👋 This is CVE Pulse — the official channel from cve.tools.
“Critical” by CVSS ≠ dangerous. What's dangerous is what's being exploited. We surface exactly those CVEs and break down: what's broken, who's attacking, how to check your own systems, and what to fix first.
Formats: #breakdown of fresh CVEs · weekly #signal · monthly #trends · product #release.
Verify any CVE → cve.tools/verify
Breakdowns & trends → cve.tools
“Critical” by CVSS ≠ dangerous. What's dangerous is what's being exploited. We surface exactly those CVEs and break down: what's broken, who's attacking, how to check your own systems, and what to fix first.
Formats: #breakdown of fresh CVEs · weekly #signal · monthly #trends · product #release.
Verify any CVE → cve.tools/verify
Breakdowns & trends → cve.tools
🛡️ CVE-2026-39893 — Cacti pre-auth SQL injection (CVSS 9.8)
Cacti ≤ 1.2.30: the graph-filter "rfilter" is concatenated into a MySQL RLIKE clause in graph_view.php with only a regex check. A quote slips past into the database.
• Pre-auth ONLY if guest graph viewing is enabled (off by default) → otherwise authenticated-only. The 9.8 is worst-case.
• No public PoC / KEV / in-the-wild activity yet (3 Jul 2026).
• But: the same bug was an unauth SQLi in 2023 (CVE-2023-39361), and Cacti pre-auth bugs turn into botnets fast → patch before the PoC.
✅ Fix: upgrade to 1.2.31. Stopgap: disable guest access + WAF rule rejecting a quote in rfilter.
📖 Full breakdown: https://cve.tools/blog/cacti-cve-2026-39893-rfilter-sql-injection-explained
Cacti ≤ 1.2.30: the graph-filter "rfilter" is concatenated into a MySQL RLIKE clause in graph_view.php with only a regex check. A quote slips past into the database.
• Pre-auth ONLY if guest graph viewing is enabled (off by default) → otherwise authenticated-only. The 9.8 is worst-case.
• No public PoC / KEV / in-the-wild activity yet (3 Jul 2026).
• But: the same bug was an unauth SQLi in 2023 (CVE-2023-39361), and Cacti pre-auth bugs turn into botnets fast → patch before the PoC.
✅ Fix: upgrade to 1.2.31. Stopgap: disable guest access + WAF rule rejecting a quote in rfilter.
📖 Full breakdown: https://cve.tools/blog/cacti-cve-2026-39893-rfilter-sql-injection-explained
CVE Tools
CVE-2026-39893: Cacti Pre-Auth SQL Injection in graph_view.php (CVSS 9.8)
CVE-2026-39893 is a CVSS 9.8 pre-authentication SQL injection in Cacti <= 1.2.30 via the rfilter RLIKE clause in graph_view.php. What it is, why the 9.8 is conditional, the attack chain, detection, and how to fix it.
🔴 CVE-2025-61882 — Oracle EBS pre-auth RCE, exploited in the wild
⚙️ CVSS 9.8 — unauthenticated, network, no user interaction
🏢 Oracle E-Business Suite 12.2.3–12.2.14
📈 EPSS 0.997 (99.95th pct) — public exploit exists
🚨 CISA KEV — listed 6 Oct 2025, ransomware-flagged
🕵️ Cl0p zero-day since ~9 Aug 2025 (traces to 10 Jul) — long dwell time
🔑 Mechanism: XSLT / XSL template injection (javax.script eval), NOT deserialization
⚠️ Patch ≠ done: also apply CVE-2025-61884, and if you were exposed — hunt for a web shell + rotate secrets. Patching won't undo stolen data.
🧩 Operators (Cl0p) ≠ leakers (Scattered Lapsus$ Hunters). Google does NOT attribute exploitation to ShinyHunters.
Confirmed victims: The Washington Post, GlobalLogic/Hitachi, Harvard, Dartmouth, Envoy Air.
