Vulnerability Watch

CVE ID not confirmed in source — check the original advisory before acting.

What Zoom is: Zoom is the video conferencing and online meetings platform used by hundreds of millions of people worldwide for work calls, webinars, and remote collaboration.

What it is: A critical input validation flaw — where software fails to properly check data it receives before acting on it — in Zoom's Windows client that could allow an unauthenticated attacker to take over a victim's account entirely. No login required on the attacker's end.

Who's at risk: Anyone running Zoom Desktop Client for Windows, Zoom VDI Client for Windows, or Zoom Meeting SDK for Windows on an unpatched version. The attack is possible over a network connection.

CVSS: 9.8 (Critical — patch today, do not delay).

Root cause: The application does not properly validate input received over the network before processing it. Think of it like a reception desk that waves through anyone claiming to be a guest without checking their name against the list — and then hands them a master key.

Attack vector: An attacker with network access sends malformed input to the Zoom client. Because the application does not verify what it receives, the attacker can manipulate the client's behaviour, ultimately gaining control of the account. No interaction from the victim is required beyond having Zoom running.

Recommended actions:

1. Open Zoom and update to the latest version immediately via Help → Check for Updates.
2. If you manage Zoom across an organisation, push the update via your MDM or endpoint management platform today.
3. Monitor for any unexpected account activity or unauthorised sessions in your Zoom admin console.

What SonicWall SMA 1000 is: A hardware and virtual appliance that organisations use to give remote workers secure access to internal corporate networks and applications.

What it is: An SSRF vulnerability (Server-Side Request Forgery — a flaw where an attacker tricks a server into making network requests on their behalf, effectively using the server as a proxy to reach internal systems) that can be triggered by anyone on the internet, no login required. SonicWall confirmed active exploitation in multiple investigated cases.

Who's at risk: Any organisation running an internet-exposed SMA 1000 appliance on a firmware version below the patched releases. No authentication is required to trigger this flaw.

CVSS: 10.0 (Critical — patch today. Stop reading, go patch.)

Root cause: The appliance's web-facing API does not adequately validate or restrict the destination of outbound requests it generates. When the server accepts a user-controlled value and uses it to construct an outbound request without checking whether that destination is legitimate, an attacker can point it anywhere — including internal infrastructure that should never be reachable from outside.

Attack vector: A remote, unauthenticated attacker sends a crafted HTTP request to the appliance's public-facing API endpoint. The request contains an attacker-controlled destination address. Because the appliance fails to validate this input, it forwards the request to the specified location — which may be an internal server, a cloud metadata service, or other network resource behind the firewall. The appliance's response to the attacker reveals information about that internal destination, giving the attacker a foothold to map internal infrastructure or pivot further. No credentials are needed at any step.

Detection strategies:

1. In extraweb_access.log, look for HTTP 200 responses to requests targeting /__api__/login or /__api__/logout — these URIs do not exist in legitimate appliance configuration and should never appear with a success status.
2. In extraweb_access.log, look for requests to /wsproxy with unusual or unexpected host parameters returning HTTP 101 (connection upgrade) status codes.
3. Check whether /var/lib/unit/conf.json contains routing entries for /__api__/login or /__api__/logout — their presence in that file indicates the configuration has been tampered with.
4. In ctrl-service.log, look for hotfix rollbacks that reference path traversal names (file paths containing sequences like ../ that are designed to escape expected directories).

Recommended actions:

1. Upgrade immediately to firmware version 12.4.3-03453 or 12.5.0-02835 (or higher). CISA's patch deadline for federal agencies is July 17, 2026 — everyone else should treat that date as their own deadline.
2. If any of the detection indicators above are present, re-image physical appliances or redeploy virtual ones from scratch. Do not attempt to clean a potentially compromised appliance in place.
3. After patching or reimaging, rotate all user and administrator passwords and reset any time-based one-time password (TOTP) tokens associated with the appliance.

What Balbooa Forms is: A drag-and-drop form builder for Joomla websites that lets site owners create contact forms with file upload functionality.

