Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Category: cve

Apple Emergency Patch for iOS 26, macOS 26, macOS 15 (CVE-2026-86950)

Posted on September 30, 2026 by Kyle

Overview

Apple has issued urgent security updates for older versions of its operating systems, specifically iOS 26, macOS 26, and macOS 15. These patches address CVE-2026-86950, a vulnerability confirmed to be under active exploitation. The immediate patching requirement underscores the critical nature of this flaw for users running the affected legacy branches.

Technical Analysis

Details regarding the specific nature of CVE-2026-86950 have not been publicly disclosed by Apple at the time of writing, beyond its active exploitation status. The vulnerability affects:
* iOS 26
* macOS 26
* macOS 15

Notably, the current generation iOS 27 and macOS 27 operating systems are explicitly stated as not being affected by this vulnerability. The attack vector and prerequisites for exploitation are currently unknown, but the emergency patch suggests a high-impact flaw, likely leading to arbitrary code execution or privilege escalation.

Detection

Specific detection methods for CVE-2026-86950 are challenging without public technical details of the exploit. However, defenders should focus on post-exploitation behaviors on affected macOS systems:
* Unusual Process Spawns: Monitor for unexpected child processes originating from common user applications (e.g., browsers, mail clients) or system services that typically do not execute shell commands or create new executables.
* Privilege Escalation Attempts: Look for attempts to modify system files, create new privileged users, or execute commands with elevated permissions following suspicious activity.
* Network Connections: Observe outbound network connections from unusual processes or to suspicious external IP addresses/domains.
* File System Monitoring: Monitor for creation of suspicious files in temporary directories, user library folders, or system directories, especially those with executable permissions.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

macOS Suspicious Child Process from Common Applications

title: macOS Suspicious Child Process from Common Applications
id: 76f8e2c3-1a2b-4d5e-8f9a-0b1c2d3e4f5a
status: experimental
description: Detects suspicious child processes (e.g., shells, scripting interpreters) spawned by common user applications, which could indicate post-exploitation activity on macOS. This is a generic rule for client-side exploits leading to code execution.
logsource:
  product: macos
  service: es_process_events
detection:
  selection_parent:
    ParentImage|contains:
      - '/Applications/Safari.app/'
      - '/Applications/Mail.app/'
      - '/Applications/Messages.app/'
      - '/Applications/Firefox.app/'
      - '/Applications/Google Chrome.app/'
      - '/Applications/Microsoft Word.app/'
      - '/Applications/Microsoft Excel.app/'
      - '/Applications/Microsoft PowerPoint.app/'
  selection_child:
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/zsh'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/ruby'
      - '/usr/bin/osascript'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
  condition: all of selection_*
level: high

Mitigations

  1. Apply Patches Immediately: Update all affected iOS 26, macOS 26, and macOS 15 devices to the latest security patches provided by Apple. This is the most critical and effective mitigation.
  2. Isolate Legacy Systems: If immediate patching is not feasible, isolate affected legacy systems from critical networks and sensitive data until updates can be applied.
  3. Endpoint Detection and Response (EDR): Ensure EDR solutions are deployed and configured to monitor for suspicious process activity, file modifications, and network connections on macOS endpoints.
  4. User Awareness: Educate users on phishing and social engineering tactics, as initial access for such exploits often relies on user interaction.

References

  • https://isc.sans.edu/diary/rss/33376

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,599 input / 1,186 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged apple, critical, cve, ios, macos, patch, vulnerabilityLeave a comment

Apple Zero-Day Vulnerability CVE-2026-86950 Weaponized in Targeted Attacks

Posted on September 30, 2026 by Kyle

Overview

Apple has acknowledged active exploitation of CVE-2026-86950, an out-of-bounds write vulnerability, in targeted attacks. This zero-day flaw is being leveraged by threat actors in a highly sophisticated manner. The vulnerability poses a critical risk to affected Apple devices, necessitating immediate patching upon release.

