{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T00:38:06.301Z",
  "tag": {
    "id": "privilege-escalation",
    "label": "Privilege escalation",
    "isStack": false,
    "url": "https://pwn.watch/t/privilege-escalation",
    "feed": "https://pwn.watch/t/privilege-escalation/feed.xml"
  },
  "counts": {
    "incidents": 20,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 20
  },
  "incidents": [
    {
      "slug": "arista-velocloud-orchestrator-cve-2026-114625",
      "title": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Arista VeloCloud Orchestrator (VCO) On-Prem",
      "tags": [
        "arista",
        "velocloud",
        "sd-wan",
        "sql-injection",
        "zero-day",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2026-114625"
      ],
      "affectedVersions": [
        "VCO 5.2.x before 5.2.3.18",
        "VCO 6.1.x before 6.1.3.10",
        "VCO 6.4.x before 6.4.2.12"
      ],
      "fixedVersions": [
        "5.2.3.18",
        "6.1.3.10",
        "6.4.2.12"
      ],
      "startedAt": "2026-10-22",
      "closedAt": null,
      "updatedAt": "2026-10-23T00:37:32Z",
      "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.",
      "xPost": {
        "id": "2113331616257077699",
        "postedAt": "2026-10-22T18:08:16.065Z",
        "url": "https://x.com/pwnwatch_app/status/2113331616257077699"
      }
    },
    {
      "slug": "litespeed-cache-privilege-escalation-cve-2024-28000",
      "title": "LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)",
      "url": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000",
      "json": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "LiteSpeed Cache (WordPress plugin)",
      "tags": [
        "wordpress",
        "php",
        "litespeed",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2024-28000"
      ],
      "affectedVersions": [
        "< 6.4 (Patchstack)"
      ],
      "fixedVersions": [
        "6.4"
      ],
      "startedAt": "2024-08-13",
      "closedAt": "2024-08-21",
      "updatedAt": "2024-08-21",
      "summary": "A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "title": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root",
      "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "json": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "privilege-escalation",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-1086"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-31",
      "closedAt": "2024-05-30",
      "updatedAt": "2024-05-30",
      "summary": "Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "microsoft-windows-cve-2023-36025-36033-36036",
      "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)",
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036",
      "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Windows",
      "tags": [
        "microsoft",
        "windows",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-36025",
        "CVE-2023-36033",
        "CVE-2023-36036"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-11-14",
      "closedAt": "2023-11-14",
      "updatedAt": "2023-11-14",
      "summary": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. Added to CISA KEV on 2023-11-14.",
      "xPost": null
    },
    {
      "slug": "microsoft-skype-for-business-cve-2023-41763",
      "title": "Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)",
      "url": "https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763",
      "json": "https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Microsoft Skype for Business",
      "tags": [
        "microsoft",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-41763"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-10",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-10-10.",
      "xPost": null
    },
    {
      "slug": "apple-ios-and-ipados-cve-2023-42824",
      "title": "Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)",
      "url": "https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824",
      "json": "https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple iOS and iPadOS",
      "tags": [
        "apple",
        "ios",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-42824"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-05",
      "closedAt": "2023-10-05",
      "updatedAt": "2023-10-05",
      "summary": "Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. Added to CISA KEV on 2023-10-05.",
      "xPost": null
    },
    {
      "slug": "microsoft-windows-cng-key-isolation-service-cve-2023-28229",
      "title": "Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)",
      "url": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229",
      "json": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Windows CNG Key Isolation Service",
      "tags": [
        "microsoft",
        "windows",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-28229"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-04",
      "closedAt": "2023-10-04",
      "updatedAt": "2023-10-04",
      "summary": "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. Added to CISA KEV on 2023-10-04.",
      "xPost": null
    },
    {
      "slug": "glibc-looney-tunables-cve-2023-4911",
      "title": "Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)",
      "url": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911",
      "json": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "GNU C Library (glibc) ld.so",
      "tags": [
        "linux",
        "glibc",
        "privilege-escalation",
        "kinsing",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-4911"
      ],
      "affectedVersions": [
        "glibc 2.34 and later before distro fixes (per Qualys)"
      ],
      "fixedVersions": [
        "See your distribution's advisory"
      ],
      "startedAt": "2023-10-03",
      "closedAt": "2023-11-21",
      "updatedAt": "2023-11-21",
      "summary": "A buffer overflow in glibc's dynamic loader, triggered through the GLIBC_TUNABLES environment variable, gave local users root through SUID binaries on default installs of Fedora, Ubuntu and Debian. Cloud attackers such as Kinsing were soon using it.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-41991-41992-41993",
      "title": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-41991",
        "CVE-2023-41992",
        "CVE-2023-41993"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-25",
      "closedAt": "2023-09-25",
      "updatedAt": "2023-09-25",
      "summary": "Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.",
      "xPost": null
    },
    {
      "slug": "minio-cve-2023-28434",
      "title": "MinIO: Security Feature Bypass (CVE-2023-28434)",
      "url": "https://pwn.watch/i/minio-cve-2023-28434",
      "json": "https://pwn.watch/i/minio-cve-2023-28434.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "MinIO",
      "tags": [
        "minio",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-28434"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-19",
      "closedAt": "2023-09-19",
      "updatedAt": "2023-09-19",
      "summary": "MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. Added to CISA KEV on 2023-09-19.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2023-35674",
      "title": "Android Framework: Privilege Escalation (CVE-2023-35674)",
      "url": "https://pwn.watch/i/android-framework-cve-2023-35674",
      "json": "https://pwn.watch/i/android-framework-cve-2023-35674.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-35674"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-13",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-13.",
      "xPost": null
    },
    {
      "slug": "microsoft-streaming-service-proxy-cve-2023-36802",
      "title": "Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)",
      "url": "https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802",
      "json": "https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Streaming Service Proxy",
      "tags": [
        "microsoft",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-36802"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-12",
      "closedAt": "2023-09-12",
      "updatedAt": "2023-09-12",
      "summary": "Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-12.",
      "xPost": null
    },
    {
      "slug": "microsoft-windows-cve-2023-32046-32049-36874",
      "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)",
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874",
      "json": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Windows",
      "tags": [
        "microsoft",
        "windows",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-32046",
        "CVE-2023-32049",
        "CVE-2023-36874"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-07-11",
      "closedAt": "2023-07-11",
      "updatedAt": "2023-07-11",
      "summary": "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-07-11.",
      "xPost": null
    },
    {
      "slug": "microsoft-win32k-cve-2023-29336",
      "title": "Microsoft Win32k: Privilege Escalation (CVE-2023-29336)",
      "url": "https://pwn.watch/i/microsoft-win32k-cve-2023-29336",
      "json": "https://pwn.watch/i/microsoft-win32k-cve-2023-29336.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Win32k",
      "tags": [
        "microsoft",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-29336"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-05-09",
      "closedAt": "2023-05-09",
      "updatedAt": "2023-05-09",
      "summary": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. Added to CISA KEV on 2023-05-09.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2023-20963",
      "title": "Android Framework: Privilege Escalation (CVE-2023-20963)",
      "url": "https://pwn.watch/i/android-framework-cve-2023-20963",
      "json": "https://pwn.watch/i/android-framework-cve-2023-20963.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-20963"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-13",
      "closedAt": "2023-04-13",
      "updatedAt": "2023-04-13",
      "summary": "Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. Added to CISA KEV on 2023-04-13.",
      "xPost": null
    },
    {
      "slug": "microsoft-windows-cve-2023-28252",
      "title": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)",
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252",
      "json": "https://pwn.watch/i/microsoft-windows-cve-2023-28252.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Windows",
      "tags": [
        "microsoft",
        "windows",
        "ransomware",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-28252"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-11",
      "closedAt": "2023-04-11",
      "updatedAt": "2023-04-11",
      "summary": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-04-11. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2023-0266",
      "title": "Linux Kernel: Use-After-Free (CVE-2023-0266)",
      "url": "https://pwn.watch/i/linux-kernel-cve-2023-0266",
      "json": "https://pwn.watch/i/linux-kernel-cve-2023-0266.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-0266"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-30",
      "closedAt": "2023-03-30",
      "updatedAt": "2023-03-30",
      "summary": "Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. Added to CISA KEV on 2023-03-30.",
      "xPost": null
    },
    {
      "slug": "microsoft-windows-cve-2023-21823-23376",
      "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)",
