CVE-2026-24312 is a medium-severity vulnerability in SAP Business Workflow caused by a missing authorization check that allows an authenticated administrative user to escalate privileges by exploiting permissions from less sensitive functions. This flaw primarily impacts data integrity by enabling unauthorized high-privilege actions, while confidentiality and availability impacts are low or none. The vulnerability affects multiple SAP_BASIS versions from 7.52 through 8.16. Exploitation requires authenticated administrative privileges and some user interaction, limiting the attack scope. No known exploits are currently in the wild. European organizations using affected SAP versions could face risks of unauthorized data manipulation within critical business workflows. Mitigation involves applying vendor patches once available, reviewing and tightening role-based access controls, and monitoring administrative activities for suspicious privilege escalations. Countries with significant SAP enterprise deployments and critical industries relying on SAP workflows, such as Germany, France, and the UK, are most likely to be affected.
CVE-2026-23684 is a race condition vulnerability in SAP Commerce Cloud affecting versions HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21. The flaw allows an attacker to manipulate product entries in a shopping cart, potentially causing erroneous product values to be checked out. This vulnerability impacts data integrity but does not affect confidentiality or availability. Exploitation requires no privileges or user interaction but has a high attack complexity. No known exploits are currently in the wild. The CVSS score is 5.9, indicating a medium severity. European organizations using SAP Commerce Cloud for e-commerce operations could face financial discrepancies and transactional errors if exploited. Mitigation involves applying vendor patches once available, implementing strict concurrency controls, and monitoring transaction logs for anomalies. Countries with significant SAP Commerce Cloud deployments and strong e-commerce sectors, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
CVE-2026-0485 is a high-severity vulnerability in SAP BusinessObjects BI Platform that allows unauthenticated attackers to cause a denial-of-service by crashing the Content Management Server (CMS) through specially crafted requests. Exploitation leads to repeated CMS crashes and automatic restarts, resulting in persistent service disruption and complete unavailability of the CMS. The vulnerability affects multiple versions including ENTERPRISE 430, 2025, and 2027. No confidentiality or integrity impact is reported, and no user interaction or authentication is required. Although no known exploits are currently in the wild, the ease of exploitation and high impact on availability make this a critical concern for organizations relying on SAP BusinessObjects for business intelligence operations. European organizations using these SAP versions should prioritize mitigation to prevent operational disruptions. Specific mitigations include network-level filtering, strict access controls, and monitoring for anomalous CMS requests. Countries with high SAP adoption and critical industries such as Germany, France, and the UK are most likely to be affected.
CVE-2026-0484 is a medium-severity vulnerability in SAP NetWeaver Application Server ABAP and SAP S/4HANA that allows an authenticated attacker with limited privileges to exploit a missing authorization check. This flaw enables modification of text data within the system, impacting data integrity without affecting confidentiality or availability. The vulnerability arises from improper validation related to URL redirection (CWE-601) and affects multiple SAP_BASIS versions from 700 through 816. Exploitation requires authentication but no user interaction, and no known exploits are currently reported in the wild. The vulnerability's impact is primarily on the integrity of application data, which could lead to unauthorized changes in business-critical information. European organizations using affected SAP versions are at risk, especially those with extensive SAP deployments in finance, manufacturing, and supply chain sectors. Mitigation requires applying SAP patches once available and implementing strict access controls and monitoring of transaction codes. Countries with significant SAP market penetration and critical infrastructure relying on SAP, such as Germany, France, and the UK, are most likely to be affected. The CVSS score of 6.5 reflects a medium severity due to the integrity impact and the need for authenticated access.
The KRVTZ-NET IDS alerts dated 2026-02-10 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and are derived from open-source intelligence (OSINT) feeds, indicating observation-level data rather than confirmed exploitation. No specific affected products or versions are identified, and no patches or known exploits exist for this activity. The alerts primarily signify reconnaissance efforts, which are often preliminary steps in an attack chain. European organizations should be aware that such reconnaissance can precede more targeted attacks, though the current threat level is low. Mitigation should focus on enhancing network monitoring and anomaly detection to identify and respond to reconnaissance attempts promptly. Countries with significant internet infrastructure and critical industries may be more likely to observe such activity. Given the low severity and lack of exploitation, the suggested severity is low. Defenders should treat these alerts as early warnings and maintain vigilance against potential escalation.
CVE-2026-25885 is a critical improper authorization vulnerability in PolarLearn versions prior to 0-PRERELEASE-16. It allows unauthenticated attackers to connect to the group chat WebSocket endpoint and subscribe to or send messages in any group chat by supplying a group UUID. This flaw enables attackers to inject unauthorized messages that are stored persistently, not just displayed temporarily, leading to potential misinformation, disruption, or data integrity issues. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 base score is 10, reflecting its critical severity due to full network exploitability and high impact on confidentiality, integrity, and availability. European organizations using PolarLearn for educational or collaborative purposes are at risk of unauthorized data manipulation and privacy breaches. Mitigation involves upgrading to versions beyond 0-PRERELEASE-16 once available or implementing strict access controls and WebSocket authentication proxies. Countries with significant adoption of PolarLearn or similar open-source educational platforms, such as the Netherlands, Germany, France, and the UK, are most likely to be affected. Given the critical nature and ease of exploitation, immediate attention is required to prevent abuse and maintain trust in collaborative learning environments.
North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The attack utilized social engineering involving a compromised Telegram account, fake Zoom meeting, and reported AI-generated video. UNC1069 has shifted from spear-phishing to targeting Web3 industry entities like centralized exchanges, software developers, and venture capital firms. The intrusion demonstrated sophisticated techniques to bypass macOS security features and harvest credentials, browser data, and cryptocurrency information. This marks a significant expansion in UNC1069's capabilities and highlights their focus on financial theft and fueling future social engineering campaigns.
GuLoader, a malware downloader active since 2019, primarily delivers RATs and information stealers. It employs sophisticated anti-analysis techniques, including polymorphic code for dynamic constant construction and complex exception-based control flow obfuscation. The malware has evolved to handle multiple exception types, making tracing its execution flow challenging. GuLoader uses dynamic hashing, encrypted strings, and stack-based string encryption to conceal critical information. It often hosts payloads on trusted cloud services to bypass reputation-based detection. The malware's consistent development and updating of anti-analysis techniques suggest it will remain a significant threat in the future.
A recent supply chain attack targeting EmEditor users has been uncovered, involving watering hole tactics. The investigation reveals multiple domains masquerading as EmEditor-related sites, all registered through NameSilo LLC in December 2025. The domains resolve to various IP addresses, with some changes observed in February 2026. Additional domains with similar patterns were discovered, along with peculiar HTTP header behavior. A potential early stage of the campaign was identified, sharing similar characteristics with the initial report. The attackers continued their activities even after exposure, utilizing PowerShell scripts and various domains for command and control purposes. The analysis provides a comprehensive list of indicators, including domain names, IP addresses, and file hashes associated with the attack.
As only data exfiltration for extortion no longer delivers ROI, ransomware gangs may increasingly encrypting data for additional leverage. The post Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter appeared first on SecurityWeek .
Romania’s national oil pipeline operator, Conpet, experienced a cyberattack that disrupted its IT systems and took its website offline, although operational technology systems controlling the pipeline remained unaffected. The attack highlights the risk to critical infrastructure organizations from cyber threats targeting their IT environments. No known exploits are currently active in the wild, and the severity is assessed as medium. The incident underscores the importance of securing IT systems that support critical infrastructure to prevent operational disruptions and reputational damage. European organizations in the energy sector should be vigilant and enhance their cyber defenses accordingly.
SmarterTools says customers were impacted after hackers compromised a data center used for quality control testing. The post SmarterTools Hit by Ransomware via Vulnerability in Its Own Product appeared first on SecurityWeek .
