tag: Code-Injection · 5 items
- Engineer — Act: A public PoC on GitHub for a CVSS 9.9 code injection flaw (CVE-2026-104351) makes exploitation pressure real despite the low EPSS; patch Adobe Campaign Classic to the latest released version immediately.
- SOC/IR — Plan: With a public PoC available, build or tune detections for exploitation attempts against Campaign Classic endpoints — look for anomalous process spawning or outbound connections from the Campaign Classic application process.
- Leader — Skip
- Signals: CVE-2026-104351 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Max-severity code injection in Kiteworks EPG with 126 total CVEs patched — if Kiteworks is in your stack, schedule an update this sprint; no active exploitation signals yet but the severity warrants prioritization over routine patches.
- SOC/IR — Skip
- Leader — Plan: If Kiteworks is in your vendor inventory for secure file transfer or email security, confirm your instance is on the patched release and document it for vendor risk records — no breach reported, but a max-severity flaw in a data-handling platform warrants a quick compliance check.
- Engineer — Act: Patch Roundcube Webmail to the version released in May or later immediately — active exploitation confirmed by a national cyber authority means this is no longer a routine patch-window item; prioritize any self-hosted Roundcube instances over other queued work.
- SOC/IR — Act: Sweep Roundcube server logs for signs of code injection attempts since May; active exploitation of a webmail platform can yield credential access or persistent footholds before patching occurs, so assume-breach investigation is warranted on any unpatched instances.
- Leader — Skip
- Engineer — Act: If you run a self-hosted Gitea instance, patch to the fixed version immediately — CISA-confirmed active exploitation of a critical code injection flaw means your CI/CD pipeline and source repositories are at direct risk.
- SOC/IR — Act: Audit any Gitea instances in your estate for signs of code injection compromise dating back to initial disclosure; a compromised source-code host can stage supply-chain attacks that require assume-breach investigation of downstream build artifacts.
- Leader — Plan: Direct your teams to inventory self-hosted Gitea deployments and validate patch status; a code injection flaw in source-code infrastructure carries supply chain risk worth confirming is closed before it surfaces in a customer security questionnaire.
- Engineer — Act: GitLab is a core CI/CD asset in most engineering environments; this unauthenticated code-injection flaw (CVSS 9.4) with a public PoC is already being weaponized. Patch all self-hosted GitLab instances to the vendor’s fixed version immediately and audit recently modified public projects for unexpected data rewrites.
- SOC/IR — Act: Active exploitation of a GitLab code-injection flaw means assume-compromise posture for any internet-exposed self-hosted instance: hunt GitLab audit logs for unauthenticated modification or deletion events against public projects since the disclosure date, and alert engineering if anomalies are found.
- Leader — Plan: A critically-rated, actively exploited flaw in a widely-used CI/CD platform carries supply-chain risk if projects were tampered with before patching; confirm with engineering that all GitLab deployments are patched this week and assess whether any customer-facing build artifacts could have been affected.
- Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub