Zoom Releases Patches for Critical Privilege Escalation Flaws in Workplace for Windows

Critical Xen Orchestra Authentication Bypass Flaw Exploited in Attacks

A threat actor has been actively exploiting a critical authentication bypass vulnerability in Xen Orchestra, the web-based management platform for XCP-ng and XenServer environments. The flaw resides in the REST authentication mechanism, where an empty token is mishandled and treated as an unfiltered lookup, allowing the first valid token to be returned and enabling unauthenticated attackers to gain administrator privileges. Vates, the software maker behind the product, confirmed that successful compromise of Xen Orchestra can lead to arbitrary code execution on managed pools and full root takeover of XCP-ng nodes. The same actor also exploited a second vulnerability involving malicious VM imports that can compromise underlying hosts, though a fix for this issue remains under development. The attacks originated from infrastructure including the IP address 91.211.251.112:8001 and Tor exit nodes, with no CVE identifiers assigned to either flaw. Vates has published indicators of compromise and recommended placing Xen Orchestra instances behind dedicated networks, implementing WAF rules, rotating credentials, and performing full reinstalls in confirmed compromise cases.

Asus, Zoom, and Cisco Release Security Patches for Router and Windows Vulnerabilities

Asus published an advisory covering four high- and medium-severity vulnerabilities in certain router firmware releases that could allow attackers to execute arbitrary commands with root privileges or overwrite memory and cause a crash. Zoom addressed two vulnerabilities in Workplace for Windows, including a critical unauthenticated privilege escalation flaw tracked as CVE-2026-108186 with a CVSS score of 9.6 and a second issue CVE-2026-108187 scoring 8.1 that also permits remote unauthenticated privilege escalation. Both flaws are fixed in Zoom Workplace for Windows versions 7.1.8 and later, with no indication of in-the-wild exploitation. Cisco updated multiple advisories with new details on Node2Shell impact, an authorization bypass affecting ISE and ISE-PIC, and the availability of fixes for seven critical- and high-severity CVEs in Meraki products. On Tuesday, both Cisco and SonicWall removed root certificates impacted by compromised eMudhra intermediate certificates. The updates arrived alongside hundreds of patches from Apple, Fortinet, Citrix, Ivanti, Intel, AMD, Microsoft, Adobe, SAP, and multiple ICS vendors.

Citrix and Ivanti Patch 19 Vulnerabilities Including Multiple Critical Flaws

Citrix and Ivanti released patches on Tuesday for 19 vulnerabilities across their products, addressing several critical- and high-severity issues. Ivanti fixed 13 flaws in five products, including two critical vulnerabilities in Cloud Services Application and Endpoint Manager that could enable remote attacks without authentication. The CSA issue tracked as CVE-2026-121683 allows attackers to add or delete trusted certificate entries, while the EPM flaw CVE-2026-121653 permits unauthenticated remote code execution via SQL injection. Citrix addressed six defects in XenServer, including CVE-2026-102705 that could expose the Pool Secret, along with mitigations for AMD CPU vulnerabilities affecting virtual machines. Neither vendor has observed active exploitation of the disclosed issues in the wild.