What it is: The plugin fails to restrict which file types users can upload. An attacker can submit a PHP script through the form's upload feature and trigger it to run on the server, achieving RCE (remote code execution — the ability to run arbitrary commands on a machine they don't own).

Who's at risk: Any Joomla site running Balbooa Forms below version 2.4.1. CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog, meaning active exploitation is confirmed in the wild, according to Bleeping Computer.

CVSS: Not yet scored — treat as Critical. CISA ordered federal agencies to patch within three days.

Root cause: The upload feature lacks validation on file type. Think of it as a secure post box with a slot wide enough to fit a crowbar — the opening exists for legitimate use, but nothing checks what comes through it.

Attack vector: An attacker visits a Joomla site running the vulnerable plugin, submits a PHP file through the public-facing upload form, then navigates directly to that file's URL on the server to execute it. This worked as a zero-day from July 8, one day before a patch was released.

Recommended actions:

1. Update Balbooa Forms to version 2.4.1 immediately.
2. Audit your server for unexpected PHP files in upload directories.
3. If you cannot patch immediately, disable file upload functionality in the plugin settings.

CVE ID not confirmed in source — check the original advisory before acting.

What a CMS is: A content management system (CMS) is software that powers websites, letting users publish and manage content without writing code directly. WordPress, Drupal, and Joomla are common examples.

What it is: Australia's cybersecurity agency has issued a warning about an active global campaign targeting websites running outdated or unpatched CMS platforms, according to Bleeping Computer. Full technical details were not available at the time of writing, but the advisory signals active exploitation in the wild.

Who's at risk: Anyone running a website built on a CMS platform that has not been recently updated. Small businesses, personal sites, and organisations without dedicated IT support are particularly exposed.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: CMS platforms are complex, widely deployed, and frequently extended with third-party plugins. Older versions accumulate known vulnerabilities that attackers scan for and exploit systematically. Unpatched installs are standing targets.

Attack vector: Attackers scan the internet for CMS installations matching known vulnerable version signatures. Once identified, they deliver exploit payloads targeting those specific flaws, potentially gaining the ability to alter site content, steal visitor data, or use the server as a launchpad for further attacks.

Detection strategies: Check your CMS admin panel for a version number and compare it against the vendor's latest release. Review recent file modification timestamps in your web root for unexpected changes. Monitor for new admin user accounts you did not create.

Recommended actions:

1. Update your CMS and all installed plugins to their latest versions today.
2. Remove or disable any plugins or themes that are no longer maintained.
3. Enable login attempt limiting and two-factor authentication on your CMS admin account.

What Gitea is: Gitea is an open-source, self-hosted platform for storing and managing source code — think a version of GitHub or GitLab that a company runs on its own servers.

What it is: The official Gitea Docker image (a pre-packaged container used to deploy Gitea quickly) shipped with a configuration that trusted identity headers from any IP address on the internet. An attacker could send a single HTTP header claiming to be any user, including an administrator, and Gitea would believe them — no password required.

Who's at risk: Anyone running the official Gitea Docker image up to and including version 1.26.2 with default settings. Roughly 6,200 Gitea instances are currently exposed on the public internet, though the exact number of vulnerable deployments is unknown.

CVSS: Critical. Patch today.

Root cause: The Docker image set REVERSE_PROXY_TRUSTED_PROXIES=*, meaning it accepted the X-WEBAUTH-USER header (a field that tells Gitea who the user is) from any source, not just from a trusted internal proxy. Think of it like a hotel front desk that accepts a note saying "I'm the hotel manager" from anyone who walks in off the street — with no ID check whatsoever.

Attack vector: An attacker sends a standard HTTP request to an exposed Gitea instance and includes a header naming any account — admin, gitea_admin, or any known username. Gitea processes the header as a verified identity and grants full access. No credentials, no tokens, one line of a request. Sysdig researchers confirmed active exploitation began at least 13 days before public disclosure.

