Search: CVE-2026-63520

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

A sophisticated multi-component malware campaign targets telecommunications and network-edge appliances using BPFDoor variants and a newly identified implant called AVERAT. The attackers exploit SMTP traffic on port 25 to hide command-and-control communications within legitimate mail relay activity. The malware uses memory-only execution to avoid leaving forensic artifacts on disk. BPFDoor variants impersonate legitimate processes on South Korean systems, while AVERAT targets Taiwanese appliances with regional disguises. The operation employs compromised consumer devices as relays, consistent with a China-linked covert network. The campaign demonstrates advanced evasion techniques including process spoofing and encrypted configurations.