Insufficient isolation in WebSphere Liberty 17.0.0.3 through 26.0.0.10 allows an authenticated attacker who already has low-level privileges on one server instance to cross into other server instances that share the same installation, yielding high confidentiality and integrity impact with a changed scope (CVSS 8.2). Exploitation is conditional: it requires a shared or consolidated install topology and a pre-existing foothold on a co-located server, and the assessment rates this as a genuine but conditional priority rather than a mass-exploitation threat. No public exploit identified at time of analysis.
Stored cross-site scripting in VNote versions prior to 4.3.0 allows remote attackers to execute JavaScript in the file:// viewer context when a victim opens a crafted Markdown note containing malicious YAML frontmatter. The injected script can read reachable local note files and exfiltrate their contents to a remote server because Qt's QWebEngineSettings::LocalContentCanAccessRemoteUrls is enabled by default, though exploitation requires the user to open the note (UI:R) and no public exploit was identified at time of analysis. The issue is fixed in 4.3.0.
Memory corruption in Microsoft XML (MSXML) allows an unauthenticated remote attacker to execute arbitrary code in the context of whatever process parses attacker-supplied XML, with high impact to confidentiality, integrity, and availability (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected systems are supported Windows client and server editions - including Server Core installs - running builds older than the fixed levels catalogued in EUVD-2026-99433 and the MSRC advisory, from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025. Microsoft has shipped vendor fixes, and there is no public exploit identified at time of analysis: CISA's SSVC entry records exploitation as 'none' and marks the flaw as not automatable, though the HIGH attack complexity reflects that a reliable use-after-free requires precise heap grooming and, in practice, an XML-rendering or XML-consuming path must be reached.
Spoofing and authentication bypass in the Microsoft Windows IKE Extension allow an unauthenticated remote attacker to subvert a security decision made during Internet Key Exchange negotiation, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1). All supported Windows client and server branches that carry the IKE Extension are affected, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, with Server Core installations included. Exploitation is conditional rather than trivial: the CVSS vector is AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are required, but the target host must actually have IKE/IPsec configured and actively negotiating and the attacker must hold a network position capable of influencing the handshake (a man-in-the-middle vantage or race-window dependency). CISA's SSVC assessment rates Exploitation as none and Automatable as no while assigning total technical impact, and no public exploit code or in-the-wild activity has been identified - no public exploit identified at time of analysis. Vendor patches are published by Microsoft (EUVD-2026-99912 / CVE-2026-83522) and should be treated as a priority for any estate that runs IPsec.
Unauthenticated remote code execution in the Windows DNS Server role stems from a use-after-free (CWE-416) that lets an attacker who can reach the service over the network run code in the context of the DNS service. All supported Windows Server generations carrying the DNS role are affected - 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), plus Windows 10 1607 and 1809 where the role is installed - while hosts without the DNS Server role are not exposed. The practical risk is tempered by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), since reliable exploitation depends on winning a race or landing a specific heap state; no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available - making this serious but not emergency-tier.
Remote code execution in the Remote Desktop Gateway Service (Windows Server) via a use-after-free memory corruption flaw (CWE-416) allows an unauthenticated network attacker to execute code with high impact. Although the assessed vector (AV:N/AC:H/PR:N/UI:N) requires no authentication or user interaction, the high attack complexity means exploitation depends on winning a memory-reuse race, making success probabilistic. No public exploit code or confirmed active exploitation has been identified at time of analysis, and organizations that restrict RD Gateway exposure behind VPN/MFA or do not deploy the role are materially less exposed.
Heap-based buffer overflow in Microsoft Word allows unauthenticated remote attackers to execute arbitrary code when a crafted document is parsed, though exploitation is difficult to trigger reliably (AC:H) and, per our assessment, requires the victim to open or preview the malicious file (UI:R). Microsoft's advisory vector lists UI:N (no user interaction), which would suggest an automatic preview-pane path; this discrepancy should be resolved with MSRC because UI:R materially lowers real-world exploitability. A vendor patch is available for all affected Office channels, no public exploit code or CISA KEV entry was identified at time of analysis, and SSVC marks the flaw non-automatable, making this a serious but not emergency-tier vulnerability.
Remote code execution against domain controllers running Active Directory Domain Services is achievable by an unauthenticated network attacker (CVSS 3.1: AV:N/PR:N/UI:N) who successfully bypasses an incorrect authorization check, yielding full confidentiality, integrity, and availability impact for a base score of 8.1. The practical constraint is the High attack-complexity rating: exploiting the flawed authorization decision requires an attacker-influenced condition such as a timing window, race, or particular directory state rather than a single deterministic request against a default configuration, and only hosts serving the AD DS role - not member servers or ordinary clients - are the realistic target. At time of analysis no public exploit identified and no confirmed active exploitation (no CISA KEV listing); vendor patch available, with EUVD-listed fixed build levels published.
