Threat briefs

A vulnerability in the Ethernet function of multiple Mitsubishi Electric factory automation products allows remote attackers to trigger a denial-of-service condition via specially crafted UDP packets.

Rockwell Automation OTTO Fleet Manager versions V2.36.2 and earlier use an insufficient work factor for bcrypt password hashing, enabling attackers with access to system backups to perform efficient offline brute-force attacks.

Multiple critical vulnerabilities in Ebyte NA111-M firmware version 9013-2-17, including missing authentication and authorization bypasses, allow unauthenticated remote attackers to gain full administrative control.

Applied Systems Engineering ASE2000 V2 (versions 2.25-2.37) is affected by critical XXE and improper TLS validation vulnerabilities that allow for remote code execution, arbitrary file access, and man-in-the-middle attacks.

WebPros has released security updates for Plesk and its Migrator and Site Import extensions to address critical vulnerabilities CVE-2026-65642 and CVE-2026-65647.

The Russian threat group BlueDelta is using a custom batch-script backdoor named HOOKEDGE to target European government and diplomatic entities via macro-enabled Microsoft Word documents that leverage legitimate webhook services for C2.

A remote denial of service vulnerability identified as CVE-2026-15310 exists in CPython, potentially allowing unauthenticated attackers to crash the interpreter via resource exhaustion.

Threat actors are increasingly exploiting Version Control Systems for supply chain compromise, necessitating proactive audit log streaming and metadata configuration to overcome significant platform-specific visibility gaps.

A stored cross-site scripting (XSS) vulnerability in the si-map component of Element maps-ng allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via crafted map pin tooltips.

Multiple Zbtlink router models contain an unauthenticated command injection vulnerability in the infosrvd service, enabling root-level remote code execution via crafted UDP packets.

Multiple Zbtlink and MoreQuick router models contain an unauthenticated backdoor service, 'yunmgrd', which allows remote attackers to execute root commands and manipulate network traffic.

Adobe Campaign Classic is affected by three critical vulnerabilities, including SSRF and OS Command Injection, which allow unauthenticated remote attackers to achieve full system compromise.

Multiple high-severity vulnerabilities, including CVE-2026-77533 and CVE-2026-77537, affect Ubiquiti UniFi products, potentially allowing for system compromise.

A stack-based buffer overflow vulnerability in Nessus allows an authenticated user to execute arbitrary code with full system privileges by deploying a malicious NASL vulnerability test script.

The Chinese-speaking threat actor TA4922 is actively using the modular PackClient C2 framework, delivered via tax-themed spearphishing, to conduct surveillance and deploy follow-on tools like ManageEngine RMM.

GNU screen contains multiple vulnerabilities that enable a local attacker to perform privilege escalation, data manipulation, or unauthorized information disclosure.

TeamViewer clients are affected by multiple vulnerabilities that allow an unauthenticated or local attacker to execute arbitrary code with the privileges of the logged-in user.

Broadcom Brocade SANnav contains multiple vulnerabilities that could allow an unauthenticated or remote attacker to perform information disclosure, potentially exposing sensitive system or network data.

Multiple vulnerabilities in the Vim text editor allow an unauthenticated attacker to trigger a Denial of Service condition, resulting in application crashes or resource exhaustion.

CKAN is affected by multiple vulnerabilities that allow remote attackers to conduct cross-site scripting (XSS) attacks, bypass security controls, and disclose sensitive information.

This detection identifies adversary attempts to impair security monitoring by detecting a complete cessation of host telemetry immediately following a security alert generated by the Elastic Defend agent.

A publicly disclosed path traversal vulnerability (CVE-2026-81491) in boxpositron with-context-mcp versions 3.0.7 and earlier allows remote attackers to manipulate file paths via specific ingested note functions.

The China-nexus cyberespionage actor SilkParasite is using AI-assisted development to create and iterate a modular, multi-language malware suite designed for persistent, stealthy operations across Central Asia.

Threat actors are observed abusing Azure Role-Based Access Control (RBAC) to gain unauthorized administrative privileges and achieve persistence by assigning high-privilege built-in roles to actor-controlled accounts.

An exploit for CVE-2025-3464 allows local attackers to escalate privileges to SYSTEM by leveraging a TOCTOU authentication bypass and an arbitrary decrement primitive within the ASUS AsIO3.sys driver.

CVE-2026-23398 is a vulnerability related to a NULL pointer dereference in the ICMP protocol, potentially leading to a denial-of-service condition in affected Microsoft products.

RAGFlow before 0.26.3 contains a server-side request forgery (SSRF) vulnerability in the 'Invoke' component that allows attackers to access sensitive internal network resources and cloud metadata.

The sentry-selfhosted-mcp 0.4.0 component contains a server-side request forgery (SSRF) vulnerability in raw_sentry_api, allowing remote attackers to perform unauthorized requests.

An unauthenticated attacker can exploit CVE-2026-11551, a critical privilege escalation vulnerability in the WordPress Branda plugin up to version 3.4.29, by leveraging improper identity validation to change arbitrary user passwords, including administrators, leading to full account takeover and potential compromise of the WordPress site.

A SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 allows unauthenticated remote attackers to manipulate database queries via the email parameter in /admin/ajax.php.