Threat Alerts

Multiple vulnerabilities in JFrog Artifactory allow unauthenticated attackers to bypass authentication and retrieve arbitrary artifacts, risking exposure of proprietary code, embedded secrets, and enabling further compromise via dependency tampering or lateral movement.

A path-matching flaw in the AWS token exchange flow, CVE-2026-42018 (CVSS Score 7.5), permits requests with a trailing slash to skip authentication filters, causing the service to mint a JWT for the anonymous principal without validating IAM mapping. The token can be used to call authenticated APIs and access resources normally restricted to authenticated users.

A separate issue in the UI stash feature, CVE-2026-69107 (CVSS Score 5.9), permits creation of server-side stash entries using attacker-controlled repository and path values; stash objects are saved to an HTTP session without authorization checks, exposing artifact metadata and content-addressing keys that can be dereferenced to retrieve artifact bytes.

Multiple critical vulnerabilities in Zoom Workplace, including CVE-2026-53413 and CVE-2026-53414, can allow an attacker participating in a meeting to achieve zero-click remote code execution on another participant’s device. The flaws affect Zoom’s annotation functionality and were confirmed across Windows, macOS, iOS, Android, and Linux clients, requiring no interaction, download, or visible action from the victim.

The vulnerabilities originate from memory-safety issues in Zoom’s proprietary annotation protocol. CVE-2026-53413 (CVSS Score 8.3) is an out-of-bounds write caused by insufficient validation of attacker-controlled data during annotation deserialization, while CVE-2026-53414 (CVSS Score 6.5) can expose process memory and potentially provide information required to bypass protections such as ASLR. By sending specially crafted annotation messages through a legitimate Zoom meeting, an attacker can corrupt the receiving client’s memory and potentially execute arbitrary code with the privileges of the Zoom process.

A critical remote code execution vulnerability in SAP Commerce Cloud, CVE-2026-58231 (CVSS Score 10.0), allows unauthenticated remote attackers to execute arbitrary code and compromise vulnerable systems. The vulnerability is actively exploited in the wild, with exploitation attempts observed against honeypots only three days after SAP released a security update.

The vulnerability stems from insufficient authorization checks and input validation, allowing an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to vulnerable functions. Successful exploitation can result in arbitrary code execution and compromise of internal components, potentially affecting the confidentiality, integrity, and availability of the application. No public proof-of-concept was reported when the initial exploitation activity was identified, and the threat actors responsible for the observed attacks remain unknown.

Akira ransomware affiliates have begun abusing Windows Safe Mode with Networking to disable endpoint detection and Microsoft Defender, creating a temporary window for hands-on access, data collection, and exfiltration before attempting encryption. This elevates data-extortion risk.

Initial access followed credential-spraying against an internet-exposed SSL VPN account without MFA, then RDP into a domain controller for Active Directory discovery. Shared files were archived and staged, uploaded to attacker-controlled S3 storage using a cloud transfer tool, and a remote-access service was installed for persistence and payload delivery. Boot configuration was changed to force a Safe Mode with Networking startup so third-party EDR and Defender remained offline during the attempted encryptor run.

The Akira payload launched in Safe Mode but experienced virtual-memory failures and did not complete encryption; the binary was quarantined only after the system returned to normal boot and Defender real-time protection resumed. Data theft and credential exposure occurred prior to the failed encryptor, preserving extortion leverage.

Lazarus group, a North Korean‑linked threat actor exploited a Windows privilege‑escalation zero‑day, CVE-2026-68820 (CVSS Score 7.0), to deploy a remote backdoor and a kernel‑mode rootkit. Successful exploitation yields SYSTEM privileges and persistent remote access, increasing espionage risk.

The campaign uses recruiter‑style social engineering to convince targets to open malicious PDFs or install a trojanized PDF viewer. One infection chain decodes an embedded payload inside the viewer and loads an in‑memory backdoor referred to as Troy. A parallel chain employs a DLL side‑loading sequence to launch a lightweight downloader (MISTPEN) that retrieves modules via Microsoft Graph API and OneDrive, then leverages the AFD.sys use‑after‑free flaw to escalate privileges and install a kernel implant for stealth and persistence.

The combination of in‑memory loaders, cloud API retrieval, a kernel exploit, and a rootkit enables long‑term access and data collection. Microsoft issued an update in August 2026 to remediate CVE-2026-68820.

Lucid Stealer is a Node.js SEA-based information stealer that uses encryption, obfuscation and UAC bypass techniques to evade detection while targeting browser credentials, Discord tokens, screenshots, and keystrokes. The malware disguises itself as a legitimate JavaScript runtime and leverages the Node.js Single Executable Applications (SEA) framework to conceal its payload. Anti-analysis techniques include encrypted payloads, obfuscated resources and false certificate-like structures, while PowerShell, code compilation utilities and a malicious native module support its execution and data theft capabilities.

Once active, Lucid Stealer communicates with its command-and-control (C2) infrastructure through WebSocket connections and HTTP POST requests to transmit stolen data and system metadata. The malware also attempts to elevate privileges through UAC bypass techniques and hides its working directory using system-level file attributes. Directory listings on the identified C2 infrastructure revealed a remote access trojan (RAT), suggesting shared infrastructure or potential coordination between multiple malware families. The combination of layered evasion, broad-spectrum information theft and shared C2 infrastructure enables Lucid Stealer to target sensitive personal, authentication and financial data across multiple attack surfaces.