CVE-2026-64561

Overview

Linux
Linux

04 Aug 2026

Published

04 Aug 2026

Updated

CVSS

Pending

EPSS

0.16%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

Statistics

7 Posts
6 Interactions

Last activity: 1 hour ago

Fediverse

Tom Sellers @TomSellers

Not sure if I'm late to that party on this one or not. Guest to host escape in Linux KVM.

Zapscape (CVE-2026-64561)
Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive zap path that runs when shadow pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds.

https://github.com/V4bel/Zapscape

#Security #Linux #VIrtualization

3
2
0
2h ago

tomcat @tomcat

‼️ New Linux KVM escape flaw disclosed with public PoC.

Zapscape (CVE-2026-64561) could let an attacker with guest root break out of a nested VM and execute code as root on the host when nested virtualization is exposed to untrusted guests.

Learn which KVM setups are exposed: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html

0
1
0
4h ago

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-64561: Zapscape KVM Escape Runs Commands With Kernel Root Privilege, PoC Exploit Code Publicly Disclosed

https://securityonline.info/kvm-escape-vulnerability-zapscape/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
1h ago

Bluesky

Hacker News Top Stories @hackernewsbot.bsky.social

Zapscape (CVE-2026-64561) | Discussion

0
0
0
9h ago

Hacker News 20 @betterhn20.e-work.xyz

Zapscape (CVE-2026-64561) https://github.com/V4bel/Zapscape (https://news.ycombinator.com/item?id=49198843)

0
0
0
9h ago

Information Security Briefly @infosecbriefly.bsky.social

Zapscape (CVE-2026-64561) is a KVM shadow-MMU use-after-free that can let a privileged L1 guest escape to host kernel/root execution when nested virtualization is exposed to untrusted guests.

0
0
0
9h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Zapscape (CVE-2026-64561) in Linux KVM/x86 shadow-MMU can let a privileged L1 guest escape to the host and run code as root. Upstream fix already merged. #Zapscape #CVE-2026-64561 #KVM

0
0
0
6h ago

CVE-2026-63077

Overview

JetBrains
TeamCity

27 Jul 2026

Published

06 Aug 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

1.01%

MITRE

KEV

Description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Statistics

8 Posts
1 Interaction

Last activity: 4 hours ago

Fediverse

AllAboutSecurity @allaboutsecurity

CVE-2026-63077: CISA warnt vor aktiver Ausnutzung einer TeamCity-Sicherheitslücke

Angreifer können ohne Authentifizierung Schadcode auf dem Server ausführen.

https://www.all-about-security.de/cve-2026-63077-cisa-warnt-vor-aktiver-ausnutzung-einer-teamcity-sicherheitsluecke/

#cybersecurity #cve #cisa #itsecurity #itsicherheit

0
0
0
21h ago

Michael I Ransier @thecybermind

🚨 CSUITE THREAT ADVISORY: CISA confirms active exploitation of CVE-2026-63077 in JetBrains TeamCity. Unauthenticated RCE threatens core build pipelines & supply chain integrity. Get the executive governance, risk management, and compliance brief now: https://thecybermind.co/jvee

0
0
0
15h ago

Patrick C Miller :donor: @patrickcmiller

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html

0
0
1
5h ago

CyberNetsecIO @netsecio

📰 JetBrains Patches Critical Unauthenticated RCE Flaw in TeamCity

🚨 CRITICAL ALERT: JetBrains patches CVE-2026-63077, a 9.8 CVSS unauthenticated RCE in TeamCity On-Premises. All versions affected. Exploit allows full server takeover. Upgrade immediately to prevent supply chain attacks! #TeamCity #CI/CD #CyberSecurity

🔗 https://cyber.netsecops.io/articles/jetbrains-patches-critical-unauthenticated-rce-flaw-cve-2026-63077-in-teamcity/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
4h ago

Bluesky

Information Security Briefly @infosecbriefly.bsky.social

CVE-2026-63077 in JetBrains TeamCity enables unauthenticated remote code execution via untrusted deserialization, requiring immediate patching of on-prem deployments.

0
1
0
20h ago

All About Security @allaboutsecurity.bsky.social

CVE-2026-63077: CISA warnt vor aktiver Ausnutzung einer TeamCity-Sicherheitslücke - Angreifer können ohne Authentifizierung Schadcode auf dem Server ausführen. www.all-about-security.de/cve-2026-630... #itsecurity #itsicherheit #cve

0
0
0
21h ago

ReconBee @reconbee.bsky.social

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild reconbee.com/cisa-flags-t... #CISA #cybersecurity #RCEflaw #cyberattack #TeamCity

0
0
0
19h ago

CVE-2026-20200

Overview

Cisco
Cisco Unified Computing System (Standalone)

05 Aug 2026

Published

06 Aug 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

0.84%

MITRE

KEV

Description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.  This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. 