Technical Analysis

CVE-2026-86950 is described as an out-of-bounds write vulnerability. Specific details regarding the affected component, attack vector, and prerequisites for exploitation are not publicly available at the time of writing, as Apple has only confirmed its active exploitation and nature of the flaw. The “out-of-bounds write” typically implies that an attacker can write data outside of an allocated memory buffer, potentially leading to arbitrary code execution or denial of service. Apple states the attacks are “extremely sophisticated.”

Detection

Due to the limited public details about CVE-2026-86950 and its exploitation, specific detection mechanisms are challenging to define.
* Monitor for unusual process behavior or unexpected network connections originating from Apple devices, particularly those running older, unpatched versions.
* Review device logs (e.g., unified logs on macOS/iOS) for crashes, unexpected reboots, or suspicious system calls that might indicate exploit attempts or post-exploitation activity.
* Look for signs of privilege escalation or persistence mechanisms being established on compromised systems.
* Note: Without specific process names, file paths, or network indicators, concrete detection rules cannot be provided at this time.

Mitigations

  1. Apply security updates from Apple immediately upon their release. This is the primary and most effective mitigation for zero-day vulnerabilities.
  2. Ensure all Apple devices (iOS, macOS, watchOS, tvOS, visionOS) are kept up-to-date with the latest software versions.
  3. Implement robust endpoint detection and response (EDR) solutions on macOS devices to monitor for post-exploitation activities.
  4. Educate users about phishing and social engineering tactics, as these are common initial access vectors for targeted attacks.
  5. Restrict unnecessary network access and enforce the principle of least privilege for all users and applications.

References

  • https://www.darkreading.com/cyberattacks-data-breaches/apple-zero-day-vulnerability-weaponized-targeted-attacks

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,487 input / 708 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged apple, critical, vulnerability, zero-dayLeave a comment

CVE-2026-41091: Microsoft Defender Link Following Vulnerability

Posted on May 24, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-41091 is a local privilege escalation vulnerability affecting Microsoft Defender, specifically due to improper link resolution before file access (link following). An authorized local attacker can exploit this to elevate their privileges. This vulnerability is considered critical for defenders as it is actively exploited in the wild, as indicated by its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

This vulnerability, classified as CWE-59 (Improper Link Resolution Before File Access), allows an authorized local attacker to achieve privilege escalation. The attack vector is local (AV:L), requires low privileges (PR:L), and does not require user interaction (UI:N). The core issue lies in Microsoft Defender’s handling of symbolic links or junctions, where it fails to properly resolve the target of a link before performing file operations. An attacker can craft a malicious link that, when accessed by a privileged Defender process, points to a location or file that the attacker wishes to manipulate with elevated permissions.

  • Vulnerability Type: Improper Link Resolution Before File Access (Link Following)
  • CVE ID: CVE-2026-41091
  • CVSS 3.1 Score: 7.8 (High)
  • Attack Vector: Local
  • Prerequisites: Authorized local attacker
  • Impact: High confidentiality, integrity, and availability impact (C:H/I:H/A:H)
  • Affected Products: microsoft malware_protection_engine versions greater than or equal to 1.1.26030.3008 and less than 1.1.26040.8.

Detection

Detecting the direct exploitation of a link following vulnerability within a system service like Microsoft Defender can be challenging without specific internal telemetry. However, post-exploitation activity, where the attacker leverages the newly gained elevated privileges, can be identified.

  • Process Creation Anomalies: Monitor for unusual child processes spawned by MsMpEng.exe (Microsoft Defender’s core engine) that are not typical for its operation (e.g., cmd.exe, powershell.exe, wscript.exe, cscript.exe, or other administrative tools).
  • File System Monitoring: Look for unexpected file modifications or creations in sensitive system directories or user profiles, especially if attributed to the MsMpEng.exe process.
  • Registry Monitoring: Monitor for suspicious registry key modifications, particularly those related to persistence or service configurations, initiated by MsMpEng.exe.
  • Service Configuration Changes: Look for changes to Microsoft Defender’s service configuration or related components that could indicate tampering.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Process Spawn by MsMpEng.exe

title: Suspicious Process Spawn by MsMpEng.exe
id: 7e7f8e9a-b0c1-4d2e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects unusual child processes spawned by Microsoft Defender's engine (MsMpEng.exe), which could indicate post-exploitation activity after a privilege escalation vulnerability like CVE-2026-41091.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\MsMpEng.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\schtasks.exe'
      - '\at.exe'
  condition: selection
level: high

