, which poses a significant risk to systems that rely on FreeIPA for user management. Organizations using FreeIPA should prioritize addressing this flaw to prevent unauthorized administrative access.
Articles tagged "Exploit"
Found 989 articles
A recent proof-of-concept by security firm TantoSec has demonstrated how a vulnerability in Telerik UI for ASP.NET AJAX can be exploited to achieve unauthenticated remote code execution (RCE). This exploit takes advantage of a 'padding oracle' issue with AES-CBC encryption, but it's important to note that it only affects applications configured in a specific, non-default way. Progress, the vendor of Telerik, patched this vulnerability back in July, and so far, there are no confirmed reports of this exploit being used in real-world attacks. Organizations using Telerik UI should ensure their configurations are secure and apply any relevant updates to mitigate potential risks.
Actively Exploited
Hackers are taking advantage of two newly discovered vulnerabilities in MikroTik routers, specifically targeting devices that have SSH services exposed on the internet. These weaknesses allow attackers to hijack routers, potentially compromising network security for users. The vulnerabilities have been confirmed to be actively exploited in the wild, raising concerns for individuals and businesses using these devices. Users are urged to secure their routers by limiting SSH access and applying any available patches. This incident serves as a reminder of the importance of keeping networking equipment updated and properly configured to prevent unauthorized access.
Actively Exploited
A security researcher has disclosed a zero-day exploit in CrowdStrike's software that could allow attackers to escalate their privileges on affected systems. This vulnerability poses a significant risk as it may enable unauthorized users to gain elevated access, potentially compromising sensitive data and systems. CrowdStrike, known for its endpoint protection solutions, is likely to be contacted by organizations using its services to assess their security posture and mitigate any risks associated with this exploit. The publication of this exploit raises concerns about the security of systems relying on CrowdStrike's technology and emphasizes the need for organizations to remain vigilant about potential vulnerabilities.
Actively Exploited
A serious vulnerability in MikroTik routers has been discovered, specifically affecting those with SSH exposed to the internet. This zero-day exploit, known as the MikroTrick chain, has been actively exploited since September 2, 2023. Experts recommend that anyone using MikroTik routers immediately update their systems to patched versions: 7.24.2, 7.23.5, or 6.49.21. Additionally, users should check their logs for any signs of unauthorized access. Until verified, users should consider their routers compromised, highlighting the urgent need for vigilance among MikroTik router users to protect their networks.
Broadcom has issued security updates to address two vulnerabilities in VMware Workstation and VMware Fusion, one of which is particularly severe. This critical vulnerability, identified as CVE-2026-59346, has a CVSS score of 9.3 and involves an integer-overflow issue. If exploited by a local attacker with elevated privileges, this flaw could allow them to execute arbitrary code on the host system. This poses a significant risk to users of these virtualization products, as it could lead to unauthorized access and control over the host machine. Users are urged to apply the updates promptly to mitigate this risk.
Critical
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and UniversitiesThe Hacker News
Actively Exploited
Recent vulnerabilities in PaperCut have been exploited by attackers to steal credentials from educational institutions in the U.S. and Europe. The Arctic Wolf Adversary Research Team identified two specific vulnerabilities, CVE-2026-81578 and CVE-2026-82078, which allow for authentication bypass and remote code execution. These flaws enable attackers to execute commands and gather information within the affected systems. The impact is particularly significant for schools and universities, as they often handle sensitive student and staff information. Immediate action is essential to prevent unauthorized access and potential data breaches.
PostGREShell vulnerability allows server takeover
SCM feed for Latest
A recently discovered vulnerability in PostgreSQL's logical decoding feature could allow attackers to take control of affected servers. This issue arises from a lack of proper authorization checks, meaning that unauthorized users could exploit this flaw to gain access to sensitive data or manipulate database operations. Organizations using PostgreSQL need to be particularly vigilant as this vulnerability poses a significant risk, especially for those with exposed database services. The potential for server takeover could lead to data breaches or downtime, highlighting the need for immediate attention and action from database administrators.
