pwn.watch: Privilege escalation incident updates

[critical] Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks

Thu, 22 Oct 2026 23:38:20 GMT

Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.

Status: live · Patch: patched · Fixed in: 5.2.3.18, 6.1.3.10, 6.4.2.12

Latest updates:

2026-10-22: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected. (source)

CVEs: CVE-2026-114625

[critical] LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)

Wed, 21 Aug 2024 00:00:00 GMT

A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.

Status: closed · Patch: patched · Fixed in: 6.4

Latest updates:

2024-08-21: Patchstack publishes details (source)
2024-08-13: LiteSpeed Cache 6.4 released with the fix (source)

CVEs: CVE-2024-28000

[high] Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root

Thu, 30 May 2024 00:00:00 GMT

Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-30: CISA added CVE-2024-1086 to the KEV catalog (federal deadline 2024-06-20) (source)
2024-01-31: CVE-2024-1086 published (source)

CVEs: CVE-2024-1086

[high] Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)

Tue, 21 Nov 2023 00:00:00 GMT

A buffer overflow in glibc's dynamic loader, triggered through the GLIBC_TUNABLES environment variable, gave local users root through SUID binaries on default installs of Fedora, Ubuntu and Debian. Cloud attackers such as Kinsing were soon using it.

Status: closed · Patch: patched · Fixed in: See your distribution's advisory

Latest updates:

2023-11-21: CISA adds CVE-2023-4911 to the KEV catalog
2023-10-03: Qualys discloses Looney Tunables; distros ship patched glibc (source)

CVEs: CVE-2023-4911

[high] Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)

Tue, 14 Nov 2023 00:00:00 GMT

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. Added to CISA KEV on 2023-11-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-11-14: CISA added CVE-2023-36025 to the KEV catalog (due 2023-12-05).
2023-11-14: CISA added CVE-2023-36033 to the KEV catalog (due 2023-12-05).
2023-11-14: CISA added CVE-2023-36036 to the KEV catalog (due 2023-12-05).

CVEs: CVE-2023-36025, CVE-2023-36033, CVE-2023-36036

[medium] Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)

Tue, 10 Oct 2023 00:00:00 GMT

Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-10-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-10: CISA added CVE-2023-41763 to the KEV catalog (due 2023-10-31).

CVEs: CVE-2023-41763

[high] Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)

Thu, 05 Oct 2023 00:00:00 GMT

Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. Added to CISA KEV on 2023-10-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-05: CISA added CVE-2023-42824 to the KEV catalog (due 2023-10-26).

CVEs: CVE-2023-42824

[high] Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)

Wed, 04 Oct 2023 00:00:00 GMT

Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. Added to CISA KEV on 2023-10-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-04: CISA added CVE-2023-28229 to the KEV catalog (due 2023-10-25).

CVEs: CVE-2023-28229

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)

Mon, 25 Sep 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-25: CISA added CVE-2023-41991 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41992 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41993 to the KEV catalog (due 2023-10-16).

CVEs: CVE-2023-41991, CVE-2023-41992, CVE-2023-41993

[high] MinIO: Security Feature Bypass (CVE-2023-28434)

Tue, 19 Sep 2023 00:00:00 GMT

MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. Added to CISA KEV on 2023-09-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-19: CISA added CVE-2023-28434 to the KEV catalog (due 2023-10-10).

CVEs: CVE-2023-28434

[high] Android Framework: Privilege Escalation (CVE-2023-35674)

Wed, 13 Sep 2023 00:00:00 GMT

Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-13: CISA added CVE-2023-35674 to the KEV catalog (due 2023-10-04).

CVEs: CVE-2023-35674

[high] Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)

Tue, 12 Sep 2023 00:00:00 GMT

Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-12: CISA added CVE-2023-36802 to the KEV catalog (due 2023-10-03).

CVEs: CVE-2023-36802

[high] Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)

Tue, 11 Jul 2023 00:00:00 GMT

Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-07-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-07-11: CISA added CVE-2023-32046 to the KEV catalog (due 2023-08-01).
2023-07-11: CISA added CVE-2023-32049 to the KEV catalog (due 2023-08-01).
2023-07-11: CISA added CVE-2023-36874 to the KEV catalog (due 2023-08-01).

CVEs: CVE-2023-32046, CVE-2023-32049, CVE-2023-36874

[high] Microsoft Win32k: Privilege Escalation (CVE-2023-29336)

Tue, 09 May 2023 00:00:00 GMT

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. Added to CISA KEV on 2023-05-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-05-09: CISA added CVE-2023-29336 to the KEV catalog (due 2023-05-30).

CVEs: CVE-2023-29336

[high] Android Framework: Privilege Escalation (CVE-2023-20963)

Thu, 13 Apr 2023 00:00:00 GMT

Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. Added to CISA KEV on 2023-04-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-13: CISA added CVE-2023-20963 to the KEV catalog (due 2023-05-04).

CVEs: CVE-2023-20963

[high] Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)

Tue, 11 Apr 2023 00:00:00 GMT

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-04-11. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-11: CISA added CVE-2023-28252 to the KEV catalog (due 2023-05-02).

CVEs: CVE-2023-28252

[high] Linux Kernel: Use-After-Free (CVE-2023-0266)

Thu, 30 Mar 2023 00:00:00 GMT

Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. Added to CISA KEV on 2023-03-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-03-30: CISA added CVE-2023-0266 to the KEV catalog (due 2023-04-20).

CVEs: CVE-2023-0266

[high] Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)

Tue, 14 Feb 2023 00:00:00 GMT

Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-02-14. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-02-14: CISA added CVE-2023-21823 to the KEV catalog (due 2023-03-07).
2023-02-14: CISA added CVE-2023-23376 to the KEV catalog (due 2023-03-07).

CVEs: CVE-2023-21823, CVE-2023-23376

[high] Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)

Tue, 10 Jan 2023 00:00:00 GMT

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. Added to CISA KEV on 2023-01-10. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-01-10: CISA added CVE-2022-41080 to the KEV catalog (due 2023-01-31).

CVEs: CVE-2022-41080

[high] Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)

Tue, 10 Jan 2023 00:00:00 GMT

Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-01-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-01-10: CISA added CVE-2023-21674 to the KEV catalog (due 2023-01-31).

CVEs: CVE-2023-21674