About Remote Code Execution – Microsoft Word (CVE-2026-21514) vulnerability. This vulnerability is from February Microsoft Patch Tuesday. Reliance on Untrusted Inputs in a Security Decision (CWE-807) in Microsoft Office Word allows an unauthenticated attacker to bypass OLE security features when opening a malicious file. The vulnerability is NOT exploitable via the Preview Pane.

👾 Microsoft reports that the vulnerability is being exploited in the wild. It has been listed in CISA KEV since February 10.

💬 Microsoft has classified the vulnerability as a Security Feature Bypass, but given that exploiting such vulnerabilities can lead to arbitrary code execution, it seems reasonable to classify it as Remote Code Execution, similar to the actively exploited CVE-2026-21509.

🛠 No public exploits are available yet.

На русском

February Linux Patch Wednesday. In February, Linux vendors addressed 632 vulnerabilities – 1.5× fewer than in January, including 305 in the Linux Kernel. Two vulnerabilities show signs of in-the-wild exploitation:

🔻 RCE – Chromium (CVE-2026-2441)
🔻 InfDisc – MongoDB “MongoBleed” (CVE-2025-14847)

Public exploits are available or suspected for 56 more vulnerabilities. Notable ones include:

🔸 RCE – OpenSSL (CVE-2025-15467, CVE-2025-69421, CVE-2025-11187), pgAdmin (CVE-2025-12762, CVE-2025-13780), DiskCache (CVE-2025-69872), PyTorch (CVE-2026-24747), Wheel (CVE-2026-24049)
🔸 AuthBypass – M/Monit (CVE-2020-36968)
🔸 EoP – Grafana (CVE-2025-41115, CVE-2026-21721), M/Monit (CVE-2020-36969)
🔸 AFR – Proxmox Virtual Environment (CVE-2024-21545)
🔸 SFB – Chromium (CVE-2026-1504), Roundcube (CVE-2026-25916)

🗒 Full Vulristics report

На русском

February “In the Trend of VM” (#24): vulnerabilities in Microsoft products. A traditional monthly roundup of trending vulnerabilities. This time, compact and all-Microsoft.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

In total, two vulnerabilities:

🔻 RCE – Microsoft Office (CVE-2026-21509)
🔻 InfDisc – Desktop Window Manager (CVE-2026-20805)

🟥 Trending Vulnerabilities Portal

На русском

February Microsoft Patch Tuesday. A total of 55 vulnerabilities, half as many as in January. There are as many as six (❗️) vulnerabilities being exploited in the wild:

🔻 SFB – Windows Shell (CVE-2026-21510)
🔻 SFB/RCE – Microsoft Word (CVE-2026-21514)
🔻 SFB – MSHTML Framework (CVE-2026-21513)
🔻 EoP – Windows Remote Desktop Services (CVE-2026-21533)
🔻 EoP – Desktop Window Manager (CVE-2026-21519)
🔻 DoS – Windows Remote Access Connection Manager (CVE-2026-21525)

There is also one vulnerability with a public exploit:

🔸 DoS – libjpeg (CVE-2023-2804)

Among the remaining vulnerabilities, the following stand out:

🔹 RCE – Windows Notepad (CVE-2026-20841)
🔹 Spoofing – Outlook (CVE-2026-21511)
🔹 EoP – Windows Kernel (CVE-2026-21231, CVE-2026-21239, CVE-2026-21245), Windows AFD.sys (CVE-2026-21236, CVE-2026-21238, CVE-2026-21241)

🗒 Full Vulristics report

На русском

I released Vulristics 1.0.11: added Server-Side Request Forgery (SSRF) as a distinct vulnerability type. I try to use a very small set of base vulnerability types (around 20) in Vulristics and map everything else to them. With a few exceptions, these are the same types Microsoft uses – and Microsoft doesn’t like SSRF.

SSRF is a vulnerability that allows an attacker to make network requests to arbitrary destinations.

