Monthly
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Path traversal in Skype for Business Server allows an authenticated attacker to elevate privileges over the network by exploiting absolute path traversal (CWE-36). Affected versions include Skype for Business Server 2019 CU8 below build 7.0.2046.583, Subscription Edition CU1 below build 7.0.2046.889, and 2015 CU13 below build 6.0.9319.886. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with 'Automatable: no', though the required authentication limits real-world risk.
Path traversal in on-premises Skype for Business Server (including the Microsoft Lync lineage) lets an attacker who already holds a low-privileged authenticated account on the service send a crafted network request containing an absolute file path and achieve code execution, scoring CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds are Skype for Business Server Subscription Edition before 7.0.2046.889, Skype for Business Server 2015 CU13 before 6.0.9319.886, and Skype for Business Server 2019 CU8 before 7.0.2046.583; the PR:L prerequisite means this is not a pre-auth remote exploit, so realistic risk concentrates on insiders or attackers who have already obtained a valid credential or foothold. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable, and though no EPSS score was supplied, the total technical impact combined with an available vendor patch makes prompt upgrading the priority. This is a credible, actionable priority rather than an inflated-CVSS artifact.
Unauthenticated arbitrary file write in WAVLINK WN535M1 and WN535M3 routers (firmware before M35M1_V250922) exposes any file on the device to remote overwrite via the sync_server daemon on TCP port 13136, which runs as root and performs no client authentication. The daemon's 100-byte protocol filename field lacks path canonicalization, allowing absolute path traversal (CWE-36) that enables attackers to overwrite startup scripts or credential stores and achieve persistent root-level compromise. A public proof-of-concept repository (camdsmith/wavlink-sync_server-rce) is available on GitHub, substantially lowering the exploitation bar.
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise through a path traversal (CWE-36) in the handling of an unsigned backup header. Any low-privileged Plesk customer account can write files to attacker-chosen locations with root privileges, and because Plesk is a widely deployed hosting control panel, the flaw exposes shared and reseller hosting environments to tenant-to-root escalation. No public exploit identified at time of analysis, though the vendor support advisory documents the root cause (unsigned/unvalidated backup header enabling traversal).
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege elevation in the Windows Encrypting File System (EFS) lets an authenticated remote attacker supply an absolute path that EFS resolves outside its intended directory, yielding high impact across confidentiality, integrity, and availability (CVSS 8.8, CWE-36). Every supported Windows client and server generation is affected - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - while exploitation requires the attacker to already hold valid low-privilege credentials and network reachability to the EFS service (PR:L, AV:N), with no user interaction needed. No public exploit code and no confirmed active exploitation have been identified at time of analysis per CISA's SSVC (Exploitation: none, Automatable: no), though the assessed technical impact is total; Microsoft has shipped vendor patches.
Path traversal in Skype for Business Server allows an authenticated attacker to elevate privileges over the network by exploiting absolute path traversal (CWE-36). Affected versions include Skype for Business Server 2019 CU8 below build 7.0.2046.583, Subscription Edition CU1 below build 7.0.2046.889, and 2015 CU13 below build 6.0.9319.886. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with 'Automatable: no', though the required authentication limits real-world risk.
Path traversal in on-premises Skype for Business Server (including the Microsoft Lync lineage) lets an attacker who already holds a low-privileged authenticated account on the service send a crafted network request containing an absolute file path and achieve code execution, scoring CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds are Skype for Business Server Subscription Edition before 7.0.2046.889, Skype for Business Server 2015 CU13 before 6.0.9319.886, and Skype for Business Server 2019 CU8 before 7.0.2046.583; the PR:L prerequisite means this is not a pre-auth remote exploit, so realistic risk concentrates on insiders or attackers who have already obtained a valid credential or foothold. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable, and though no EPSS score was supplied, the total technical impact combined with an available vendor patch makes prompt upgrading the priority. This is a credible, actionable priority rather than an inflated-CVSS artifact.
Unauthenticated arbitrary file write in WAVLINK WN535M1 and WN535M3 routers (firmware before M35M1_V250922) exposes any file on the device to remote overwrite via the sync_server daemon on TCP port 13136, which runs as root and performs no client authentication. The daemon's 100-byte protocol filename field lacks path canonicalization, allowing absolute path traversal (CWE-36) that enables attackers to overwrite startup scripts or credential stores and achieve persistent root-level compromise. A public proof-of-concept repository (camdsmith/wavlink-sync_server-rce) is available on GitHub, substantially lowering the exploitation bar.
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise through a path traversal (CWE-36) in the handling of an unsigned backup header. Any low-privileged Plesk customer account can write files to attacker-chosen locations with root privileges, and because Plesk is a widely deployed hosting control panel, the flaw exposes shared and reseller hosting environments to tenant-to-root escalation. No public exploit identified at time of analysis, though the vendor support advisory documents the root cause (unsigned/unvalidated backup header enabling traversal).
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.