📖 Full breakdown → https://cve.tools/blog/cve-2025-61882-oracle-ebs-preauth-rce-cl0p
⚙️ CVSS 9.8 — unauthenticated, network, no user interaction
🏢 Oracle E-Business Suite 12.2.3–12.2.14
📈 EPSS 0.997 (99.95th pct) — public exploit exists
🚨 CISA KEV — listed 6 Oct 2025, ransomware-flagged
🕵️ Cl0p zero-day since ~9 Aug 2025 (traces to 10 Jul) — long dwell time
🔑 Mechanism: XSLT / XSL template injection (javax.script eval), NOT deserialization
⚠️ Patch ≠ done: also apply CVE-2025-61884, and if you were exposed — hunt for a web shell + rotate secrets. Patching won't undo stolen data.
🧩 Operators (Cl0p) ≠ leakers (Scattered Lapsus$ Hunters). Google does NOT attribute exploitation to ShinyHunters.
Confirmed victims: The Washington Post, GlobalLogic/Hitachi, Harvard, Dartmouth, Envoy Air.
📖 Full breakdown → https://cve.tools/blog/cve-2025-61882-oracle-ebs-preauth-rce-cl0p
CVE Tools
CVE-2025-61882: Oracle EBS Pre-Auth RCE (Cl0p Zero-Day) Explained
CVE-2025-61882 is a critical unauthenticated RCE in Oracle E-Business Suite (12.2.3-12.2.14) exploited by Cl0p. The exploit chain, IoCs, detection, and patch guidance.
🚨 Cisco Catalyst SD-WAN — CVE-2026-20245 (root access)
Exploited as a 0-day ~2 months before Cisco disclosed it. Now on CISA KEV; June 23 federal patch deadline has passed.
Read the numbers honestly:
📊 CVSS 7.8 HIGH — but LOCAL + netadmin (privesc to root, not an internet RCE)
🎯 KEV: confirmed in-the-wild exploitation
📈 EPSS: top ~5% (94.99th percentile)
⛓ The real risk is the chain: auth-bypass bugs CVE-2026-20182 (CVSS 10.0) + CVE-2026-20127 → netadmin, then 20245 → commands as root on vManage/vSmart/vBond, a hidden root account, logs wiped.
🛠 No workaround — upgrade, and patch the whole chain.
🕵️ SD-WAN gear runs no EDR — no alerts ≠ clean. Assume-breach and hunt.
📖 Full breakdown + IoCs: https://cve.tools/blog/cisco-sd-wan-cve-2026-20245-root-access-explained
Exploited as a 0-day ~2 months before Cisco disclosed it. Now on CISA KEV; June 23 federal patch deadline has passed.
Read the numbers honestly:
📊 CVSS 7.8 HIGH — but LOCAL + netadmin (privesc to root, not an internet RCE)
🎯 KEV: confirmed in-the-wild exploitation
📈 EPSS: top ~5% (94.99th percentile)
⛓ The real risk is the chain: auth-bypass bugs CVE-2026-20182 (CVSS 10.0) + CVE-2026-20127 → netadmin, then 20245 → commands as root on vManage/vSmart/vBond, a hidden root account, logs wiped.
🛠 No workaround — upgrade, and patch the whole chain.
🕵️ SD-WAN gear runs no EDR — no alerts ≠ clean. Assume-breach and hunt.
📖 Full breakdown + IoCs: https://cve.tools/blog/cisco-sd-wan-cve-2026-20245-root-access-explained
CVE Tools
CVE-2026-20245: Cisco Catalyst SD-WAN Root Access (KEV, Exploited)
CVE-2026-20245 lets a netadmin run arbitrary commands as root on Cisco Catalyst SD-WAN — exploited in the wild for months before disclosure and now on CISA KEV. What it is, how attackers chain it, and what to do.
🔥 CVE-2026-24858 + FortiBleed: patch the bug, but chase the credentials
🛡 The CVE: FortiCloud SSO auth bypass (CWE-288), pre-auth, CVSS 9.8, on CISA KEV since Jan 27, 2026 — but PATCHED by Fortinet in January (FG-IR-26-060).