Detection strategies: Review access logs for requests containing X-WEBAUTH-USER headers arriving from external IP addresses. Look for unexpected admin account activity, particularly repository access, user creation, or settings changes. Check for authentication events with no corresponding password or token validation entries.

Recommended actions:

1. Upgrade to Gitea version 1.26.4 immediately (1.26.3 introduced a regression; 1.26.4 resolves both the CVE and that regression).
2. If upgrading is not immediately possible, set REVERSE_PROXY_TRUSTED_PROXIES to specific trusted IP addresses rather than the wildcard *.
3. Review access logs for suspicious activity to determine whether compromise has already occurred.

What UniFi Connect is: UniFi Connect is a Ubiquiti platform for managing displays, intercom systems, and building access hardware — popular in small offices, schools, and home setups.

What it is: This flaw allows anyone on the same network to inject and execute arbitrary commands directly on the host device, with no authentication required. It is an improper access control vulnerability, meaning the software fails to verify whether a user has permission before carrying out sensitive operations.

Who's at risk: Anyone running UniFi Connect Application version 3.4.16 or earlier on a network where other users or devices are present. Home lab users, small businesses, and schools using Ubiquiti gear are all in scope.

CVSS: 10.0 (Critical) — Patch today. This is a perfect score. Stop reading, go patch.

Root cause: The application does not enforce access controls before processing certain commands. A network-adjacent attacker can send a crafted request that the device treats as a trusted instruction, then execute commands at the system level. There is no authentication barrier in the way.

Attack vector: An attacker on the local network sends a specially crafted request to the UniFi Connect service. The device processes it without checking who sent it, executes the embedded command, and hands the attacker control of the host. No credentials needed.

Recommended actions:

1. Update UniFi Connect Application to version 3.4.20 or later immediately.
2. Restrict network access to UniFi management interfaces to trusted devices only.
3. Review other UniFi products in your environment — Ubiquiti patched six additional critical flaws across UniFi Talk, Access, Protect, and OS in the same release cycle.

CVE ID confirmed in source — see the full disclosure from The Hacker News.

What the Linux Kernel is: The kernel is the core of the Linux operating system — the layer that manages memory, processes, and hardware on behalf of every program running on the machine.

What it is: Researchers at Nebula Security disclosed GhostLock, a flaw that lets any logged-in user gain full root (administrator-level) control of an unpatched Linux machine. It has existed in the codebase since 2011 and requires no special permissions or network access to trigger.

Who's at risk: Anyone running an unpatched Linux system — particularly cloud servers, shared hosting environments, containers, and CI runners (automated build systems) where an attacker may already have low-level local access.

CVSS: 7.8 (High — patch this week. Do not put this one off.)

Root cause: The flaw lives in the kernel's futex (fast userspace mutex — a primitive that coordinates access between competing processes) priority inheritance code. When a lock operation hits a dead end and backs out, a cleanup routine fires at the wrong moment and wipes the wrong task's record. The kernel is then left holding a pointer — a reference to a memory address that has already been freed and reassigned. Trusting that stale pointer is a use-after-free vulnerability (acting on memory that has been handed to someone else, like a hotel key-card that still opens a room after check-out).

Attack vector: From a standard local user account, an attacker triggers the flawed futex path to corrupt kernel memory. Nebula's team chained several steps from that corruption to redirect kernel execution, ending with arbitrary code running at root level. The published exploit achieves this in roughly five seconds on tested hardware. Because Nebula has released working exploit code publicly, any attacker can now run it without needing to understand the underlying mechanics.

Detection strategies:

1. Unexpected privilege escalation events in system audit logs — look for a non-root process spawning root-level child processes without a corresponding authorised sudo call.
2. Kernel crash logs (check /var/log/kern.log or journalctl -k) referencing futex or memory faults may indicate failed exploitation attempts.
3. On systems with eBPF (extended Berkeley Packet Filter — a kernel feature that lets programs observe system activity in real time) monitoring enabled, watch for anomalous syscall sequences from unprivileged processes targeting futex operations.