Microsoft usually classifies SSRFs as EoP, Information Disclosure, or RCE. 🤯

I used to map SSRF to Command Injection, based on the logic that crafting a request can be considered a form of command execution. But, of course, that’s… questionable. 🙄

So I decided to add a dedicated SSRF type (with a severity of 0.87) and stopped doing mental gymnastics. 🙂 For the icon, I drew an anvil (a play on words with “forge”). I also uploaded the icon to avleonov.com so that Vulristics HTML reports render correctly.

На русском

About Remote Code Execution – Microsoft Office (CVE-2026-21509) vulnerability. The vulnerability was urgently fixed on January 26, outside the regular Microsoft Patch Tuesday. Microsoft classified it as a Security Feature Bypass, but in fact, it is more of a Remote Code Execution. The vulnerability involves bypassing OLE (Object Linking and Embedding) security features in Microsoft 365 and Microsoft Office. It is exploited when opening malicious Office files (Preview Pane is safe).

⚙️ In Office 2021+, protection is enabled automatically via server-side changes after restarting the applications. For Office 2016/2019, updates must be installed or registry changes applied.

👾 Microsoft reports that the vulnerability is being exploited in the wild.

🛠 No public exploits are available yet.

На русском

January “In the Trend of VM” (#23): vulnerabilities in Windows, React and MongoDB. Traditional monthly roundup of trending vulnerabilities. Launching the 2026 season. 🙂

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

In total, three vulnerabilities:

🔻 EoP – Windows Cloud Files Mini Filter Driver (CVE-2025-62221)
🔻 RCE – React Server Components “React2Shell” (CVE-2025-55182)
🔻 InfDisc – MongoDB “MongoBleed” (CVE-2025-14847)

🟥 Trending Vulnerabilities Portal

На русском

January Linux Patch Wednesday. In January, Linux vendors started fixing 918 vulnerabilities, one and a half times more than in December. Of these, 616 are in the Linux Kernel. Three show signs of exploitation in the wild:

🔻 AuthBypass – GNU Inetutils (telnetd) (CVE-2026-24061)
🔻 RCE – Safari (CVE-2025-43529); fixed in Linux distributions in webkit packages
🔻 MemCor – Chromium (CVE-2025-14174)

Another 97 vulnerabilities have public exploits or signs of their existence. Key examples:

🔸 MemCor – libpng (CVE-2026-22695)
🔸 XSS – Roundcube (CVE-2025-68461)
🔸 RCE – expr-eval (CVE-2025-13204)
🔸 ComInj – cpp-httplib (CVE-2026-21428), httparty (CVE-2025-68696), Miniflux (CVE-2026-21885)
🔸 SQLi – parsl (CVE-2026-21892)
🔸 SFB – OWASP CRS (CVE-2026-21876), Authlib (CVE-2025-68158)
🔸 AFW – node-tar (CVE-2026-23745)
🔸 PathTrav – GNU Wget2 (CVE-2025-69194), Tar (CVE-2025-45582)

🗒 Full Vulristics Report

На русском

Our PR team awarded me the “The Best Positive Speaker 2025” metal pin for public speaking, articles, and media commentary. Huge thanks to my colleagues for this! I’m very pleased. 😇 The collection is growing. 😉

This time, the pin is styled like the Friends sitcom logo. It’s made of metal, coated with colored enamel, quite hefty, measures 5×2 cm, and fastens with two butterfly clasps. Very nice. 👍

PS: I hope there wasn’t any hidden hint in the pin’s style. 😉

So no one told you life was going to be this way. 👏👏
Your job’s a joke, you’re broke, your love life’s DOA. 😅

На русском

About Information Disclosure – Desktop Window Manager (CVE-2026-20805) vulnerability. Desktop Window Manager is a compositing window manager that has been part of Windows since Windows Vista. Exploitation of the vulnerability, which was addressed in the January Microsoft Patch Tuesday, allows a local attacker to disclose the “section address from a remote ALPC port which is user-mode memory”.

👾 Microsoft noted that this vulnerability is being exploited in attacks. The vulnerability was added to CISA’s KEV catalog on January 13. There are no public details about the attacks yet, but Rapid7 experts suggest that the disclosed memory address can be used to bypass ASLR, “increasing the chance of developing a stable elevation of privilege exploit for DWM”.

🛠 Public exploit PoCs have been available on GitHub since January 14.

На русском