Two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited. These code injection flaws allow unauthenticated remote code execution, prompting urgent advisories for immediate patching.
Vulnerability Details
Affected Product: Ivanti Endpoint Manager Mobile (EPMM) versions 12.7.0.0 and prior.
Identifier: CVE-2026-1281, CVE-2026-1340
CVSS Score: 9.8 (Critical) for both vulnerabilities.
Exploitation Status: Actively Exploited. CISA has added CVE-2026-1281 to its Known Exploited Vulnerabilities (KEV) catalog.
Risk & Impact
Triage: Immediate patching is required due to active exploitation and the availability of public proof-of-concept (PoC) code.
Attack Vector: An unauthenticated attacker can send specially crafted HTTP requests over the network to achieve remote code execution. This allows for the deployment of web shells and backdoors for persistent access.
Ease of Exploit: The exploit requires no authentication or user interaction, making it easy for attackers to automate.
Action Plan
Immediate Action: Apply the version-specific RPM security updates provided by Ivanti immediately.
CRITICAL WARNING: These RPM hotfixes do not persist through system upgrades. If you upgrade your EPMM firmware (e.g., from 12.5 to 12.6) after patching, the fix will be deleted. You must re-apply the RPM immediately after any firmware upgrade until the permanent fix in Version 12.8.0.0 is released.
Workaround: If patching is not immediately possible, restrict access to the EPMM management interface from the internet or use a Web Application Firewall (WAF) to filter traffic.
Detection: Ivanti has provided guidance for hunting for evidence of exploitation by searching Apache Access Logs. Monitor for suspicious HTTP requests, unexpected process execution, and unusual outbound network connections from EPMM servers.
Relevant professional terms
Web Shell
A malicious script uploaded to a web server that allows an attacker to maintain persistent access and remotely execute commands.
Backdoor
A covert method of bypassing normal security and authentication measures to gain unauthorized access to a system, network, or application.
An AI-powered analysis discovered twelve zero-day vulnerabilities in OpenSSL, leading to a major security update on January 27, 2026. The most severe of these, CVE-2025-15467, is a critical stack buffer overflow that could allow for remote code execution and has been patched.
Vulnerability Details
Affected Product:OpenSSL versions 3.0, 3.3, 3.4, 3.5, and 3.6. (Note: OpenSSL 1.0.2 and 1.1.1 are not affected by this specific critical RCE, though they were patched for other lesser severities in this batch)
Identifier: CVE-2025-15467
CVSS Score: 9.8 (Critical)
Exploitation Status: Not specified as actively exploited in the wild, but proof-of-concept exploits have been developed online.
Risk & Impact
Triage: Immediate patching is required due to the critical nature and potential for remote code execution.
Attack Vector: An attacker could send a maliciously crafted Cryptographic Message Syntax (CMS) message to a vulnerable system. Processing this message could trigger a stack-based buffer overflow, leading to a crash or arbitrary code execution.
Ease of Exploit: While modern defenses complicate reliable code execution, the vulnerability is pre-authentication, and exploits have been developed. The most likely impact is denial of service, but RCE remains a possibility.
Action Plan
Immediate Action: Upgrade to the fixed version for your branch: 3.6.1, 3.5.5, 3.4.4, 3.3.6, or 3.0.19. Note: Patches for EOL versions 1.1.1ze and 1.0.2zn are available only to Premium Support customers; public users on these versions should migrate to 3.x immediately.
Workaround: No specific workarounds have been listed; upgrading is the recommended course of action.
Detection: Monitor for and inspect traffic involving the parsing of untrusted CMS AuthEnvelopedData, commonly used in S/MIME and PKCS#7 workflows.
Relevant professional terms
Zero-Day Vulnerability
A software security flaw that is known to the software vendor but does not have a patch in place to fix the flaw. It has a high-security risk because it is open to exploitation by hackers.
Stack Buffer Overflow
A type of software vulnerability that occurs when a program writes more data to a buffer located on the stack than what is allocated for that buffer. This can overwrite adjacent memory, leading to program crashes, unexpected behavior, or remote code execution.
Mozilla has addressed several memory safety bugs, tracked as CVE-2023-6864, which showed evidence of memory corruption. These vulnerabilities, now patched, could have been exploited by an attacker to execute arbitrary code.
