Briefs
April 2026 (30)
Azure Monitor Agent Improper Input Validation Vulnerability (CVE-2026-32168)
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-32168 is an improper input validation vulnerability in Azure Monitor Agent that allows a locally authorized attacker to elevate privileges.
Composer Command Injection via Malicious Perforce Repository
2 rules 1 TTPComposer is vulnerable to command injection via a malicious Perforce repository due to improper escaping of user-supplied Perforce connection parameters, potentially leading to arbitrary command execution in the context of the user running Composer.
Critical Remote Code Execution Vulnerability in Talend JobServer and Talend Runtime
2 rules 2 TTPs 1 CVECVE-2026-6264, a critical deserialization vulnerability in Talend JobServer and Runtime, allows unauthenticated remote code execution via the JMX monitoring port, leading to complete system compromise.
CVE-2026-26152: Windows Cryptographic Services Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-26152 is an insecure storage of sensitive information vulnerability in Windows Cryptographic Services that allows a local, authorized attacker to elevate privileges.
CVE-2026-26153: Windows EFS Out-of-Bounds Read Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-26153 is an out-of-bounds read vulnerability in the Windows Encrypting File System (EFS) that allows an authorized local attacker to elevate privileges.
CVE-2026-26163: Windows Kernel Double Free Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-26163 is a double free vulnerability in the Windows Kernel, allowing an authorized attacker to elevate privileges locally with a CVSS v3.1 score of 7.8.
CVE-2026-26179 Windows Kernel Double Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26179 is a double free vulnerability in the Windows Kernel, allowing a locally authenticated attacker to elevate privileges on the system.
CVE-2026-26181 - Microsoft Brokering File System Use-After-Free Vulnerability
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-26181 is a use-after-free vulnerability in the Microsoft Brokering File System that enables a locally authenticated attacker to escalate privileges on the system.
CVE-2026-26182: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-26182 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, allowing a locally authorized attacker to elevate privileges.
CVE-2026-27908 Use-After-Free in Windows TDI Translation Driver
2 rules 1 TTP 1 CVE 1 IOCA use-after-free vulnerability, CVE-2026-27908, exists in the Windows TDI Translation Driver (tdx.sys), allowing a locally authenticated attacker to elevate privileges.
CVE-2026-27909 Use-After-Free in Windows Search Component Allows Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-27909 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows a locally authorized attacker to escalate privileges.
CVE-2026-27910: Windows Installer Local Privilege Escalation
2 rules 1 TTP 1 CVE 2 IOCsCVE-2026-27910 describes a local privilege escalation vulnerability in Windows Installer due to improper handling of insufficient permissions, allowing an authorized attacker to gain elevated privileges.
CVE-2026-27916 Use-After-Free in Windows UPnP Device Host
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-27916 is a use-after-free vulnerability in Windows Universal Plug and Play (UPnP) Device Host that allows an authorized attacker to elevate privileges locally.
CVE-2026-27917: Windows WFP NDIS Lightweight Filter Driver Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-27917 is a use-after-free vulnerability in the Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) that allows a locally authorized attacker to elevate privileges.
CVE-2026-27926 Windows Cloud Files Mini Filter Driver Privilege Escalation
3 rules 1 TTP 1 CVECVE-2026-27926 is a race condition vulnerability in the Windows Cloud Files Mini Filter Driver that allows a local attacker to elevate privileges.
CVE-2026-32071: Windows LSASS Null Pointer Dereference DoS
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-32071 is a null pointer dereference vulnerability in the Windows Local Security Authority Subsystem Service (LSASS), allowing an unauthorized network attacker to cause a denial-of-service condition.
CVE-2026-32078: Windows Projected File System Use-After-Free Elevation of Privilege
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-32078, exists in the Windows Projected File System, allowing a locally authenticated attacker to escalate privileges.
CVE-2026-32152 Use-After-Free in Desktop Window Manager
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-32152 is a use-after-free vulnerability in the Desktop Window Manager (dwm.exe) that allows an authorized local attacker to elevate privileges.
CVE-2026-32153 Windows Speech Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32153 is a use-after-free vulnerability in Microsoft Windows Speech that allows a locally authorized attacker to elevate privileges.
CVE-2026-32155: Desktop Window Manager Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-32155 is a use-after-free vulnerability in the Desktop Window Manager that allows an authorized attacker to escalate privileges locally on a Windows system.
CVE-2026-32157 - Remote Desktop Client Use-After-Free Vulnerability
2 rules 2 TTPs 1 CVE 1 IOCCVE-2026-32157 is a use-after-free vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network.
CVE-2026-32164 Windows User Interface Core Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32164 is a race condition vulnerability in Windows User Interface Core that allows a locally authorized attacker to elevate privileges.
CVE-2026-32195 Windows Kernel Stack-Based Buffer Overflow Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-32195 is a stack-based buffer overflow vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges locally.
CVE-2026-33096 HTTP.sys Out-of-Bounds Read Denial-of-Service
2 rules 2 TTPs 1 CVEAn unauthenticated, remote attacker can exploit an out-of-bounds read vulnerability (CVE-2026-33096) in Windows HTTP.sys to cause a denial-of-service condition.
CVE-2026-33098 Use-After-Free in Windows Container Isolation FS Filter Driver
2 rules 1 TTP 1 CVECVE-2026-33098 is a use-after-free vulnerability in the Windows Container Isolation FS Filter Driver that allows a locally authorized attacker to elevate privileges.
CVE-2026-33099: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-33099, in the Windows Ancillary Function Driver for WinSock, enables a locally authenticated attacker to elevate privileges on the system.
CVE-2026-33101 Use-After-Free Vulnerability in Windows Print Spooler
2 rules 1 TTP 1 CVE 2 IOCsCVE-2026-33101 is a use-after-free vulnerability in the Windows Print Spooler Components that allows an authenticated local attacker to elevate privileges.
CVE-2026-33824: Windows IKE Extension Double Free Vulnerability
2 rules 3 TTPs 1 CVE 1 IOCA double free vulnerability in the Windows IKE Extension, tracked as CVE-2026-33824, allows an unauthenticated remote attacker to execute arbitrary code over the network.
CVE-2026-33826: Windows Active Directory Improper Input Validation Vulnerability
2 rules 1 TTP 1 CVE 1 IOCAn improper input validation vulnerability (CVE-2026-33826) in Windows Active Directory could allow an authenticated attacker on an adjacent network to execute code.
Fortinet FortiDDoS-F SQL Injection Vulnerability (CVE-2026-39815)
2 rules 3 TTPs 1 CVEAn SQL injection vulnerability (CVE-2026-39815) in Fortinet FortiDDoS-F versions 7.2.1 through 7.2.2 may allow a low-privilege attacker to execute unauthorized code or commands.