VulnHub

Recent threat intelligence reports indicate that a single threat actor is behind the majority of attacks exploiting two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), identified as CVE-2026-21962 and CVE-2026-24061. These vulnerabilities allow for remote code execution, posing significant risks to organizations using this mobile management solution. The findings suggest that companies using Ivanti's software need to be vigilant, as the attacks are actively occurring. The focus on a single actor highlights the need for targeted defenses against this specific threat. Organizations are encouraged to monitor for unusual activity and apply any available patches to mitigate potential exploitation.

A serious vulnerability has been discovered in BeyondTrust Remote Support and Privileged Remote Access appliances, allowing attackers to execute code remotely without authentication. This flaw has become a target for exploitation after a proof-of-concept (PoC) was made publicly available. Organizations using these systems should be particularly vigilant, as the flaw can lead to unauthorized access and potential data breaches. BeyondTrust has released patches to address this issue, and it’s crucial for users to apply these updates promptly to protect their systems. The urgency of this situation highlights the need for proactive security measures in remote access technologies.

BeyondTrust has issued a patch for a serious remote code execution (RCE) vulnerability that affects its Remote Support (RS) and Privileged Remote Access (PRA) products. This vulnerability allows attackers to exploit the systems remotely by sending specially crafted requests, and alarmingly, it does not require authentication to do so. This means that unauthorized users could potentially gain control over affected systems, posing significant risks to organizations using these products. Users and companies should prioritize applying the latest patches to mitigate potential threats. Keeping systems updated is crucial to maintaining security against such vulnerabilities.

BeyondTrust has issued a warning about a serious vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) software. This flaw could let unauthorized attackers run arbitrary code on affected systems, posing a significant security risk. Users of these software products are strongly advised to apply the necessary patches to protect their systems from potential exploitation. The vulnerability's nature means that it could be exploited without requiring any form of authentication, making it particularly dangerous. Organizations using BeyondTrust's software should prioritize updating to secure their environments against this threat.

BeyondTrust has addressed a serious remote code execution vulnerability, identified as CVE-2026-1731, which affects its Remote Support (RS) and Privileged Remote Access (PRA) solutions. This vulnerability can be exploited without authentication, making it particularly dangerous for self-hosted customers. BeyondTrust is urging users to apply the patch immediately to protect their systems. Unlike a previous zero-day vulnerability exploited by threat actors linked to China, this issue was discovered by a security researcher and disclosed privately. The prompt action by BeyondTrust highlights the necessity for timely vulnerability management in remote access tools, which are critical for many organizations.

The Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning regarding a serious vulnerability, identified as CVE-2026-24423, in SmarterMail. This flaw allows for unauthenticated remote code execution (RCE), which means attackers could potentially take control of affected systems without needing any prior authentication. This vulnerability has already been leveraged in ransomware attacks, posing significant risks to users and organizations running SmarterMail. Users are urged to take immediate action to secure their systems, as the flaw could lead to severe data breaches and operational disruptions. The urgency of this warning stems from the active exploitation of the flaw in the wild, highlighting the need for prompt remediation.

Recent findings have revealed that configuration files in Visual Studio Code (VS Code) can be exploited to launch remote code execution (RCE) attacks through GitHub Codespaces. This situation poses significant risks, including supply chain issues, credential theft, and unauthorized network access. Researchers warn that attackers could manipulate these config files to gain control over users' development environments, potentially affecting developers and companies relying on this popular platform. The implications are serious, as sensitive data and infrastructure could be compromised if these vulnerabilities are not addressed promptly. It is crucial for users to stay vigilant and adopt best practices to secure their coding environments.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious vulnerability in SolarWinds Web Help Desk that is currently being exploited in active attacks. This flaw poses a risk to federal agencies, which have been instructed to apply necessary patches within three days to mitigate potential damage. The urgency of the situation underscores the importance of maintaining up-to-date systems, especially for organizations that rely on SolarWinds products. If left unaddressed, this vulnerability could lead to unauthorized access and compromise sensitive data, affecting not just government agencies but potentially their partners and clients as well. The situation is a reminder for all users of SolarWinds software to remain vigilant and ensure their systems are secure.

A serious security vulnerability, identified as CVE-2025-11953 and nicknamed Metro4Shell, has been discovered in the Metro Development Server, which is part of the '@react-native-community/cli' npm package. This flaw, rated 9.8 on the CVSS scale, allows remote attackers to execute arbitrary code without authentication. Researchers from VulnCheck first detected active exploitation of this vulnerability on December 21, 2025. This poses a significant risk for developers and organizations using this package, as it could lead to unauthorized control over their systems. Users of the affected npm package need to take immediate action to protect their applications.

Ivanti has reported two serious vulnerabilities in its Endpoint Manager Mobile (EPMM) software, identified as CVE-2026-1281 and CVE-2026-1340. These flaws allow remote code execution, meaning attackers could potentially take control of affected systems without needing physical access. The company warns that these vulnerabilities are currently being actively exploited, putting users at risk. Organizations using EPMM should prioritize applying the necessary security updates to safeguard their systems. Failure to address these vulnerabilities could lead to significant security breaches, affecting both the integrity of user data and the overall security posture of the organization.

OpenSSL has patched 12 vulnerabilities, including a critical remote code execution (RCE) flaw that poses a significant risk to users. These vulnerabilities mainly arise from issues related to memory safety, parsing robustness, and resource handling. Affected products include various versions of OpenSSL, which is widely used across different platforms and applications. This is particularly concerning for organizations that rely on OpenSSL for secure communications, as attackers could exploit these flaws to gain unauthorized access or control over systems. Users and administrators are urged to apply the latest patches to mitigate these risks and protect their systems from potential exploitation.