🩸 FortiBleed: the live credential campaign. Fortinet says it's NOT a new exploit — it's reuse + brute force. This CVE helped fill the pool.
📊 SOCRadar: 86,644 exposed devices, 194 countries — ~half of internet-facing Fortinet. "FortigateSniffer" implants sniff creds across ~24 protocols.
❓ Attribution to a Russian-speaking broker ("SantaAd") is tentative and unconfirmed.
✅ Today: rotate every Fortinet credential + enforce MFA. Patching alone won't undo harvested creds.
📖 Full breakdown: https://cve.tools/blog/cve-2026-24858-fortinet-sso-bypass-fortibleed-explained
🛡 The CVE: FortiCloud SSO auth bypass (CWE-288), pre-auth, CVSS 9.8, on CISA KEV since Jan 27, 2026 — but PATCHED by Fortinet in January (FG-IR-26-060).
🩸 FortiBleed: the live credential campaign. Fortinet says it's NOT a new exploit — it's reuse + brute force. This CVE helped fill the pool.
📊 SOCRadar: 86,644 exposed devices, 194 countries — ~half of internet-facing Fortinet. "FortigateSniffer" implants sniff creds across ~24 protocols.
❓ Attribution to a Russian-speaking broker ("SantaAd") is tentative and unconfirmed.
✅ Today: rotate every Fortinet credential + enforce MFA. Patching alone won't undo harvested creds.
📖 Full breakdown: https://cve.tools/blog/cve-2026-24858-fortinet-sso-bypass-fortibleed-explained
CVE Tools
CVE-2026-24858: Fortinet SSO Auth Bypass & FortiBleed (KEV)
CVE-2026-24858 is a critical FortiCloud SSO authentication bypass on KEV, patched in January 2026. Here's what it is, how it connects to the FortiBleed credential campaign, and what to do — without the hype.
🚨 UniFi OS Server — unauthenticated RCE to root
CVE-2026-34910 · CVSS 10.0 · on CISA KEV · exploited in the wild
🔗 The chain (per Bishop Fox, validated on live 5.0.6):
• CVE-2026-34908 + CVE-2026-34909 — auth bypass (raw-vs-normalized URI)
• CVE-2026-34910 — command injection via an unvalidated package name
• passwordless sudo → trivial root
⚠️ No password, no user interaction, no failed-login trail to hunt.
👀 In the wild: rogue "John Sim" admin accounts + Mirai-style botnet. Detection script published; no working exploit released.
✅ Fix: upgrade UniFi OS Server to 5.0.8+ (also 5.1.10/5.1.11/5.1.12), take the mgmt UI off the internet, assume-breach hunt.
📖 Full breakdown: https://cve.tools/blog/unifi-os-cve-2026-34910-unauthenticated-rce-chain-explained
CVE-2026-34910 · CVSS 10.0 · on CISA KEV · exploited in the wild
🔗 The chain (per Bishop Fox, validated on live 5.0.6):
• CVE-2026-34908 + CVE-2026-34909 — auth bypass (raw-vs-normalized URI)
• CVE-2026-34910 — command injection via an unvalidated package name
• passwordless sudo → trivial root
⚠️ No password, no user interaction, no failed-login trail to hunt.
👀 In the wild: rogue "John Sim" admin accounts + Mirai-style botnet. Detection script published; no working exploit released.
✅ Fix: upgrade UniFi OS Server to 5.0.8+ (also 5.1.10/5.1.11/5.1.12), take the mgmt UI off the internet, assume-breach hunt.
📖 Full breakdown: https://cve.tools/blog/unifi-os-cve-2026-34910-unauthenticated-rce-chain-explained
CVE Tools
CVE-2026-34910: UniFi OS Unauthenticated RCE Chain (KEV)
CVE-2026-34910 is the command-injection link in a no-auth chain that gives root on Ubiquiti UniFi OS Server. CVSS 10, on CISA KEV, exploited in the wild. What it is, the chain, and how to fix it.
