Do Son A new analysis details how the RansomEXX gang exploited a use-after-free zero-day (CVE-2025-29824) in the Windows Common Log File System to gain SYSTEM privileges.
privilege escalation
A critical privilege escalation flaw in Capsule Kubernetes (CVE-2025-55205) allows tenant users to bypass security and launch cross-tenant attacks.
Zoom has released security updates addressing two significant vulnerabilities in its Windows-based clients—CVE-2025-49456 and CVE-2025-49457—that could enable...
A critical UAF flaw in the Linux kernel (CVE-2025-38236) allows for privilege escalation. A PoC exploit is now public, demonstrating how to escape the Chrome sandbox and gain kernel control.
Microsoft warns of a critical flaw (CVE-2025-53786) in Exchange hybrid environments, allowing attackers with on-prem admin access to escalate privileges in Exchange Online.
Elastic patched two local privilege escalation flaws (CVE-2025-0712, CVE-2025-25011) in APM Server and Beats for Windows, allowing local attackers to gain SYSTEM privileges.
BeyondTrust patches two high-severity LPE flaws (CVE-2025-2297, CVE-2025-6250) in Privilege Management for Windows, allowing local attackers to gain SYSTEM privileges via user profile manipulation and WMIC exploit.
A critical privilege escalation flaw (CVE-2025-6241) in Lakeside Software's SysTrack allows low-privileged local users to gain SYSTEM access via DLL hijacking. Patch immediately.
NVIDIA released critical security updates for GPU Display Drivers and vGPU software, patching 14 vulnerabilities that could lead to code execution, privilege escalation, or data leaks.
A high-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows allows local users to escalate privileges due to an OpenSSL config file path vulnerability.
A critical vulnerability in ASUSTOR's Windows apps, ASUSTOR Backup Plan and EZSync, allows local attackers to gain SYSTEM privileges via unquoted service paths.
Sophos has patched three high-severity LPE vulnerabilities in Intercept X for Windows (CVE-2024-13972, CVE-2025-7433, CVE-2025-7472), allowing local users to gain SYSTEM privileges.
A Windows CLFS zero-day (CVE-2025-29824) actively exploited by RansomEXX and Play ransomware gangs for privilege escalation, with a public PoC. Patch now!
Lenovo issued patches for three vulnerabilities in Lenovo Vantage (CVE-2025-6230, CVE-2025-6231, CVE-2025-6232) allowing local privilege escalation on PCs. Update immediately.
Datadog reveals a method to impersonate any hybrid Entra ID user, including Global Admins, by exploiting Office 365 Exchange Online service principal. Microsoft calls it "expected behavior."
Microsoft introduces RedirectionGuard for Windows 11, a new mitigation feature designed to block filesystem redirection attacks using junctions, preventing privilege escalation.
NVIDIA patched critical vulnerabilities in its Container Toolkit and GPU Operator, allowing privilege escalation, data tampering, and DoS in containerized environments.
A kernel-level UAF flaw (CVE-2025-38001) in Linux HFSC/NETEM allows root privilege escalation via RBTree manipulation. PoC available. Update now!
CERT/CC warns of critical flaws in Gigabyte UEFI firmware, allowing SMRAM writes and SMM code execution. Patch immediately to prevent firmware implants and Secure Boot bypass.
A Windows Update flaw (CVE-2025-48799) allows SYSTEM privilege escalation via arbitrary folder deletion using symlinks on multi-drive systems. PoC available. Patch now!
Schneider Electric warns of critical flaws (CVSS 10.0 RCE, SSRF, EoP) in EcoStruxure IT Data Center Expert. Patch to v9.0 immediately to prevent data center disruption.
Unit 42 reveals "Gold Melody" uses leaked ASP.NET Machine Keys to achieve in-memory RCE via View State deserialization and privilege escalation via GodPotato, compromising web servers.