Statistics

4 Posts

Last activity: 2 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 Cisco Patches Critical IMC Flaw (CVE-2026-20200) with Public PoC

Cisco patches critical root-level RCE flaw (CVE-2026-20200) in its IMC server management software. A public PoC exploit is available, making attacks imminent. Unauthenticated attackers can take over UCS servers. Patch now! #Cisco #Vulnerability #PoC

🔗 https://cyber.netsecops.io/articles/cisco-patches-critical-root-level-imc-flaw-with-public-poc/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
4h ago

Daily CyberSecurity @DailyCyberSecurity

PoC exploit code is public for CVE-2026-20200, a Cisco IMC argument injection flaw enabling root RCE. CVSS 8.8. Patch details inside.

#Cisco #RCE #CVE #InfoSec #CyberSecurity

https://securityonline.info/cisco-imc-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
2h ago

Bluesky

Help Net Security @helpnetsecurity.com

Critical Cisco IMC bug gives attackers root, PoC is out (CVE-2026-20200) 📖 Read more: www.helpnetsecurity.com/2026/08/06/c... #cybersecurity #cybersecuritynews #datacenter #enterprise #exploit #poc #vulnerability @cisco.com

0
0
0
15h ago

キタきつね @kitafox.bsky.social

Cisco IMCの重大な脆弱性により攻撃者がroot権限を取得可能、概念実証（PoC）が公開されました（CVE-2026-20200） Critical Cisco IMC bug gives attackers root, PoC is out (CVE-2026-20200) #HelpNetSecurity (Aug 6) www.helpnetsecurity.com/2026/08/06/c...

0
0
0
3h ago

CVE-2026-66747

Overview

Zbtlink
CPE2801 Firmware

05 Aug 2026

Published

05 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.58%

MITRE

KEV

Description

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

Statistics

2 Posts
2 Interactions

Last activity: 1 hour ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-66747: a Zbtlink router backdoor named ENDLESSDOORS gives unauthenticated remote code execution as root. No fix exists. CVSS 9.8.

#Zbtlink #RouterBackdoor #CVE #IoT #CyberSecurity

https://securityonline.info/zbtlink-router-backdoor/?utm_source=mastodon&utm_medium=jetpack_social

2
0
0
1h ago

Bluesky

曖昧ナ犬 @aimainainnu.bsky.social

Lumoより特定のメーカーについてはい、特定のメーカーが特定されています。製造元の特定情報項目内容製造元Shenzhen Zhibotong Electronics Co.（深州市智博通电子有限公司）ブランド名Zbtlink および Wiflyer影響モデル数20種類以上（ファームウェアイメージ約24個）CVE番号CVE-2026-66747深刻度9.3/10（クリティカル）バックドア名「Endlessdoors」推定設置台数約10万台（世界規模）

0
0
0
2h ago

CVE-2026-64531

Overview

Linux
Linux

27 Jul 2026

Published

05 Aug 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.13%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.

Statistics

3 Posts
2 Interactions

Last activity: 20 hours ago

Fediverse

Sam Stepanyan :verified: 🐘 @securestep9

#Linux: a 13-year-old Linux kernel flaw dubbed #OVSWrap lets local users gain root privileges on most Linux distributions. CVE-2026-64531 vulnerability is in the Linux kernel’s Open vSwitch datapath:
#PrivilegeEscalation
👇

https://securityaffairs.com/196657/hacking/ovswrap-13-year-old-linux-kernel-flaw-lets-local-users-become-root.html

1
1
1
20h ago

Bluesky

ohhara @shiojiri.com

Linuxカーネルの脆弱性「OVSwrap」：Open vSwitch経由でローカルユーザーがroot権限を取得可能に（CVE-2026-64531） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47047/

0
0
0
22h ago

CVE-2026-39868

Overview

Apple
iOS and iPadOS

29 Jun 2026

Published

27 Jul 2026

Updated

CVSS

Pending

EPSS

0.94%

MITRE

KEV

Description

This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.

