🔐
Pre-Auth Heap Overflow in libssh2 Clients
Anyone shipping or using libssh2-based SSH clients should update as soon as a fixed release is available or backport the referenced fix. The attack is server-driven and occurs before authentication, making it especially important for clients connecting to untrusted SSH servers.
CVE-2026-66035 is a HIGH-severity heap buffer overflow in libssh2 through 1.11.1 with a CVSS score of 7.5. A malicious SSH server can exploit the flaw before authentication by sending a crafted packet during Encrypt-then-MAC cipher negotiation, potentially corrupting heap metadata and enabling code execution techniques. The issue is fixed in commit 42e33d8.
🔗 Read more 🔗
Source: NVD
🛡️
libssh2 Bounds Check Bug Leaks Memory
Organizations using libssh2 should prioritize updates, particularly where clients connect to untrusted SSH endpoints. The combination of information disclosure and heap corruption makes this worth addressing promptly.
CVE-2026-66034 is a HIGH-severity missing bounds check vulnerability in libssh2 through 1.11.1 with a CVSS score of 7.5. A malicious SSH server can trigger an arbitrary-length heap out-of-bounds read and free an uninitialized pointer through the public key subsystem, potentially leaking memory and corrupting heap state. The issue is fixed in commit a13bb6c.
🔗 Read more 🔗
Source: NVD
⚠️
Stored XSS Hits Loytec OPC XML-DA
Operators of affected Loytec deployments should patch quickly and restrict administrative interface exposure where possible. This is especially important for environments managing industrial infrastructure.
CVE-2026-12496 is a HIGH-severity stored cross-site scripting vulnerability affecting multiple Loytec products through version 8.4.16 on LINX-A64, with a CVSS score of 8.7. An unauthenticated attacker can inject JavaScript via a crafted User-Agent header in a POST /da request, leading to session hijacking, credential theft, or device reconfiguration in an administrator’s browser.
🔗 Read more 🔗
Source: NVD
🔑
Loytec Privilege Management Flaw Enables Password Resets
Administrators should apply vendor fixes and review privileged account assignments. While authenticated access is required, the impact on account integrity is significant.
CVE-2026-12502 is a HIGH-severity improper privilege management vulnerability in multiple Loytec products through version 8.4.16 on LINX-A64 with a CVSS score of 8.4. A user in the superadmin group can reset the password of any LARM user, including the larmapp service account, through the set-passwd subcommand.
🔗 Read more 🔗
Source: NVD
🚨
Critical Symlink Attack Leads to Root on Loytec
Patch this quickly if affected systems are deployed. Even though authentication is required, the path to full root compromise makes this a high-priority fix.
CVE-2026-12503 is a CRITICAL improper link resolution vulnerability affecting several Loytec products through version 8.4.16 on LINX-A64 with a CVSS score of 9.2. An authenticated larmapp user can exploit a symlink attack to make /etc/passwd writable, ultimately enabling root privilege escalation.
🔗 Read more 🔗
Source: NVD
🧩
PAM Authentication Flaw Grants Root Access
System owners should deploy patches and audit local account configurations immediately. This issue can directly result in root-level access on affected devices.
CVE-2026-12504 is a HIGH-severity improper authentication vulnerability in the PAM configuration of multiple Loytec products through version 8.4.16 on LINX-A64 with a CVSS score of 8.4. A local attacker can authenticate as a uid=0 account without a password if an /etc/passwd entry contains an empty password field, obtaining a root shell.
🔗 Read more 🔗
Source: NVD
🔍
Loytec LWEB-802 Credential Leak via Crafted Link
Upgrade affected LWEB-802 installations and encourage administrators to clear stored browser data where appropriate. Credential exposure can lead to broader compromise.
CVE-2026-55729 is a HIGH-severity information disclosure vulnerability in Loytec LWEB-802 before version 5.0.8 with a CVSS score of 7.7. An unauthenticated attacker can use a crafted link to expose stored management credentials from browser localStorage.
🔗 Read more 🔗
Source: NVD
🌐
Reflected XSS in Loytec LWEB-802
Patch promptly and avoid opening untrusted links to management interfaces until systems are updated. Administrative users are the highest-risk targets.
CVE-2026-55730 is a HIGH-severity reflected cross-site scripting vulnerability in Loytec LWEB-802 before version 5.0.8 with a CVSS score of 8.7. A crafted link using the project or mspParams parameter can execute arbitrary JavaScript in a victim’s browser with the victim’s privileges.
🔗 Read more 🔗
Source: NVD
📡
BACnet Parsing Bug Can Reboot Loytec Devices
Organizations using affected BACnet-enabled devices should prioritize updates, especially on exposed or operational technology networks. Network filtering can help reduce exposure until patches are applied.
CVE-2026-55732 is a HIGH-severity out-of-bounds read vulnerability affecting multiple Loytec products through version 8.4.18 on LINX-A64 with a CVSS score of 8.7. A malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet can crash the process and ultimately reboot the device. Multiple additional Loytec products are also affected.
🔗 Read more 🔗
Source: NVD
☁️
Critical Azure Kubernetes Service Privilege Escalation
Azure Kubernetes Service customers should treat this as an emergency and apply Microsoft’s guidance or mitigations immediately. A network-reachable privilege escalation with a maximum CVSS score deserves top priority.
CVE-2026-56163 is a CRITICAL missing authentication vulnerability in Microsoft Azure Kubernetes Service with a CVSS score of 10.0. The flaw allows an unauthorized attacker to elevate privileges over a network due to missing authentication for a critical function.
🔗 Read more 🔗
Source: NVD
🚨
Critical SSRF Enables Privilege Escalation
If you run the affected Data Quality product, prioritize remediation immediately. The maximum CVSS score indicates this should be handled with urgency.
CVE-2026-57106 is a CRITICAL server-side request forgery vulnerability in Data Quality with a CVSS score of 10.0. An unauthorized attacker can exploit the flaw over a network to elevate privileges.
🔗 Read more 🔗
Source: NVD
☁️
Azure App Service Access Control Bug Rated Critical
Azure App Service users should follow Microsoft’s remediation guidance without delay. A remotely exploitable privilege escalation rated 10.0 warrants immediate attention.
CVE-2026-58630 is a CRITICAL improper access control vulnerability in Azure App Service with a CVSS score of 10.0. The flaw allows an unauthorized attacker to elevate privileges over a network.
🔗 Read more 🔗
Source: NVD