Vulnerability intelligence

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.

CVE-2026-58115 is a missing authentication vulnerability affecting the Node-RED HTTP interface bundled with Siemens SIMATIC IoT2050 Advanced devices running Industrial OS (versions prior to V4.3.4.1). Because the Node-RED editor and admin API are exposed without access control by default, an unauthenticated remote attacker with network access can reach the programming interface. By deploying malicious flows containing built-in nodes—such as `exec` or `function` nodes—attackers can execute arbitrary system commands on the underlying server. In late October 2026, security researchers observed active exploitation of this vulnerability in the wild. Attackers targeted exposed instances by sending HTTP POST requests to deploy malicious flows, which automatically downloaded Linux bot payloads and established persistent web shells to execute remote commands. Siemens has addressed the issue in Industrial OS version V4.3.4.1 and later. For standalone Node-RED installations, administrators are advised to enable the `adminAuth` setting and restrict the editor from public internet access.

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that affects versions 4.7 through 7.1.3. The issue arises during the core update process when WordPress extracts a full-package upgrade into a predictable, web-accessible staging directory within the `wp-content/upgrade` folder. Because these temporary paths are predictable, an unauthenticated remote attacker can target the staged installer files during the brief extraction window to execute arbitrary PHP code on the underlying server. The vulnerability, discovered by researcher Umut Bayram, was patched with the release of WordPress version 7.1.4 on October 28, 2026, with security fixes backported to all affected branches. Despite the narrow timing window required to successfully exploit the race condition, security firms observed automated scanning and exploitation attempts targeting the staged installer paths almost immediately after disclosure. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw stems from the system mishandling how the privileged `dsinvoked` broker trusts configuration data stored in the `DSCache`. By manipulating this trust—specifically by temporarily modifying library code in memory and altering a maintenance task in the configuration store—an attacker with local authenticated access can execute arbitrary code with root-level privileges. Discovered by cybersecurity firm Volexity, this vulnerability was actively exploited in the wild in October 2026 by a threat actor tracked as UTA0576. The attacker chained CVE-2026-111357 with an authentication bypass (CVE-2026-104935) and a predictable-filename weakness (CVE-2026-118527) to achieve unauthenticated root access on fully patched appliances, which they used to harvest Active Directory credentials and sensitive metadata. In response, Ivanti released security patches on October 29, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.