CVE-2026-41089

Overview

Microsoft
Windows Server 2012

12 May 2026

Published

01 Jun 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.10%

MITRE

KEV

Description

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

Statistics

14 Posts
81 Interactions

Last activity: 7 hours ago

Fediverse

cR0w @cR0w

:brdScream2: ^{^{^Hello,}} ^{^{^{CVE-2026-41089.}}} ^{^{^My}} ^{^{^name}} ^{^{^is}} ^{^{^{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}}}

15
42
0
22h ago

Graham Sutherland / Polynomial @gsuberland

hmm. CVE-2026-41089 looks like a super basic stack buffer overflow in LSASS, straight out of a remote packet. I know Microsoft runs CodeQL over their code, and I can't envision a world where LSASS doesn't have coverage, so that raises questions about how it wasn't identified. my best guess is a process gap somewhere, but it would be cool to see a post incident report with info.

(and before one of you mentions the slopcoding thought-terminating cliché, maybe think about it for a minute first)

4
18
0
20h ago

Licho @licho

CVE-2026-41089 be like

0
1
0
22h ago

cR0w @cR0w

@zombie042 :brdThink:

MS08-067
9 years later
MS17-010
9 years later
CVE-2026-41089

0
1
0
19h ago

WinterKnight :donor: @winterknight1337

Am I mistaken that essentially zerologon v2 came out? CVE-2026-41089

0
0
0
15h ago

benzogaga33 :verified: @benzogaga33

Windows Server – CVE-2026-41089 : cette faille critique dans Netlogon est exploitée ! https://www.it-connect.fr/windows-server-cve-2026-41089-cette-faille-critique-dans-netlogon-est-exploitee/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #WindowsServer #Microsoft

0
0
0
10h ago

J @jackryder

Per Microsoft details:

How could an attacker exploit this vulnerability?
An attacker could send a specially crafted network request to a Windows server that is acting as a domain controller. If successful, this could cause the Netlogon service to improperly handle the request, potentially allowing the attacker to run code on the affected system without needing to sign in or have prior access.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089

I don't think they fully understand the words "specially crafted".

Screaming at a network login for compliance is special... but it's not the kind of special you are looking for.

0
0
0
7h ago

Bluesky

Robert Wilson @frcolumba.bsky.social

Hang on, RCE in netlogon and Belgium is saying it’s actively being exploited? CVE-2026-41089 Either internal networks are going to be on fire or something ain’t right with the actively exploited bit ccb.belgium.be/advisories/w...

0
0
0
21h ago

キタきつね @kitafox.bsky.social

Windows Netlogonのリモートコード実行（RCE）が悪用され、ドメインコントローラーが危険にさらされています（CVE-2026-41089） Windows Netlogon RCE exploited, domain controllers at risk (CVE-2026-41089) #HelpNetSecurity (Jun 1) www.helpnetsecurity.com/2026/06/01/w...

0
0
0
19h ago

いがろぐ IGALOG🍜📷 @igalog.bsky.social

Windows Netlogon RCE exploited, domain controllers at risk (CVE-2026-41089) - Help Net Security https://www.helpnetsecurity.com/2026/06/01/windows-netlogon-rce-exploited-cve-2026-41089/ オンプレでADサーバ建ててるなら対応済みと思いますががが

0
0
0
12h ago

ohhara @shiojiri.com

Windows NetlogonのRCE脆弱性が攻撃に悪用される（CVE-2026-41089） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/45887/

0
0
0
12h ago

IT-Connect @it-connect.bsky.social

🚨 Une faille critique déjà exploitée… êtes-vous protégé ? Le Centre pour la #cybersécurité de Belgique (CCB) a publié une alerte à propos de la CVE-2026-41089. 🔐 Ne laissez pas cette faille ouverte dans votre environnement #Windows

0
0
0
12h ago

Alexandre Cheron @axcheron.bsky.social

Critical Windows Netlogon RCE flaw now exploited in attacks #RCE #Windows (CVE-2026-41089) www.bleepingcomputer.com/news/microso...