🚨 CVE-2026-35273 — Oracle PeopleSoft pre-auth RCE, exploited as a 0-day
• 💥 CVSS 9.8, unauthenticated RCE in PeopleTools 8.61/8.62 (PSEMHUB) · EPSS 0.9233 (~99.8th pct)
• 📅 Exploited May 27–June 9, 2026 — before Oracle's patch · now on CISA KEV (due 2026-06-15)
• 🔗 Chain: SSRF via /PSIGW/HttpListeningConnector → POST /PSEMHUB/hub → Java deserialization RCE
• 🕵️ Google/Mandiant attribute it to ShinyHunters-linked UNC6240 — data-theft extortion (pay-or-leak), NOT encryption
• 🎓 100+ orgs notified, ~68% higher ed · Victims: U. of Nottingham (~455k), NAIC (~3.1 TB)
• ⚠️ Patched before June 10? Still vulnerable. Webshells + XMLDecoder .xml survive patching — hunt before you restart
• 🛡️ Cheap fix: deny /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter
📖 Full breakdown, IoCs & hunt commands: https://cve.tools/blog/cve-2026-35273-peoplesoft-psemhub-rce-breakdown
• 💥 CVSS 9.8, unauthenticated RCE in PeopleTools 8.61/8.62 (PSEMHUB) · EPSS 0.9233 (~99.8th pct)
• 📅 Exploited May 27–June 9, 2026 — before Oracle's patch · now on CISA KEV (due 2026-06-15)
• 🔗 Chain: SSRF via /PSIGW/HttpListeningConnector → POST /PSEMHUB/hub → Java deserialization RCE
• 🕵️ Google/Mandiant attribute it to ShinyHunters-linked UNC6240 — data-theft extortion (pay-or-leak), NOT encryption
• 🎓 100+ orgs notified, ~68% higher ed · Victims: U. of Nottingham (~455k), NAIC (~3.1 TB)
• ⚠️ Patched before June 10? Still vulnerable. Webshells + XMLDecoder .xml survive patching — hunt before you restart
• 🛡️ Cheap fix: deny /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter
📖 Full breakdown, IoCs & hunt commands: https://cve.tools/blog/cve-2026-35273-peoplesoft-psemhub-rce-breakdown
CVE Tools
CVE-2026-35273: Oracle PeopleSoft PSEMHUB pre-auth RCE, explained
How CVE-2026-35273 chains a PSIGW SSRF into unauthenticated Java deserialization on PeopleSoft PeopleTools 8.61/8.62 — the ShinyHunters education-sector extortion campaign, the IoCs, and what to do now.
