CVE-2026-66384

CVE: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability: JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
CWE: CWE-22
Published: JFrog | Artifactory
Link: https://www.cve.org/CVERecord?id=CVE-2026-66384

Threat Analysis (JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability: JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.)

  1. Impact: The vulnerability can let an authenticated user write files outside the intended Docker cache directory, compromising integrity (malicious payload insertion) and confidentiality (exposure of sensitive data outside protected paths). Availability is not directly affected.

  2. Affected Components & Attack Surface: Artifactory’s REST API for remote repositories, specifically the write endpoint; the Docker cache sub‑directory; remote‑repository configuration that permits write access.

  3. Exploitation Prerequisites: An authenticated user with write permission on the remote repository, a repository that allows write operations, and a request that includes a path traversal component (e.g., ../ or .. in the target path).

  4. Detection Ideas & Indicators: Unexpected file uploads to paths outside /docker/cache/, audit‑log entries showing write to non‑cache locations, file‑system changes detected by SIEM. MITRE ATT&CK: T1195 (Path Traversal), T1105 (Web Interface).

  5. Mitigations & Workarounds: Apply the vendor patch that validates all paths; restrict repository write access to /docker/cache/ via ACLs or configuration; enforce server‑side sanitization of all request parameters.

  6. Verification Steps: Using Artifactory’s UI, construct a request with a path like /docker/../test.txt. Verify that the request is rejected or that the file is created only inside /docker/cache/. Compare behavior before and after patch.

  7. Attack‑Path Sequence:

    sequenceDiagram
 User->>Artifactory: POST /remote-repo/write?path=/docker/../payload.txt
 Artifactory->>Artifactory: Parse path, allow traversal
 Artifactory->>Docker: Write payload to /docker/../payload.txt
 Docker->>Artifactory: Store file (outside cache)
 Artifactory->>User: Success response

CVE-2026-53362

CVE: Linux Kernel Unspecified Vulnerability: Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
Published: Linux | Kernel
Link: https://www.cve.org/CVERecord?id=CVE-2026-53362

Threat Analysis (Linux Kernel Unspecified Vulnerability: Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.)
  1. Impact: Privilege escalation via IPv6 can compromise confidentiality, integrity, and availability of the system.
  2. Affected Components & Attack Surface: Linux kernel IPv6 networking subsystem, present in Suse, Red Hat, and other Linux distributions; exposure is remote.
  3. Exploitation Prerequisites: Ability to send or receive malformed IPv6 packets; typically requires network access but not necessarily elevated privileges.
  4. Detection Ideas & Indicators: Kernel dmesg entries, auditd logs for IPv6 errors, syslog warnings; MITRE ATT&CK T1190 (Abuse of OS Service).
  5. Mitigations & Workarounds: Apply kernel patch CVE-2026-53362, upgrade to patched kernel, or disable IPv6 stack.
  6. Verification Steps: Run kernel regression test suite or use patched kernel; confirm with uname -r and grep CVE-2026-53362 /var/log/kern.log.
  7. Attack-Path Sequence: 
    sequenceDiagram
 Attacker->>Kernel: Send malformed IPv6 packet
 Kernel->>IPv6 Stack: Process packet
 IPv6 Stack->>Kernel: Buffer overflow
 Kernel->>Privilege Escalation: Execute with root

CVE-2023-49105

CVE: ownCloud Improper Authentication Vulnerability: ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.
CWE: CWE-287
Published: ownCloud | ownCloud
Link: https://www.cve.org/CVERecord?id=CVE-2023-49105

Threat Analysis (ownCloud Improper Authentication Vulnerability: ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.)

  1. Impact: An attacker can read, modify, or delete any file without authentication, compromising confidentiality, integrity, and availability of the entire ownCloud instance.

  2. Affected Components & Attack Surface: The vulnerability resides in the ownCloud web interface (PHP/Node.js components) and the file‑system API; exposure is remote via the HTTP/HTTPS web server.

  3. Exploitation Prerequisites: The attacker must know a valid user‑name (any account) and the target file system must lack a signing‑key for that user. No elevated privileges or special configuration are needed.

  4. Detection Ideas & Indicators: Unexpected file‑system changes logged by ownCloud audit logs, missing signing‑key entries, or repeated unauthenticated access attempts; MITRE ATT&CK T1190 (Unauthenticated Access).

