Markus Wulftange

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات SmarterTools SmarterMail السابقة للإصدار 9511 **الوصف** يحتوي SmarterTools SmarterMail على ثغرة تسمح بتنفيذ التعليمات البرمجية عن بُعد دون مصادقة في طريقة API ConnectToHub. تسمح هذه الثغرة للمهاجمين بتوجيه خادم SmarterMail إلى خادم HTTP ضار، والذي يقوم بدوره بتوفير أمر ضار من نظام التشغيل يتم تنفيذه بواسطة التطبيق المعرض للخطر. هذه الثغرة، التي تم تتبعها تحت الرمز CVE-2026-24423، تحمل درجة CVSS تبلغ 9.3 ويتم استغلالها بشكل نشط من قبل جهات فاعلة في مجال برامج الفدية، بما في ذلك مجموعة Warlock المتخصصة في برامج الفدية. تؤثر هذه الثغرة الأمنية على الإصدارات السابقة للبناء 9511، وتسمح للمهاجمين بتنفيذ تعليمات برمجية عشوائية دون مصادقة عبر **نقطة نهاية واجهة برمجة التطبيقات** `/api/v1/settings/sysadmin/connect-to-hub`. اكتشفت WatchTowr Labs هذه الثغرة وتم إصلاحها في 15 يناير 2026. تشير التقارير إلى أن أكثر من 6,000 مثيل معرض للخطر على مستوى العالم. وقد لوحظ أن مجموعة برامج الفدية Warlock تستغل هذه الثغرة الأمنية، وقد أضافت وكالة الأمن السيبراني والبنية التحتية (CISA) هذه الثغرة إلى قائمة «الثغرات الأمنية المعروفة المستغلة»، وحددت موعدًا نهائيًا للإصلاح بحلول 26 فبراير 2026 للوكالات الفيدرالية. يُعرف المهاجمون بإنشاء وصول مسبق لعدة أيام قبل نشر برامج الفدية واستخدام أدوات مثل Velociraptor للتنقل الجانبي والتشفير. **التوصيات** قم بتحديث SmarterMail إلى الإصدار 9511

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** SmarterTools SmarterMail الإصدارات الأقدم من البيلد 9511 **الوصف** يحتوي SmarterTools SmarterMail على ثغرة أمنية تتعلق بتجاوز المصادقة في واجهة برمجة التطبيقات (API) الخاصة بإعادة تعيين كلمة المرور. تسمح نقطة النهاية `force-reset-password` بالطلبات المجهولة ولا تتحقق من كلمة المرور الحالية ولا من رمز إعادة التعيين عند إعادة تعيين حسابات مسؤولي النظام. يمكن لمهاجم غير مصدق عليه تقديم اسم مستخدم إداري مستهدف وكلمة مرور جديدة لإعادة تعيين الحساب، مما يؤدي إلى اختراق إداري كامل لمثيل SmarterMail. تتيح امتيازات المسؤول عن النظام في SmarterMail تنفيذ أوامر نظام التشغيل، مما قد يمنح وصولاً إدارياً إلى المضيف الأساسي. تم تحديد حوالي 6,000 مثيل معرض للإنترنت على أنه معرض للخطر بشكل محتمل، ولوحظ استغلال نشط في البيئة الفعلية، بما في ذلك من قبل مجموعة برامج الفدية Warlock. ولوحظ أن المهاجمين يستغلون هذه الثغرة الأمنية للحصول على وصول أولي، والتحرك أفقيًا عبر الشبكات، ونشر برامج الفدية. توجد الثغرة الأمنية في نقطة نهاية واجهة برمجة التطبيقات (API) `/api/v1/auth/force-reset-password`. المعلمة المعرضة للخطر هي `IsSysAdmin`، والتي، عند تعيينها على «true»، تسمح بإعادة تعيين كلمات مرور المسؤولين دون مصادقة. **التوصيات** قم بالتحديث إلى الإصدار 9511 أو أحدث على الفور. قم بتقييد الوصول إلى واجهة برمجة التطبيقات (API) لنقطة النهاية `/api/v1/auth/force-reset-

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Progress® Telerik® Reporting السابقة لـ 2025 Q1 (19.0.25.211) **الوصف** يمكن لمهاجم محلي الكشف عن المعلومات من خلال ثغرة أمنية تتعلق بمسار الملف المطلق. تتيح هذه المشكلة لمهاجم محلي إمكانية الكشف عن معلومات حساسة. **التوصيات** بالنسبة للإصدارات الأقدم من 2025 Q1 (19.0.25.211)، قم بالتحديث إلى إصدار تم إصداره بعد 2025 Q1 (19.0.25.211) لحل المشكلة. كإجراء تجاوبي مؤقت، ضع في اعتبارك تقييد الوصول إلى المعلومات الحساسة وتنفيذ إجراءات أمنية إضافية لتقليل مخاطر الاستغلال.

