Severity level:
CVSS Score: 8.8/High

Description:

CVE-2026-86950 is an out-of-bounds write vulnerability in Apple's CoreGraphics framework. Processing a maliciously crafted file may trigger memory corruption and allow arbitrary code execution on an affected device. Apple has stated that it is aware of reports indicating the vulnerability may have been exploited in an extremely sophisticated attack targeting specific individuals on versions of iOS prior to iOS 27.

Affected Versions:

• iOS versions prior to iOS 26.7.1
• iPadOS versions prior to iPadOS 26.7.1
• macOS Sequoia versions prior to 15.8.1
• macOS Sequoia versions prior to 15.8.1

Impact:

Successful exploitation may allow attackers to execute arbitrary code on a vulnerable device.

Resolution:

Upgrade affected devices immediately to:

• iOS 26.7.1 or later
• iPadOS 26.7.1 or later
• macOS Sequoia 15.8.1 or later
• macOS Tahoe 26.7.1 or later

Reference:

UIT Information Security

The post Apple CoreGraphics Code Execution Vulnerability (CVE-2026-86950) appeared first on Information Security.

CVE-2026-88771 is an improper input validation vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw could allow an unauthenticated attacker to execute arbitrary commands remotely against affected appliances. The vulnerability impacts default NetScaler deployments and does not require any special configuration to be exploitable.

CVE-2026-88772 is a memory overflow vulnerability that may allow remote code execution or denial-of-service attacks. The issue affects systems where DTLS is enabled, which is the default configuration for VPN virtual servers on NetScaler Gateway deployments.

Affected Versions:

• NetScaler ADC and Gateway prior to 14.1-73.37
• NetScaler ADC and Gateway prior to 13.1-64.23
• NetScaler ADC FIPS prior to 14.1-73.37
• NetScaler ADC FIPS and NDcPP prior to 13.1-37.279

Impact:

Successful exploitation may allow attackers to gain unauthorized access to NetScaler infrastructure.

Resolution:

Upgrade immediately to the following fixed versions:-

• NetScaler ADC / Gateway 14.1-73.37 or later
• NetScaler ADC / Gateway 13.1-64.23 or later
• 14.1-73.37 FIPS
• 13.1-37.279 FIPS and NDcPP

Reference:

UIT Information Security

The post Citrix NetScaler ADC/Gateway RCE Vulnerabilities (CVE-2026-88771 & CVE-2026-88772) appeared first on Information Security.

Severity level:
CVSS Score: 9.2/Critical.

Description:

CVE-2026-87902 is a critical path traversal vulnerability in WordPress Core's get_page_template() functionality. The flaw allows an unauthenticated attacker to manipulate page template resolution and cause WordPress to include a readable local PHP file located outside the active theme directory. Under specific conditions, including the presence of a theme directory beginning with page- and a suitable PHP file accessible to the web server, an attacker may leverage the vulnerability to execute arbitrary code and fully compromise the affected website.

Affected Versions:

• WordPress core version prior to 7.1.2
• Older WordPress branches 4.7.x through 7.1.x prior to their respective security updates.

Impact:

Successful exploitation may allow attackers to gain unauthorized access to the WordPress environment.

Resolution:

Upgrade WordPress immediately to a patched version appropriate to the branch:-

• WordPress 7.1.2 or later.
• WordPress security releases for 7.0.x, 6.9.x, 6.8.x and older supported branches.

Reference:

UIT Information Security

The post WordPress RCE (CVE-2026-87902) appeared first on Information Security.

Severity level:
CVSS Score: 7.8/High

Description:

CVE-2026-80521 is a use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem caused by a race condition in the garbage collection mechanism used to manage file descriptors passed through SCM_RIGHTS messages. An attacker with code execution inside a container can exploit the flaw to corrupt kernel memory, escape container isolation, and gain root privileges on the underlying host.

Affected Versions:

• Ubuntu 26.04 LTS.
• Ubuntu 24.04 LTS.
• Ubuntu 22.04 LTS.
• Red Hat Enterprise Linux 10.
• Debian 12,13,14.
• Upstream Linux Kernel (All versions prior to official patch committed on Aug 6, 2026).

Impact:

Successful exploitation may allow attackers to obtain root privileges on the host operating system.

Resolution:

Apply vendor-provided kernel updates as soon as they become available. Monitor Ubuntu and vendor security advisories for package availability.

Reference:

UIT Information Security

The post Linux Kernel Container Escape Vulnerability (CVE-2026-80521) appeared first on Information Security.

CVE-2026-85706 is a critical path traversal vulnerability in GitLab's Repository Commits API. The flaw results from improper path confinement and missing authentication enforcement, allowing an unauthenticated attacker to submit a specially crafted request and read arbitrary files from the GitLab server. Sensitive information such as SSH keys, credentials, configuration files, CI/CD secrets, and access tokens may be exposed.