0
0
0
8h ago

CyberVeille @cyberveille-ch.bsky.social

📢 CVE-2026-41089 : exploitation active de la faille RCE critique Windows Netlogon 📝 ## 🗓️ Contexte Source : BleepingComputer, publié le 1er juin 2026. https://cyberveille.ch/posts/2026-06-02-cve-2026-41089-exploitation-active-de-la-faille-rce-critique-windows-netlogon/ #CVE_2026_33825 #Cyberveille

0
0
0
9h ago

CVE-2025-48595

Overview

Google
Android

01 Jun 2026

Published

02 Jun 2026

Updated

CVSS

Pending

EPSS

0.01%

MITRE

KEV

Description

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Statistics

14 Posts
119 Interactions

Last activity: Last hour

Fediverse

GrapheneOS @GrapheneOS

Google disclosed CVE-2025-48595 to OEMs in a security preview release near the end of September 2025. Those patches are allowed to be shipped right away, so it was included in our 2025092501 release. We noted it was already publicly fixed so it was added to our regular releases too in 2025100300.

10
28
1
4h ago

maniabel @maniabel

Android-Sicherheitsupdates Juni 2026: Kritische Schwachstellen adressiert
Google hat im Juni 2026 Sicherheitspatches für Android veröffentlicht, die 124 Schwachstellen schließen, darunter die aktiv ausgebeutete Lücke CVE-2025-48595 in der Android-Framework-Komponente. Betroffen sind Geräte mit Android 14 oder höher, wobei 18 weitere kritische Vulnerabilitäten ebenfalls behoben wurden.

https://source.android.com/docs/security/bulletin/2026/2026-06-01?hl=de#2026-06-05-security-patch-level-vulnerability-details

#AndroidPatchDay #infosec #Android #up2date

1
0
0
2h ago

CyberNetsecIO @netsecio

📰 Android Zero-Day Under Attack: Google Issues Urgent Patch for Privilege Escalation Flaw

⚠️ ANDROID ZERO-DAY! Google has patched CVE-2025-48595, a privilege escalation flaw actively exploited in the wild. The fix is in the June 2026 security update, which patches 124 flaws total. Update your Android device NOW! #Android #ZeroDay #CyberSe...

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-zero-day-flaw-in-android-fram…

0
0
0
4h ago

🔒 Security Cyber @securitycyber

Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited

**Critical Alert:** A severe vulnerability (CVE-2025-48595) has been identified and requires immediate attention from security teams worldwide.

## The Details

https://securitycyber.uk

Resources: https://securitycyber.uk | https://www.hackthebox.com

0
0
0
Last hour

Bluesky

GrapheneOS @grapheneos.org

June 2026 Android Security Bulletin notes CVE-2025-48595 is being exploited in the wild. It's being widely misreported in tech media as a 0-day vulnerability being exploited. That's a major misunderstanding of Android Security Bulletins and how poorly OEMs keep up with patches.

10
68
1
4h ago

Help Net Security @helpnetsecurity.com

Google fixes actively exploited Android vulnerability (CVE-2025-48595) 📖 Read more: www.helpnetsecurity.com/2026/06/02/a... #cybersecurity #cybersecuritynews #vulnerability #securityupdate #CVE #Android

1
1
0
8h ago

Information Security Briefly @infosecbriefly.bsky.social

Android update patches 124 vulnerabilities, including exploited zero-day CVE-2025-48595, with additional critical and high issues enabling privilege escalation, DoS, and one remote code execution flaw.

0
0
0
5h ago

Kaldata.com @kaldata.bsky.social

Google пусна юнските актуализации за сигурност на Android, които отстраняват 124 уязвимости, включително една уязвимост от типа „нулев ден“ (CVE-2025-48595), активно експлоатирана от злонамерени лица в целенасочени атаки за получаване на достъп до изпълнение на код и повишаване на привилегиите на...

0
0
0
4h ago

boredchilada @boredchilada.bsky.social

~Cybergcca~ CCCS issued 3 advisories, noting Android CVE-2025-48595 may be under targeted exploitation. - IOCs: CVE-2025-48595 - #Android #CVE202548595 #ThreatIntel

0
0
0
4h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Google patched 124 Android flaws, including zero-day CVE-2025-48595, a privilege escalation bug in Android Framework linked to limited targeted attacks. #Android #ZeroDay #CVE2025

0
0
0
1h ago

Information Security Briefly @infosecbriefly.bsky.social

June 2026 Android patches address 124 vulnerabilities, including CVE-2025-48595, a high-severity Framework privilege-escalation flaw under limited targeted exploitation.

