Privilege escalation

8 articles

CVECheck point

Attackers took over unpatched Check Point firewalls and wiped servers behind them. The root bug, CVE-2026-123039, is now on CISA KEV

How to fix CVE-2026-123039: upgrade Check Point Gaia to the November Jumbo Hotfix (R81.20 Take 174, R82 Take 132, R82.10 Take 52, R82.20 Take 14). Attackers chained it with PHP2Shell to take full control of firewalls, then wiped servers behind some of them. CISA added it to KEV on Nov 13.

HOL Guard
BreakingCVE

Patched Ivanti Connect Secure on Oct 13? The root-escalation half of the chain is now on CISA KEV (CVE-2026-111357, CVE-2026-118527)

How to fix CVE-2026-111357: upgrade Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6. CISA added it and CVE-2026-118527 to KEV on Oct 30, and the Oct 13 builds 25.1.1.2 and 22.8R2.5 are still affected. Check edge and domain controller logs before the reboot.

HOL Guard
CVELinux kernel

Fragnesia CVE-2026-46300 is on CISA KEV: the Linux kernel bug that turned a web shell into root. Check memory, then patch

How to fix CVE-2026-46300: upgrade the Linux kernel to 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, 5.15.208 or your distro's fixed build, then reboot. Fragnesia rewrites files in memory, so check su and PAM before you restart.

HOL Guard
BreakingTailscale

Tailworm turns one hacked laptop into root on your Tailscale SSH servers. Upgrade to 1.104.4 (TS-2026-014)

How to fix Tailworm (TS-2026-014): upgrade Tailscale to 1.104.4 on every node running Tailscale SSH or serve. A device already on your tailnet could use SSH socket forwarding to get root on servers its SSH rules reach. If you cannot upgrade yet, set TS_SSH_DISABLE_FORWARDING=1.

HOL Guard
CVEJfrog

Artifactory anonymous token chain hits CISA KEV

How to fix CVE-2026-42018 / CVE-2026-42016: upgrade self-hosted Artifactory past the anonymous-JWT and token-scope floors (prefer 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20)

Hashgraph Online
BreakingCVE

CVE-2026-76578 lets an unauthenticated LDAP client become a FreeIPA admin

How to fix CVE-2026-76578: apply the RHEL 9/10 errata where available; otherwise restrict LDAP ports 389/636 and disable anonymous binds until your train is patched

HOL Guard
BreakingCVE

CVE-2026-18432 - Frontend Admin WordPress Unauthenticated Admin Takeover

CVE-2026-18432 is a CVSS 9.8 privilege-escalation flaw in Frontend Admin by DynamiApps that can let unauthenticated attackers reset the default WordPress administrator account. Update to 3.29.10.

HOL Guard
BreakingCVE

CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover

CVE-2026-19598 is a CVSS 9.8 authorization bypass in the Pods WordPress plugin that lets unauthenticated attackers reach admin methods and take over sites. Update to 3.3.9.1.

HOL Guard

Related topics

Keep exploring

The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.

Security research hubPlugin marketplace