Statistics

2 Posts

Last activity: 3 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-39868: Public PoC Discloses a macOS and iOS Kernel Memory Corruption Flaw

https://securityonline.info/cve-2026-39868-macos-dtrace/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
14h ago

Bluesky

キタきつね @kitafox.bsky.social

CVE-2026-39868: 公開された概念実証により、macOSおよびiOSカーネルのメモリ破損の脆弱性が明らかに CVE-2026-39868: Public PoC Discloses a macOS and iOS Kernel Memory Corruption Flaw #DailyCyberSecurity (Aug 6) securityonline.info/cve-2026-398...

0
0
0
3h ago

CVE-2026-41679

Overview

paperclipai
paperclip

23 Apr 2026

Published

23 Apr 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

1.97%

MITRE

KEV

Description

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

Statistics

2 Posts

Last activity: 13 hours ago

Fediverse

OffSequence @offseq

CVE-2026-41679 | Paperclip AI platform CRITICAL vuln: auth bypass let attackers register, obtain API tokens, & run code as server. DNS rebinding risk in dev mode. Patch now. https://radar.offseq.com/threat/critical-paperclip-flaw-allowed-admin-access-code-execution-09ee35c54d49b29b #OffSeq #CVE #Paperclip #vuln

0
0
0
15h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

Critical Paperclip flaw, CVE-2026-41679, let remote attackers self-register, approve a CLI challenge, and gain code execution with server permissions. Oasis Security also found data exposure and DNS rebinding issues. #Paperclip #CVE202641679

0
0
0
13h ago

CVE-2026-12569

Overview

PTC
Windchill PDMLink

18 Jun 2026

Published

01 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

30.20%

MITRE

KEV

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Statistics

4 Posts

Last activity: 19 hours ago

Fediverse

CryptoLek 🍉🌻 @CryptoLek

Cl0p ransomware started listing victims from their campaign of exploitation of an RCE vuln in PTC Windchill PDMlink and PTC FlexPLM. The victims seem to be anonymised for now.

Exploited bug: https://www.cve.org/CVERecord?id=CVE-2026-12569

In fact, Ransomware-ISAC warned on 22 July about the campaign by Cl0p affiliates, targeting internet-exposed PTC Windchill and FlexPLM deployments: https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/

The vuln was added to CISA's KEV in the end of June.

0
0
0
21h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

Clop claims a breach of qc******* via CVE-2026-12569, saying database and project data were exfiltrated. No country was identified. #Clop #Ransomware #DataBreach

0
0
0
22h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Clop reportedly hit mid******* by exploiting CVE-2026-12569, with exfiltration of databases and project files. The claim does not name a country. #Clop #CVE202612569 #Ransomware

0
0
0
19h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Clop claimed a ransomware attack on flu*******, exploiting CVE-2026-12569 to steal databases, project data, and CAD files. #Ransomware #Clop #DataLeak

0
0
0
19h ago

CVE-2026-64564

Overview

Linux
Linux

04 Aug 2026

Published

06 Aug 2026

Updated

CVSS

Pending

EPSS

0.16%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

Statistics

3 Posts
22 Interactions

Last activity: 9 hours ago

Fediverse

Harry Sintonen @harrysintonen

Yet another linux LPE to root. "CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape"

https://www.openwall.com/lists/oss-security/2026/08/06/3

#CVE_2026_64564 #infosec #cybersecurity

6
8
0
12h ago

Harry Sintonen @harrysintonen

#CVE_2026_64564 mitigation:

echo install sctp /bin/true | sudo tee /etc/modprobe.d/sctp.conf

3
1
0
11h ago

Harry Sintonen @harrysintonen

#Debian stable has a fix now: linux-image-6.12.101+deb13-amd64

- sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)

#CVE_2026_64564

3
1
0
9h ago

CVE-2026-48282

Overview

Adobe
ColdFusion

30 Jun 2026

Published

08 Jul 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

99.20%

MITRE

KEV

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Statistics

1 Post
4 Interactions

Last activity: 11 hours ago

Fediverse

Marvin @inmarvinwetrust

🚨 CVE-2026-48282: una semplice Path Traversal può trasformarsi in una Remote Code Execution su Adobe ColdFusion.

Nel video spiego:
🔴 cos'è RDS
🔴 perché il CVSS è 10.0
🔴 come avviene la catena di attacco
🔴 cosa controllare dopo aver applicato la patch

🎥 Guarda il video:
👉 https://youtu.be/SHYU1ag3NsQ

#CyberSecurity #ColdFusion #CVE202648282 #InfoSec #BlueTeam
@sicurezza

2
2
0
11h ago