Vulnerability intelligence

CVE-2026-94127 is a heap-based buffer overflow vulnerability found in F5 BIG-IP Access Policy Manager (APM). This flaw specifically affects systems where an access policy and an OAuth profile are configured on a virtual server. The vulnerability allows an unauthenticated attacker to achieve remote code execution by sending specially crafted malicious traffic to the affected BIG-IP APM system. This issue has been observed to be actively exploited in the wild.

It appears there might be a slight typo in the CVE ID provided. Based on popular articles, a closely related vulnerability is **CVE-2026-61151**, which affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager. CVE-2026-61151 is an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search or Oracle Commerce Experience Manager. Successful exploitation of this vulnerability can lead to unauthorized access to critical data, or even complete access to all data accessible by these Oracle Commerce products. Additionally, an attacker could gain unauthorized update, insert, or delete access to some of the accessible data. The affected version is 11.4 of Oracle Commerce.

CVE-2026-65660 is a vulnerability affecting Microsoft Office SharePoint, specifically SharePoint Server 2016, 2019, and Subscription Edition, with potential impact on SharePoint 2013. This flaw stems from an improper control of code generation, characterized as a 'code injection' vulnerability. It involves a parser desynchronization issue within SharePoint's `SafeControls` filter, which is designed to prevent the loading of dangerous classes. The vulnerability arises when the `ToolPane` component processes web-part markup, failing to properly escape quotes within attribute values when reconstructing `Register` directives. This oversight allows an attacker to inject additional directives through unescaped quotes, enabling the registration of arbitrary .NET classes. While initially described by Microsoft as a spoofing vulnerability, further technical analysis revealed that CVE-2026-65660 can lead to authenticated remote code execution (RCE). Researchers have also demonstrated that this flaw can be chained with other vulnerabilities to achieve pre-authentication remote code execution on servers configured to allow anonymous page access.

CVE-2026-94127 is a heap-based buffer overflow vulnerability found in F5 BIG-IP Access Policy Manager (APM). This flaw specifically affects systems where an access policy and an OAuth profile are configured on a virtual server. The vulnerability allows an unauthenticated attacker to achieve remote code execution by sending specially crafted malicious traffic to the affected BIG-IP APM system. This issue has been observed to be actively exploited in the wild.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.