Threat briefs

The ShieldBreak exploit abuses Windows Error Reporting (WerMgr.exe) by loading a malicious phantom DLL (phoneinfo.dll) to execute arbitrary processes at SYSTEM integrity level.

Adversaries leverage Phantom DLL hijacking by planting malicious libraries in privileged system paths to achieve local privilege escalation and persistence via legitimate Windows services.

The ShieldBreak exploit facilitates local privilege escalation by manually creating malicious .wer files in the Windows Error Reporting ReportQueue directory to achieve arbitrary code execution as SYSTEM.

Malware families like Qakbot and Trickbot inject malicious code into the legitimate Windows Error Reporting process (wermgr.exe) to establish covert named pipe communication for C2 and persistence.

The ShieldBreak exploit abuses symbolic link swaps over local loopback SMB shares to create NTFS Alternate Data Streams, enabling privilege escalation by redirecting privileged file writes to system-critical directories.

Attackers utilize network utilities curl or wget to download remote payloads and pipe them directly into system interpreters to execute malicious code in memory or from non-standard locations.

Johnson Controls Simplex Incident Manager versions 2.01 and earlier store sensitive user credentials in memory, allowing a local attacker with low privileges to extract them via memory analysis.

Cudy WR3000 routers running firmware prior to 2.5.24 contain a hard-coded HMAC secret in the Mosquitto MQTT broker plugin, enabling unauthenticated attackers to forge JWT tokens and gain unauthorized mesh interface access.

An unauthenticated SQL injection vulnerability in the delete.php file of Simple Inventory System 1.0 allows remote attackers to execute arbitrary database queries via the ID parameter.

Authenticated administrators can exploit a SQL injection vulnerability in baserCMS versions prior to 5.3.0, chaining it with a secondary code injection flaw to extract sensitive data and execute arbitrary PHP code.

A remote memory corruption vulnerability in the Generic Attribute Logic component of liftoff-sr CIPster allows for unauthenticated exploitation via the GetAttrData and SetAttrData functions.

CVE-2026-15706 describes a critical missing authentication vulnerability in Baylan Smart Meter Management Application (BMS) versions prior to 1.1.10.142, enabling unauthenticated remote attackers to bypass authentication and potentially achieve full system control.

An unauthenticated remote denial-of-service vulnerability in FreeIPA, tracked as CVE-2026-73197, allows attackers to exhaust system memory by sending oversized form POST requests to the migration endpoint.

CVE-2026-13097 is a privilege escalation vulnerability in FreeIPA where the 389-ds directory server fails to enforce uniqueness constraints on Kerberos principal names, allowing attackers with LDAP write access to impersonate privileged service principals.

An authenticated remote attacker can exploit a vulnerability in Octopus Deploy Server to perform unauthorized information disclosure.

Cisco Industrial Ethernet 1000 Series Switches contain multiple vulnerabilities, including CVE-2024-20412, CVE-2024-20413, and CVE-2024-20414, which allow unauthenticated attackers to cause a denial-of-service or perform cross-site scripting attacks.

Cisco Secure Workload is affected by multiple vulnerabilities allowing unauthenticated remote attackers to execute arbitrary code, escalate privileges, and cause service disruptions.

Splunk SOAR versions prior to 8.6.0 are vulnerable to authenticated remote code execution due to improper path validation and insufficient role-based access control on the REST API.

An authenticated remote attacker can exploit a vulnerability in Cisco Unified Contact Center Enterprise to perform unauthorized file manipulation.

A vulnerability in the Cisco Unified Intelligence Center allows a remote, authenticated attacker to perform a SQL injection attack due to insufficient input validation.

A remote, unauthenticated attacker can exploit a vulnerability in Arista EOS and WiFi Access Point firmware to trigger a denial of service condition by crashing affected network devices.

A vulnerability in the Royal Elementor Addons plugin for WordPress allows an authenticated attacker to achieve arbitrary code execution via the application backend.

A vulnerability in the HashiCorp Vault Secrets Operator allows a remote, authenticated attacker to escalate privileges, leading to potential unauthorized data disclosure or manipulation within Kubernetes environments.

A vulnerability in the MLflow machine learning lifecycle platform allows unauthenticated remote attackers to bypass security controls, resulting in potential data disclosure or unauthorized data manipulation.

Adversaries targeting Linux systems often execute payloads from ephemeral directories and immediately delete the binary to evade detection and hinder forensic investigation.

An integer overflow vulnerability (CVE-2026-18917) in the libvirt NodeGetFreePages RPC handler allows an unprivileged local user to trigger a heap buffer overflow and achieve potential local privilege escalation.

CVE-2026-14950 is an insufficient session expiration vulnerability in Frauscher Sensortechnik FDS 102 that allows an attacker with a valid session identifier to maintain access beyond the intended expiration time.

Multiple memory management and web content processing vulnerabilities in Apple macOS Tahoe version 26.6.2 could allow attackers to trigger system crashes or exfiltrate sensitive memory data.

The Events Made Easy WordPress plugin is vulnerable to authenticated Local File Inclusion via the eme_single_event_page_template function, allowing contributors to execute arbitrary PHP code.

A stack-based buffer overflow vulnerability in binutils versions 2.46.1 and prior allows attackers to achieve arbitrary code execution by enticing a victim to process a maliciously crafted Portable Executable (PE) file.