Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Unauthenticated credential disclosure in Netis NX10 routers (firmware V4.0.1.5808 and V3.0.0.4142) lets remote attackers retrieve the administrator password by sending a request to the 'sysinfo' action of the web management interface without any session. The exposed credential can then be replayed against the login handler to establish a fully authenticated administrator session, yielding complete device takeover. Publicly available exploit code exists (published by VulnCheck/hackwithmike), and the network-reachable, no-auth nature makes this straightforward to weaponize.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in the Netis NX10 router's ping diagnostic handler allows authenticated administrators to execute arbitrary commands as root by embedding shell metacharacters in the IpAddr parameter. The device's firmware (V4.0.1.5808 and V3.0.0.4142) interpolates this parameter directly into a system() call with an incomplete denylist that filters spaces, pipes, semicolons, and ampersands but leaves command substitution syntax ($() and backticks) and IFS-based space bypasses fully exploitable. A publicly available exploit is referenced via VulnCheck and hackwithmike.com; no vendor-released patch has been identified at time of analysis.
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. A public proof-of-concept exploit is available, though EPSS probability remains low at 0.17% and no active exploitation has been confirmed by CISA.
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Remote unauthenticated denial-of-service (and possible memory corruption) in SAP's Extended Passport (EPP) processing library allows an attacker to send a crafted network request with a malformed EPP header, triggering a buffer overflow (CWE-120) that leads to undefined behavior and abnormal program termination. Any SAP application relying on the vulnerable EPP processing component is affected; SAP rates it CVSS 10.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in the Microsoft Windows DNS Server role (across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free that an unauthenticated attacker can trigger over the network, per CVSS PR:N/UI:N. Microsoft rates it 9.8 (critical) with full confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Remote code execution in Microsoft Office Outlook stems from a heap-based buffer overflow (CWE-122) that lets an unauthenticated network attacker run arbitrary code, per Microsoft's MSRC advisory and CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Word 2016, and Office for Mac builds; Microsoft has released fixed builds. No public exploit identified at time of analysis, but the critical severity and no-interaction network vector make it a high patch priority.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft's Windows Message Queuing (MSMQ) service affects all supported Windows client and server releases and lets an unauthenticated remote attacker corrupt memory via a use-after-free (CWE-416) to run arbitrary code. The flaw carries a critical CVSS 9.8 with a fully remote, no-interaction, no-privilege vector. Microsoft has shipped patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) that a remote attacker can trigger to run arbitrary code with the victim's privileges. It affects a broad set of Office builds including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and the macOS Office editions. Microsoft has released a patch; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Security feature bypass in Microsoft Windows iSCSI (Initiator/Target service) lets a remote, unauthenticated attacker defeat the protocol's weak authentication over the network, per Microsoft's advisory carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact. The flaw spans essentially the entire supported Windows Server line (2012 through 2025) plus Windows 10 (1607/1809), and a vendor patch is available. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in the Windows Services for NFS ONCRPC XDR driver allows an unauthenticated network attacker to execute arbitrary code by triggering a use-after-free (CWE-416) in the driver that parses ONC RPC/XDR-encoded NFS traffic. All supported Windows Server releases (2012 through 2025, including Server Core) are affected when the Services for NFS role is enabled, and Microsoft rates it critical (CVSS 9.8). No public exploit has been identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector and kernel-mode driver target make it a high patch priority.
Unauthenticated remote access control bypass in Fortinet FortiSandbox 4.2.x through 5.0.x - and its Cloud and PaaS variants - allows network-reachable attackers to retrieve sensitive information and disrupt availability by sending crafted HTTP requests, with no credentials or user interaction required. Fortinet's confirmed CVSS temporal metrics include E:P (proof-of-concept exploit code exists) alongside RL:O (official remediation available) and RC:C (confirmed), establishing this as an actively documented, patchable risk against sandboxing infrastructure that processes enterprise malware submissions. The scope-changed vector (S:C) combined with high availability impact (A:H) indicates the access control failure cascades beyond the directly targeted HTTP endpoint to other components within the FortiSandbox platform.
Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an unauthenticated network attacker run arbitrary code by controlling a file name or path processed by the server (CWE-73). The flaw was reported by Microsoft's own MSRC team and a patch is available; there is no public exploit identified at time of analysis and no CISA KEV listing, but the pre-authentication, network-reachable RCE profile makes it a top-priority patch for any on-premises deployment.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a protection mechanism when a user is lured into interacting with malicious content (UI:R). Rooted in an incomplete comparison that omits required factors (CWE-693), the flaw carries a scope-changed CVSS 9.6 with full confidentiality, integrity, and availability impact, consistent with a trust/security-control bypass that can extend beyond the editor's initial boundary. A vendor patch exists; no public exploit is identified at time of analysis.
Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Hard-coded cryptographic key (CWE-321) in AVEVA Pipeline Integrity Monitor through version 2025 SP1 P1 (build 7.1.9580.8513) enables any local user with read access to PIMBoards project files to decrypt and view sensitive protected content. The CVSS 4.0 vector's subsequent-system impacts (SC:H/SI:H) indicate the decrypted material - likely credentials, connection strings, or configuration data - is sufficient to compromise downstream pipeline control or monitoring infrastructure, making this a lateral-movement enabler in OT/ICS environments. Reported by ICS-CERT (ics-cert@hq.dhs.gov) with a vendor advisory from AVEVA; no public exploit is identified at time of analysis.
Weak password hashing in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables a local attacker with read access to project files to recover app-native user credentials through offline brute-force, then escalate privileges to a PIMBoards administrator account. The CWE-327 root cause - use of a broken or risky cryptographic algorithm for password storage - means hashes can be cracked computationally without network-side rate limiting or lockout defenses. Reported via ICS-CERT and covered under AVEVA security bulletin AVEVA-2026-006; no public exploit or CISA KEV listing is present at time of analysis.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to execute arbitrary code in the context of the running user with no user interaction. Adobe PSIRT rates this a maximum-severity CVSS 10.0 issue with a changed scope, meaning a successful exploit can affect resources beyond the vulnerable component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Network-based privilege escalation in Microsoft Exchange Server lets an already-authenticated attacker gain higher privileges by exploiting a missing authorization check (CWE-862). Affected on-premises builds include Exchange 2016 CU23, Exchange 2019 CU14/CU15, and the Subscription Edition; Microsoft has released fixed cumulative-update builds via MSRC. No public exploit identified at time of analysis and the flaw is not on CISA KEV, but its 9.1 CVSS with scope change and full CIA impact makes it a high-priority patch for internet-facing mail infrastructure.
Remote code execution in Adobe ColdFusion 2023 (update ≤23) and ColdFusion 2025 (update ≤12) allows a low-privileged, authenticated attacker to inject directives into dynamically evaluated code (CWE-95, 'Eval Injection') and execute arbitrary code in the context of the current user without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable, low-complexity flaw with a scope change, meaning code executes beyond the initially authorized security context. No public exploit is identified at time of analysis, but ColdFusion RCE flaws are historically high-value targets and are frequently weaponized quickly after disclosure.
Privilege elevation in Spring Cloud Azure (versions 1.0.0 up to but not including 7.4.0) lets a network-based, unauthenticated attacker bypass improper authentication logic (CWE-287) to gain elevated privileges. Reported by Microsoft (MSRC) with a vendor patch available; no public exploit identified at time of analysis and neither KEV nor EPSS/POC signals are present in the provided data.
OpenBSD's 802.11 TKIP implementation deauthenticates all wireless clients and blocks reassociation for up to 90 seconds when an attacker within RF range sends two malformed TKIP frames separated by more than 60 seconds. The root cause is an inverted comparison operator in ieee80211_michael_mic_failure() that reverses the 60-second MIC failure countermeasure window: out-of-window failures incorrectly trigger the IEEE 802.11i countermeasure (a DoS), while in-window failures that should trigger the countermeasure are silently discarded, leaving active TKIP key-recovery attacks completely undetected. A publicly available exploit exists per the Argus Systems advisory; no KEV listing at time of analysis.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) allows an already-authenticated network attacker to gain elevated privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw lets a low-privileged principal act beyond its authorized role, with high confidentiality and integrity impact reaching resources outside the initially vulnerable component. No public exploit identified at time of analysis; the issue is documented solely in Microsoft's MSRC update guide and is remediated by Microsoft server-side rather than by a customer-installed patch.
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.
Remote code execution in Microsoft SQL Server 2019, 2022, and 2025 is achievable by an authenticated low-privilege attacker via deserialization of untrusted data (CWE-502) delivered over the network. The flaw covers multiple build tracks across three major SQL Server versions, with full confidentiality, integrity, and availability impact on the database host. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation to arbitrary code execution in Adobe Experience Manager (AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2) lets a low-privileged authenticated attacker abuse an incorrect-authorization flaw to execute code and take over a victim's account or session without any user interaction. Because the CVSS scope is changed, the impact extends beyond the vulnerable component. Adobe (PSIRT) rated it 9.9 critical and shipped a fix in APSB26-98; no public exploit is identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.