Affected Versions:

• GitLab CE/EE 18.7 through 19.1.7
• GitLab CE/EE 19.2.0 through 19.2.5
• GitLab CE/EE 19.3.0 through 19.3.1

Impact:

Successful exploitation may allow attackers to read arbitrary files from the GitLab server.

Resolution:

Upgrade GitLab immediately to the following fixed versions:-

• GitLab 19.1.8
• GitLab 19.2.6
• GitLab 19.3.2

Reference:

UIT Information Security

The post GitLab Path Traversal Vulnerability (CVE-2026-85706) appeared first on Information Security.

CVE-2026-65400 is a critical authentication bypass vulnerability in the macOS Screen Sharing component. Due to improper state management during authentication, a network-based attacker may be able to establish a Screen Sharing session without valid credentials. Successful exploitation could allow unauthorized access to affected macOS systems and remote control of exposed devices.

Affected Versions:

• macOS Sonoma versions prior to 14.8.9.
• macOS Sequoia versions prior to 15.7.9.
• macOS Tahoe versions prior to 26.6.1.

Impact:

Successful exploitation may allow attackers to gain unauthorized remote access to affected macOS systems.

Resolution:

Upgrade affected systems to:-

• macOS Sonoma version 14.8.9 or later.
• macOS Sequoia version 15.7.9 or later.
• macOS Tahoe version 26.6.1 or later.

Mitigations:

• Disable Screen Sharing on systems where it is not required.
• Limit Screen Sharing access to trusted IP addresses and administrative networks.
• Monitor systems for unauthorized remote access attempts and unusual account activity.
• Review internet-facing macOS systems to ensure Screen Sharing is not unnecessarily exposed.

Reference:

UIT Information Security

The post macOS Screen Sharing Authentication Bypass (CVE-2026-65400) appeared first on Information Security.

CVE-2026-15459 is an authentication bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress. An unauthenticated attacker can exploit the flaw on sites that have not been connected to the WPMU DEV Hub to perform privileged actions, including installing malicious plugins, gaining administrator access, and potentially achieving remote code execution.

Affected Versions:

• WPMU DEV Dashboard Plugin for WordPress versions 5.0.0 and earlier.

Impact:

Successful exploitation may allow attackers to bypass authentication and gain administrative access to the WordPress site.

Resolution:

• Update the WPMU DEV Dashboard plugin to the latest available version.
• Ensure the website is connected to the WPMU DEV Hub, generating a valid API key used for authentication verification.
• Review installed plugins, themes, and administrator accounts for unauthorized changes.

Mitigations:

• Connect affected sites to the WPMU DEV Hub immediately.
• Restrict access to WordPress administrative interfaces.
• Monitor for unexpected plugin installations, theme changes, and administrator account creation.
• Review web server and WordPress logs for suspicious requests targeting the ?wpmudev-hub= endpoint.
• Remove any unauthorized plugins, themes, or users discovered during review.

Reference:

UIT Information Security

The post WPMU DEV Dashboard Auth Bypass (CVE-2026-15459) appeared first on Information Security.

CVE-2026-59309 is a critical authentication bypass vulnerability in the VMware Directory Service component of VMware vCenter Server. A remote attacker with network access to vCenter can exploit this flaw to bypass authentication controls and gain unauthorized access to the affected system.

CVE-2026-59310 is a critical directory traversal vulnerability in the VMware vCenter Syslog Server component. A remote attacker can leverage this flaw to access unauthorized files and potentially achieve arbitrary code execution on the vCenter Server.

Affected Versions:

• VMware vCenter Server 8.0
• VMware Cloud Foundation ( 9.0.x, 9.1.x)
• VMware vSphere Foundation (9.0.x, 9.1.x)
• VMware Telco Cloud Platform (3.0,4.x,5.0.x,5.1.x)
• VMware Telco Cloud Infrastructure 3.0

Impact:

Successful exploitation may allow attackers to bypass authentication or execute arbitrary code on the affected server.

Resolution: Upgrade to the following fixed versions or later:-

• VMware Cloud Foundation/ VMware vSphere Foundation 9.1.0.0300.
• VMware Cloud Foundation/ VMware vSphere Foundation 9.0.2.0100.
• VMware vCenter 8.0 U3k.

Reference:

UIT Information Security

The post VMware vCenter Server multiple vulnerabilities (CVE-2026-59309,CVE-2026-59310) appeared first on Information Security.

WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. CVE-2026-63030 is a critical REST API batch endpoint route confusion vulnerability in WordPress Core. The flaw causes a mismatch between request validation and execution within the WordPress REST API batch processing mechanism, allowing specially crafted requests to bypass expected security controls. When chained with CVE-2026-60137, an SQL injection vulnerability in WP_Query, an unauthenticated attacker can achieve remote code execution and fully compromise a vulnerable WordPress site.

