Upwind Security MDR

The official Upwind Security MDR Team. Essential defense built on three values: SPEED, SPEED, SPEED. Up & up 🏄‍♂️

[Upwind Security MDR @UpwindMDR]

🚨 CRITICAL - Unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3)

A critical vulnerability in React Server Components packages (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel) allows unauthenticated remote attackers to execute arbitrary code via crafted RSC Flight payload responses transporting multiple typed arrays and attacker-controlled values.

👉 Affected: Versions 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 | Upgrade immediately to 19.0.9, 19.1.10, 19.2.9, or 19.3.1 (or Next.js 16.4.1 / 15.5.28)

https://t.co/Kbpu3ws8Om

[Upwind Security MDR @UpwindMDR]

🚨High - Node.js HTTPS heap memory disclosure via TLSWrap re-entrancy (CVE-2026-123864)

In Node.js node:https, a zero-byte write in TLSWrap::DoWrite() triggers ClearOut() during the HTTP parser on_body callback, re-entering llhttp_execute() and causing UAF/OOB reads. An unauthenticated client can leak heap data into HTTP responses, potentially exposing TLS private keys and other connections' request data. Cleartext node:http is not affected.

👉Affected: Node.js 22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1 | Upgrade to 22.23.5 / 24.22.3 / 26.13.1

[Upwind Security MDR @UpwindMDR]

🚨High - Cockpit cockpit-ws WebSocket Fragment Memory Exhaustion DoS (CVE-2026-91150)

Cockpit's cockpit-ws caps each WebSocket fragment at 128 KiB but not the total size of a reassembled message, so fragments pile up in memory without bound. A remote attacker can stream crafted fragments to exhaust memory and take the web console down. Red Hat rates it unauthenticated; upstream says login is required.

👉Affected: Cockpit < 372 | Upgrade to 372, or restrict port 9090 to trusted networks, to mitigate.

[Upwind Security MDR @UpwindMDR]

🚨High - xfsprogs xfs_admin OS Command Injection Privilege Escalation (CVE-2026-108472)

The xfs_admin utility in xfsprogs does not properly validate user-supplied parameters, allowing OS command injection. A local attacker who can pass crafted arguments to xfs_admin (e.g. via sudo delegation or provisioning tools) can run arbitrary commands as the executing user, typically root.

👉Affected: xfsprogs (versions TBD) | No patched release available yet, until then keep untrusted input away from xfs_admin.

[Upwind Security MDR @UpwindMDR]

🚨HIGH - Node.js TLS Client Cert Auth Bypass via Renegotiation SNI Swap (CVE-2026-123872)

Node.js TLS (TLS 1.2) allows changing servername (SNI) during renegotiation, letting a client reuse an existing mTLS-authenticated session across hostnames. Servers enforcing different client-cert policies per hostname can be bypassed to access unauthorized endpoints. TLS 1.3 is not affected.

👉Affected: Node.js 22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1 | Upgrade to 22.23.5 / 24.22.3 / 26.13.1

[Upwind Security MDR @UpwindMDR]

🚨 CRITICAL - Origin Validation Flaw in FortiClient (CVE-2026-121529)

Fortinet has published a critical security advisory addressing an origin validation error in the local API endpoints of FortiClient, which can allow unauthorized remote attackers to execute code via victim interaction.

👉 Affected / Remediation: Affects FortiClient Windows (7.2, 7.4), FortiClient Mac (7.4), and FortiClient Windows PAM (7.2, 7.4). Upgrade immediately to 7.4.8+ or 7.2.15+ (v8.0 releases are unaffected).

[Upwind Security MDR @UpwindMDR]

🚨 CRITICAL - Apache HTTP Server Patches mod_http2 Race Condition (CVE-2026-119618)

Apache HTTP Server 2.4.71 addresses a critical race condition in mod_http2 (assign_headers()) that can corrupt heap memory and lead to Remote Code Execution, alongside fixes for CVE-2026-106023 and CVE-2026-109163.

• Impact: Can cause server child process crashes, memory corruption, or lead to arbitrary code execution on servers with HTTP/2 enabled.

