Threat Alerts

A critical integer-overflow vulnerability, CVE-2026-59346 (CVSS Score 9.3), affects the VMXNET3 virtual network adapter in VMware Workstation and VMware Fusion. A privileged attacker inside a guest VM can trigger memory corruption that may enable code execution on the host, raising escape and data-exposure risk.

The flaw resides in the TCP Segmentation Offload (TSO) processing path where a 32-bit multiplication of segment counts can wrap, causing the host to allocate an undersized buffer. A subsequent copy loop may write beyond that allocation, producing memory corruption that can crash the host process and, in some conditions, allow arbitrary host-side code execution. Public proof-of-concept code demonstrating host crashes is available. The issue affects Workstation and Fusion 25H2 and 26H1 branches and is fixed in 26H1u1; no official workaround has been published.

Exploitation requires elevated control within the guest, so systems running untrusted or externally sourced VMs, developer workstations, and analysis sandboxes are at highest risk.

Atlassian has addressed a critical arbitrary file access vulnerability, CVE-2026-21589 (CVSS 9.3), affecting eight self-hosted Data Center products, including Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability allows remote, unauthenticated attackers to access files within the affected applications’ web root directories by supplying specially crafted requests containing the targeted file path. Exploitation does not require valid credentials or user interaction, although attackers must know or identify the exact file paths. Depending on the application and configuration, exposed files may contain sensitive information, including application credentials and configuration data.

Of particular concern are environments where Jira is integrated with Crowd for identity management. In such configurations, exposed application credentials could potentially be used to create accounts with administrative privileges, enabling further compromise of the affected environment. The risk has increased following the publication of technical analysis and a proof-of-concept (PoC) exploit, with exploitation attempts observed shortly after the PoC’s release.

A critical vulnerability, tracked as CVE-2026-107406 (CVSS 9.5), affects NetScaler ADC and NetScaler Gateway deployments under specific SAML configurations. The issue is a memory overflow vulnerability that can result in remote code execution (RCE) or denial of service (DoS). Exploitation is possible when vulnerable appliances are configured as a SAML Identity Provider (IdP) or, for certain affected versions, as either a SAML Service Provider (SP) or IdP.

Affected releases include vulnerable builds in the NetScaler 14.1, 14.1-FIPS, 13.1, and 13.1-FIPS/NDcPP branches. Secure Private Access Hybrid deployments using affected NetScaler instances are also impacted, while Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected. At the time of disclosure, the vendor stated that it was not aware of any unmitigated exploitation of CVE-2026-107406.

A critical authentication bypass vulnerability, CVE-2026-76504 (CVSS 9.8), is being actively exploited in a widely deployed enterprise SD-WAN management platform. The flaw allows remote, unauthenticated attackers to access the SD-WAN Manager API with full administrative privileges, potentially enabling complete compromise of exposed systems. The default administrator role permits unrestricted operations on the device, increasing the risk to internet-facing deployments.

The vulnerability stems from improper URI encoding in the API’s session-handling mechanism, allowing crafted HTTP requests to bypass authentication checks for a protected endpoint. Exploitation attempts may involve URI-encoded characters in session login request paths to evade detection controls. Relevant activity can be investigated through specific application log files, although analysts should correlate multiple indicators to distinguish malicious requests from legitimate activity.

The vulnerability affects SD-WAN Manager regardless of its configuration, and no other products have been identified as affected. Security updates are available across multiple release trains, and organizations that previously installed patches for earlier vulnerabilities must apply the latest update, as those fixes do not address this flaw. Given confirmed exploitation in the wild, organizations should prioritize patching exposed instances and review relevant logs for potential unauthorized access.

TeamViewer addressed a high-severity vulnerability, CVE-2026-92370 (CVSS Score 8.8), affecting its Full Client and Host applications that could allow an authenticated remote attacker to bypass configured session permissions and potentially achieve remote code execution. The flaw stems from improper access control during remote session establishment, allowing an attacker to manipulate access control parameters and perform actions that were explicitly restricted by the targeted user.

Successful exploitation requires the attacker to establish an authenticated TeamViewer session with the target, but could allow actions beyond the permissions granted for that session, potentially resulting in code execution on the affected system.

A new macOS backdoor has been discovered hidden inside a fake Zoom installer, designed to trick users into handing over their login credentials before silently deploying a second-stage payload. The malware, known as CloudSyncD, has already progressed beyond early development and has been observed operating against live command-and-control infrastructure, signaling an active and advancing threat.

The malware arrives as a disk image mimicking a legitimate Zoom installer, instructing victims to bypass macOS security protections through system settings to get around Gatekeeper. It then presents a fake authorization prompt, collecting the user’s password and validating it locally — the password is never transmitted externally, but instead buried in a decoy configuration file using hidden Unicode characters, where it is later retrieved to launch the second stage with elevated privileges.

The embedded payload supports both Apple silicon and Intel architectures, and the malware initially attempts to execute it entirely in memory to avoid leaving traces on disk. If that method fails, it falls back to writing the payload temporarily and running it using the harvested password for elevated access. Once active, the backdoor establishes a hidden working directory on the system and communicates with its operators over encrypted channels, first sending a system survey and then using the machine’s hardware identifier for ongoing check-ins. Rather than functioning as a traditional infostealer, CloudSyncD focuses on remote task execution — capable of receiving and running executable files or archives — with no built-in functionality for harvesting browser data, keychain items, or cryptocurrency wallets, suggesting its primary purpose is maintaining operator access rather than immediate data theft.