0
0
0
Last hour

boredchilada @boredchilada.bsky.social

~Cisa~ CISA added CVE-2022-0492 (Linux) and CVE-2025-48595 (Android) to the KEV catalog. - IOCs: CVE-2022-0492, CVE-2025-48595 - #CISA #KEV #threatintel

0
0
0
Last hour

CVE-2026-0257

Overview

Palo Alto Networks
Cloud NGFW

13 May 2026

Published

30 May 2026

Updated

CVSS v4.0

HIGH (7.8)

EPSS

36.34%

MITRE

KEV

Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Statistics

7 Posts
2 Interactions

Last activity: 4 hours ago

Fediverse

Christoph Schmees @PC_Fluesterer

Palo Alto: Neue Schwachstelle, neue Angriffe

Die Sicherheitslücke CVE-2026-0257 im Betriebssystem PAN-OS der Firma Palo Alto wurde am 2026-05-13 veröffentlicht. Die Firma hielt die Lücke für nicht sonderlich gefährlich; sie brachte Updates für die verschiedenen Ausgaben von PAN-OS nach und nach in den folgenden Tagen. Am 2026-05-29 berichtete das Sicherheitsunternehmen Rapid7, dass es erfolgreiche Angriffe gegen diese Sicherheitslücke beobachtet hat. Weitere Nachforschungen ergaben, dass die Sicherheitslücke mindestens seit 2026-05-17 angegriffen wird. Zumindest die frühen Angriffe müssen als Zero-Day angesehen werden

https://www.pc-fluesterer.info/wordpress/2026/06/02/palo-alto-neue-schwachstelle-neue-angriffe/

#Empfehlung #Hintergrund #Warnung #0day #cybercrime #exploits #firewall #router #sicherheit #spionage #UnplugTrump #vpn

0
1
0
11h ago

🔒 Security Cyber @securitycyber

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

**Critical Alert:** A severe vulnerability (CVE-2026-0257) has been identified and requires immediate attention from security teams worldwide.

## The Details

https://securitycyber.uk

Resources: https://securitycyber.uk | https://www.hackthebox.com

0
0
0
12h ago

ThreatNoir @threatnoir

⚠️ CRITICAL: Attackers are exploiting Palo Alto Networks defect that initially flew under the radar

Palo Alto Networks GlobalProtect portals and gateways are under active attack via CVE-2026-0257, a critical authentication-bypass vulnerability. Attackers can forge valid auth cookies using public TLS certificates and gain VPN access with a single HTTP request. All affected customers are at immedia…

https://threatnoir.com/focus

#infosec #cybersecurity

0
0
0
8h ago

halil deniz @halildeniz

Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

In this article, I break down how the vulnerability works, affected configurations, exploitation scenarios, and the mitigation steps organizations should take to protect their remote access infrastructure.

https://denizhalil.com/2026/06/02/cve-2026-0257-pan-os-globalprotect-authentication-bypass/

#CyberSecurity #PaloAlto #GlobalProtect #PANOS #CVE20260257 #VulnerabilityManagement #ThreatDetection #NetworkSecurity #BlueTeam #RedTeam #InfoSec #DenizHalil

0
0
0
4h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

Weekly recap: active exploitation of PAN-OS and Prisma Access flaw CVE-2026-0257, a critical Gogs zero-day, and AI-driven phishing, poisoned dev tools, and identity abuse across open-source and enterprise systems. #PANOS #Gogs #OAuth

0
1
0
16h ago

キタきつね @kitafox.bsky.social

ハッカーがPalo Alto GlobalProtect VPNの認証バイパス脆弱性（CVE-2026-0257）を悪用しています Hackers are exploiting Palo Alto GlobalProtect VPN authentication bypass (CVE-2026-0257) #HelpNetSecurity (Jun 1) www.helpnetsecurity.com/2026/06/01/h...

0
0
0
19h ago

OpsMatters @opsmatters.com

The latest update for #CyCognito includes "Emerging Threat: (CVE-2026-0257) PAN-OS GlobalProtect Authentication Bypass via Forged Override Cookies". #cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X

0
0
0
17h ago

CVE-2026-8732

Overview

flippercode
WP Maps Pro

29 May 2026

Published

29 May 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.07%

MITRE

KEV

Description

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.

