Security news, decoded.

Microsoft has released Patch Tuesday updates to address an Exchange Server vulnerability that is already being exploited in the wild, tracked as CVE-2026-42897. The flaw affects Exchange Server Subscription Edition, 2016, and 2019, and could be triggered via a specially crafted email leading to spoofing and cross-site scripting that allows JavaScript execution in a victim’s browser context. CISA added CVE-2026-42897 to its Known Exploited Vulnerabilities (KEV) catalog, requiring remediation by May 29, underscoring the urgency for organizations using affected Exchange deployments to apply the June 9 patches.

Oracle has issued an emergency update for a PeopleSoft remote code execution vulnerability that can be triggered over the network without authentication. The issue affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 and is tracked as CVE-2026-35273 (CVSS 9.8), enabling attackers with HTTP access to take over systems, alter databases, and execute arbitrary commands. Organizations running affected deployments should apply Oracle’s patched update immediately and validate that exposed instances are remediated.

Dahua’s advisory DHCC-SA-202606-001 reports multiple severe security issues across certain Dahua IP cameras (IPC), PTZ cameras (SD), network video recorders (NVR), and related hardware. The affected CVE IDs are CVE-2026-29114 (certificate trust chain weakness), CVE-2026-29115 (authenticated remote denial of service), and CVE-2026-29116 (unauthenticated remote denial of service via specially crafted packets). These flaws matter because they can enable attackers to undermine certificate-based trust and repeatedly disrupt surveillance availability, putting enterprise physical security networks at risk.

A proof-of-concept for an ITScape KVM escape issue has been publicly released, tracked as CVE-2026-46316. The flaw impacts KVM/arm64 environments by enabling untrusted guest virtual machines to break isolation and execute commands on the host with kernel (root) privileges. Because the bug resides in-kernel KVM and can be triggered from guest-side actions, it significantly raises risk for multi-tenant public cloud providers and tenants running affected kernel versions.

A new Jenkins security advisory released in 2026 reports several high-impact issues affecting Jenkins, including remote code execution and data exposure via deserialization (CVE-2026-53435) and additional open redirect and XSS-related weaknesses (CVE-2026-53436, CVE-2026-53437, CVE-2026-53441). The advisory also addresses missing authorization checks and information leakage that can let attackers disrupt job queues, view sensitive user data, and extract plaintext secrets from POST config.xml submissions (CVE-2026-53438, CVE-2026-53439, CVE-2026-53442). Because these flaws can be exploited against CI/CD deployments, Jenkins administrators should apply the published patches immediately—upgrading to version 2.568 for weekly releases or 2.555.3 for LTS.

GitLab released security updates for self-managed Community and Enterprise Editions, including versions 19.0.2, 18.11.5, and 18.10.8, addressing 12 vulnerabilities. The fixes include high-impact issues such as CVE-2026-6552 (improper access control in Group SAML Identity API), CVE-2026-10087 (XSS in the Analytics Dashboard), CVE-2026-7250 (unauthenticated DoS), and multiple injection/authorization problems like CVE-2026-8589 and CVE-2026-10733. Administrators should upgrade promptly because these bugs can enable account takeover, execute client-side code, disrupt availability, and expose or alter sensitive data.

NVIDIA has released a June 2026 security update for NVIDIA DALI addressing two critical issues affecting versions 0.0 through 2.0. The flaws are tracked as CVE-2026-24180 (heap-based buffer overflow) and CVE-2026-24181 (improper index validation), and successful exploitation could enable code execution, data tampering, denial of service, or information disclosure across any supported platform/OS. Organizations using NVIDIA DALI should update to DALI v2.1 or later immediately to reduce exposure.

A critical remote code execution issue tracked as CVE-2026-45034 has been disclosed in PhpSpreadsheet (PHPOffice), along with public proof-of-concept exploit details. The problem stems from a patch-bypass weakness in File::prohibitWrappers that attackers can evade by manipulating wrapper input, allowing dangerous file handling and, depending on the PHP version and application behavior, potential deserialization to reach RCE. Versions in the 1.x series up to 1.30.4 are reported as vulnerable, and upgrading to 1.30.5 is recommended to reduce exposure.