Memory corruption in the libarchive component bundled with Windows (the library behind tar.exe/bsdtar) lets a remote, unauthenticated attacker execute code on affected hosts by having them process a maliciously crafted archive. The root cause is a double free (CWE-415) during archive parsing that corrupts the heap, and because reliably converting that corruption into code execution requires precise heap grooming, Microsoft and our own assessment both rate attack complexity as High despite a CVSS base score of 8.1. No public exploit code has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and automatable as no, and vendor patches are already available for every affected Windows 10, Windows 11 and Windows Server branch, so this is a serious-but-not-emergency issue that should be closed on a normal patch cadence. One caveat: Microsoft's vector lists UI:N (no user interaction) while our independent assessment uses UI:R, since in interactive deployments a user or application typically has to initiate extraction of the hostile archive - an unattended/service context is where the impact is highest.
Remote code execution in Microsoft Word for Windows and macOS is possible through a heap-based buffer overflow (CWE-122) that is triggered when an affected Office build processes a specially crafted Word document delivered over a network, typically as an email attachment or a web download. The vulnerability is unauthenticated (PR:N) but requires user interaction: the victim must open the malicious document, and the AC:H rating reflects that the attacker must achieve reliable heap layout and grooming to convert the memory corruption into code execution. When successful the outcome is total loss of confidentiality, integrity and availability on the victim's system, although no public exploit code has been identified and CISA's SSVC review records no active exploitation and no automatable path, making this a targeted-attack risk rather than a wormable or mass-exploitation event. Microsoft has released patched builds for the affected Windows and macOS channels.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
Remote code execution in the Windows DHCP Server role allows an unauthenticated attacker who can reach the service on UDP port 67 to corrupt memory via a use-after-free and potentially execute code with the privileges of the DHCP service. Affected builds span Windows Server 2012 through Windows Server 2025, including Server Core installations, below the fixed versions published by Microsoft; the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no authentication or user interaction is required, but the high attack complexity reflects a race-condition-style heap corruption that is not guaranteed to succeed on a single attempt. There is no public exploit identified at time of analysis and no confirmed active exploitation, so risk is driven primarily by the total technical impact (memory corruption with full confidentiality, integrity and availability loss) rather than by observed attacker activity.
Unauthenticated remote code execution in Microsoft's Windows DHCP Server affects Windows Server 2012 through Windows Server 2025 (including Server Core installations) that have the DHCP Server role installed and reachable over the network. A use-after-free (CWE-416) in the DHCP service lets a network attacker corrupt memory and potentially execute code, but the CVSS AC:H rating reflects a race/timing-dependent condition that makes reliable exploitation harder than a deterministic request. No public exploit code was identified at time of analysis, and vendor patches are available; the DHCP role is non-default and typically only present on infrastructure servers acting as DHCP providers.
Use-after-free in Windows Message Queuing (MSMQ) allows unauthenticated remote attackers to execute arbitrary code on systems where the optional MSMQ feature is installed and its listener is network-reachable, typically on TCP port 1801. Exploitation requires winning a memory race due to the high attack complexity (CVSS AC:H), and the feature is not enabled by default, which significantly limits real-world exposure; no public exploit identified at time of analysis.
Memory corruption in the Microsoft Windows PDF rendering component allows an unauthenticated remote attacker to execute arbitrary code on unpatched Windows 10, Windows 11, and Windows Server systems by supplying a crafted PDF document, resulting in total loss of confidentiality, integrity, and availability (CVSS 8.1, CWE-787). Exploitation is not confirmed as active: the CISA SSVC assessment records exploitation as 'none' and no public exploit has been identified, while the high attack complexity (AC:H) and SSVC Automatable=no reflect the heap-layout manipulation normally required to turn the out-of-bounds write into reliable code execution. Vendor patches are available, so the residual risk is concentrated in systems that have not yet applied the current cumulative updates - the assessed vector (PR:N/UI:N) implies a parsing path that may not require an explicit user action, but that precondition should be verified with Microsoft before treating the issue as fully drive-by.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
A double-free memory corruption flaw in Microsoft's Remote Desktop Gateway (RD Gateway) role service allows an unauthenticated remote attacker to execute code with high confidentiality and integrity impact on affected Windows Server builds (2012 through 2025, including Server Core installations) and on Windows 10 1607 and 1809. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms the flaw is remotely reachable without credentials or user interaction, but exploitation is gated by high attack complexity: reliably triggering the double free generally requires winning a race condition or hitting a precise memory/timing state, which is why CISA's SSVC rates the issue as not automatable with no observed exploitation. There is no KEV listing and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine high-priority issue for internet-facing RD Gateway hosts rather than a drop-everything emergency on current signals.