Recommended actions:

1. Install your distribution's latest kernel update — confirm the patch includes commit 3bfdc63936dd and verify it is not an early build that introduced the subsequent crash bug CVE-2026-53166.
2. Prioritise patching shared and multi-tenant machines first: cloud servers, containers, and CI runners are highest risk.
3. If patching is delayed, enable RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER build options as partial mitigations — these raise the bar for exploitation but do not close the flaw.

What Adobe ColdFusion is: A commercial platform used by developers to build and deploy enterprise websites and web applications.

What it is: A maximum-severity flaw allowing an unauthenticated attacker — one with no account or prior access — to execute arbitrary code remotely on an unpatched ColdFusion server. Adobe released a patch and urged administrators to apply it within 72 hours, per Bleeping Computer.

Who's at risk: Any organisation running ColdFusion versions 2025.9, 2023.20, or earlier with internet-facing deployments.

CVSS: 10.0 (Critical — patch today, full stop.)

Root cause: The flaw requires no authentication and no user interaction to trigger. An attacker simply sends a crafted request to the server. The underlying failure is in how ColdFusion handles external input before verifying who is sending it, allowing code execution before any identity check occurs.

Attack vector: Exploitation began within two hours of Adobe's public disclosure, captured by KEVIntel's global honeypot network. An attacker sends a malicious HTTP request to an exposed ColdFusion instance, gains code execution, and can subsequently read files, install backdoors, or pivot deeper into the network. No credentials needed.

Detection strategies: Look for unexpected outbound connections from your ColdFusion server, unusual process spawning from the ColdFusion service account, and unfamiliar files written to the web root directory.

Recommended actions:

1. Apply Adobe's patch immediately — the 72-hour window has already passed for most organisations.
2. Place ColdFusion servers behind a web application firewall (WAF) if not already done.
3. Restrict external access to ColdFusion admin interfaces at the network level.

What ClamAV is: ClamAV is a free, open-source antivirus scanning engine maintained by Cisco's Talos group, widely used inside email gateways, file upload systems, and security tooling at organisations of all sizes.

What it is: CVE-2026-20215 is a flaw in ClamAV's parser for 7z archives (a compressed file format). When processing a crafted 7z file, the parser mishandles a substream count value in a way that causes it to allocate too little memory, then write data beyond the boundary of that allocation — a classic heap overflow (writing data outside a reserved memory block, like overfilling a labelled box and spilling into the next one). This is one of seven flaws patched in ClamAV releases 1.5.3 and 1.4.5, as reported by Help Net Security.

Who's at risk: Any system running ClamAV that scans untrusted or user-submitted archive files — mail gateways, file upload services, and endpoint security tools are all exposed if unpatched.

CVSS: Not yet scored — treat as High until confirmed. Patch this week.

Root cause: The parser fails to validate the substream count before using it to calculate memory allocation size. A value crafted to be unexpectedly large causes the system to allocate insufficient space, after which the parser writes beyond that space when reading the archive's contents. The developer did not enforce an upper bound on the count before allocation.

Attack vector: An attacker crafts a malformed 7z archive and submits it to any service that scans files with ClamAV — an email attachment, a file upload form, or a shared folder under active monitoring. When ClamAV processes the file, the malformed substream count triggers the overflow. Depending on what sits in adjacent memory, this could crash the scanner or potentially be developed into code execution.

Detection strategies: Monitor for unexpected ClamAV process crashes or restarts. Look for scan jobs that terminate without producing a result on 7z files specifically. Unusual volumes of malformed archive submissions from a single source are worth investigating.

Recommended actions:

1. Upgrade ClamAV to version 1.5.3 (recommended) or 1.4.5 immediately — both are available on the ClamAV GitHub releases page.
2. If immediate patching is not possible, restrict ClamAV from scanning untrusted 7z archives at the gateway level as a temporary measure.
3. Enable logging for scanner crashes and set up alerts if the ClamAV daemon exits unexpectedly.