Statistics

13 Posts
1 Interaction

Last activity: 8 hours ago

Fediverse

RS Web Solutions (RSWEBSOLS) @rswebsols

WP Maps Pro Vulnerability Used to Generate Admin Accounts on WordPress Websites #wordpress

Critical WordPress alert: A vulnerability in WP Maps Pro (CVE-2026-8732) allows unauthenticated creation of admin accounts on affected sites (versions 6.1.0 and earlier). Exploits enable backdoors, content changes, and full site takeover. Update to WP Maps Pro 6.1.1 now. More details: https://ift.tt/rD2835w

Source: https://ift.tt/rD2835w | Image: https://ift.tt/8Bei13V

0
1
0
21h ago

🔒 Security Cyber @securitycyber

Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts

**Critical Alert:** A severe vulnerability (CVE-2026-8732) has been identified and requires immediate attention from security teams worldwide.

## The Details

https://securitycyber.uk

Resources: https://securitycyber.uk | https://www.hackthebox.com

0
0
7
20h ago

Trinacriatech @trinacriatech

WP Maps Pro CVE-2026-8732 (CVSS 9.8) — privilege escalation unauthenticated. Attackers creano admin account istantanei, takeover completo. 3.600 exploit attempts/giorno. Fix: upgrade a 6.1.1. #wordpress #cybersecurity

0
0
0
11h ago

ThreatNoir @threatnoir

⚠️ CRITICAL: Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts

Critical privilege escalation vulnerability CVE-2026-8732 in WP Maps Pro is actively being exploited to create unauthorized administrator accounts on WordPress sites. Any unpatched installation is at immediate risk of complete site takeover. This affects all versions prior to 6.1.1.

https://threatnoir.com/focus

#infosec #cybersecurity

0
0
0
8h ago

Bluesky

キタきつね @kitafox.bsky.social

CVE-2026-8732：WP Maps Proの脆弱性により、誰でもパスワードなしでWordPress管理画面を作成できてしまう CVE-2026-8732: The WP Maps Pro Flaw That Lets Anyone Create a WordPress Admin Without a Password #SecurityAffairs (Jun 1) securityaffairs.com/192977/hacki...

0
0
0
19h ago

セキュリティ対策Lab @securitylab-jp.bsky.social

WordPressプラグイン WP Maps Proで重大な脆弱性 CVE-2026-8732-サイバー攻撃への悪用確認 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews

0
0
0
13h ago

CVE-2026-8206

Overview

themeum
Kirki – Freeform Page Builder, Website Builder & Customizer

02 Jun 2026

Published

02 Jun 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.12%

MITRE

KEV

Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

Statistics

3 Posts
2 Interactions

Last activity: 5 hours ago

Fediverse

OffSequence @offseq

🚩 CRITICAL: CVE-2026-8206 in Kirki Page Builder (v6.0.0 – 6.0.6) lets unauth attackers reset any user password & hijack WordPress accounts. No patch yet — admins should disable or monitor plugin. Details: https://radar.offseq.com/threat/cve-2026-8206-cwe-269-improper-privilege-managemen-ac423059 #OffSeq #WordPress #Infosec

1
0
0
16h ago

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-8206 - Critical Privilege Escalation in Kirki WordPress plugin (v6.0.0-6.0.6). Unauthenticated account takeover via password reset email manipulation. CVSS 9.8. No patch available—disable immediately. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-8206/

1
0
0
15h ago

Bluesky

Red Hot Cyber @redhotcyber.bsky.social

Vulnerabilità nel plug-in Kirki: migliaia di siti WordPress a rischio 📌 Link all'articolo : www.redhotcyber.com/post/vulnera... A cura di Carolina Vivianti #redhotcyber #news #cybersecurity #hacking #wordpress #kirki #vulnerabilita #CVE20268206

0
0
0
5h ago

CVE-2024-21182

Overview

Oracle Corporation
WebLogic Server

16 Jul 2024

Published

02 Jun 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

89.65%

MITRE

KEV

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Statistics

4 Posts
1 Interaction

Last activity: 1 hour ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

CISA added CVE-2024-21182 to its exploited list. The Oracle WebLogic Server flaw affects versions 12.2.1.4.0 and 14.1.1.0.0, enabling remote unauthenticated attacks. #OracleWebLogic #CISA #Oracle

0
1
0
3h ago

キタきつね @kitafox.bsky.social

CISAが既知の悪用された脆弱性を1件カタログに追加 CISA Adds One Known Exploited Vulnerability to Catalog #CISA (Jun 1) CVE-2024-21182 Oracle WebLogic Serverの特定されていない脆弱性 www.cisa.gov/news-events/...

