🚨 ACTIVE EXPLOITATION
CVSS 10.0 VeloCloud Orchestrator Flaw (CVE-2026-93952) Actively Exploited in Certificate-Based Setups
CVE-2026-93952
Arista warns that attackers are actively exploiting a CVSS 10.0 flaw in on-premises VeloCloud Orchestrators configured for certificate-based Edge authentication.- Applies to on-premises VeloCloud Orchestrator (VCO) deployments where certificate-based authentication from VeloCloud Edge to VCO is configured; Hosted and Dedicated VCOs are already patched.
- CVE-2026-93952 (CVSS 3.1: 10.0) lets a remote attacker with no login access privilege internal functions and affect the VCO host; a successful attack may compromise the orchestrator, its managed data, and the Edge devices it manages.
- The attacker needs network access to the VCO web interface and the public part of an Edge's authentication certificate; affected versions are 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, and 7.0.0.2 and earlier.
- Fixes are out for the 5.2 (5.2.3.16+) and 6.4 (6.4.2.8+) trains as of September 22; no fix yet for 6.1 and 7.0 trains.
- Indicators of compromise include files /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0), /etc/systemd/system/vc-sysmon.service, the x-vc-opt HTTP header in nginx logs, and IPs 142.93.149[.]77 and 104.248.126[.]159.
Veeam Agent LPE flaw CVE-2026-32996 exploited to gain SYSTEM privileges on Windows
CVE-2026-32996
A public proof-of-concept exploit for a local privilege escalation flaw in Veeam Agent for Microsoft Windows lets low-privileged users run commands as SYSTEM.- Affects Veeam Agent for Microsoft Windows version 13.0.1.2067 and earlier 13 builds; fixed in build 13.0.3.1220 (via Veeam Backup & Replication 13.0.2.29 or later).
- The flaw (CVE-2026-32996) resides in the Veeam Endpoint Backup service, which handles privileged activity through a local gRPC named pipe at \.\pipe\Veeam\VAW\ServiceConnectionPipe.
- The service stores an elevated administrator identity against a client-controlled session UID not tied to the requesting user, letting a local attacker reuse an elevated session identifier to run commands with NT AUTHORITY\SYSTEM rights.
- Required session identifiers can be read by standard users from Svc.VeeamEndpointBackup.log under C:\ProgramData\Veeam\Endpoint; public PoC code retrieves a valid GUID from the log and executes whoami as SYSTEM.
- Technical details and exploit code were publicly released on September 14, 2026 by GitHub researcher suce0155, raising the risk of use in post-compromise attack chains.
Sources 📄 Source: github.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🕵️ RESEARCH & DEEP DIVES
Researcher Nightmare Eclipse Reveals Identity as Abdelhamid Naceri, Releases New Defender Exploit
The researcher known as Nightmare Eclipse revealed he is former Microsoft employee Abdelhamid Naceri and released a new Windows Defender exploit called BigDiskBuster.- Affects Windows Defender on all currently supported Windows versions
- BigDiskBuster is a proof-of-concept exploit that prevents Defender from completing platform and signature updates, similar to the earlier UnDefender PoC
- The researcher, also known as Chaotic Eclipse and MSNightmare, has published a rapid string of Windows and Defender PoC exploits
- Naceri is a former Microsoft Germany employee who says he was terminated abruptly and lost a German labor court challenge over his dismissal
- He admitted fabricating earlier claims that Microsoft filed legal action against him
ENISA: Mustang Panda breached maritime orgs in four EU states and governments in three others
ENISA's Threat Landscape 2026 reports China's Mustang Panda hacked shipping and maritime organizations across four EU member states and government bodies in three more.- Applies to EU shipping, maritime organizations, and government entities in seven member states
- China-linked Mustang Panda group breached these organizations, per ENISA's Threat Landscape 2026 report
- The finding comes from ENISA's analysis of incidents observed January 1 to December 31, 2025
📋 ADVISORIES
📄 Source for SharePoint RCE flaw CVE-2026-65660 lets low-privileged users run code (CVSS 8.8) — blog.viettelcybersecurity.com
📄 Source for Linux KVM/arm64 flaw CVE-2026-89775 lets guests escape VMs and access host memory — openwall.com
🔓 CVEs & KEV
CVE-2026-95675 — D-LINK DAP-1360 — CVSS 9.3 — D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management InterfaceD-Link D...
CVE-2026-75939 — Red Hat OpenShift Container Platform 4 — CVSS 7.4 — Red Hat OpenShift Flaw Lets Attackers Bypass PGP Checks and Push Malicious Releases
CVE-2026-95679 — MISP — CVSS 6.9 — MISP Unauthenticated Blind SSRF via XML Body ProcessingMISP's RequestHandlerC...
CVE-2026-95667 — MISP — CVSS 6.9 — MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Creden...
CVE-2026-95658 — MISP — CVSS 6.9 — MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-sit...
CVE-2026-94393 — MISP — CVSS 6.4 — MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in edi...
CVE-2026-94394 — MISP — CVSS 6.3 — MISP ObjectReferencesController: Granular Distribution and Sharing Group Rest...