CVE Vulnerability Advisory Database

[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.

[Impact] Local attackers can manipulate DSCache configuration to gain root privileges and full system control.

[Mitigation] Apply the latest security patches from Ivanti and run the Integrity Checker Tool (ICT).

[Affected Scope] Zammad installations using DEB or RPM packages built via packager.io (Source and Docker excluded).

[Impact] A local attacker with 'zammad' service account access can escalate to full 'root' privileges on the host.

[Mitigation] Immediately update Zammad to the latest patched version via package manager.

[Affected Scope] Acronis Backup plugins for Linux-based hosting panels (cPanel, Plesk, DirectAdmin) prior to specific builds.

[Impact] Local attackers can exploit insecure file permissions to gain root-level privileges on the host server, leading to full system compromise.

[Mitigation] Immediate update to the latest plugin versions (cPanel 1.9.3.1021+, Plesk 1.8.11.638+, DirectAdmin 1.2.3.238+).

[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled

[Impact] An authorized local attacker with low privileges can exploit insufficient access control granularity to elevate privileges to SYSTEM

[Mitigation] Apply the official Microsoft security updates immediately and audit AD FS service account and directory permissions

[Affected Scope] Windows operating systems running Windows Remote Desktop services

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the target system

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce Network Level Authentication (NLA)

[Affected Scope] Desktop Window Manager (DWM) component within Microsoft Windows operating systems

[Impact] An authorized local attacker can exploit a type confusion vulnerability to elevate privileges to SYSTEM, enabling full system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor endpoint process creation events for anomalous DWM behavior

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] High-privileged attackers can exploit insufficient authorization to escalate privileges to root, leading to complete system compromise

[Mitigation] Apply the official security patches immediately and restrict network access to the management console

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] All Windows operating systems utilizing the Host Process for Windows Tasks (taskhostw.exe).

[Impact] An authorized local attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise.

[Mitigation] Apply the official Microsoft security patches immediately, and implement temporary workarounds and monitoring scripts prior to patching.

[Affected Scope] Virtual machines with VMware Tools installed, managed by Aria Operations with SDMP (Service Discovery Management Pack) enabled

[Impact] A malicious local actor with non-administrative privileges can exploit this vulnerability to escalate privileges to root on the same VM

[Mitigation] Immediately apply the official security updates for VMware Tools and Aria Operations as recommended by Broadcom

[Affected Scope] Windows and Windows Server operating systems utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] An authorized local attacker can execute arbitrary code in kernel mode, elevating privileges to SYSTEM, which is actively exploited in the wild

[Mitigation] Immediately apply the official Microsoft security updates and restrict unauthorized local access to critical systems

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Fast FAT File System Driver (fastfat.sys)

[Impact] Local unauthorized attackers can execute arbitrary code with SYSTEM privileges by exploiting kernel-level memory corruption

[Mitigation] Apply the official Microsoft security updates immediately, or restrict auto-mounting of untrusted storage media and virtual disk images

[Affected Scope] Windows 10, 11, and Windows Server deployments running the CNG Key Isolation (KeyIso) service

[Impact] Local authenticated attackers with low privileges can execute arbitrary code with SYSTEM privileges by running a specially crafted application

[Mitigation] Apply the latest Microsoft Cumulative Updates (LCU) immediately and restrict unauthorized local access

[Affected Scope] Systems running Linux Kernel utilizing the ALSA (Advanced Linux Sound Architecture) PCM subsystem

[Impact] A local attacker can trigger a Use-After-Free (UAF) condition to corrupt kernel memory, leading to complete system compromise with Ring 0 privileges

[Mitigation] Upgrade the Linux kernel past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e, or blacklist the vulnerable sound modules

[Affected Scope] Most Windows operating system versions, including Windows 10, 11, and Windows Server 2008 through 2022

[Impact] A locally authenticated attacker can exploit a race condition to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict multi-user interactive logins on unpatched systems

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server 2008 through 2022.

[Impact] Local authenticated attackers can execute arbitrary code with kernel-level privileges (SYSTEM), leading to complete system compromise.

[Mitigation] Immediately apply the Microsoft official cumulative security updates and monitor for anomalous CLFS log creation and driver activities.

[Affected Scope] Almost all major Linux distributions (RedHat, Debian, Ubuntu, SUSE, etc.) with the Polkit (formerly PolicyKit) pkexec utility installed.

[Impact] A local unprivileged attacker can exploit the vulnerable pkexec binary to bypass authorization policies and gain full root administrative privileges on the target host.

[Mitigation] Apply official vendor security patches immediately, or remove the SUID permission (chmod 0755) from the pkexec binary as a temporary workaround.

[Affected Scope] Samsung mobile devices and Exynos modem interface drivers prior to SMR Oct-2021 Release 1

[Impact] Local attackers can execute arbitrary code with kernel privileges by dereferencing an invalid function pointer, leading to complete system compromise

[Mitigation] Immediately apply the official Samsung Android security update (October 2021 or later)

[Affected Scope] Linux virtual machines and Azure service environments running Microsoft Open Management Infrastructure (OMI) versions prior to v1.6.8-1

[Impact] A local attacker with low-privileged access can elevate privileges to root, gaining full control over the target system and executing arbitrary code

[Mitigation] Immediately update the OMI package to the latest version (v1.6.8-1 or higher) and verify the auto-update status of associated Azure agents

[Affected Scope] 64-bit Windows operating systems including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 utilizing the splwow64.exe process

[Impact] Local attackers can exploit memory corruption (CWE-787) to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the official Microsoft security updates immediately, or restrict local execution privileges and disable the Print Spooler service as a temporary workaround