0
0
0
20h ago

Information Security Briefly @infosecbriefly.bsky.social

CISA warns that Oracle WebLogic CVE-2024-21182 is being exploited remotely and without authentication, and federal agencies must remediate it by June 4.

0
0
0
8h ago

Information Security Briefly @infosecbriefly.bsky.social

CISA added CVE-2024-21182 in Oracle WebLogic Server to the KEV Catalog due to evidence of active exploitation, requiring FCEB remediation by June 4, 2026.

0
0
0
1h ago

CVE-2026-33825

Overview

Microsoft
Microsoft Defender Antimalware Platform

14 Apr 2026

Published

01 Jun 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

7.07%

MITRE

KEV

Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Statistics

2 Posts

Last activity: 5 hours ago

Bluesky

NEWSTECNICAS | Tecnología , IA y Gaming @newstecnicas.com

🛡️ #Vulnerabilidad CVE-2026-33825 en #Windows Defender: Solución y Mitigación Paso a Paso www.newstecnicas.com/2026/06/vuln...

0
0
0
5h ago

CyberVeille @cyberveille-ch.bsky.social

📢 CVE-2026-41089 : exploitation active de la faille RCE critique Windows Netlogon 📝 ## 🗓️ Contexte Source : BleepingComputer, publié le 1er juin 2026. https://cyberveille.ch/posts/2026-06-02-cve-2026-41089-exploitation-active-de-la-faille-rce-critique-windows-netlogon/ #CVE_2026_33825 #Cyberveille

0
0
0
9h ago

CVE-2026-46243

Overview

Linux
Linux

01 Jun 2026

Published

02 Jun 2026

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

Statistics

1 Post
5 Interactions

Last activity: 11 hours ago

Bluesky

L'algorisme @lalgorisme.bsky.social

🧵 Un investigador armat amb un framework d'IA ha descobert una vulnerabilitat crítica al kernel Linux que permet escalar a root. El codi vulnerable portava 19 anys amagat. El bug: CVE-2026-46243, "CIFSwitch" heyitsas.im/posts/cifswi...

3
2
0
11h ago

CVE-2026-45585

Overview

Microsoft
Windows 11 Version 24H2

19 May 2026

Published

01 Jun 2026

Updated

CVSS v3.1

MEDIUM (6.8)

EPSS

0.11%

MITRE

KEV

Description

Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable.

Statistics

1 Post
2 Interactions

Last activity: 19 hours ago

Fediverse

Walkie Talkie 13 @amiserabilist

@maxleibman

“When I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people,” they wrote on Saturday. “You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot.”

Nightmare also noted that “Microsoft still has chains in my hands,” preventing them from releasing “documents” yet, or anytime in June, and then warned: “Mark this date July 14th, I will make sure your bones are shattered that day.”

turn off the Internet till morale improves.

https://www.reddit.com/r/sysadmin/comments/1tty49c/comment/op6n1bp/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

@Kierkegaanks

Why does he sound like Ea Nassir?

https://www.reddit.com/r/sysadmin/comments/1tty49c/comment/op5rx3x/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

1
1
0
19h ago

CVE-2026-40965

Overview

Cloud Foundry Foundation
uaa_release

01 Jun 2026

Published

02 Jun 2026

Updated

CVSS v4.0

CRITICAL (10.0)

EPSS

0.04%

MITRE

KEV

Description

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing. Affected versions: - uaa_release: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later - CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaa_release v78.13.0)

Statistics

1 Post
1 Interaction

Last activity: 21 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-40965 - CRITICAL Cryptographic Key Exposure in Cloud Foundry UAA. EC private keys leaked via /token_keys endpoint. CVSS 10.0. UNPATCHED. Update or disable EC keys immediately. #CVE #CloudFoundry #infosec

https://www.valtersit.com/cve/CVE-2026-40965/

1
0
0
21h ago