Monthly
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis.
Denial of service in OpenSSL's CMP (Certificate Management Protocol) client affects versions 3.4.x, 3.5.x, 3.6.x and 4.0.x, where ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name directly as a format string to ERR_raise_data(). A malicious or intercepted CMP server can return a sender DN containing format specifiers (e.g. 'CN=%s%n') to crash a validating client. Despite a 9.8 CVSS score and an 'RCE' tag, the vendor explicitly states the reliable consequence is a crash only; there is no public exploit identified at time of analysis and EPSS is low (0.41%).
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 arises from a format string weakness (CWE-134) that a remote, unauthenticated attacker can leverage to run arbitrary code, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 critical. IBM PSIRT is the reporting source and a single vendor support advisory is referenced; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The affected component or listening service is not named in the available data, so the exact remote entry point is unconfirmed.
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
IBM PowerVM Hypervisor across firmware branches FW1060, FW1110, and FW1120 contains a format string vulnerability (CWE-134) that enables a local attacker with high-privilege access to extract sensitive hypervisor memory or trigger a denial-of-service condition crashing the hypervisor and all hosted virtual machines. The attack requires local presence, high privileges, and high attack complexity, confining realistic risk to insider threat or post-compromise scenarios. No public exploit code or active exploitation has been identified at time of analysis; IBM has confirmed a patch is available.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
Memory disclosure and denial-of-service in ASUSTOR ADM (the NAS operating system) arises from an externally-controlled format string in the Notification OAuth settings, where administrator-supplied notification configuration values are passed into an unsafe format function. An authenticated administrator can submit crafted format specifiers to leak process memory or crash the affected notification component, affecting ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by ASUSTOR's own security team.
Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) arise from an unsafe format string operation in the Rsync Backup component, where user-controlled backup configuration or log data reaches a format function without a fixed format specifier. An authenticated attacker on the NAS management interface can leak process memory contents or crash the backup component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis.
Denial of service in OpenSSL's CMP (Certificate Management Protocol) client affects versions 3.4.x, 3.5.x, 3.6.x and 4.0.x, where ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name directly as a format string to ERR_raise_data(). A malicious or intercepted CMP server can return a sender DN containing format specifiers (e.g. 'CN=%s%n') to crash a validating client. Despite a 9.8 CVSS score and an 'RCE' tag, the vendor explicitly states the reliable consequence is a crash only; there is no public exploit identified at time of analysis and EPSS is low (0.41%).
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 arises from a format string weakness (CWE-134) that a remote, unauthenticated attacker can leverage to run arbitrary code, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 critical. IBM PSIRT is the reporting source and a single vendor support advisory is referenced; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The affected component or listening service is not named in the available data, so the exact remote entry point is unconfirmed.
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. No public exploit identified at time of analysis and no CISA KEV listing; however, the attack surface is reachable by any valid TURN credential holder, including guest or externally-provisioned users in many WebRTC deployments.
IBM PowerVM Hypervisor across firmware branches FW1060, FW1110, and FW1120 contains a format string vulnerability (CWE-134) that enables a local attacker with high-privilege access to extract sensitive hypervisor memory or trigger a denial-of-service condition crashing the hypervisor and all hosted virtual machines. The attack requires local presence, high privileges, and high attack complexity, confining realistic risk to insider threat or post-compromise scenarios. No public exploit code or active exploitation has been identified at time of analysis; IBM has confirmed a patch is available.
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.
Memory disclosure and denial-of-service in ASUSTOR ADM (the NAS operating system) arises from an externally-controlled format string in the Notification OAuth settings, where administrator-supplied notification configuration values are passed into an unsafe format function. An authenticated administrator can submit crafted format specifiers to leak process memory or crash the affected notification component, affecting ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by ASUSTOR's own security team.
Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) arise from an unsafe format string operation in the Rsync Backup component, where user-controlled backup configuration or log data reaches a format function without a fixed format specifier. An authenticated attacker on the NAS management interface can leak process memory contents or crash the backup component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.