Hewlett Packard Enterprise (HPE) has released critical patches to address a series of vulnerabilities in its AOS-CX networking operating system. These vulnerabilities, collectively identified as CVE-2026-73749, carry a high severity score of 9.8, indicating they could allow remote code execution. This means that attackers could potentially exploit these flaws to take control of affected systems from a distance. Organizations using AOS-CX should prioritize applying these updates to safeguard their networks. The vulnerabilities are significant as they could affect a wide range of network devices, potentially putting sensitive data and operations at risk.
PostgreSQL has issued updates to fix a serious security vulnerability, tracked as CVE-2026-6471, that has existed for 12 years. This flaw allows users with the REPLICATION attribute to execute arbitrary code as the operating system user running the database server. The vulnerability affects several versions of PostgreSQL, specifically those released before 18.6, 17.11, 16.15, 15.19, and 14.24. The potential for attackers to exploit this flaw poses a significant risk to database security, making it crucial for users to apply the updates promptly. The vulnerability was introduced with the logical decoding feature in PostgreSQL 9.4, highlighting the importance of regularly updating database systems to protect against long-standing vulnerabilities.
Critical
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web TrafficThe Hacker News
Actively Exploited
A new Linux toolkit, dubbed 'ted', has been discovered embedded within altered HAProxy load balancers used by two South Korean organizations. This malicious implant allows attackers to intercept web traffic and manipulate the pages seen by certain visitors. The presence of 'ted' in the HAProxy binaries indicates that it does not exploit a vulnerability in HAProxy itself; instead, it requires the attackers to execute code on the affected systems. This incident raises significant concerns as it demonstrates how attackers can compromise widely used software to conduct web traffic interception. Organizations using HAProxy should be vigilant and ensure their installations are secure to prevent such intrusions.
39 New Methods That Compromise Passkey Authentication
BleepingComputer
Researchers have identified 39 different methods that can compromise passkey authentication, which is designed to replace traditional passwords and reduce security risks. These methods exploit various aspects of the authentication process, including how prompts are presented, how credentials are synced, and how users enroll or recover their accounts. Notably, these vulnerabilities do not break the underlying FIDO2 cryptography, meaning the attacks are focused on misusing the authentication framework rather than cracking it outright. This discovery is significant as it shows that while passkeys are a step forward in security, they are not foolproof and can still be vulnerable to sophisticated attacks. Users and organizations adopting passkey systems need to be aware of these risks and implement additional security measures to protect against potential exploitation.
CriticalCVE-2026-85046
Google patches actively exploited Chrome zero-day (CVE-2026-85046)Help Net Security
Actively Exploited
Google has released a patch for several vulnerabilities in its Chrome browser, including a serious zero-day flaw identified as CVE-2026-85046, which is currently being exploited by attackers. The company confirmed that exploits for this vulnerability are circulating in the wild, prompting the urgent update. Users on Windows, macOS, and Linux should ensure they are running the latest version, which includes Chrome 152.0.7977.82/.83 for Windows and macOS, and Chrome 152.0.7977.82 for Linux. Keeping browsers up to date is crucial to mitigate risks from such vulnerabilities, which could allow attackers to gain unauthorized access or execute malicious code. This incident serves as a reminder of the importance of regular software updates to protect against emerging threats.
+3 more
G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules
Infosecurity Magazine
The G7 has called on its member countries to develop national strategies focused on transitioning to quantum-safe encryption methods. This push comes as concerns grow about the potential for quantum computing to break current encryption methods, which would jeopardize the security of sensitive data across various sectors. The G7's recommendation emphasizes the urgency for governments to prepare for a future where quantum computers could compromise existing cybersecurity measures. By adopting new encryption standards, countries aim to safeguard personal information, financial transactions, and national security. This initiative is crucial as it seeks to protect against future vulnerabilities that quantum technologies could exploit.
Actively Exploited
Researchers from Wordfence have discovered that hackers are taking advantage of two serious vulnerabilities in popular WordPress plugins: Super Forms and Elementor Pro. The first vulnerability, identified as CVE-2026-14894, has a CVSS score of 9.8 and allows unauthenticated attackers to upload files of any type due to a lack of file type validation in the Super Forms plugin. This flaw has led to over 440,000 exploit attempts. The Elementor Pro plugin is also affected, although specific details about its vulnerabilities were not provided. This situation is alarming for website owners using these plugins, as successful exploitation can lead to unauthorized access and potential data breaches. Website administrators should take immediate action to secure their sites against these threats.