CVE-2026-25846 is a medium severity vulnerability in JetBrains YouTrack prior to version 2025.3.119033 where access tokens could be exposed in mailbox logs. This exposure stems from improper handling of sensitive information (CWE-532), potentially allowing attackers with network access and low privileges to obtain tokens without user interaction. While the vulnerability does not impact integrity or availability, the confidentiality breach could enable unauthorized access to YouTrack resources. No known exploits are currently reported in the wild. European organizations using affected YouTrack versions should prioritize updating to the patched release to prevent token leakage. Mitigation involves upgrading YouTrack, auditing mailbox logs for token exposure, and restricting log access. Countries with significant JetBrains YouTrack adoption, such as Germany, France, and the UK, are most likely to be impacted due to their large software development sectors. The vulnerability’s CVSS score of 6.
A recent investigation reveals that the APT-C-28 (ScarCruft) group has expanded its targets to include the cryptocurrency industry. The group employs sophisticated phishing tactics, using LNK files disguised as PDFs to lure victims with investment proposals ranging from $1-3 million. Upon execution, a multi-stage payload deployment occurs, ultimately installing MiradorShell v2.0 to gain system control. The attack chain involves file downloads, decryption, and the creation of scheduled tasks for persistence. MiradorShell, an AutoIt-based backdoor, connects to a command and control server, offering reverse shell capabilities, file management, remote program execution, and victim fingerprinting. The malware employs various evasion techniques, including inline library files and direct API calls.
The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it. The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek .
CVE-2026-25905 is a medium severity vulnerability affecting the 'mcp-run-python' project, where Python code executed via 'runPython' or 'runPythonAsync' is not properly isolated from JavaScript code. This improper compartmentalization (CWE-653) allows Python code to manipulate the JavaScript environment through Pyodide APIs, potentially enabling an attacker to hijack the MCP server and perform malicious activities such as tool shadowing. The vulnerability has a CVSS score of 5.8, indicating moderate risk, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The project is archived and unlikely to receive patches, increasing the risk for users still relying on it. There are no known exploits in the wild as of now. European organizations using this tool or similar environments integrating Python and JavaScript without proper isolation are at risk, especially those in critical infrastructure or software development sectors. Mitigation requires isolating Python execution environments, restricting Pyodide API access, or migrating away from the unmaintained project. Countries with strong software development ecosystems and critical infrastructure relying on such tools, including Germany, France, the UK, and the Netherlands, are more likely to be affected.
CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI MCP Run Python tool, which uses an overly permissive Deno sandbox configuration. This misconfiguration allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling SSRF attacks. The project is archived and unlikely to receive a fix, increasing risk for users who continue to rely on it. The vulnerability has a CVSS score of 5.8 (medium severity), reflecting moderate impact and exploitation complexity. Exploitation requires user interaction but no privileges or authentication. While no known exploits are currently in the wild, the vulnerability could allow attackers to access internal services, leading to information disclosure and limited integrity and availability impacts. European organizations using this tool or similar configurations should be cautious, especially those in countries with strong adoption of Python and Deno-based development environments. Mitigation involves discontinuing use of the vulnerable tool, isolating sandbox environments, and restricting network access from sandboxed code. Countries with significant tech sectors and software development communities, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
The signs of a cyberattack were identified on systems EU's main executive body uses for mobile device management. The post European Commission Investigating Cyberattack appeared first on SecurityWeek .
CVE-2026-22906 is a critical vulnerability in the WAGO 0852-1322 device where user credentials are encrypted using AES-ECB with a hardcoded cryptographic key. An unauthenticated remote attacker who obtains the device's configuration file can decrypt and recover plaintext usernames and passwords. This vulnerability allows full compromise of confidentiality, integrity, and availability without requiring authentication or user interaction. The weakness stems from the use of a static, hardcoded key combined with the insecure AES-ECB mode, which is susceptible to cryptanalysis. Although no exploits are currently known in the wild, the high CVSS score of 9.8 reflects the ease of exploitation and severe impact. European organizations using WAGO 0852-1322 devices, especially in industrial automation and critical infrastructure, are at significant risk. Immediate mitigation involves restricting access to configuration files, monitoring for unauthorized access, and applying vendor patches once available. Countries with extensive industrial automation deployments, such as Germany, France, and the Netherlands, are most likely to be affected due to WAGO’s market presence and critical infrastructure reliance.