  5. Mitigations & Workarounds: Deploy ownCloud 2.8.14 or later (official patch), enable signing‑keys for all users, and enforce HTTPS‑only with strict CSP.

  6. Verification Steps: Use the CVE test harness to submit a username without a signing‑key; the server should reject the request. After patching, attempt the same request and observe a 403/401 response.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>ownCloud: Send unauthenticated request with known username
 ownCloud->>FileSystem: Retrieve file without signing‑key check
 FileSystem-->>ownCloud: Return file/modified data
 ownCloud-->>Attacker: Unencrypted file access/modification

CVE-2019-1068

CVE: Microsoft SQL Server Remote Code Execution Vulnerability: Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
Published: Microsoft | SQL Server
Link: https://www.cve.org/CVERecord?id=CVE-2019-1068

Threat Analysis (Microsoft SQL Server Remote Code Execution Vulnerability: Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.)

  1. Impact: A remote code execution (RCE) flaw lets an attacker run arbitrary code under the SQL Server Database Engine service account, jeopardizing confidentiality, integrity, and availability of the database and the host.

  2. Affected Components & Attack Surface: The vulnerability resides in the SQL Server database engine; it is exposed remotely via TCP/HTTP (port 1433/1434) to any client that can reach the server.

  3. Exploitation Prerequisites: No elevated host privileges are needed; only network access to the SQL Server instance (any user with a TCP/IP connection) can exploit the flaw, which is present in versions 2012‑2016 SP2 and earlier.

  4. Detection Ideas & Indicators: Look for the error 29082 in SQL Server error logs, repeated failed login attempts, unusual process creation (e.g., sqlserver.exe spawning child processes), and ATT&CK T1105 (Exploit Public‑Facing Application) / T1059.004 (Command‑Line Interface).

  5. Mitigations & Workarounds: Deploy the official patches (SQL Server 2016 SP4, 2017 SP2, 2019 SP1), disable the HTTP listener, restrict TCP/IP access to trusted IP ranges, and enforce least‑privilege service accounts.

  6. Verification Steps: Use Metasploit’s sql_server_remote_code_execution payload to attempt execution; confirm the process runs as the service account and that the server version is patched (e.g., sqlcmd -Q "SELECT @@VERSION").

  7. Attack‑Path Sequence:

    flowchart TD
 A[External Network] -->|HTTP request| B[SQL Server Engine]
 B --> C[Vulnerable code execution]
 C --> D[Code runs as SQL Server service account]
 D --> E[Attack complete]

CVE-2026-8452

CVE: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.
CWE: CWE-119
Published: Citrix | NetScaler ADC and NetScaler Gateway
Link: https://www.cve.org/CVERecord?id=CVE-2026-8452

Threat Analysis (Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.)

  1. Impact: The buffer‑overflow vulnerability can cause the NetScaler ADC or Gateway to crash, exhausting memory or CPU resources, resulting in a denial‑of‑service that compromises availability. Confidentiality and integrity may also be degraded if the service becomes unresponsive.

  2. Affected Components & Attack Surface: Citrix NetScaler ADC and NetScaler Gateway; exposed via HTTP/HTTPS web interfaces and local privileged access.

  3. Exploitation Prerequisites: An attacker must send a malformed HTTP/HTTPS request with data exceeding the buffer limit; no special privileges are needed beyond authentication to the device.

  4. Detection Ideas & Indicators: High CPU or memory usage, repeated 500 HTTP errors, CVE‑119 logs, MITRE ATT&CK T1195 (Buffer Overflow), IDA‑119.

  5. Mitigations & Workarounds: Apply Citrix’s official patch, restrict input size via firewall/web‑application filters, disable the vulnerable service if patch unavailable.

  6. Verification Steps: Inject an oversized payload into the web interface; confirm the device crashes or returns a 500 error. After patching, repeat the test and verify normal operation.

  7. Attack‑Path Sequence:

    sequenceDiagram
    User->>NetScaler Gateway: Oversized HTTP request
    NetScaler Gateway->>Buffer: Read > size
    Buffer->>Heap: Overflow
    Overflow->>Heap: Crash / DoS
    NetScaler Gateway->>Client: 500 error