🪟 CVE-2026-44812 — Win32k GRFX graphics RCE in the Preview Pane
🔎 CWE-190 integer overflow in Windows Win32k GRFX → heap corruption → local code execution
📐 CVSS 7.8 HIGH · AV:L / UI:R — victim previews/opens a crafted graphics file in the Explorer Preview Pane
🗓 June 2026 Patch Tuesday (disclosed 2026-06-09)
⚖️ The "conflict" that isn't:
• MSRC: "Exploitation More Likely" (forward-looking code-path judgment)
• EPSS ~0.44% (~35th pct, 2026-07-01) · no public PoC · NOT in CISA KEV
→ attractive future target, not a live threat today
✅ Standard June patch ring for most assets
🚨 Escalate: multi-user terminal servers, VDI, RDP hosts, jump boxes
📱 Also Office for Android — fixed 2026-06-15, push via MDM/Play Store (Windows Update won't)
🔁 Re-triage as emergency on: public PoC · EPSS >~5% · KEV listing
📖 Full breakdown: https://cve.tools/blog/cve-2026-44812-win32k-grfx-rce-breakdown
🔎 CWE-190 integer overflow in Windows Win32k GRFX → heap corruption → local code execution
📐 CVSS 7.8 HIGH · AV:L / UI:R — victim previews/opens a crafted graphics file in the Explorer Preview Pane
🗓 June 2026 Patch Tuesday (disclosed 2026-06-09)
⚖️ The "conflict" that isn't:
• MSRC: "Exploitation More Likely" (forward-looking code-path judgment)
• EPSS ~0.44% (~35th pct, 2026-07-01) · no public PoC · NOT in CISA KEV
→ attractive future target, not a live threat today
✅ Standard June patch ring for most assets
🚨 Escalate: multi-user terminal servers, VDI, RDP hosts, jump boxes
📱 Also Office for Android — fixed 2026-06-15, push via MDM/Play Store (Windows Update won't)
🔁 Re-triage as emergency on: public PoC · EPSS >~5% · KEV listing
📖 Full breakdown: https://cve.tools/blog/cve-2026-44812-win32k-grfx-rce-breakdown
CVE Tools
CVE-2026-44812: Win32k GRFX integer-overflow RCE explained
How CVE-2026-44812 turns a crafted graphics file into local code execution via a Win32k integer overflow — June 2026 Patch Tuesday, CVSS 7.8, 'Exploitation More Likely', no public PoC yet, and how to patch and detect it.
🚨 CVE-2026-45657 — Windows kernel TCP/IP UAF, wormable RCE
🔓 CVSS 9.8 · unauthenticated · no user interaction → code exec at SYSTEM
🧬 Use-after-free (CWE-416) + heap overflow (CWE-122) in the kernel IP stack (attributed to tcpip.sys). ZDI: "Yup — this is wormable." EternalBlue-class profile, but IP stack, not SMB — no single port to firewall.
🩹 Patched 2026-06-09 (part of a record 208-CVE Patch Tuesday). Patch-only — no workaround.
🧊 Honest status (2026-07-01):
• No public PoC (0 GitHub repos)
• NOT in CISA KEV
• MS: "Exploitation Less Likely" · EPSS ~0.155
• The June in-the-wild bug was CVE-2026-41091 (Defender), not this
→ but the patch diff is the exploit roadmap, being reversed now. Patch internet-facing + flat-internal within ~7 days.
🖥 Affected: Win 11 23H2/24H2/25H2/26H1 · Server 2022/2025 (incl. Server Core)
📖 Full breakdown (KB/build matrix, attack chain, detection):
https://cve.tools/blog/cve-2026-45657-windows-kernel-tcpip-uaf-wormable-rce-breakdown
🔎 No port to block — exposure = who can reach the host. See what an attacker sees, free:
🔓 CVSS 9.8 · unauthenticated · no user interaction → code exec at SYSTEM
🧬 Use-after-free (CWE-416) + heap overflow (CWE-122) in the kernel IP stack (attributed to tcpip.sys). ZDI: "Yup — this is wormable." EternalBlue-class profile, but IP stack, not SMB — no single port to firewall.
🩹 Patched 2026-06-09 (part of a record 208-CVE Patch Tuesday). Patch-only — no workaround.
🧊 Honest status (2026-07-01):
• No public PoC (0 GitHub repos)
• NOT in CISA KEV
• MS: "Exploitation Less Likely" · EPSS ~0.155
• The June in-the-wild bug was CVE-2026-41091 (Defender), not this
→ but the patch diff is the exploit roadmap, being reversed now. Patch internet-facing + flat-internal within ~7 days.
🖥 Affected: Win 11 23H2/24H2/25H2/26H1 · Server 2022/2025 (incl. Server Core)
📖 Full breakdown (KB/build matrix, attack chain, detection):
https://cve.tools/blog/cve-2026-45657-windows-kernel-tcpip-uaf-wormable-rce-breakdown
🔎 No port to block — exposure = who can reach the host. See what an attacker sees, free:
CVE Tools
CVE-2026-45657: Windows Kernel TCP/IP UAF wormable RCE, explained
CVE-2026-45657 is a CVSS 9.8 unauthenticated wormable use-after-free in the Windows Kernel TCP/IP stack, patched June 2026. No public PoC as of 2026-07-01. Patch on the emergency track — affected SKUs, KB matrix, detection, and exploitation chain.