Elevation of privilege in the Microsoft Windows Kernel lets an unauthenticated, remote attacker who can reach the affected kernel code path corrupt or redirect kernel memory and gain SYSTEM-level control of the target host. All currently supported Windows client and server families are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and the assessment vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, base 8.1) confirms no credentials or user interaction are needed. The decisive limitation is attack complexity: the attacker must control or influence an untrusted pointer and win a precise kernel memory-layout or timing condition, so this is not a single-shot request. Microsoft has published a fix and there is confirmed vendor patch availability, but no CISA KEV listing and no public exploit code identified at time of analysis; the practical verdict is a genuine high-priority patching candidate rather than a drop-everything emergency.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Remote code execution in Windows Schannel can be triggered by unauthenticated attackers who can reach a TLS/SSL service that relies on Schannel-such as RDP with TLS, IIS HTTPS, LDAPS, or EAP/TLS endpoints-by sending crafted handshake data that causes an out-of-bounds write (CWE-787). The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, meaning no authentication or user interaction is required, but successful exploitation is constrained by high attack complexity and dependence on specific memory state, likely requiring heap grooming or repeated attempts. No public exploit identified at time of analysis, and no CISA KEV active exploitation is indicated in the provided data.
Incorrect authorization in Adobe ColdFusion 2023.0.25 and earlier and 2025.0.13 and earlier allows an authenticated low-privileged attacker to execute arbitrary code in the context of the current user, but only when a victim opens a malicious file supplied by the attacker. The local access vector and required user interaction mean the flaw is not directly reachable through a network request against an exposed server without a prior foothold; no public exploit code or active exploitation has been identified at time of analysis. Adobe has released security advisory APSB26-144 covering affected versions.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Improper neutralization of special elements (CWE-74) in Microsoft's Azure Storage client libraries - azure-storage-blob-batch 1.0.0 and the Azure Storage Blobs client library for Java - allows an attacker who already holds low-level authorized access (PR:L) to escalate privileges over the network by routing crafted input through the library into a downstream component that does not sanitize it. The weakness requires no user interaction (UI:N) and produces high integrity and availability impact (I:H/A:H) with no confidentiality loss (C:N), which is consistent with Microsoft's 'Code Injection' tagging. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable, so real-world urgency sits below what the 8.1 base score alone would imply.
A classic buffer overflow (CWE-120) in AMI Aptio V UEFI/BIOS firmware allows a local user holding low-level privileges to supply crafted input to an affected BIOS code path, producing memory corruption that can crash or destabilize the platform (rated high availability impact) and potentially execute limited attacker-controlled code in firmware context. Exploitation is strictly local and requires existing privileges rather than anonymous access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with no user interaction and low attack complexity, but the exact vulnerable interface is not identified because the CPE is wildcarded and the advisory content was not retrieved. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a serious-but-not-emergent local firmware flaw; no EPSS score was supplied.
Remote code execution may be possible in the Windows Event Logging Service on affected Windows 11 and Windows Server builds, where an unauthenticated network attacker can trigger an out-of-bounds read under specific memory-layout or timing conditions (CVSS 8.1, AC:H). Windows 11 23H2 through 26H2 and Windows Server 2022/2025 are affected below vendor-fixed build revisions, and a vendor patch is available. No public exploit was identified at time of analysis; CISA SSVC reports Exploitation=none and Automatable=no, and EPSS is 0.57% (46th percentile), so risk is serious but not emergency-level.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Remote code execution in Windows DHCP Server is possible through a use-after-free that can be triggered by unauthenticated, network-adjacent attackers against Windows Server systems where the optional DHCP Server role is enabled and reachable. The assessed CVSS vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, and affected builds include Windows Server 2012 through Server 2025, including Server Core installations. Vendor patches are available, and available intelligence indicates no public exploit identified at time of analysis and no confirmed active exploitation, so this is a credible high-priority patching target rather than an emergency under active attack.
Remote code execution in the Windows iSCSI initiator stack (CVE-2026-70013) allows a network-adjacent attacker to execute arbitrary code with high confidentiality, integrity and availability impact. Affected are the Windows iSCSI components shipped across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025, including Server Core installations, with vendor fixes now published. Exploitation requires an active iSCSI session - typically a target the attacker controls or can inject responses into - and, because the flaw is a use-after-free race (CWE-416, AC:H), success depends on winning a memory-reuse timing window rather than issuing a single deterministic request; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, so this is a serious-but-not-emergency priority rather than an active incident.
