Joel Traber AG

Top news

• TAKTISCH The Hacker News
  Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

  This is more than a patch notice: CISA confirms active in-the-wild exploitation of the Zyxel flaw, with attackers gaining command and SYSTEM access, and the item is raised alongside a Veeam vulnerability.

  → CISA added an actively exploited Zyxel switch flaw to its KEV catalog and the report also references a Veeam flaw, and Veeam Backup & Replication is part of the company's stack.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  → Adobe Acrobat Reader DC is part of the company's software stack, and this remote code execution vulnerability could be exploited via malicious PDF files.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-659: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

  This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

  → The vulnerability affects Adobe Acrobat Reader DC, which is part of the company's software stack, though the CVSS score is only 3.3 and no active exploitation is reported.

• TAKTISCH The Hacker News
  Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

  A Chinese state actor is actively exploiting a Chrome and Windows zero-day chain through fake websites , the BlueMoon exploit kit is already in use, which goes beyond mere patch information.

  → The exploited zero-day chain targets Google Chrome and Microsoft Windows, both present in the company's tech stack, deployed by an active China-linked APT campaign.

• TAKTISCH The Hacker News
  SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

  CISA confirms active exploitation: the SharePoint RCE CVE-2026-65660 is being attacked in the wild, and the RouterOS flaw CVE-2026-67279 is chained with CVE-2026-86060 into the 'MikroTrick' exploit chain that yields full unauthenticated access.

  → Microsoft SharePoint is part of the company's Microsoft 365 stack and CVE-2026-65660 is an actively exploited remote code execution flaw confirmed in CISA's KEV catalog.

• TAKTISCH The Hacker News
  SharePoint flaw initially listed as spoofing by Microsoft enables authenticated RCE

  Microsoft initially classified the flaw merely as a spoofing bug with a CVSS score of 6.5, although it actually allows authenticated remote code execution , the real risk is therefore higher than the original score suggests.

  → Affects Microsoft SharePoint Server (2016, 2019, Subscription Edition) , part of the Microsoft 365/server landscape used by the company , and reveals a more severe impact (authenticated RCE) than Microsoft initially classified.

• TAKTISCH The Hacker News
  Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

  Beyond the mere patch information, the report highlights a window between the upstream fix and LTS delivery in which a public container-escape exploit is available for unpatched Ubuntu systems.

  → The unpatched AF_UNIX use-after-free affects Ubuntu 24.04 LTS, a server OS present in the environment, and a public container-escape exploit allowing host root is already available.

• OPERATIV ZDI: Published Advisories
  ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

  This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8.

  → The advisory affects Microsoft Windows, a core platform in the described environment, and describes a high-severity local privilege escalation flaw.

• INFORMATIV ZDI: Published Advisories
  ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

  This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.

  → The Linux kernel vulnerability affects Ubuntu 24.04 LTS, a distribution in the company's tech stack, allowing local privilege escalation.

• TAKTISCH Project Zero
  Windows Exploitation Techniques: Dangling COM Object Registrations

  The report provides a public exploit for an incomplete Windows patch and describes a novel technique for abusing dangling COM object registrations.

  → This publicly disclosed Windows local privilege-escalation technique directly affects Microsoft Windows systems, which are part of the company's server and endpoint estate.

• OPERATIV Rapid7 Cybersecurity Blog
  Patch Tuesday - September 2026

  The report highlights two Windows zero-day EoP vulnerabilities and an actively exploited Chrome V8 zero-day, while Microsoft Edge lags behind Chrome without its own browser advisories.

  → Patch Tuesday covers numerous Microsoft vulnerabilities, including zero-day EoP flaws and an exploited Chrome V8 zero-day, directly affecting the company's Windows and browser stack.

• PROJECT ZERO 21/09/2026
  Windows Exploitation Techniques: Dangling COM Object Registrations

  The report provides a public exploit for an incomplete Windows patch and describes a novel technique for abusing dangling COM object registrations.

• RAPID7 CYBERSECURITY BLOG 08/09/2026
  Patch Tuesday - September 2026

  On September 2026 Patch Tuesday, Microsoft published a total of 999 vulnerabilities, including 974 Microsoft product vulnerabilities, of which 723 affect Windows, plus fixes for 25 non-Microsoft CVEs. This is the largest Patch Tuesday ever by number of CVEs published in a single day. Microsoft confirms active exploitation of two zero-day elevation-of-privilege flaws, including one in Windows ALPC (CVE-2026-85880) that grants SYSTEM privileges via an out-of-bounds buffer overflow. For manufacturing companies like Joel Traber AG in the DACH region, immediate patching is critical, especially for Windows and browser components.

• MICROSOFT SECURITY BLOG 09/09/2026
  Passkey-themed social engineering leads to identity and cloud compromise

  The real lever is not the credential theft itself but the early-established MFA persistence via an actor-registered factor, which keeps the compromise alive even after credential resets.