Vulnerability intelligence

CVE-2025-43529 is a use-after-free vulnerability in WebKit that can be exploited by processing maliciously crafted web content. Google's Threat Analysis Group discovered this flaw. Apple has released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to address this vulnerability, as it may have been exploited in targeted attacks against specific individuals using versions of iOS before iOS 26. Devices impacted include iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).

CVE-2026-20700 is a memory corruption vulnerability found within Apple's `dyld` component, which is the Dynamic Link Editor responsible for loading dynamic libraries into memory and bridging application code with system frameworks. This flaw could enable an attacker with memory write capabilities to execute arbitrary code on affected devices. Apple addressed this issue through improved state management in updates for watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3, and iPadOS 26.3. Reports indicate that this vulnerability may have been exploited in "extremely sophisticated attacks" targeting specific individuals on versions of iOS preceding iOS 26. Google's Threat Analysis Group is credited with discovering and reporting the vulnerability.

CVE-2026-102764 is an improper origin validation vulnerability affecting the internal messaging components of BeyondTrust Remote Support (formerly Bomgar) appliances. The flaw impacts all supported versions of the software up to and including 26.2.3. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to perform arbitrary file operations on the appliance. This capability can allow attackers to gain host-level control, escalate privileges to root, and access credentials stored or brokered by the system. The vulnerability was exploited as a zero-day starting in late August 2026 by a suspected China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). During these intrusions, the threat actors deployed custom backdoors, such as the SAWFLY web shell and BARECLAW tunneler, to maintain persistence and harvest credentials. BeyondTrust released patches on October 9, 2026, which were automatically deployed to SaaS customers, while self-hosted customers running versions 24.3.1 through 26.2.3 are advised to manually apply the BT26-05-RS update. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog.

CVE-2026-102764 is an improper origin validation vulnerability affecting the internal messaging components of BeyondTrust Remote Support (formerly Bomgar) appliances. The flaw impacts all supported versions of the software up to and including 26.2.3. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to perform arbitrary file operations on the appliance. This capability can allow attackers to gain host-level control, escalate privileges to root, and access credentials stored or brokered by the system. The vulnerability was exploited as a zero-day starting in late August 2026 by a suspected China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). During these intrusions, the threat actors deployed custom backdoors, such as the SAWFLY web shell and BARECLAW tunneler, to maintain persistence and harvest credentials. BeyondTrust released patches on October 9, 2026, which were automatically deployed to SaaS customers, while self-hosted customers running versions 24.3.1 through 26.2.3 are advised to manually apply the BT26-05-RS update. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog.

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting the command line interpreter (CLI) of several Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw stems from improper input validation, specifically involving unsanitized `system.auto-script` object names. This allows an authenticated attacker with administrative privileges and read-write permissions to escape restricted directories and write or delete arbitrary files on the underlying filesystem by executing crafted CLI commands. In real-world attacks, threat actors have exploited this vulnerability as a privilege-escalation vector to transition from restricted administrative access to root-level control over the underlying operating system. This exploit has been used in the wild to deploy PEERSTITCH, a stealthy, memory-resident ARM64 malware designed to evade traditional file-based detection. Fortinet addressed the vulnerability in April 2026, releasing patches for affected versions of FortiOS and other impacted products.

CVE-2026-21589 is a path traversal and arbitrary file access vulnerability that affects multiple self-hosted Atlassian Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows remote, unauthenticated attackers to access specific files within the web application's root directory. To successfully exploit the vulnerability, an attacker must know the exact name and path of the target file, as the flaw does not allow directory listing or file enumeration. The vulnerability impacts all versions of the affected products prior to their designated fixed releases. While Atlassian's cloud-based services are secure and require no action, organizations utilizing self-hosted deployments are advised to upgrade to the patched versions. For systems that cannot be immediately updated, recommended mitigations include taking internet-facing instances offline, deploying web application firewall (WAF) rules, or configuring URL rewriting rules to block directory traversal attempts containing double-dot (`../`) sequences.