🔴 CVE-2026-46817 — Oracle EBS Payments unauth file read (CVSS 9.8)
⚠️ Exploited in the wild since 27 June 2026 — before any public PoC existed.
🎭 The signal trap: EPSS just 0.68% • NOT on CISA KEV yet. Both lag private exploits — don't wait for them.
How it works:
• Unauth POST → /OA_HTML/ibytransmit (Payments File Transmission)
• Abuses CODEX_PULL + FULL_FILE_PATH → reads any server file (PoC: /etc/passwd)
• Loot: dbc/context files, EBS wallet, payment API keys
• Confirmed primitive = file read, not RCE (Oracle scores it as full takeover because of the readable secrets)
📦 Affected: EBS 12.2.3–12.2.15 • Fix: May 2026 Oracle CPU • ~900–950 instances internet-exposed
🚫 No credible actor attribution — and this is NOT the 2025 Cl0p / CVE-2025-61882 bug.
✅ Do now: patch → block /OA_HTML/ibytransmit externally → rotate secrets if you were exposed (patching won't undo credential theft).
📖 Full breakdown: https://cve.tools/blog/cve-2026-46817-oracle-ebs-payments-file-read-breakdown
⚠️ Exploited in the wild since 27 June 2026 — before any public PoC existed.
🎭 The signal trap: EPSS just 0.68% • NOT on CISA KEV yet. Both lag private exploits — don't wait for them.
How it works:
• Unauth POST → /OA_HTML/ibytransmit (Payments File Transmission)
• Abuses CODEX_PULL + FULL_FILE_PATH → reads any server file (PoC: /etc/passwd)
• Loot: dbc/context files, EBS wallet, payment API keys
• Confirmed primitive = file read, not RCE (Oracle scores it as full takeover because of the readable secrets)
📦 Affected: EBS 12.2.3–12.2.15 • Fix: May 2026 Oracle CPU • ~900–950 instances internet-exposed
🚫 No credible actor attribution — and this is NOT the 2025 Cl0p / CVE-2025-61882 bug.
✅ Do now: patch → block /OA_HTML/ibytransmit externally → rotate secrets if you were exposed (patching won't undo credential theft).
📖 Full breakdown: https://cve.tools/blog/cve-2026-46817-oracle-ebs-payments-file-read-breakdown
CVE Tools
CVE-2026-46817: Oracle E-Business Suite Payments unauth file read, explained
How CVE-2026-46817 abuses the Oracle Payments File Transmission servlet (/OA_HTML/ibytransmit, CODEX_PULL/FULL_FILE_PATH) for an unauthenticated file read on EBS 12.2.3-12.2.15 -- exploited in the wild, not yet on KEV. Detection, patch and IR.
🚨 CVE-2026-48558 — SimpleHelp OIDC auth bypass (CVSS 10.0)
🔓 With OIDC SSO on, SimpleHelp accepts the login token without verifying its signature (CWE-347). Remote + unauthenticated → forge a token → full Technician session → pivot to every managed endpoint.
🛡 MFA doesn't save you: the forged identity is a "new" technician who can self-enroll their own MFA device.
Reading the axes straight:
• CVSS 10.0 — Scope: Changed (crosses into downstream hosts)
• EPSS — low (precondition: OIDC group login enabled)
• KEV — added 2026-06-29, exploited in the wild
✅ Affected: 5.5.15 & earlier + all 6.0 pre-release. Fixed: 5.5.16 / 6.0 RC2.
⚠️ Preserve logs and triage BEFORE upgrading — it's remote-support tooling; don't wipe evidence.