Security researchers report a resurgence and expansion of the JDY botnet, a covert network attributed to China-nexus state-sponsored threat activity. JDY now targets more than 1,500 SOHO and IoT devices and operates as a centralized scanner to discover, fingerprint, and continuously map exposed services for later exploitation. The activity includes use of edge-device vulnerabilities such as CVE-2026-35616, highlighting ongoing risk to internet-facing infrastructure and the persistence of reconnaissance capabilities even after related takedowns.

Security researchers report that an unpatched vulnerability in Langflow, an open-source low-code AI application platform, is being exploited in the wild. CVE-2026-5027 (CVSS 8.8) is a path traversal issue that can allow arbitrary file writes via the POST /api/v2/files endpoint, and unauthenticated access can be sufficient to reach the vulnerable code path before exploitation. This matters because it enables remote compromise without valid credentials, adding to a series of active Langflow attacks this year tied to CVE-2026-0770, CVE-2026-33017, CVE-2026-21445, and CVE-2025-34291.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of in-the-wild exploitation, affecting Cisco Catalyst SD-WAN Manager, Google Chrome V8, and Arista Extensible Operating System (EOS). The listed issues are CVE-2026-20245 (Cisco; authenticated local command execution as root), CVE-2026-11645 (Chrome V8; sandbox escape via crafted HTML for remote code execution), and CVE-2026-7473 (Arista EOS; improper handling of tunnel traffic that can process unexpected tunneled packets). It matters because the KEV listing signals active attacker use, and federal civilian agencies have been directed to remediate or mitigate by June 23, 2026.

Microsoft released security updates for a zero-day in Microsoft Exchange Server that has been exploited in real-world attacks, enabling attackers to run arbitrary JavaScript via a cross-site scripting (XSS) path that targets Outlook Web Access users. The issue, tracked as CVE-2026-42897, affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE), and can be triggered remotely by sending a crafted email without special privileges. This matters because the flaw allows malicious script execution in the victim’s browser context, increasing the risk of account and session compromise; defenders should apply the June 2026 fixes and keep the related mitigations enabled.

Researchers disclosed six security issues in protobuf.js (often used with Google Cloud client libraries, Baileys, and CI/CD workflows), collectively dubbed Proto6. The vulnerabilities affect Node.js services that deserialize attacker-controlled Protobuf data or generate code from schemas, enabling remote code execution and denial-of-service conditions. Affected CVEs include CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44294, and CVE-2026-44295, with the most critical RCE risk tied to CVE-2026-44291; patches are available in protobufjs 7.5.6 and 8.0.2, and protobufjs-cli 1.2.1 and 2.0.2.

Ivanti has published urgent fixes for its gateway appliances after researchers and watchTowr Labs disclosed a publicly available proof of concept for an Ivanti Sentry remote code execution issue. The affected component is associated with CVE-2026-10520 (CVSS 10), and a related authentication/privilege bypass is tracked as CVE-2026-10523 (CVSS 9.9), which can enable creation of administrative accounts and full administrative access. Because these systems sit at the edge of corporate traffic, unpatched deployments face a heightened risk of full administrative compromise; organizations should review logs and upgrade to versions 10.5.2, 10.6.2, or 10.7.1 immediately.

OpenSSL has released emergency security updates to fix multiple memory-safety flaws in its certificate and QUIC-related code paths, including a use-after-free that can be triggered remotely and lead to Remote Code Execution via CVE-2026-45447. The release also covers additional security issues such as input-validation weaknesses (CVE-2026-34182), nonce handling problems in AES-OCB one-shot operations (CVE-2026-45445), and denial-of-service and crash conditions in the QUIC stack (CVE-2026-34183, CVE-2026-42764, CVE-2026-42765) plus an OCSP stapling double-free hazard (CVE-2026-35188). OpenSSL users are urged to upgrade promptly—e.g., from version 4.0 to version 4.0.1, and from 1.1.1 to 1.1.1zh—because unauthenticated attackers may be able to exploit these problems over the network.

The US CISA has updated its Known Exploited Vulnerabilities catalog/active exploit list by adding three newly identified, in-the-wild flaws. Affected products include Cisco Catalyst SD-WAN Manager (CVE-2026-20245), Arista EOS (CVE-2026-7473), and Google Chromium (CVE-2026-11645), spanning command-injection, tunneling/decapsulation weaknesses, and memory-safety issues that can lead to remote code execution. Because attackers are already targeting these weaknesses, organizations should prioritize patching and remediation immediately.