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376",
      "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Windows",
      "tags": [
        "microsoft",
        "windows",
        "ransomware",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-21823",
        "CVE-2023-23376"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-02-14",
      "closedAt": "2023-02-14",
      "updatedAt": "2023-02-14",
      "summary": "Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-02-14. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "microsoft-exchange-server-cve-2022-41080",
      "title": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)",
      "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080",
      "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Exchange Server",
      "tags": [
        "microsoft",
        "ransomware",
        "cisa-kev",
        "rce",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2022-41080"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-01-10",
      "closedAt": "2023-01-10",
      "updatedAt": "2023-01-10",
      "summary": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. Added to CISA KEV on 2023-01-10. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "microsoft-windows-cve-2023-21674",
      "title": "Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)",
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21674",
      "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21674.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Windows",
      "tags": [
        "microsoft",
        "windows",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-21674"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-01-10",
      "closedAt": "2023-01-10",
      "updatedAt": "2023-01-10",
      "summary": "Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-01-10.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "‼️ Critical VeloCloud SQL injection flaw exploited in the wild.\n\nTracked as CVE-2026-114625 (CVSS 9.9), the flaw lets even read-only users escalate to full operator privileges.\n\nArista confirms active attacks.\n\nWhat admins need to know ↓ https://t.co/NHJ4SMAP84",
      "date": "2026-10-22T19:06:41.000Z",
      "url": "https://x.com/TheHackersNews/status/2113346318953545907",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    },
    {
      "authorName": "Dark Web Informer",
      "handle": "DarkWebInformer",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2109088203504287744/BJcETLaO_bigger.jpg",
      "text": "🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited\n\nArista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.\n⠀\nThe SQL injection flaw allows any authenticated user, including someone https://t.co/YmvPfvAwhb",
      "date": "2026-10-22T15:33:25.000Z",
      "url": "https://x.com/DarkWebInformer/status/2113292650828726321",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    }
  ],
  "changes": [
    {
      "incident": "arista-velocloud-orchestrator-cve-2026-114625",
      "incidentTitle": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625"
    },
    {
      "incident": "litespeed-cache-privilege-escalation-cve-2024-28000",
      "incidentTitle": "LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-21",
      "title": "Patchstack publishes details",
      "body": null,
      "sourceUrl": "https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/",
      "url": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000"
    },
    {
      "incident": "litespeed-cache-privilege-escalation-cve-2024-28000",
      "incidentTitle": "LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-13",
      "title": "LiteSpeed Cache 6.4 released with the fix",
      "body": null,
      "sourceUrl": "https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/",
      "url": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000"
    },
    {
      "incident": "linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "incidentTitle": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-30",
      "title": "CISA added CVE-2024-1086 to the KEV catalog (federal deadline 2024-06-20)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086"
    },
    {
      "incident": "linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "incidentTitle": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-31",
      "title": "CVE-2024-1086 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1086",
      "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086"
    },
    {
      "incident": "glibc-looney-tunables-cve-2023-4911",
      "incidentTitle": "Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-21",
      "title": "CISA adds CVE-2023-4911 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911"
    },
    {
      "incident": "microsoft-windows-cve-2023-36025-36033-36036",
      "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-14",
      "title": "CISA added CVE-2023-36025 to the KEV catalog (due 2023-12-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036"
    },
    {
      "incident": "microsoft-windows-cve-2023-36025-36033-36036",
      "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-14",
      "title": "CISA added CVE-2023-36033 to the KEV catalog (due 2023-12-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036"
    },
    {
      "incident": "microsoft-windows-cve-2023-36025-36033-36036",
      "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-14",
      "title": "CISA added CVE-2023-36036 to the KEV catalog (due 2023-12-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036"
    },
    {
      "incident": "microsoft-skype-for-business-cve-2023-41763",
      "incidentTitle": "Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "CISA added CVE-2023-41763 to the KEV catalog (due 2023-10-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763"