📖 Full breakdown + IoCs: https://cve.tools/blog/simplehelp-cve-2026-48558-oidc-auth-bypass-explained
🔓 With OIDC SSO on, SimpleHelp accepts the login token without verifying its signature (CWE-347). Remote + unauthenticated → forge a token → full Technician session → pivot to every managed endpoint.
🛡 MFA doesn't save you: the forged identity is a "new" technician who can self-enroll their own MFA device.
Reading the axes straight:
• CVSS 10.0 — Scope: Changed (crosses into downstream hosts)
• EPSS — low (precondition: OIDC group login enabled)
• KEV — added 2026-06-29, exploited in the wild
✅ Affected: 5.5.15 & earlier + all 6.0 pre-release. Fixed: 5.5.16 / 6.0 RC2.
⚠️ Preserve logs and triage BEFORE upgrading — it's remote-support tooling; don't wipe evidence.
📖 Full breakdown + IoCs: https://cve.tools/blog/simplehelp-cve-2026-48558-oidc-auth-bypass-explained
CVE Tools
CVE-2026-48558: SimpleHelp OIDC Auth Bypass (CVSS 10.0, KEV, Exploited)
CVE-2026-48558 lets a remote, unauthenticated attacker forge an OIDC token and gain a privileged SimpleHelp technician session, pivoting to every managed endpoint. What it is, the exploitation chain, IoCs, and what to do.
🛡️➡️🗡️ RoguePlanet — Microsoft Defender IS the attack surface
CVE-2026-50656 — unpatched EoP zero-day in Defender's MsMpEng engine. Standard user → SYSTEM on fully patched Windows 10/11.
🔗 CWE-59 link-following in the quarantine pipeline
⏸️ VSS oplock makes the race deterministic
🪝 NTFS junction swap redirects Defender's SYSTEM write
🧩 7-stage chain, precompiled PoC on GitHub (1,471★ / 592 forks)
Status, kept separate:
• CVSS: 7.8 (Microsoft) / 7.0 (NVD) — temporal 7.6
• EPSS: 3.4% (87th percentile)
• CISA KEV: NOT listed (2026-07-01)
• ITW: Qualys says active, MSRC says "not detected" but "Exploitation More Likely" → treat as HIGH
⚠️ No patch yet. Interim controls only: WDAC enforced mode, block virtual-disk auto-mount, alert on MsMpEng.exe spawning a SYSTEM shell.
📖 Full breakdown: https://cve.tools/blog/cve-2026-50656-rogueplanet-defender-eop
CVE-2026-50656 — unpatched EoP zero-day in Defender's MsMpEng engine. Standard user → SYSTEM on fully patched Windows 10/11.
🔗 CWE-59 link-following in the quarantine pipeline
⏸️ VSS oplock makes the race deterministic
🪝 NTFS junction swap redirects Defender's SYSTEM write
🧩 7-stage chain, precompiled PoC on GitHub (1,471★ / 592 forks)
Status, kept separate:
• CVSS: 7.8 (Microsoft) / 7.0 (NVD) — temporal 7.6
• EPSS: 3.4% (87th percentile)
• CISA KEV: NOT listed (2026-07-01)
• ITW: Qualys says active, MSRC says "not detected" but "Exploitation More Likely" → treat as HIGH
⚠️ No patch yet. Interim controls only: WDAC enforced mode, block virtual-disk auto-mount, alert on MsMpEng.exe spawning a SYSTEM shell.
📖 Full breakdown: https://cve.tools/blog/cve-2026-50656-rogueplanet-defender-eop
CVE Tools
CVE-2026-50656 RoguePlanet: Unpatched Microsoft Defender EoP Zero-Day
CVE-2026-50656 (RoguePlanet) is an unpatched CWE-59 zero-day in Microsoft Defender's MsMpEng engine. CVSS 7.8, public C++ PoC (1,471 stars), active Nightmare-Eclipse campaign. Full 7-stage kill chain, Sigma/KQL detection rules, and interim controls — no patch…
🚨 CVE-2026-8037 — Progress LoadMaster pre-auth RCE (root)
One unauthenticated request to the management API (POST /accessv2) runs OS commands as root. Root cause: an uninitialised, unterminated heap buffer in the input-escaping routine — a memory bug, not a filter gap.
