Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CVE-2026-25262 is a write-what-where vulnerability in the Qualcomm Sahara protocol experimentally confirmed on the Snapdragon 8 Gen 1 (SM8450) platform. It allows arbitrary writes to SRAM during the Sahara handshake, bypassing signature verification and partially bypassing Firehose loader authorization. The loader executes and responds to commands without authorization errors, but full UFS storage access has not yet been achieved. The vulnerability was previously known only on legacy 32-bit Qualcomm platforms but now affects modern 64-bit ARMv9 SoCs. No official patch or remediation guidance is currently available, and research is ongoing to achieve full Firehose initialization and understand TrustZone dependencies.

CVE-2026-25262 is a write-what-where vulnerability in the Qualcomm Sahara protocol that has been experimentally confirmed on the Snapdragon 8 Gen 1 (SM8450) platform, specifically on the POCO F4 GT device. The exploit enables arbitrary writes to SRAM during the Sahara handshake, bypassing signature verification and partially bypassing Firehose loader authorization by injecting a value into the authentication state structure. Static analysis identified a critical 64-bit authentication field at address 0x6B9CD538. Using a custom tool, researchers wrote the value 5 to this field, allowing the Firehose loader to execute and respond to commands without authorization errors. However, full UFS storage access has not been achieved, with commands like getstorageinfo returning empty responses, likely due to incomplete initialization or TrustZone/SMC dependencies. This extends the vulnerability's applicability beyond legacy 32-bit platforms to modern 64-bit ARMv9 SoCs. No official patch or remediation is currently available, and further research is ongoing.

Detailed information about CVE-2026-25262 Write-What-Where in Qualcomm Sahara confirmed on Snapdragon 8 Gen 1 (SM8450) – partial Firehose auth bypass. Get real-

CVE-2026-25262 Write-What-Where in Qualcomm Sahara confirmed on Snapdragon 8 Gen 1 (SM8450) – partial Firehose auth bypass - Live Threat Intelligence - Threat Radar | OffSeq.com

I’d like to share the results of an experimental research note on the applicability of CVE-2026-25262 (Kaspersky ICS CERT, May 2026) to a modern 64-bit ARMv9 Qualcomm platform. **Device:** POCO F4 GT (ingres) / Snapdragon 8 Gen 1 (SM8450, Waipio). **What was done:** - Static analysis of the engineering Firehose loader (`xbl_s_devprg_ns.melf`) in Ghidra identified the authorization state structure at `0x6B9CD500` (critical field `0x6B9CD538`). - A modified Sahara client (`cve_final_single`, based on B. Kerler's edl) was created to exploit the CVE and deliver the loader to an arbitrary SRAM address (`0x2211C000`) *without* signature verification. - An additional `SAHARA_CMD_RECV_DATA` packet injected the value `5` into the `is_authenticated` field before control was transferred to Firehose. **Result (partial success):** - Arbitrary write to SRAM via CVE-2026-25262 is **confirmed working** on SM8450. - The loader executes and responds to commands (`nop` succeeds), no authorization error is observed. - Full UFS access is **not yet achieved**; `getstorageinfo` and `read` return empty responses. Two hypotheses are being investigated: (1) loading only the LOAD segments without ELF/certificate overlay, and (2) potential TrustZone/SMC dependencies. **Why this might be interesting:** The official Qualcomm list for CVE-2026-25262 includes only 32-bit legacy platforms. This experiment suggests that the vulnerable code path in the Boot ROM is also present on the latest flagship SoCs, widening the scope of the vulnerability. Full article, logs, PBL status codes, and static analysis notes are available in the repository: <a href="https://github.com/shurikgo/cve-2026-25262-sm8450-research">https://github.com/shurikgo/cve-2026-25262-sm8450-research</a> No full exploit code is provided; the published material is sufficient for independent verification and further research. *This work is shared for educational and research purposes only.*

I’d like to share the results of an experimental research note on the applicability of CVE-2026-25262 (Kaspersky ICS CERT, May 2026) to a modern 64-bit ARMv9 Qualcomm platform.
 **Device:** POCO F4 GT (ingres) / Snapdragon 8 Gen 1 (SM8450, Waipio).
 **What was done:**
 - Static analysis of the engineering Firehose loader (`xbl_s_devprg_ns.melf`) in Ghidra identified the authorization state structure at `0x6B9CD500` (critical field `0x6B9CD538`).
 - A modified Sahara client (`cve_final_single`, based on B. Kerler's edl) was created to exploit the CVE and deliver the loader to an arbitrary SRAM address (`0x2211C000`) *without* signature verification.
 - An additional `SAHARA_CMD_RECV_DATA` packet injected the value `5` into the `is_authenticated` field before control was transferred to Firehose.
 **Result (partial success):**
 - Arbitrary write to SRAM via CVE-2026-25262 is **confirmed working** on SM8450.
 - The loader executes and responds to commands (`nop` succeeds), no authorization error is observed.
 - Full UFS access is **not yet achieved**; `getstorageinfo` and `read` return empty responses. Two hypotheses are being investigated: (1) loading only the LOAD segments without ELF/certificate overlay, and (2) potential TrustZone/SMC dependencies.
 **Why this might be interesting:**
 The official Qualcomm list for CVE-2026-25262 includes only 32-bit legacy platforms. This experiment suggests that the vulnerable code path in the Boot ROM is also present on the latest flagship SoCs, widening the scope of the vulnerability.
 Full article, logs, PBL status codes, and static analysis notes are available in the repository:
 https://github.com/shurikgo/cve-2026-25262-sm8450-research
 No full exploit code is provided; the published material is sufficient for independent verification and further research.
 *This work is shared for educational and research purposes only.*

CVE-2026-25262 Write-What-Where in Qualcomm Sahara confirmed on Snapdragon 8 Gen 1 (SM8450) – partial Firehose auth bypass

Reddit Discussion: CVE-2026-25262 Write-What-Where in Qualcomm Sahara confirmed on Snapdragon 8 Gen 1 (SM8450) – partial Firehose auth bypass

Threats Tagged 'cve-2026-25262'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-25262'

Lead Pen Test Professional