Weak authentication in the Network Device Enrollment Service (NDES) of Active Directory Certificate Services (AD CS) allows a remote, unauthenticated attacker to execute code on affected Windows Server installations. Only servers that have the optional, non-default NDES role installed and whose SCEP enrollment endpoint is network-reachable are exposed; Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 are affected across both full and Server Core installations. The assessed vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact, meaning no credentials or user interaction are needed but successful exploitation depends on attacker-uncontrollable conditions (a weak-authentication edge case), consistent with CISA SSVC Exploitation=None and Automatable=no; no public exploit has been identified at the time of analysis, and EPSS/KEV data were not provided.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Unauthenticated remote code execution in the Microsoft Windows DHCP Server role is achievable when an attacker on a reachable network segment wins a race condition on a shared resource inside the DHCP service. The vulnerability is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with complete confidentiality, integrity and availability impact, but the high attack complexity reflects a narrow, non-deterministic synchronization window that makes exploitation unreliable and typically requires repeated concurrent DHCP requests, potentially combined with favorable server load conditions. No public exploit code was identified at time of analysis and there is no CISA KEV listing; hosts without the DHCP Server role installed, or where DHCP traffic cannot be reached from an untrusted segment, are not exposed.
Stored cross-site scripting in Shopware 6.7 lets remote attackers upload attacker-controlled HTML that Shopware serves as text/html without effective security headers, so when an administrator views the file the attacker can exfiltrate the administrator's authentication token. The stolen token opens the Shopware Administration API, and if that administrator can manage extensions the attacker can install a malicious plugin to achieve arbitrary PHP code execution on the underlying host. No public exploit code was identified at time of analysis; EPSS is 0.28% (19th percentile), CVSS 3.1 is 8.1 (AV:N/AC:L/PR:N/UI:R) and exploitation requires administrator file viewing plus, for code execution, extension-management privileges.
Enterprise Policies mitigation bypass in Mozilla Firefox allows an attacker-influenced page to circumvent administrator-enforced policies in managed browser deployments, resulting in high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Only fleets where Firefox is managed through the Enterprise Policies feature are meaningfully exposed - on a default, unmanaged installation there is no enforced policy to bypass - and the vector requires the victim to interact with attacker-controlled or attacker-influenced content, with no attacker authentication required. The issue is fixed in Firefox 158 and Firefox ESR 153.5; EPSS is low at 0.20% (9th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected enterprise-managed population makes timely patching worthwhile.
Protection-mechanism bypass in Mozilla Firefox's HTTP networking component lets remote, unauthenticated attackers defeat a built-in browser security mitigation when a victim loads attacker-controlled HTTP content, with high confidentiality and integrity impact (CVSS 8.1, C:H/I:H/A:N) but no availability impact. Exploitation requires user interaction (UI:R) and works only through drive-by or social-engineering delivery against an actively browsing user; the payoff depends on chaining the bypass to the very attack the mitigation was meant to stop. It is fixed in Firefox 158 and Firefox ESR 153.5, has no public exploit code or CISA KEV entry at time of analysis, and carries a low EPSS of 0.20% (9th percentile).
Mozilla Firefox before 158 and Firefox ESR before 153.5 contain a DOM Security mitigation bypass that allows remote attackers to defeat a browser-enforced protection mechanism when a victim loads attacker-controlled web content. The flaw is rated CVSS 8.1 (High) with high confidentiality and integrity impact, but requires user interaction (UI:R) and no public exploit code or active exploitation has been identified. EPSS is low at 0.20% (9th percentile).
Cross-origin data exposure in Mozilla Firefox's Networking component allows unauthenticated remote attackers to bypass site isolation and read sensitive content from other origins when a victim loads attacker-controlled web content. Firefox versions before 158 and Firefox ESR versions before 153.5 are affected, and the condition is removed in Firefox 158 and Firefox ESR 153.5. EPSS is low at 0.19% (8th percentile), and no public exploit or CISA KEV listing is identified at time of analysis.
Exploiting incorrect boundary conditions in Mozilla Firefox's DOM Editor component can corrupt memory when a victim loads attacker-controlled web content, with high confidentiality, integrity, and availability impact under the independent assessment. Firefox builds prior to 158 and Firefox ESR builds prior to 153.5 are affected; exploitation requires user interaction (UI:R), and no public exploit identified at time of analysis, with no CISA KEV listing provided. EPSS is 0.19% (8th percentile), a low signal, but because the assessed vector raises availability impact to high, the risk signals should be weighed carefully.