👉 Affected / Remediation: Affects Apache HTTP Server 2.4.55 through 2.4.70. Upgrade immediately to v2.4.71, or disable mod_http2 as a temporary mitigation.

[Upwind Security MDR @UpwindMDR]

🚨Critical - Azure Managed Grafana SSRF Privilege Escalation (CVE-2026-114160)

Azure Managed Grafana is vulnerable to SSRF where crafted requests can coerce the service to fetch internal endpoints (e.g., cloud metadata/management APIs), enabling unauthorized privilege escalation over the network. High impact to confidentiality, integrity, and availability.

👉Affected: Azure Managed Grafana (service)

[Upwind Security MDR @UpwindMDR]

🚨 CRITICAL - Pre-Auth Bypass & Command Injection in Barracuda Products

Barracuda has warned of two vulnerabilities in multiple products that, when chained together, can allow an attacker with administrative UI access to bypass authorization controls and achieve root access to the appliance. Active exploitation has been observed affecting a small number of organizations.

• CVE-2026-116606: Pre-authentication authorization bypass affecting Email Security Gateway (ESG) administrative interfaces.
• CVE-2026-111560: Post-auth command injection affecting ESG, ADC, Message Archiver, WAF, WCC, and Web Security Gateway.
• Impact: Chaining both flaws against exposed admin interfaces can lead to complete root compromise of the device.

👉 Affected / Remediation: Apply vendor security patches immediately. Ensure admin interfaces are restricted from the public internet and isolated to trusted management networks.

[Upwind Security MDR @UpwindMDR]

🚨High - jsdiff parsePatch Infinite Loop + Memory Exhaustion DoS (CVE-2026-24001)

In jsdiff (npm: diff), parsePatch mishandles patch filename headers containing \r/\u2028/\u2029, causing an infinite loop and unbounded memory growth until crash; applyPatch is also reachable when called with a string patch (it calls parsePatch). Crafted headers can also trigger regex-based DoS with cubic-time parsing.

👉Affected: diff (jsdiff) versions unknown

[Upwind Security MDR @UpwindMDR]

🚨High - Perl Pod::Text DoS via nested =over wrap() width=0 loop (CVE-2026-82560)

Pod::Text (podlators) can be driven into an infinite loop by attacker-supplied POD with deeply nested =over directives, forcing wrap() available width to 0. The formatter then repeatedly matches an empty string while appending margin padding, causing unbounded CPU + output growth (memory exhaustion) and DoS.

👉Affected: podlators / perl (Pod::Text) versions unknown

[Upwind Security MDR @UpwindMDR]

🚨High - https://t.co/jE4L6fFAHB Core Algorithmic Complexity DoS (CVE-2026-109478)

https://t.co/jE4L6fFAHB Core on .NET 8.0 is vulnerable to remote algorithmic complexity abuse, allowing unauthenticated attackers to send crafted requests that trigger excessive CPU/memory consumption and cause service-level denial of service across Linux/macOS/Windows. Visual Studio 2022 17.14 is also impacted.

👉Affected: https://t.co/jE4L6fFAHB Core / .NET 8.0 (Linux/macOS/Windows); Microsoft Visual Studio 2022 17.14

[Upwind Security MDR @UpwindMDR]

🚨High - Azure aznfs Privilege Escalation via Untrusted Search Path (CVE-2026-105494)

Azure NFS mount helper aznfs uses unsafe search path resolution during mount operations, allowing a local authorized attacker to influence PATH/working dir to load a rogue executable/library. Exploitation can lead to privilege escalation to root. Remote attackers are not impacted.

👉Affected: aznfs (versions not specified)

[Upwind Security MDR @UpwindMDR]

🚨High - FortiSandbox Web UI Reflected XSS via Input Neutralization Flaw (CVE-2026-26248)

Fortinet FortiSandbox web UI improperly neutralizes user input during web page generation, allowing unauthenticated attackers to send crafted HTTP requests that inject script into rendered pages. Exploitation typically requires social engineering to get a victim to load the malicious URL, leading to session hijack/UI action abuse.