🔻 CVSS 9.6 (some outlets 9.8), unauthenticated, root impact
🔻 LoadMaster, ECS + Object Scale Connection Manager, MOVEit WAF (≠ MOVEit Transfer)
🔻 Public PoC + exploitation attempts since 29 Jun (reported unsuccessful, no attribution)
🔻 Only reachable when the API is enabled — isolate the mgmt interface
✅ Patch: GA 7.2.63.2 / LTSF 7.2.54.18 (also fixes CVE-2026-33691)
⚠️ Not on CISA KEV yet — don't wait for it
📖 Full breakdown: https://cve.tools/blog/cve-2026-8037-progress-loadmaster-pre-auth-rce-breakdown
One unauthenticated request to the management API (POST /accessv2) runs OS commands as root. Root cause: an uninitialised, unterminated heap buffer in the input-escaping routine — a memory bug, not a filter gap.
🔻 CVSS 9.6 (some outlets 9.8), unauthenticated, root impact
🔻 LoadMaster, ECS + Object Scale Connection Manager, MOVEit WAF (≠ MOVEit Transfer)
🔻 Public PoC + exploitation attempts since 29 Jun (reported unsuccessful, no attribution)
🔻 Only reachable when the API is enabled — isolate the mgmt interface
✅ Patch: GA 7.2.63.2 / LTSF 7.2.54.18 (also fixes CVE-2026-33691)
⚠️ Not on CISA KEV yet — don't wait for it
📖 Full breakdown: https://cve.tools/blog/cve-2026-8037-progress-loadmaster-pre-auth-rce-breakdown
CVE Tools
CVE-2026-8037: Progress LoadMaster pre-auth command injection (root RCE), explained
How CVE-2026-8037 abuses an uninitialised, unterminated heap buffer in the Progress LoadMaster /accessv2 API for unauthenticated root RCE across LoadMaster, ECS/Object Scale Connection Manager and MOVEit WAF (fixed 7.2.63.2 / 7.2.54.18). Exploitation attempts…
🛡 CVE-2026-45659 — the "forgotten" SharePoint RCE now in CISA KEV
• CWE-502 deserialization RCE in on-prem SharePoint 2016 / 2019 / Subscription Edition (Online not affected)
• CVSS 8.8 — authenticated, but only Site Member permissions
• Patched May 2026, but left out of the update summary → in KEV since 1 Jul (deadline passed)
• No legit public PoC — GitHub "PoCs" are malware lures
• ⚠️ Runs in w3wp.exe & steals ASP.NET MachineKeys — patch ≠ eviction, rotate the keys
Chain, affected builds, detection + IR 👇
https://cve.tools/blog/cve-2026-45659-sharepoint-deserialization-rce-breakdown
• CWE-502 deserialization RCE in on-prem SharePoint 2016 / 2019 / Subscription Edition (Online not affected)
• CVSS 8.8 — authenticated, but only Site Member permissions
• Patched May 2026, but left out of the update summary → in KEV since 1 Jul (deadline passed)
• No legit public PoC — GitHub "PoCs" are malware lures
• ⚠️ Runs in w3wp.exe & steals ASP.NET MachineKeys — patch ≠ eviction, rotate the keys
Chain, affected builds, detection + IR 👇
https://cve.tools/blog/cve-2026-45659-sharepoint-deserialization-rce-breakdown
CVE Tools
CVE-2026-45659: SharePoint Server deserialization RCE, explained
How CVE-2026-45659 turns an authenticated Site Member login into code execution on on-prem SharePoint 2016/2019/Subscription Edition via CWE-502 deserialization -- in CISA KEV, no public PoC. Affected builds, detection, patch and MachineKey-rotation IR.