Vulnerability Details
Affected Product: Firefox versions before 121, Firefox ESR versions before 115.6, and Thunderbird versions before 115.6.
Identifier: CVE-2023-6864
CVSS Score: 8.8 (High)
Exploitation Status: No known active exploitation.
Risk & Impact
Triage: Immediate patching is recommended due to the potential for arbitrary code execution.
Attack Vector: An attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted, malicious website or HTML email.
Ease of Exploit: The vulnerability requires user interaction, and successful exploitation would require "enough effort," according to Mozilla.
Action Plan
Immediate Action: Upgrade to Firefox 121, Firefox ESR 115.6, or Thunderbird 115.6.
Workaround: No specific workarounds have been provided by the vendor; updating is the primary mitigation.
Detection: Monitor for unexpected browser crashes, unusual child processes spawned by Firefox or Thunderbird, and anomalous network connections.
Relevant professional terms
Memory Corruption
A type of software bug where a program unintentionally modifies a memory location, which can lead to crashes, incorrect behavior, or security exploits like arbitrary code execution.
Arbitrary Code Execution
An attacker's ability to run any commands or code of their choice on a target machine. It is often the ultimate goal of an exploit, granting the attacker full control over the compromised system.
A flaw exists in PostgreSQL where a predefined role can improperly signal and terminate superuser-owned background processes, potentially leading to a denial of service. This vulnerability, identified as CVE-2023-5870, has been assessed and patches have been released.
Vulnerability Details
Affected Product: PostgreSQL versions 11 through 16.
Identifier: CVE-2023-5870
CVSS Score: 4.4 (Medium)
Exploitation Status: Not actively exploited.
Risk & Impact
Triage: Moderate. While the core vulnerability has limited impact, it can be significant for environments using non-core extensions with less resilient background workers.
Attack Vector: A remote, authenticated user with the `pg_signal_backend` role can send signals to terminate certain superuser processes like the autovacuum launcher. This contradicts documentation stating the role cannot signal superuser-owned backends.
Ease of Exploit: High complexity. Successful exploitation requires the presence of a non-core extension with a background worker that does not automatically restart.
Action Plan
Immediate Action: Upgrade to a patched version. Fixes are available in versions 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22.
Workaround: There are no specific workarounds mentioned other than applying the patch.
Detection: Monitor for unexpected terminations of PostgreSQL background worker processes, particularly those associated with third-party extensions.
Relevant professional terms
Superuser
In a PostgreSQL context, a superuser is a privileged role that bypasses all permission checks, except for the right to log in. It has the highest level of administrative access to the database.
Denial of Service (DoS)
A cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet.
An out-of-bounds write vulnerability, identified as CVE-2025-27363, exists in the FreeType font rendering library. The flaw can be triggered when parsing specially crafted font files, potentially leading to arbitrary code execution, and there are indications that it is being actively exploited in targeted attacks.
Vulnerability Details
Affected Product: FreeType versions 2.13.0 and below
Identifier: CVE-2025-27363
CVSS Score: 8.1 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is required; this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Attack Vector: An attacker can exploit this by tricking a user or an application into processing a malicious font file (TrueType GX or variable font). This can be a zero-click attack, requiring no user interaction.
Ease of Exploit: The attack complexity is considered high, but it has been demonstrated to be under limited, targeted exploitation in the wild.
Action Plan
Immediate Action: Upgrade to a patched version of FreeType. Version 2.13.3 is confirmed to be not vulnerable.
Workaround: If immediate patching is not possible, restrict the use of fonts from untrusted sources. No definitive workarounds have been provided.
Detection: Monitor systems for the loading of unusual or untrusted font files. Organizations should review security advisories from their specific Linux distribution or software vendors for detailed patching information.
Relevant professional terms
Out-of-bounds Write
A type of memory corruption vulnerability where a program writes data beyond the boundaries of an allocated buffer. This can corrupt adjacent memory, lead to a crash, or be leveraged by an attacker to execute arbitrary code.
Heap Buffer
A region of memory in the heap used for dynamic data storage during the execution of a program. The vulnerability in FreeType causes too small of a heap buffer to be allocated, which is then overwritten, leading to the out-of-bounds write condition.
