PULSEUnderground Intel

EN VIVO19señales / 24h

FEED

ransomakira reclama a Bravilor Bonamat · NL · Manufacturingransomakira reclama a SCHWAB-SYSTEM · DE · Financial Servicesransomorova reclama a Wah Chan Consolidated Sdn Bhd · MY · Otherransomorova reclama a Trevi Technology · TW · Technologyransomdoommageddon reclama a R*********b R**-L** · Not Foundransomsarcoma reclama a Don Pickett & Associates · Professional Servicesransomscarlettgroup reclama a vinsolutions.com · US · Professional Servicesransomauditteam reclama a Ca***ka · ES · Not Foundransomrhysida reclama a Line2Line Coatings · Manufacturingransomfulcrumsec reclama a EMARKETER · US · Technologyransomn0n reclama a Horn of Africa Regional Environment Centre and Network · ET · Otherransomwallstreet reclama a Prism Medical Products · US · Healthcareransomn0n reclama a PROTEX Confection · TN · Manufacturingransomn0n reclama a SunTechnics Fabrisolar AG · CH · Energy & Utilitiesransomakira reclama a Bravilor Bonamat · NL · Manufacturingransomakira reclama a SCHWAB-SYSTEM · DE · Financial Servicesransomorova reclama a Wah Chan Consolidated Sdn Bhd · MY · Otherransomorova reclama a Trevi Technology · TW · Technologyransomdoommageddon reclama a R*********b R**-L** · Not Foundransomsarcoma reclama a Don Pickett & Associates · Professional Servicesransomscarlettgroup reclama a vinsolutions.com · US · Professional Servicesransomauditteam reclama a Ca***ka · ES · Not Foundransomrhysida reclama a Line2Line Coatings · Manufacturingransomfulcrumsec reclama a EMARKETER · US · Technologyransomn0n reclama a Horn of Africa Regional Environment Centre and Network · ET · Otherransomwallstreet reclama a Prism Medical Products · US · Healthcareransomn0n reclama a PROTEX Confection · TN · Manufacturingransomn0n reclama a SunTechnics Fabrisolar AG · CH · Energy & Utilities

← Todos los CVEs

CVE Watch8 oct 2026

CVE-2026-76501

A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, kn

CVSS

9.8

Crítico

EPSS

0.5%

p43

KEV

—

Exploit Today

13

0-100

Publicado: 7 oct 2026 · Última mod.: 8 oct 2026 · CWE-121

EPSS · 30d

0.5%EPSS · 30 días0.5%

2026-10-082026-10-23

Descripción técnica

A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SRv6 features are enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

Referencias oficiales

sec.cloudapps.cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1158637.6 ALT

———ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded "c += jump + 1" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.46m CVE-2026-539219.8 CRÍ

———odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.5h CVE-2026-961857.5 ALT

——13Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.20h CVE-2026-94502—

——4In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.7h CVE-2026-85080—

——8In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.7h CVE-2026-85079—

——7In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.1d