October 28, 2026
- Veeam patched five flaws, led by CVE-2026-108142 (CVSS 9.1), an unauthenticated authorization bypass in the Backup & Replication CDP Coordinator Service, plus a local privilege escalation in managed Veeam Agent for Linux (@DarkWebInformer).
· Vulnerabilities & Exploits
in Pre-Boot RCE in EDK2 Breaks Cover Months Before Its Disclosure Date
September 24, 2026
- Veeam Agent for Windows LPE exploited with a public PoC. Arctic Wolf reports active exploitation of CVE-2026-32996 (CVSS 7.3), a local privilege escalation to SYSTEM; the GitHub PoC demonstrates it by running
whoami and writing the output to a file (The Hacker News).
· Vulnerabilities & Exploits
in The Exploit Is Public, the Ubuntu Patch Isn't
August 27, 2026
- Unauthenticated RCE in Veeam Service Provider Console: Bishop Fox details CVE-2026-58073 (CVSS 9.5) and CVE-2026-58072 (9.0), where a GUID is treated as an authentication credential, letting an attacker impersonate a managed agent and obtain its credentials. There is no 9.2.x backport — remediation means upgrading to 9.3.0.35057 (Bishop Fox).
· Vulnerabilities & Exploits
in When the Sandbox Isn't a Boundary
August 6, 2026
- Others worth noting: a CVSS 10.0 cross-tenant flaw in HashiCorp's Terraform MCP Server (one user's token reusable by later users) plus a CVSS 9.5 unauthenticated Veeam Service Provider Console bug, among 11 patched (The Hacker News); and an unfixed path-traversal in Apache Dubbo 3.0.0–3.3.6 (SecureLayer7).
· Vulnerabilities & Exploits
in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board
July 7, 2026
- Veeam Backup & Replication CVE-2026-44963 is an authenticated deserialization RCE letting low-privilege domain users execute code via a BinaryFormatter-based endpoint, thanks to insecure class filtering and broad authorization. Patches add gadget-class restrictions (SecureLayer7).
· Vulnerabilities & Exploits
in A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary