CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
CVE-2023-42793 is actively exploited by APT29 for supply-chain attacks, underlining its strategic relevance for Swiss industrial companies with software suppliers.
The vulnerability is a local privilege escalation in the DirectX graphics kernel and is therefore primarily relevant as a building block in attack chains after an attacker has already gained a foothold.
The analysis reveals two previously undocumented DPRK implants and an attack path abusing the HAProxy filter API, underscoring North Korean groups' continued willingness to target industry-adjacent supply chains.
The flaw is a ZDI-coordinated disclosure rated CVSS 7.8 for which neither exploit code nor in-the-wild exploitation is documented so far, with the fix arriving through Adobe's regular security bulletin.
Beyond the pure patch information, the report provides no indication of active exploitation or technical details.
Beyond the pure patch information, the report shows that in addition to remote code execution, bypassing session access restrictions is also possible, which expands the attack surface beyond classic RCE.
The report provides neither a CVE identifier nor a CVSS score or any indication of active exploitation, so the concrete urgency cannot be derived from the BSI text alone.
The zero-day nature suggests exploitation occurred prior to the patch release.
Device code phishing abuses Microsoft Entra ID's legitimate device code flow to bypass MFA, with the victim authorizing the attacker's sign-in on a genuine Microsoft page.
The report summarizes several unspecified vulnerabilities in Microsoft Edge and serves as a general patch reminder without providing specific CVEs or exploitation details.
The report is an update without new CVE details or evidence of active exploitation; the local attack surface remains.