Vulnerability intelligence

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook that stems from the application failing to warn users before performing a potentially unsafe action. To exploit this flaw, an unauthenticated attacker must convince a target to open a specially crafted message file in an affected version of Outlook. The vulnerability cannot be triggered through the Preview Pane alone. Once the malicious file is opened, Outlook is forced to connect to an attacker-controlled network location without displaying the standard external-content warning. This unauthorized connection exposes the victim's NTLMv2 authentication hash to the remote server, allowing the attacker to capture the hash and potentially use it to impersonate the user in subsequent attacks. Discovered by researchers "nono" and Benoît Sevens, the vulnerability was addressed in Microsoft's November 2026 Patch Tuesday updates. Because the flaw has been actively exploited in the wild as a zero-day, the Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) Catalog.

CVE-2025-62861 is a vulnerability in Bitcoin Core affecting versions 28.0 through 28.2 and 29.0 through 29.1. Discovered by security researcher Niklas Goegge, the flaw stems from the software's Transaction Policy for Requesting Unconfirmed Transactions (TRUC / v3 transaction rules) "sibling transaction eviction" logic during a blockchain reorganization. When a chain reorganization occurs, a node drops blocks and attempts to re-add those transactions back into its mempool with the `bypass_limits` parameter enabled. However, because the sibling-eviction logic was not properly gated by this parameter, TRUC enforcement continued to run during the re-addition process. This could result in a parent transaction being evicted from the mempool while its dependent child transactions remained. This discrepancy led to an inconsistent mempool state where child transactions attempted to spend missing outputs, causing block template creation to fail and preventing affected mining nodes from producing valid blocks. The issue did not allow for the theft of funds or the creation of unauthorized coins, and affected nodes could temporarily resolve the block-production halt by restarting. A fix proposed by developer Greg Sanders was released in October 2025 with Bitcoin Core version 30.0 and backported to the 28.x and 29.x branches. The vulnerability details were publicly disclosed on November 10, 2026, following the end-of-life of the 29.x software branch.

CVE-2026-121653 is a SQL injection vulnerability affecting the Core component of Ivanti Endpoint Manager (EPM). The flaw stems from the improper neutralization of special elements within SQL commands, which allows user-controlled inputs to modify database queries. By exploiting this vulnerability, a remote, unauthenticated attacker can achieve remote code execution (RCE) on the affected system. The vulnerability impacts Ivanti EPM versions prior to 2024 SU8. Disclosed by Ivanti on November 10, 2026, through their responsible disclosure program, the company reported no evidence of active exploitation in the wild at the time of public release. Organizations can resolve the issue by upgrading to Ivanti EPM 2024 SU8, which is available through the Ivanti License System.

CVE-2026-20320 is an XML External Entity (XXE) injection vulnerability found in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. The issue stems from the parser improperly handling XML entries because external entity resolution is enabled by default. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. This allows the attacker to read sensitive configuration information and view files from the filesystem with the privileges of the Cisco BroadWorks user. The vulnerability affects several Cisco BroadWorks products running versions earlier than release RI. 2026.07, including the Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. Cisco released patches for the issue in August 2026. In November 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation in the wild.

CVE-2026-125350 is a use-after-free vulnerability in the XML component of Google Chrome and other Chromium-based browsers. The flaw occurs when the browser attempts to access a memory location after it has already been released. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted HTML or XML page, which can allow the attacker to execute arbitrary code inside the browser's sandbox, bypass security restrictions, or cause a denial of service. The vulnerability was reported anonymously on November 6, 2026, and Google confirmed shortly after that it has been actively exploited in the wild. In response, Google released emergency updates to address the issue, patching it in Chrome Stable versions 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the updates.

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook that stems from the application failing to warn users before performing a potentially unsafe action. To exploit this flaw, an unauthenticated attacker must convince a target to open a specially crafted message file in an affected version of Outlook. The vulnerability cannot be triggered through the Preview Pane alone. Once the malicious file is opened, Outlook is forced to connect to an attacker-controlled network location without displaying the standard external-content warning. This unauthorized connection exposes the victim's NTLMv2 authentication hash to the remote server, allowing the attacker to capture the hash and potentially use it to impersonate the user in subsequent attacks. Discovered by researchers "nono" and Benoît Sevens, the vulnerability was addressed in Microsoft's November 2026 Patch Tuesday updates. Because the flaw has been actively exploited in the wild as a zero-day, the Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) Catalog.