‼️ CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability
Details: https://t.co/9hqn7XHeqI
The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of a Microsoft Outlook zero-day vulnerability, CVE-2026-124194, that can expose user authentication data.
According to Microsoft’s security advisory, an attacker can send a specially crafted message file and persuade a victim to open it in Outlook.
The application may then connect to an attacker-controlled network location without showing its usual warning about external content. Microsoft released security updates for an actively exploited Outlook network-spoofing flaw (CVSS 6.5) that allows unauthenticated attackers to spoof networks.
#CybersecurityNews
@el_pais Es de coña. La única posibilidad de este resultado es pucherazo. Por cierto, El País todavía no ha publicado nada de que la Fiscalía Europea está investigando al Ministerio de Igualdad por fraude con las pulseras antimaltrato
🚨 Critical Fortinet2Shell flaw lets malicious websites execute code on FortiClient devices, CVE-2026-121529
Fortinet has patched a critical vulnerability in FortiClient that could allow attackers to execute malicious code on a victim's computer simply by getting them to visit a malicious website.
Dubbed Fortinet2Shell, the flaw carries a CVSS score of 9.1 and stems from improper security restrictions in a local API service.
Researchers demonstrated how attackers could exploit the weakness on systems with FortiPAM enabled, potentially compromising affected endpoints without authentication.
The vulnerability affects FortiClient 7.4.0 through 7.4.7 on Windows and macOS, along with Windows versions 7.2.0 through 7.2.14. Fortinet has released patched versions 7.4.8 and 7.2.15, with no confirmed exploitation in the wild.