Threats tagged 'local'

A local privilege escalation vulnerability exists in Quest Foglight for Databases due to a hardcoded encryption key in the EncryptionUtil component. Exploitation requires the attacker to have the ability to execute low-privileged code on the affected system. The vulnerability has a high severity rating assigned by ZDI.

A local privilege escalation vulnerability exists in Quest Foglight for Databases that allows an attacker with low-privileged code execution on the target system to escalate their privileges. The vulnerability is identified as CVE-2026-92200 and has a high severity rating.

This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.

INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities. CVE-2026-16305 allows a local low-privileged attacker to execute arbitrary commands with administrative privileges due to insecure file permissions on an update manifest file. CVE-2026-16306 allows remote code execution via a crafted imodular:// URI scheme that executes unsafe commands without proper validation. Both vulnerabilities have been fixed in versions 3.0.12.3 and 3.0.12.5.

A local privilege escalation vulnerability exists in the Linux Kernel related to the IPv6 AH Routing Header. Exploitation requires the attacker to have the ability to execute low-privileged code on the target system. The vulnerability is assigned CVE-2026-80844 and has a high severity rating.

A local privilege escalation vulnerability exists in the Linux Kernel's handling of the Logitech HIDPP protocol. Exploitation requires the attacker to already have the ability to execute low-privileged code on the system. The vulnerability is identified as CVE-2026-93826 and has a high severity rating assigned by ZDI.

A use-after-free vulnerability in the Linux Kernel XFRM subsystem allows local attackers with low-privileged code execution to escalate privileges. The vulnerability is assigned CVE-2026-98231 and has a high severity rating of 7.8 by ZDI. Exploitation requires prior local code execution capability.

A local privilege escalation vulnerability exists in the FreeBSD Kernel due to a TTY race condition. Exploitation requires the attacker to already have the ability to execute low-privileged code on the affected system. The vulnerability is assigned CVE-2026-58093 and has a high severity rating.

CVE-2026-6064 is a local privilege escalation vulnerability in AVG Internet Security's avgToolsSvc component. It requires an attacker to have the ability to execute low-privileged code on the target system before exploitation. The vulnerability allows escalation to higher privileges, potentially compromising system security.

A local privilege escalation vulnerability exists in Alpine iLX-F511, allowing attackers with low-privileged code execution to escalate their privileges. The vulnerability has a high severity rating of 7.8 assigned by ZDI and is tracked as CVE-2026-118602. No affected versions or patch information are provided.

Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation on certain Google Compute Engine VMs. These vulnerabilities involve a 2-byte out-of-bounds read/write in the vTPM parameter decryption routine. CVE-2023-1017 could allow a local attacker to cause denial-of-service or possibly execute arbitrary code within the vTPM context. CVE-2023-1018 could allow a local attacker to leak limited data from the vTPM context. Google has automatically applied patches to all vulnerable VMs, and no customer action is required.

A vulnerability in the Trusted Platform Module (TPM) software affects Shielded VMs using virtual TPM (vTPM). An authenticated local attacker with access to the vTPM interface can send malicious commands exploiting an out-of-bounds memory read, potentially exposing sensitive vTPM data or impacting vTPM availability. Google will proactively update affected systems during standard maintenance windows, and no customer action is required. Limiting vTPM access to administrative users can help reduce risk.

A vulnerability (CVE-2026-6726, also known as TCGVRT0010) has been identified in the Trusted Computing Group's TPM 2.0 reference implementation code, affecting all published revisions of the code (v1.16, v1.38, v1.59, v1.83, v184). This flaw could allow a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority for a falsified TPM key, enabling the creation of fraudulent TPM 2.0 attestations. Google will proactively update affected systems during standard maintenance windows, and no customer action is required.

Bulletin ID: 2026-058-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/16/2026 10:15 AM PDT Description: Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content. Impacted versions: 1.4.8, 1.5.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-047-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/23/2026 09:30 AM PDT Description: Language Servers for AWS provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio). We identified CVE-2026-12957, an improper trust boundary enforcement issue in Language Servers for AWS before version 1.65.0. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted. We identified CVE-2026-12958, a missing symlink-validation issue in Language Servers for AWS before version 1.69.0. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. These issues affect the Amazon Q Developer IDE plugins, which bundle Language Servers for AWS. Both issues are remediated in Language Servers for AWS version 1.69.0. Affected products & versions: - Language Servers for AWS: < 1.69. - Amazon Q Developer for Visual Studio Code: < 2.20 - Amazon Q Developer for JetBains: < 4.3 - Amazon Q Developer for Eclipse: < 2.7.4 - AWS Toolkit with Amazon Q for Visual Studio: < 1.94.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Bulletin ID: 2026-045-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931, where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions: < 0.11.133 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

A local privilege escalation vulnerability named 'Fragnesia' has been reported in the Linux Kernel involving ESP-in-TCP. No detailed technical information or affected versions are provided.

CVE-2026-87886 is a high-severity insecure file permissions vulnerability in the Acronis Backup plugin for cPanel & WHM and the Backup extension for Plesk. This flaw allows local privilege escalation by enabling attackers to gain elevated privileges on affected systems. The vulnerability has been exploited in the wild in limited, targeted attacks against the cPanel plugin. Acronis has released patches to address this issue and urges users to update immediately.

Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. [...]

UAT-10147 is a sophisticated Chinese-speaking intrusion actor deploying a cross-platform backdoor named SPECTRE targeting IIS and Linux servers. SPECTRE integrates advanced post-exploitation features including process injection, credential theft, anti-analysis, and kernel-level EDR bypass via Bring Your Own Virtual Driver (BYOVD) techniques. The campaign combines SEO fraud monetization with custom malware, open-source tools, and AI-assisted development workflows. The Windows variant of SPECTRE uses runtime API resolution and string encryption to evade static detection and includes a comprehensive command set for system control and persistence. The Linux variant incorporates a kernel rootkit with similar advanced capabilities. The actor also uses in-memory web shells and sophisticated evasion methods. No patch or remediation is indicated in the available data.