Mitigations

  1. Apply Security Updates: Immediately apply the latest security updates from Microsoft that address CVE-2026-41091. Ensure Microsoft Defender’s Malware Protection Engine is updated to version 1.1.26040.8 or newer.
  2. Principle of Least Privilege: Enforce the principle of least privilege for all user accounts to minimize the impact of successful local privilege escalation.
  3. Endpoint Detection and Response (EDR): Deploy and maintain EDR solutions to monitor for and alert on suspicious process activity and system changes that may indicate post-exploitation behavior.
  4. Regular Audits: Conduct regular security audits of system configurations and user permissions.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-41091
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
  • T1574.001 — DLL
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,879 input / 1,416 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged highLeave a comment

CVE-2026-41091: Microsoft Defender Link Following Vulnerability

Posted on May 20, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-41091 describes a local privilege escalation vulnerability within Microsoft Defender, rated with a CVSS 3.1 score of 7.8 (HIGH). The flaw, categorized as CWE-59 (Improper Link Resolution Before File Access), allows an authorized attacker to elevate their privileges locally. This vulnerability is critical as it undermines the integrity of a core endpoint security product, enabling attackers to gain SYSTEM-level access on affected machines.

Technical Analysis

  • Vulnerability Type: Improper link resolution before file access (‘link following’).
  • Affected Product: Microsoft Defender.
  • Impact: Local Privilege Escalation (LPE), allowing an authorized attacker to gain higher privileges.
  • Attack Vector: Local (AV:L). Requires an attacker to have existing local access to the system.
  • Prerequisites: An attacker with local user-level access to the affected system.
  • CVSS 3.1 Score: 7.8 (HIGH)
    • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weakness Enumeration: CWE-59 (Improper Link Resolution Before File Access (‘Link Following’)).
  • Affected Versions: Specific affected versions of Microsoft Defender are not detailed in the provided information. Defenders should refer to Microsoft’s official security advisories for precise versioning.

Detection

  • Monitor for unusual file system activity, specifically the creation of symbolic links or hard links by low-privileged users in unexpected locations, potentially followed by interactions from Microsoft Defender processes.
  • Look for unexpected process creation with elevated privileges (e.g., NT AUTHORITY\SYSTEM) where the parent process is Microsoft Defender or a user-level process that interacted with Defender in an unusual manner.
  • Analyze Windows Event Logs (e.g., Security Event ID 4688 for process creation, Sysmon Event ID 1 for process creation, Event ID 11 for file creation) for anomalies related to Defender’s file access patterns or privilege changes.
  • Hunt for suspicious modifications to critical system files or registry keys by processes running with elevated privileges that cannot be attributed to legitimate system updates or administrative actions.

Mitigations

  1. Apply the security update for CVE-2026-41091 released by Microsoft as soon as it becomes available. This is the primary and most effective mitigation.
  2. Enforce the principle of least privilege across all user accounts and services to limit the potential impact of any successful local privilege escalation.
  3. Implement robust endpoint detection and response (EDR) solutions to monitor for and alert on post-exploitation activities indicative of privilege escalation or unauthorized system access.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-41091
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1574.001 — DLL
  • T1068 — Exploitation for Privilege Escalation
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,468 input / 913 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged highLeave a comment

CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability

Posted on May 20, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-45498 is an unspecified denial of service (DoS) vulnerability affecting Microsoft Defender. Its inclusion in CISA’s KEV catalog highlights its potential for active exploitation or significant risk. Successful exploitation could disrupt the availability of Microsoft Defender on affected systems, potentially leaving endpoints unprotected.

Technical Analysis

The vulnerability allows for a denial of service condition within Microsoft Defender. Specific details regarding the underlying mechanism are currently unspecified. According to the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), exploitation requires local access to the system, has low attack complexity, does not require any privileges or user interaction, and results in a low impact to availability. No specific affected versions have been publicly detailed beyond ‘Microsoft Defender’ generally.

