HIGH 95% confidence cve

ZDI-26-081: Win32kfull Use-After-Free Local Privilege Escalation

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. The CVSS rating is 8.8, with CVE-2026-21235.

['The vulnerability arises from improper memory handling practices.', 'Successful exploitation leads to a significant security risk as attackers gain elevated privileges.']

Microsoft Windows

action items (2)

• Apply patches for CVE-2026-21235 immediately.
• Review logs for signs of exploitation activity.

Zero Day Initiative · 2026-02-24T23:55

CRITICAL 95% confidence cve

ZDI-26-080: Ivanti Endpoint Manager AuthHelper Authentication Bypass Vulnerability

Remote attackers can bypass authentication in affected Ivanti Endpoint Manager installations without needing credentials. CVE-2026-1603. Includes severity, conf

['Allows unauthorized access to systems', 'Increases likelihood of data breaches', 'Can lead to full system compromise']

Ivanti Endpoint Manager usersEnterprise network administrators

action items (3)

• Update to latest version of Ivanti Endpoint Manager
• Review system permissions and access controls
• Enable logging and alerts for suspicious activities

Zero Day Initiative · 2026-02-24T23:55

HIGH 95% confidence cve

ZDI-26-079: Ivanti Endpoint Manager ROI SQL Injection RCE Vulnerability

Ivanti Endpoint Manager suffers from a SQL injection leading to remote code execution. Requires authentication; CVSS score 7.2. Includes severity, confidence, a

['Allows untrusted users with credentials to execute arbitrary commands on server', 'Exposes sensitive data and control of endpoint management']

Ivanti Endpoint Manager ROI users

action items (2)

• Update to latest version of software
• Review and restrict user permissions

Zero Day Initiative · 2026-02-24T23:54

HIGH 95% confidence cve

Deciso OPNsense diag_backup.php filename Command Injection Vulnerability

['Vulnerability in Deciso OPNsense allows for remote code execution via command injection in diag_backup.php. Requires authentication, CVSS rating of 6.8.'.

['The affected function does not properly sanitize input, allowing attackers to inject commands.', 'Attackers with network proximity and valid credentials can execute arbitrary code on the system.']

Deciso OPNsense users

action items (3)

• Apply available security patches immediately.
• Review system logs for any signs of exploitation attempts.
• Increase monitoring of the affected component.

Zero Day Initiative · 2026-02-24T23:54

MEDIUM 85% confidence general

AI Finds Bugs but Patching Remains a Challenge

['AI excels at identifying software bugs, but the process of validating and applying these patches remains costly and complex.', "Security researchers. Read ful

['AI can enhance vulnerability discovery but does not replace human expertise in validation and deployment processes.', 'The need for manual intervention to validate and deploy patches complicates the overall bug-fixing

Software development teamsSecurity operations

action items (2)

• Evaluate the effectiveness of current AI-driven bug finding tools in your environment.
• Develop strategies for integrating AI findings with existing security workflows, focusing on efficient patch management processes.

The Register · 2026-02-24T23:11