👉Affected: Fortinet FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS (affected versions)

[Upwind Security MDR @UpwindMDR]

🚨HIGH - Ghostscript -dSAFER Sandbox Escape to RCE via .forceput Recovery (CVE-2026-125396)

In Ghostscript, .putgstringcopy calls privileged .forceput without operand type validation, enabling a crafted PostScript/PDF to trigger a typeerror and recover .forceput via a custom error handler. This bypasses -dSAFER and can hit a save/restore use-after-free leading to arbitrary code execution.

👉Affected: Ghostscript/ghostpdl < 10.08.0 | Upgrade to 10.08.0

[Upwind Security MDR @UpwindMDR]

🚨Critical - Checkmk Kubernetes Special Agent Argument Injection to Site-User RCE (CVE-2026-121374)

Checkmk’s Kubernetes special agent is vulnerable to argument injection via crafted node roles in the rule option "Exclude nodes based on their role" (requires permission to edit rules in at least one folder). Exploitation enables arbitrary file write to paths writable by the site user, leading to code execution as the site user.

👉Affected: Checkmk < 2.5.0p19, < 2.4.0p40, and 2.3.0 (EOL) | Upgrade to 2.5.0p19 / 2.4.0p40

[Upwind Security MDR @UpwindMDR]

🚨High - Apport local root via DT_AUDIT in crash ldd pipeline (CVE-2026-84410)

Apport’s crash processing pipeline (auto crash reporting) runs as root and invokes ldd on an attacker-controlled ExecutablePath from a .crash in world-writable /var/crash. The dynamic loader honors DT_AUDIT and loads an attacker-supplied audit module, yielding root code execution and full compromise. Systems without automatic crash reporting aren’t impacted.

👉Affected: apport < 2.37.0 | Upgrade to 2.37.0

[Upwind Security MDR @UpwindMDR]

🚨Critical - OpenObserve Auth Bypass via Empty Basic Password (CVE-2026-126065)

OpenObserve’s shared auth validator accepts HTTP Basic auth with an empty/whitespace password when a user’s external_password is missing/empty. Knowing a victim email + org, an attacker can hit protected non-ingestion API routes as the victim; with search perms, DataFusion COPY ... TO can write to service-writable paths for conditional pre-auth RCE.

👉Affected: openobserve < 1.1.0 | Upgrade to 1.1.0

[Upwind Security MDR @UpwindMDR]

🚨High - Rack Multipart Parser Scan Buffer Memory DoS (CVE-2026-125111)

Rack::Multipart::Parser can retain parsed data in its internal scan buffer when multipart reads end inside or right after headers. An unauthenticated attacker can stream a well-formed multipart body with many tiny parts aligned to buffer boundaries, growing the buffer with request size to exhaust worker memory and crash/DoS the app.

👉Affected: rack < 2.2.25, 3.1.x < 3.1.23, 3.2.x < 3.2.8 | Upgrade to 2.2.25 / 3.1.23 / 3.2.8

[Upwind Security MDR @UpwindMDR]

🚨Critical - Adobe Experience Manager Remote Code Execution (CVE-2026-113580, CVE-2026-113579, CVE-2026-114371)

Code injection and incorrect authorization flaws allow remote attackers with low privileges to execute arbitrary code without user interaction. All three vulnerabilities are rated CVSS 9.9.

👉Affected: AEM Cloud Service ≤2026.10.29023; AEM 6.5 SP25 and earlier; AEM 6.5 LTS SP3 and earlier.

[Upwind Security MDR @UpwindMDR]

⚠️Medium - Microsoft Outlook Spoofing (CVE-2026-124194) | Exploited in the Wild
Opening a crafted message file can make Outlook connect to an attacker-controlled location without the usual warning, exposing the user’s NTLMv2 hash and enabling impersonation. User interaction is required; the Preview Pane alone is not an attack vector.

👉Affected: Outlook in Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. Install the November security updates.

🔗 https://t.co/1YZ7XUyELh