    },
    {
      "incident": "apple-ios-and-ipados-cve-2023-42824",
      "incidentTitle": "Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA added CVE-2023-42824 to the KEV catalog (due 2023-10-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824"
    },
    {
      "incident": "microsoft-windows-cng-key-isolation-service-cve-2023-28229",
      "incidentTitle": "Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "CISA added CVE-2023-28229 to the KEV catalog (due 2023-10-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229"
    },
    {
      "incident": "glibc-looney-tunables-cve-2023-4911",
      "incidentTitle": "Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-03",
      "title": "Qualys discloses Looney Tunables; distros ship patched glibc",
      "body": null,
      "sourceUrl": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so",
      "url": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41991-41992-41993",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-25",
      "title": "CISA added CVE-2023-41991 to the KEV catalog (due 2023-10-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41991-41992-41993",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-25",
      "title": "CISA added CVE-2023-41992 to the KEV catalog (due 2023-10-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41991-41992-41993",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-25",
      "title": "CISA added CVE-2023-41993 to the KEV catalog (due 2023-10-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993"
    },
    {
      "incident": "minio-cve-2023-28434",
      "incidentTitle": "MinIO: Security Feature Bypass (CVE-2023-28434)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-19",
      "title": "CISA added CVE-2023-28434 to the KEV catalog (due 2023-10-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/minio-cve-2023-28434"
    },
    {
      "incident": "android-framework-cve-2023-35674",
      "incidentTitle": "Android Framework: Privilege Escalation (CVE-2023-35674)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-13",
      "title": "CISA added CVE-2023-35674 to the KEV catalog (due 2023-10-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2023-35674"
    },
    {
      "incident": "microsoft-streaming-service-proxy-cve-2023-36802",
      "incidentTitle": "Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-12",
      "title": "CISA added CVE-2023-36802 to the KEV catalog (due 2023-10-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802"
    },
    {
      "incident": "microsoft-windows-cve-2023-32046-32049-36874",
      "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "CISA added CVE-2023-32046 to the KEV catalog (due 2023-08-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874"
    },
    {
      "incident": "microsoft-windows-cve-2023-32046-32049-36874",
      "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "CISA added CVE-2023-32049 to the KEV catalog (due 2023-08-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874"
    },
    {
      "incident": "microsoft-windows-cve-2023-32046-32049-36874",
      "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "CISA added CVE-2023-36874 to the KEV catalog (due 2023-08-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874"
    },
    {
      "incident": "microsoft-win32k-cve-2023-29336",
      "incidentTitle": "Microsoft Win32k: Privilege Escalation (CVE-2023-29336)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-09",
      "title": "CISA added CVE-2023-29336 to the KEV catalog (due 2023-05-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-win32k-cve-2023-29336"
    },
    {
      "incident": "android-framework-cve-2023-20963",
      "incidentTitle": "Android Framework: Privilege Escalation (CVE-2023-20963)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-13",
      "title": "CISA added CVE-2023-20963 to the KEV catalog (due 2023-05-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2023-20963"
    },
    {
      "incident": "microsoft-windows-cve-2023-28252",
      "incidentTitle": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-11",
      "title": "CISA added CVE-2023-28252 to the KEV catalog (due 2023-05-02).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252"
    },
    {
      "incident": "linux-kernel-cve-2023-0266",
      "incidentTitle": "Linux Kernel: Use-After-Free (CVE-2023-0266)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "CISA added CVE-2023-0266 to the KEV catalog (due 2023-04-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2023-0266"
    },
    {
      "incident": "microsoft-windows-cve-2023-21823-23376",
      "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-14",
      "title": "CISA added CVE-2023-21823 to the KEV catalog (due 2023-03-07).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376"
    },
    {
      "incident": "microsoft-windows-cve-2023-21823-23376",
      "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-14",
      "title": "CISA added CVE-2023-23376 to the KEV catalog (due 2023-03-07).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376"
    },
    {
      "incident": "microsoft-exchange-server-cve-2022-41080",
      "incidentTitle": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-01-10",
      "title": "CISA added CVE-2022-41080 to the KEV catalog (due 2023-01-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080"
    },
    {
      "incident": "microsoft-windows-cve-2023-21674",
      "incidentTitle": "Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-01-10",
      "title": "CISA added CVE-2023-21674 to the KEV catalog (due 2023-01-31).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21674"
    }
  ]
}