This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Non security issue fixed:
- SELinux CIL files are not shipped in Docker (bsc#1278193).
Changes for docker:
- Update to Docker 29.7.2. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/29/#2972>
fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
- Update to buildx 0.36.1. See upstream changelog online at
<https://github.com/docker/buildx/releases/tag/v0.36.1>
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without valid credentials. Ransomware groups such as Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra actively exploit this flaw to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Attackers also pivot to virtualization infrastructure by accessing vCenter management appliances, disabling ESXi hypervisor security controls, and performing offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CVE-2026-0322 is a high-severity remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Access to the management interface should be restricted to trusted internal IPs to minimize risk. Multiple PAN-OS versions prior to specific fixed releases are affected.
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
SiteGuard Server Edition for Apache httpd contains an OS command injection vulnerability that allows an attacker with limited privileges to execute arbitrary operating system commands with root or SYSTEM level privileges. This vulnerability is classified as high severity with a CVSS score of 7.8. No specific affected versions or patch information is provided.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.