PULSEUnderground Intel

EN VIVO15señales / 24h

FEED

ransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransomn0n reclama a Pure Grow Diamonds Inc. · Manufacturingransomn0n reclama a Mach Law APC (San Diego family law and divorce practice) · US · Professional Servicesransomn0n reclama a Keidel Supply Company Incorporated · US · Manufacturingransomn0n reclama a Andrews Advisory Group LLC · US · Professional Servicesransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransomn0n reclama a Pure Grow Diamonds Inc. · Manufacturingransomn0n reclama a Mach Law APC (San Diego family law and divorce practice) · US · Professional Servicesransomn0n reclama a Keidel Supply Company Incorporated · US · Manufacturingransomn0n reclama a Andrews Advisory Group LLC · US · Professional Servicesransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilities

← Todos los CVEs

CVE Watch16 oct 2026

CVE-2026-14208

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities -

CVSS

—

Sin CVSS

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Publicado: 21 ago 2026 · Última mod.: 16 oct 2026 · CWE-732

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-09-262026-10-23

Descripción técnica

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to the built-in Everyone group (BUILTIN\Everyone, S-1-1-0). A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this directory. The DLLs are file-locked at runtime, but a race window exists when the service is stopped (e.g. during a software update or following a crash), during which a local unprivileged attacker can replace a DLL with a malicious payload. Upon service restart, the payload executes as NT AUTHORITY\SYSTEM. The DLL confirmed as actively loaded during testing is libasset32.dll. Additional DLLs in the same directory (eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, webmmux.dll) share identical insecure permissions.

Referencias oficiales

www.remoteutilities.comhttps://www.remoteutilities.com/product/release-notes.php#windows

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-936407.8 ALT

——0A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.1d CVE-2026-500577.8 ALT

——0A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.1d CVE-2025-30054—

——0CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.2d CVE-2025-30051—

——0The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS32d CVE-2026-96293—

——0A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.2d CVE-2026-115253—

——0An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.2d