Vulnerability intelligence

CVE-2026-6460 is a type confusion vulnerability in the PostgreSQL core database engine that stems from inadequate tracking of typed values. Because stored values do not carry self-identifying type information, stale values can persist in data dictionary entries, PL/pgSQL variables, and other parts of the system. An authenticated user with object-creation privileges—which can include the default permission to create temporary objects—can trigger this flaw using Data Definition Language (DDL) commands, such as altering column data types (e.g., `ALTER ... SET DATA TYPE`). By manipulating these types, an attacker can execute arbitrary code on the host system with the privileges of the operating system user running the database service. The vulnerability, which security researcher Mehmet Ince traced back to a 22-year-old design choice in PostgreSQL's core, was patched on November 12, 2026. The PostgreSQL Global Development Group addressed the issue in versions 18.7, 17.12, 16.16, 15.20, and 14.25 by introducing version checks to ensure stored values match their expected types. To achieve full protection, administrators must not only update their database binaries but also rebuild any installed C-language extensions, as older compiled extensions may lack the necessary type-checking mechanisms.

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook that stems from the application failing to warn users before performing a potentially unsafe action. To exploit this flaw, an unauthenticated attacker must convince a target to open a specially crafted message file in an affected version of Outlook. The vulnerability cannot be triggered through the Preview Pane alone. Once the malicious file is opened, Outlook is forced to connect to an attacker-controlled network location without displaying the standard external-content warning. This unauthorized connection exposes the victim's NTLMv2 authentication hash to the remote server, allowing the attacker to capture the hash and potentially use it to impersonate the user in subsequent attacks. Discovered by researchers "nono" and Benoît Sevens, the vulnerability was addressed in Microsoft's November 2026 Patch Tuesday updates. Because the flaw has been actively exploited in the wild as a zero-day, the Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) Catalog.

CVE-2026-123039 is a local privilege escalation vulnerability affecting the DynamicCLI service (specifically the DynamicCLI IPC interface) in Check Point's Gaia operating system. The vulnerability stems from a missing authorization flaw where the DynamicCLI daemon runs as root and listens on a world-writable local socket (`/tmp/dynamic_socket`) without authenticating connecting processes. This allows any authenticated local user or lower-privileged process to execute arbitrary commands with root privileges by writing a single request to the socket. In late October and early November 2026, threat actors actively exploited this vulnerability in the wild alongside "PHP2Shell" remote code execution flaws. After gaining initial access to Check Point Security Gateways through the Mobile Access portal, attackers leveraged CVE-2026-123039 to escalate their privileges from a restricted service account to root. This elevated access allowed them to deploy persistent PHP webshells, install the TSGA backdoor, and in some cases, pivot to internal networks to deploy wiper malware. Check Point has since released emergency hotfixes to address the vulnerability.

CVE-2026-123039 is a local privilege escalation vulnerability affecting the DynamicCLI service (specifically the DynamicCLI IPC interface) in Check Point's Gaia operating system. The vulnerability stems from a missing authorization flaw where the DynamicCLI daemon runs as root and listens on a world-writable local socket (`/tmp/dynamic_socket`) without authenticating connecting processes. This allows any authenticated local user or lower-privileged process to execute arbitrary commands with root privileges by writing a single request to the socket. In late October and early November 2026, threat actors actively exploited this vulnerability in the wild alongside "PHP2Shell" remote code execution flaws. After gaining initial access to Check Point Security Gateways through the Mobile Access portal, attackers leveraged CVE-2026-123039 to escalate their privileges from a restricted service account to root. This elevated access allowed them to deploy persistent PHP webshells, install the TSGA backdoor, and in some cases, pivot to internal networks to deploy wiper malware. Check Point has since released emergency hotfixes to address the vulnerability.

CVE-2026-114713 is a vulnerability in UnrealIRCd that affects versions 6.0.0 through 6.2.7, as well as the legacy UnrealIRCd 5 branch. The flaw is located within the software's labeled-response module, which fails to properly escape the IRCv3 "label" message tag when echoing it back into replies. On IRC networks configured with two or more linked servers, this improper neutralization of delimiters allows any ordinary user to inject server-to-server commands. Because these injected commands are executed with server authority, a regular user can issue operator-level commands—such as KILL and GLINE—to disconnect users and ban them network-wide. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. To address the issue, UnrealIRCd released version 6.2.7.1. Server administrators can remediate the flaw by upgrading to the new version, applying an official hot-patch that does not require a server restart, or deploying a temporary spamfilter workaround. For legacy UnrealIRCd 5 installations, the recommended mitigation is to blacklist the labeled-response module and restart the server.

CVE-2026-20320 is an XML External Entity (XXE) injection vulnerability found in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. The issue stems from the parser improperly handling XML entries because external entity resolution is enabled by default. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. This allows the attacker to read sensitive configuration information and view files from the filesystem with the privileges of the Cisco BroadWorks user. The vulnerability affects several Cisco BroadWorks products running versions earlier than release RI. 2026.07, including the Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. Cisco released patches for the issue in August 2026. In November 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation in the wild.