Detection

Detecting this specific DoS event without detailed technical information is challenging. Defenders should monitor for general indicators of Microsoft Defender instability or failure:
* Unexpected termination or restart of Microsoft Defender processes (e.g., MsMpEng.exe).
* High CPU or memory utilization by Microsoft Defender services that precedes system instability or crashes.
* Windows Event Log entries indicating service crashes (e.g., Event ID 7031, 7034 from Service Control Manager) or application errors (e.g., Event ID 1000 from Application Error) related to MsMpEng.exe or other Defender components.
* Alerts from Endpoint Detection and Response (EDR) solutions indicating unusual behavior or resource consumption by security software.

Mitigations

  1. Apply all available security updates from Microsoft as soon as they are released. This is the primary mitigation for known vulnerabilities.
  2. Ensure Microsoft Defender is configured for automatic updates of both the engine and definition files to receive the latest protections.
  3. Implement robust endpoint detection and response (EDR) solutions to monitor for and alert on unusual process behavior or resource consumption that could indicate a DoS attack or system instability.
  4. Regularly review system logs for errors or warnings related to Microsoft Defender services.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-45498
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,442 input / 742 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged mediumLeave a comment

CVE-2026-42897: Microsoft Exchange Server Cross-Site Scripting Vulnerability

Posted on May 15, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-42897 is a high-severity cross-site scripting (XSS) vulnerability affecting Microsoft Exchange Server. This flaw permits an unauthenticated attacker to execute arbitrary JavaScript within a victim’s browser context during Outlook Web Access (OWA) page generation, provided specific user interaction conditions are met. The vulnerability poses a significant risk to confidentiality and integrity, enabling actions like session hijacking or data exfiltration.

Technical Analysis

  • Vulnerability Type: Improper neutralization of input during web page generation (‘cross-site scripting’) (CWE-79).
  • Affected Products:
    • microsoft exchange_server
    • microsoft exchange_server 2016
    • microsoft exchange_server 2019
  • Attack Vector: Network-based (AV:N), low attack complexity (AC:L), no privileges required (PR:N).
  • Prerequisites: User interaction is required (UI:R) for successful exploitation. The vulnerability manifests during web page generation in Outlook Web Access (OWA).
  • Impact: Successful exploitation allows an unauthorized attacker to execute arbitrary JavaScript in the browser context, leading to high impact on confidentiality (C:H) and integrity (I:H). This can facilitate session hijacking, credential theft, or other client-side attacks, and allows an unauthorized attacker to perform spoofing over a network.
  • CVSS 3.1 Score: 8.1 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

Detection

  • Monitor web server logs for Microsoft Exchange OWA for unusual requests, especially those containing script-like payloads or encoded characters in parameters not typically expected.
  • Implement and monitor Web Application Firewalls (WAFs) to detect and block XSS attempts targeting Exchange OWA endpoints.
  • Client-side security solutions (e.g., browser extensions, endpoint detection and response) may detect malicious script execution in the browser context.
  • Review security logs for suspicious activity originating from OWA sessions, such as unexpected API calls or data exfiltration attempts.

Mitigations

  1. Apply the latest security updates from Microsoft as soon as they are available. Refer to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-42897.
  2. Implement a robust Web Application Firewall (WAF) in front of Exchange OWA to filter and sanitize user input, blocking known XSS patterns.
  3. Ensure all Exchange servers are running supported versions and are configured according to Microsoft’s security best practices.
  4. Educate users on identifying and reporting suspicious emails or links, as user interaction is required for exploitation.

References

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897
  • https://nvd.nist.gov/vuln/detail/CVE-2026-42897

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1059.004 — Unix Shell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,156 input / 983 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged highLeave a comment

CVE-2026-42208: Critical SQL Injection in BerriAI LiteLLM AI Gateway

Posted on May 15, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-42208 is a critical SQL injection vulnerability affecting BerriAI LiteLLM, an AI Gateway proxy server. It allows unauthenticated attackers to read and potentially modify the proxy’s internal database, compromising credentials managed by the proxy. The vulnerability affects versions 1.81.16 through before 1.83.7 and is listed in CISA’s KEV catalog, indicating active exploitation.

