Threats tagged 'active exploitation'

CVE-2026-111497 is a critical out-of-bounds write vulnerability in Google's Brotli decompression library that allows specially crafted compressed data to corrupt application memory and potentially enable remote code execution. It affects Brotli versions 1.0.3 through 1.2.0 and multiple platforms including Node.js, Bun, Python, and .NET frameworks. Exploitation attempts were observed shortly after patches were released, with proof-of-concept code demonstrating remote code execution via malicious HTTP requests and responses. The vulnerability can be triggered through various vectors such as HTTP requests with Brotli-compressed bodies, malicious server responses, and file processing workflows. Enterprise products from Palo Alto Networks and VMware are also impacted, broadening the attack surface. CISA added this vulnerability to its KEV catalog on October 27, 2026.

VeloCloud Orchestrator (VCO) on-premises versions contain a critical SQL injection vulnerability (CVE-2026-114625) that allows authenticated users with minimal privileges, such as those with the Enterprise Read Only role, to escalate their access to superuser operator level. This escalation grants unauthorized access to privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data. The vulnerability is actively exploited in the wild, with specific malicious IP addresses identified. Fixed versions have been released for affected VCO versions 5.2.x, 6.1.x, and 6.4.x. Hosted and dedicated VCO instances have already been patched. Immediate upgrade to the fixed releases is recommended, along with restricting web interface access and monitoring for suspicious activity.

CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. It allows unauthenticated attackers to execute code with system privileges by targeting WSUS instances exposed on ports 8530 and 8531. Initial patches released on October 14, 2025, were incomplete, requiring an emergency update on October 23. Exploitation has been observed shortly after patch release, with attackers using malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, posing a significant risk, especially to European organizations. The vulnerability facilitates initial access and lateral movement within networks. Immediate patching and reducing network exposure are critical to mitigate this threat.

KEVEPSS 99%Report on CVE-2025-59287VulnerabilityCWE-502#patch managementGermany+7