Threat briefs

Threat actors, including Rhysida and Storm-0501, abuse native Microsoft Azure storage utilities as living-off-the-land binaries to exfiltrate data from compromised endpoints to attacker-controlled cloud storage.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 are vulnerable to a stack-based buffer overflow via malicious DRDA server responses, potentially leading to arbitrary command execution on clients.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to path traversal during archive extraction, allowing an authenticated remote attacker to create arbitrary files on the host system.

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 are susceptible to a container escape vulnerability via unrestricted system calls, potentially allowing a local attacker to gain unauthorized host access.

IBM webMethods Integration Server 11.1 is vulnerable to an XML External Entity (XXE) injection flaw that allows unauthenticated attackers to exfiltrate sensitive files or trigger denial of service via memory exhaustion.

CVE-2026-63427 is an authentication bypass vulnerability in Lenovo Software Fix that allows a local authenticated user to escalate privileges and execute arbitrary code.

A command injection vulnerability (CVE-2026-19136) in the Tianxi AI Agent PC Application allows unauthenticated local attackers to execute arbitrary system commands via specially crafted links.

A local improper authorization vulnerability in the Lenovo File Manager Android app allows authenticated local users to read or modify protected application files.

Lenovo Filez Client contains an improper permissions vulnerability (CVE-2026-11813) that allows local authenticated users to escalate privileges.

A prototype pollution vulnerability in isomorphic-git before 1.42.0 allows malicious Git server operators to manipulate proxy configurations and intercept credentials via crafted ref advertisements.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a path traversal flaw that allows a remote authenticated attacker to trigger a denial of service condition.

IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 are vulnerable to an unauthenticated remote redirect attack via improper HTTP Host header validation.

A high-severity vulnerability in the Lenovo Health Android application, exclusively distributed in the Chinese market, allows unauthorized access to sensitive user health data.

The passport-saml-encrypted library versions up to 0.1.13 contain a critical vulnerability where SAML signature verification is skipped if a specific configuration is omitted, allowing attackers to forge and inject arbitrary authentication assertions.

The zstd-jni library fails to validate sample buffer capacity in the Zstd.trainFromBufferDirect method, allowing attackers to trigger out-of-bounds memory access and JVM termination via crafted inputs.

FileRun versions prior to 2026.3.0 contain an OS command injection vulnerability via an improper redefinition of escapeshellcmd() that allows unauthenticated or authenticated users to execute arbitrary commands.

Multiple vulnerabilities in the Netty framework allow a remote, unauthenticated attacker to trigger denial-of-service, bypass security, perform request smuggling, and manipulate or disclose data.

Threat actors are executing a massive business email compromise campaign utilizing AI-generated templates and layered social engineering to deceive finance departments into initiating fraudulent ACH payments.

Adversaries can establish durable, phishing-resistant persistence in Microsoft Entra ID by registering unauthorized Windows Hello for Business (WHfB) credentials to survive password resets and session revocations.

Adversaries are exploiting the 'Windows Hello key borrowing' technique by replaying device-bound credentials from unauthorized infrastructure to authenticate against Entra ID, facilitating session hijacking and device registration.

Detection logic identifies internal reconnaissance activity characterized by a single source IP probing a large volume of unique destination ports using SYN packets.

Detection of potentially unauthorized IPSEC NAT Traversal (NAT-T) tunnels indicates potential command and control (C2) or exfiltration activity masked by encrypted traffic.

This detection capability correlates network-layer Suricata alerts with host-based process telemetry from Elastic Defend to identify malicious outbound command and control communication.

Anchor CMS versions 0.12.7 and earlier contain an improper access control vulnerability (CVE-2026-88959) allowing authenticated low-privileged users to escalate privileges by modifying administrative accounts.

An unauthenticated path traversal vulnerability in knowns versions prior to 0.30.0 allows attackers to overwrite arbitrary files on the server by supplying malicious traversal sequences in the import route name parameter.

A Time-of-Check Time-of-Use (TOCTOU) race condition in the gvfsd-admin daemon allows local attackers to perform privilege escalation by manipulating symbolic links to modify ownership of arbitrary system files.

ION-DTN versions prior to 4.2.1-a.1 are vulnerable to a remote denial-of-service attack, allowing unauthenticated attackers to terminate the process by sending a malformed BPv7 bundle.

AVEVA Pipeline Integrity Monitor versions through 2025_SP1_P1_build_7.1.9580.8513 contain multiple vulnerabilities including hard-coded keys and improper authorization, facilitating information disclosure, credential brute-forcing, and XSS-based code execution.

NextGen Healthcare Mirth Connect versions 4.7.1 and earlier contain three critical vulnerabilities including SQL injection and XML External Entity (XXE) injection flaws that allow for unauthorized data access and denial-of-service.

An integer overflow vulnerability (CVE-2026-87020) in Orthanc DICOM Server versions prior to 1.13.0 allows an authenticated remote attacker to cause a denial-of-service via a crafted PNG or JPEG image.