Technical Analysis

  • Vulnerability: SQL Injection (CWE-89).
  • Affected Product: litellm litellm versions >= 1.81.16 and < 1.83.7.
  • Attack Vector: Unauthenticated network access (CVSS:3.1/AV:N).
  • Mechanism: A database query used for proxy API key checks incorrectly mixes caller-supplied key values from the Authorization header directly into the SQL query text instead of using parameterized queries.
  • Exploitation Path: An attacker sends a specially crafted Authorization header to any LLM API route (e.g., POST /chat/completions). The malicious input is processed through the proxy’s error-handling path, triggering the SQL injection.
  • Impact: An attacker can read data from the proxy’s database and may be able to modify it, leading to unauthorized access to the proxy and the credentials it manages. This results in high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).
  • CVSS 3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor LiteLLM proxy server logs for unusual Authorization header values, especially those containing SQL-like syntax (e.g., ' OR 1=1--, UNION SELECT).
  • Look for unexpected or malformed database queries originating from the LiteLLM application, particularly those involving API key validation.
  • Analyze network traffic for suspicious requests to LLM API routes (/chat/completions) with abnormally long or malformed Authorization headers.
  • Check for unauthorized access attempts or modifications within the LiteLLM proxy’s internal database.

Mitigations

  1. Patch Immediately: Upgrade BerriAI LiteLLM to version 1.83.7 or newer. This version contains the patch for the vulnerability.
  2. Input Validation: Implement robust input validation and sanitization for all API key inputs if immediate patching is not feasible.
  3. Parameterized Queries: Ensure all database interactions within custom code use parameterized queries to prevent SQL injection.
  4. Network Segmentation: Restrict network access to the LiteLLM proxy server to only necessary internal systems.
  5. Monitor Database Access: Implement logging and alerting for unusual or unauthorized access patterns to the proxy’s database.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-42208
  • https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
  • https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,637 input / 1,091 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged criticalLeave a comment

CVE-2026-6973: Remote Code Execution in Ivanti EPMM

Posted on May 15, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-6973 is an improper input validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that permits remote code execution. This flaw affects specific versions of EPMM and requires prior administrative authentication for exploitation. Its inclusion in CISA’s KEV catalog signifies active exploitation in the wild, making immediate patching critical for organizations utilizing Ivanti EPMM.

Technical Analysis

  • Vulnerability: Improper Input Validation (CWE-20).
  • Impact: Remote Code Execution (RCE).
  • Affected Products: The vulnerability affects Ivanti EPMM versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1.
    • ivanti endpoint_manager_mobile < 12.6.1.1
    • ivanti endpoint_manager_mobile 12.7.0.0
    • ivanti endpoint_manager_mobile 12.8.0.0
  • Attack Vector: Network-based (AV:N).
  • Prerequisites: Requires a remotely authenticated user with administrative access (PR:H).
  • CVSS 3.1 Score: 7.2 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor Ivanti EPMM logs for unusual administrative activity, especially related to configuration changes, unexpected process spawns, or command execution attempts.
  • Look for outbound network connections from the EPMM appliance to unknown or suspicious external IP addresses.
  • Review system logs for signs of unauthorized file modifications or new user account creation on the EPMM server.
  • No specific Sigma or YARA rules are publicly available for this CVE at the time of writing.

Mitigations

  1. Apply the latest security patches immediately. Ivanti has released fixes in versions 12.6.1.1, 12.7.0.1, and 12.8.0.1.
  2. Ensure all administrative accounts for Ivanti EPMM utilize strong, unique passwords and multi-factor authentication (MFA).
  3. Restrict network access to the Ivanti EPMM administrative interface to only trusted IP ranges and necessary personnel.
  4. Regularly audit administrative user activity and system logs for anomalies.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-6973
  • https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-6973
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,397 input / 899 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged highLeave a comment

CVE-2026-0300: PAN-OS User-ID Authentication Portal RCE Vulnerability

Posted on May 15, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-0300 is a critical out-of-bounds write vulnerability affecting Palo Alto Networks PAN-OS software. This flaw in the User-ID™ Authentication Portal (Captive Portal) service permits an unauthenticated attacker to execute arbitrary code with root privileges on vulnerable PA-Series and VM-Series firewalls. Its high severity (CVSS 9.8) and potential for unauthenticated remote code execution make it a significant threat, especially if the Captive Portal is internet-facing and not properly secured.

