Oracle Essbase Flaw Allows Low-Privilege Network Takeover

🕵️ RESEARCH & DEEP DIVES

• Lazarus' Operation FlashHole targets South Korea via CrossWeb EX abuse and watering holes
  Kaspersky details Operation FlashHole, a new Lazarus campaign against South Korean organizations abusing the CrossWeb EX financial security software.
  • At least three South Korean organizations in software, construction, and wired communication equipment manufacturing were hit, with activity dating back to July 2025.
  • The attack chain abuses INISAFE CrossWeb EX V3 (version 3.4.1.2), mandatory financial security software for online banking and government sites in South Korea, spawning malware in memory with high integrity.
  • Initial access combines watering-hole compromise with spear-phishing emails linking to fabricated portfolio and résumé pages tailored to each target.
  • The modular malware set (TechHub, Cubridge, TouchHub, TouchShift, ClientHub, LPEClient) runs almost entirely in memory, and C2 traffic is protected with post-quantum cryptography.
  • The campaign follows Operation SyncHole, which abused Cross EX and a zero-day in Innorix Agent against at least six South Korean organizations.
  • IOCs including file hashes, file paths, and C2 servers are published in the Securelist report.
  Sources 📎 Coverage: securelist.com · 👁 via Securelist (Kaspersky)

🔓 CVEs & KEV

• CVE-2026-91658 — Oracle Corporation Oracle Essbase — CVSS 9.9 — Oracle Essbase Security Flaw Allows Low-Privilege Network Takeover and Scope Change

• CVE-2026-114119 — Best Practice Software Bp Premier — CVSS 9.3 — Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Adm...

• CVE-2026-114112 — lovell sharp — CVSS 8.9 — Sharp before 0.35.4 RCE via bundled libheif AVIF decodingSharp before 0.35.4 ...

• CVE-2026-114111 — lovell sharp — CVSS 8.9 — Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitysharp befo...

• CVE-2026-82814 — smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More — CVSS 8.8 — Duplicator through 1.5.17 and Duplicator Pro through 4.6.10 - Unauthenticated PHP Objec...

• CVE-2026-114110 — astral-sh uv — CVSS 8.7 — Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD EntriesAstra...

• CVE-2026-114109 — astral-sh uv — CVSS 8.7 — uv before 0.11.15 Arbitrary File Write via Entry Point Namesuv before 0.11.15...

• CVE-2026-114113 — lovell sharp — CVSS 8.4 — Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decode...

• https://cve.threatint.com/CVE/CVE-2026-69242 — libvips — CVSS 8.4 — Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decode...

• CVE-2026-96889 — Red Hat Enterprise Linux 10 — CVSS 7.8 — Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitysharp befo...

• CVE-2026-33327 — Libvips Libvips — CVSS 7.0 — Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decode...

• CVE-2026-35591 — Libvips Libvips — CVSS 7.0 — Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decode...

• CVE-2026-33328 — Libvips Libvips — CVSS 6.8 — Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decode...

• https://cve.threatint.com/CVE/CVE-2026-35590 — Libvips Libvips — CVSS 6.8 — Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decode...