Affected Versions:

• WordPress 6.9.0 through 6.9.4
• WordPress 7.0 through 7.0.1
• WordPress 7.1 beta releases prior to 7.1 beta 2

Impact:

Successful exploitation may allow attackers to execute arbitrary code on the affected server.

Resolution:

Upgrade affected WordPress installations to:-

• WordPress 6.9.5 or later.
• WordPress 7.0.2 or later.
• WordPress 7.1 beta 2 or later.

Reference:

UIT Information Security

The post WordPress RCE Vulnerability (CVE-2026-63030) appeared first on Information Security.

CVE-2026-53412 is a critical vulnerability caused by improper input validation in Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows. An unauthenticated attacker can exploit the flaw remotely over a network to perform an account takeover.

Affected Versions:

• Zoom Workplace for Windows before 7.0.0.
• Zoom Workspace VDI client for Windows before (7.0.10, 6.6.15, 6.5.18)

Impact:

Successful exploitation may allow attackers to take over affected Zoom account.

Resolution:

Upgrade affected software to the latest supported versions.

Reference:

UIT Information Security

The post Zoom Workplace for Windows - Improper Input Validation (CVE-2026-53412) appeared first on Information Security.

CVE-2026-43503 (DirtyClone) is a high-severity Linux kernel privilege escalation vulnerability caused by improper handling of shared memory fragments in the networking subsystem. A local attacker can exploit the flaw to modify file-backed page-cache memory and alter the behavior of privileged executables, potentially gaining root privileges on the affected system. The attack occurs in memory without modifying files on disk, making detection more difficult.

Affected Versions:

• Major Linux distributions.
• Linux systems running kernel versions prior to vendor-provided fixes for CVE-2026-43503.

Impact:

Successful exploitation may allow attackers to escalate privileges from local user account to root.

Resolution:

Apply the latest security updates provided by the Linux distribution and upgrade the kernel.

Reference:

UIT Information Security

The post Linux kernel vulnerability (CVE-2026-43503) appeared first on Information Security.

CVE‑2026‑35273 is a critical vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. The flaw allows an unauthenticated attacker with network access over HTTP to exploit the application due to missing or improper access controls. An attacker can send specially crafted requests to the vulnerable component to execute arbitrary code, potentially leading to full application takeover without requiring credentials or user interaction.

Affected Versions:

Oracle PeopleSoft Enterprise PeopleTools.

• Version 8.61.
• Version 8.62.

Impact:

Successful exploitation may allow attackers to gain complete control of the PeopleSoft application.

Resolution:

Install the latest available Oracle PeopleTools patches.

Reference:

UIT Information Security

The post Oracle PeopleSoft Remote Code Execution Vulnerability (CVE-2026-35273) appeared first on Information Security.

CVE‑2026‑41089 is a stack‑based buffer overflow vulnerability in the Windows Netlogon service. The flaw occurs due to improper handling of specially crafted network requests in the Netlogon RPC interface.

An attacker can exploit this vulnerability by sending a malicious request to a vulnerable domain controller, causing the service to overwrite memory on the stack. This can result in remote code execution with SYSTEM‑level privileges, without requiring authentication or user interaction.

Affected Versions:

• Microsoft Windows Server 2012/ 2012 R2.
• Microsoft Windows Server 2016.
• Microsoft Windows Server 2019.
• Microsoft Windows Server 2022 / 2022 23H2.
• Microsoft Windows Server 2025.

Impact:

Successful exploitation may allow attackers to execute arbitrary code with system privileges.

Resolution:

• Install the Microsoft’s May 2026 updates immediately.
• Prioritize Domain Controller and identity Infrastructure systems.

Reference:

UIT Information Security

The post Windows Netlogon RCE Vulnerability (CVE-2026-41089) appeared first on Information Security.

UIT Information Security

The post 7-Zip Heap Buffer Overflow (CVE-2026-48095) appeared first on Information Security.

Impacted Linux Distribution:

• Ubuntu.
• Debian.
• Red Hat Enterprise Linux (RHEL).
• SUSE Linux Enterprise.
• Fedora, Arch Linux and other mainstream distributions.

Impact:
Successful exploitation may allow attackers to read sensitive files and escalate privileges to root.

Resolution:
Please update the Linux kernel to the fixed version released by the distribution vendor.

Mitigations:
Where immediate patching is not possible:

• Disable or restrict untrusted local user access.
• Restrict ptrace access.

Reference:

UIT Information Security 

The post Linux Kernel Local root Privilege Escalation (CVE-2026-46333) appeared first on Information Security.