Technical Analysis

  • Vulnerability: CVE-2026-0300, an out-of-bounds write (CWE-787), specifically described as a buffer overflow.
  • Affected Service: User-ID™ Authentication Portal (also known as Captive Portal) service.
  • Attack Vector: An unauthenticated attacker can execute arbitrary code by sending specially crafted packets to the vulnerable service.
  • Impact: Arbitrary code execution with root privileges on the affected firewall.
  • Affected Products: Palo Alto Networks PAN-OS versions 10.2.0 through 10.2.9.
  • Unaffected Products: Prisma Access, Cloud NGFW, and Panorama appliances are not impacted by this vulnerability.
  • Prerequisites: The User-ID™ Authentication Portal must be enabled and accessible to the attacker. The risk is significantly reduced if access to the portal is restricted to trusted internal IP addresses.

Detection

  • Monitor firewall logs for unusual connection attempts or traffic patterns directed at the User-ID Authentication Portal service.
  • Look for unexpected process creation or command execution originating from the firewall’s operating system, particularly with root privileges.
  • Analyze network traffic for specially crafted packets targeting the Captive Portal, though specific signatures may not be publicly available at the time of writing.
  • Hunt for signs of post-exploitation activity, such as outbound connections to unknown external IPs, unusual file modifications, or attempts to establish persistence.
  • Review system logs for crashes or restarts of the User-ID or Captive Portal services that might indicate exploitation attempts.

Mitigations

  1. Restrict Access: Immediately restrict access to the User-ID™ Authentication Portal (Captive Portal) to only trusted internal IP addresses. This is the primary recommended mitigation to significantly reduce exposure, as highlighted in Palo Alto Networks’ best practice guidelines.
  2. Apply Patches: Apply vendor-provided patches for CVE-2026-0300 as soon as they become available for your specific PAN-OS version. No specific patch versions were provided in the source material, but updates should be prioritized.
  3. Network Segmentation: Isolate firewalls running vulnerable PAN-OS versions from untrusted networks where possible to limit attack surface.
  4. Monitor Firewall Activity: Implement robust monitoring for all firewall management interfaces and services, including the Captive Portal, to detect anomalous behavior.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-0300
  • https://security.paloaltonetworks.com/CVE-2026-0300
  • https://cert-portal.siemens.com/productcert/html/ssa-967325.html
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300
  • https://knowledgebase.paloaltonetworks.com/KCSArticleDetail
  • https://unit42.paloaltonetworks.com/captive-portal-zero-day/

Indicators of Compromise

Type Value Description
SHA256 e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584 EarthWorm payload hash (via https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
IP Address 136.0.8.48 Attacker IP (via https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
IP Address 146.70.100.69 C2 staging server (via https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
IP Address 149.104.66.84 Attacker IP (via https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
IP Address 67.206.213.86 Attacker IP (via https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
URL http://146.70.100.69:8000/php_sess EarthWorm download URL (via https://unit42.paloaltonetworks.com/captive-portal-zero-day/)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
  • T1068 — Exploitation for Privilege Escalation
  • T1498.001 — Direct Network Flood
  • T1087.002 — Domain Account
  • T1021.004 — SSH
  • T1071 — Application Layer Protocol
  • T1055 — Process Injection
  • T1572 — Protocol Tunneling
  • T1070.001 — Clear Windows Event Logs
  • T1016 — System Network Configuration Discovery
  • T1090 — Proxy
  • T1098 — Account Manipulation
  • T1562.001 — Disable or Modify Tools
  • T1078 — Valid Accounts
  • T1078.002 — Domain Accounts
  • T1070.004 — File Deletion
  • T1071.001 — Web Protocols
  • T1018 — Remote System Discovery
  • T1105 — Ingress Tool Transfer
  • T1021.001 — Remote Desktop Protocol
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,802 input / 1,120 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in cveTagged criticalLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.