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Description: The issue is related to errors in handling relative directory paths, which can be exploited by a remote attacker to disclose protected information. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 **Description** The issue is related to a vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically in the Core component. This vulnerability allows an unauthenticated attacker with network access via T3, IIOP to compromise the Oracle WebLogic Server. Successful attacks can result in the takeover of the Oracle WebLogic Server. It is estimated that over 18,000 services are potentially affected. The vulnerability can be exploited by sending specially crafted network packets, allowing an attacker to gain full access to the vulnerable software. **Recommendations** For Oracle WebLogic Server version 12.2.1.4.0, update to a newer version to mitigate the risk. For Oracle WebLogic Server version 14.1.1.0.0, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the T3 and IIOP protocols to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924) **Description** The issue is related to the insecure type resolution vulnerability in Progress Telerik Reporting, allowing for object injection and potentially enabling a remote attacker to execute arbitrary code. This vulnerability can be exploited through the injection of external input to select classes. **Recommendations** For versions prior to 2024 Q3 (18.2.24.924), update to version 2024 Q3 (18.2.24.924) or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable type resolution functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Telerik Report Server versions prior to 2024 Q3 (10.2.24.924) **Description** The issue is related to an insecure type resolution vulnerability, allowing a remote code execution attack through object injection. This vulnerability can be exploited by providing input that enables the selection of classes, potentially leading to arbitrary code execution. **Recommendations** For versions prior to 2024 Q3 (10.2.24.924), update to version 2024 Q3 (10.2.24.924) or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924) **Description** The issue is related to insecure expression evaluation, allowing for object injection and potentially leading to code execution attacks. This can be exploited by providing input that enables external control over class selection, which may permit an attacker to execute arbitrary code. **Recommendations** For versions prior to 2024 Q3 (18.2.24.924), update to version 2024 Q3 (18.2.24.924) or later to resolve the issue. As a temporary workaround, consider restricting the use of insecure expression evaluation until a patch is applied. Avoid using vulnerable functions or parameters that may facilitate object injection attacks.

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 18.1.24.709 Description: The issue is related to an insecure type resolution vulnerability, allowing for object injection and potentially enabling a code execution attack. This can be exploited by manipulating input data to select classes, which may permit a remote attacker to execute arbitrary code. The vulnerability can lead to unauthorized access, data theft, and system compromise. Recommendations: For versions prior to 18.1.24.709, upgrade the affected component to version 18.1.24.709 or later to resolve the issue. As a temporary workaround, consider restricting access to the reporting component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft .NET Framework versions prior to 4.8.4682.0/4.8.9206.0 **Description** The vulnerability is related to insufficient protection of service data when processing ObjRef objects, which may allow a remote attacker to gain unauthorized access to protected information. A successful exploit may allow an attacker to disclose sensitive information. The issue has been exploited in the wild and is tracked by CISA as a Known Exploited Vulnerability. **Recommendations** Upgrade .NET ASAP to the latest version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to HTTP .NET Remoting to minimize the risk of exploitation. Avoid using ObjRef objects in HTTP .NET Remoting until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.5.0.1 Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 9.3.0.5 Hitachi Vantara Pentaho Data Integration & Analytics version 8.3.x **Description** The issue allows control of system level data sources due to the lack of restriction on JNDI identifiers during the creation of XActions. **Recommendations** For versions prior to 9.5.0.1, update to version 9.5.0.1 or later. For versions prior to 9.3.0.5, update to version 9.3.0.5 or later. For version 8.3.x, consider restricting the creation of XActions or disabling the feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ASP.NET (affected versions not specified) **Description** The issue is related to errors in security settings of the Microsoft .NET Framework platform. It allows a remote attacker to access a closed part of a web application by sending a specially formed request. This is a security-feature bypass issue that can affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in Microsoft SharePoint Server, which can be exploited by creating a specially crafted ASP.NET page. This could allow a remote attacker to gain administrator privileges. The vulnerability is associated with insufficient access restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft SharePoint Server, allowing a remote attacker to execute arbitrary code. This can affect the system. The vulnerability involves the `TemplateParser` and can be exploited to gain remote code execution (RCE) in SharePoint Online and On-Premise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Orckestra C1 CMS versions prior to 6.13 **Description** A vulnerability in Orckestra C1 CMS allows remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this issue. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. **Recommendations** For versions prior to 6.13, upgrade to C1 CMS v6.13 or newer to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation until the upgrade can be applied.

**Name of the Vulnerable Software and Affected Versions** BMC Track-It! version 20.21.2.109 **Description** This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the authorization of HTTP requests, resulting from the lack of authentication prior to allowing access to functionality. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** For version 20.21.2.109, consider restricting access to the HTTP module to minimize the risk of exploitation until a patch is available. As a temporary workaround, ensure proper authentication mechanisms are in place prior to allowing access to functionality. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** DevExpress (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this issue. The flaw exists within the SafeBinaryFormatter library due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** ZK Framework versions 8.6.4.1, 9.0.1.2, 9.5.1.3, 9.6.0.1, 9.6.1 **Description** The issue is related to the AuUploader component of the ZK Framework, which allows attackers to access sensitive information via a crafted POST request. This can enable a remote attacker to gain unauthorized access to protected information. Approximately 5,600 instances are potentially affected. **Recommendations** For ZK Framework versions 8.6.4.1, 9.0.1.2, 9.5.1.3, 9.6.0.1, 9.6.1, consider disabling the AuUploader component until a patch is available to prevent exploitation. Restrict access to the AuUploader component to minimize the risk of unauthorized access. Avoid using the AuUploader component in the affected ZK Framework versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** The issue is related to errors in code generation management. It allows a remote attacker to execute arbitrary code. The vulnerability can be exploited by an attacker acting remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BMC Track-It! version 20.21.01.102 **Description** This issue allows remote attackers to bypass authentication on affected installations. The flaw exists within the authorization of HTTP requests due to the lack of authentication prior to allowing access to functionality. An attacker can leverage this to bypass authentication on the system. **Recommendations** For version 20.21.01.102, consider restricting access to the HTTP module to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and strengthen the authorization of HTTP requests to ensure proper authentication is required before allowing access to functionality.