CVE Vulnerability Advisory Database

[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.

[Impact] Local attackers can manipulate DSCache configuration to gain root privileges and full system control.

[Mitigation] Apply the latest security patches from Ivanti and run the Integrity Checker Tool (ICT).

[Affected Scope] Zammad installations using DEB or RPM packages built via packager.io (Source and Docker excluded).

[Impact] A local attacker with 'zammad' service account access can escalate to full 'root' privileges on the host.

[Mitigation] Immediately update Zammad to the latest patched version via package manager.

[Affected Scope] Acronis Backup plugins for Linux-based hosting panels (cPanel, Plesk, DirectAdmin) prior to specific builds.

[Impact] Local attackers can exploit insecure file permissions to gain root-level privileges on the host server, leading to full system compromise.

[Mitigation] Immediate update to the latest plugin versions (cPanel 1.9.3.1021+, Plesk 1.8.11.638+, DirectAdmin 1.2.3.238+).

[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled

[Impact] An authorized local attacker with low privileges can exploit insufficient access control granularity to elevate privileges to SYSTEM

[Mitigation] Apply the official Microsoft security updates immediately and audit AD FS service account and directory permissions

[Affected Scope] Windows operating systems running Windows Remote Desktop services

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the target system

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce Network Level Authentication (NLA)

[Affected Scope] Desktop Window Manager (DWM) component within Microsoft Windows operating systems

[Impact] An authorized local attacker can exploit a type confusion vulnerability to elevate privileges to SYSTEM, enabling full system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor endpoint process creation events for anomalous DWM behavior

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] High-privileged attackers can exploit insufficient authorization to escalate privileges to root, leading to complete system compromise

[Mitigation] Apply the official security patches immediately and restrict network access to the management console

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] All Windows operating systems utilizing the Host Process for Windows Tasks (taskhostw.exe).

[Impact] An authorized local attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise.

[Mitigation] Apply the official Microsoft security patches immediately, and implement temporary workarounds and monitoring scripts prior to patching.

[Affected Scope] Virtual machines with VMware Tools installed, managed by Aria Operations with SDMP (Service Discovery Management Pack) enabled

[Impact] A malicious local actor with non-administrative privileges can exploit this vulnerability to escalate privileges to root on the same VM

[Mitigation] Immediately apply the official security updates for VMware Tools and Aria Operations as recommended by Broadcom

[Affected Scope] Windows and Windows Server operating systems utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] An authorized local attacker can execute arbitrary code in kernel mode, elevating privileges to SYSTEM, which is actively exploited in the wild

[Mitigation] Immediately apply the official Microsoft security updates and restrict unauthorized local access to critical systems

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Fast FAT File System Driver (fastfat.sys)

[Impact] Local unauthorized attackers can execute arbitrary code with SYSTEM privileges by exploiting kernel-level memory corruption

[Mitigation] Apply the official Microsoft security updates immediately, or restrict auto-mounting of untrusted storage media and virtual disk images

[Affected Scope] Windows 10, 11, and Windows Server deployments running the CNG Key Isolation (KeyIso) service

[Impact] Local authenticated attackers with low privileges can execute arbitrary code with SYSTEM privileges by running a specially crafted application

[Mitigation] Apply the latest Microsoft Cumulative Updates (LCU) immediately and restrict unauthorized local access