DOM-based cross-site scripting in Mozilla Firefox's DOM File component affects builds prior to Firefox 158 and Firefox ESR 153.5, allowing attacker-controlled web content to execute script with high confidentiality and integrity impact when a victim interacts with a malicious page. The CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R) shows that exploitation requires user interaction but no attacker authentication. No public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, and EPSS is low at 0.19% (8th percentile), indicating a moderate rather than emergency priority.
Frame poisoning in the Firefox Layout component lets attacker-controlled web content corrupt the browser's rendered frame structure, producing a UI misrepresentation that can expose or tamper with data the user believes is confined to a trusted origin. Every Firefox build prior to 158 and Firefox ESR prior to 153.5 is affected, including default desktop configurations; the fix shipped in Firefox 158 and Firefox ESR 153.5 per Mozilla advisories MFSA 2026-106, 2026-108, 2026-109 and 2026-110. Exploitation requires the victim to load a malicious page (UI:R) with no authentication or prior privileges (PR:N), no public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is only 0.19% (8th percentile) - a genuine but non-emergency patching priority.
Mitigation bypass in Mozilla Firefox's Enterprise Policies component allows remote attackers who can get a victim to interact with crafted content to defeat policy-enforced security controls in managed deployments; the issue is fixed in Firefox 158 and Firefox ESR 153.5. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) no attacker privileges are needed but user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis and EPSS is low at 0.17% (6th percentile), so real-world exposure is concentrated in enterprise environments where Enterprise Policies are actually configured rather than in default consumer installs.
Memory corruption in Mozilla Firefox's Layout engine lets a remote, unauthenticated attacker who convinces a victim to render attacker-controlled web content corrupt memory, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicating high confidentiality and integrity impact and a full availability impact on the client. All Firefox builds prior to 158 are affected, along with Firefox ESR releases prior to 115.43 and 153.5. Exploitation hinges entirely on user interaction - the victim must navigate to or render a hostile page - and no public exploit or active exploitation has been identified at time of analysis; EPSS is low at 0.16% (5th percentile), and vendor-released fixes (Firefox 158, ESR 115.43, ESR 153.5) are available per Mozilla advisories mfsa2026-106 through mfsa2026-110.
A type-confusion miscompilation in Mozilla Firefox's JavaScript JIT engine (CWE-843) lets remote attackers corrupt memory and potentially read or modify data inside the browser process when a user loads attacker-controlled JavaScript. Exploitation is unauthenticated over the network (PR:N) but requires user interaction (UI:R) - the victim must visit or render hostile content with JavaScript enabled on an unpatched build. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; no public exploit code or confirmed active exploitation has been identified, and the EPSS score is low at 0.16% (5th percentile), making this a serious but not emergency-tier browser flaw.
JIT miscompilation in Mozilla Firefox's JavaScript engine can cause the browser to generate incorrect native code for attacker-supplied scripts, giving a malicious page high confidentiality and integrity impact within the affected browsing context. The flaw affects Firefox builds prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5; exploitation is remote and requires no credentials (PR:N) but is gated by user interaction, since the victim must load attacker-controlled web content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1). No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but vendor-released patches exist in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Mozilla Firefox releases prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5 contain incorrect boundary conditions in the JavaScript engine that let remote attackers corrupt or disclose memory when a user loads attacker-controlled web content. Because the weakness sits in script processing, no credentials or pre-existing privileges are needed - but exploitation is not unattended: the victim must actively browse to a malicious or compromised page with JavaScript enabled (the default), and the vendor rates availability impact as none, so the realistic outcome is memory disclosure/integrity corruption rather than a guaranteed crash or confirmed remote code execution. Publicly available exploit code has not been observed and there is no public exploit identified at time of analysis; CISA KEV does not list this CVE, and EPSS is only 0.16% (4th percentile), so this is a genuine patch-promptly issue rather than an emergency one.
Memory corruption in Mozilla Firefox's JavaScript engine can be triggered when a remote unauthenticated attacker convinces a user to load attacker-controlled JavaScript content, yielding high confidentiality and integrity impact with no availability impact. This is not a zero-click attack; exploitation requires user interaction (UI:R) to render a malicious page, so it depends on social engineering, malvertising, or a compromised site. Mozilla fixed the issue in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; at time of analysis there is no public exploit identified, and EPSS is very low at 0.16% (4th percentile), indicating a genuine but not emergency-level risk.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.