Base 9.8 Critical

BACKGROUND
Synology has released security updates addressing multiple critical vulnerabilities in DiskStation Manager (DSM). CVE-2026-13684 affects the DSM SCGI component, while CVE-2026-13639 affects login logic. Both vulnerabilities can be exploited remotely without authentication and may allow attackers to read or write arbitrary files or cause a denial-of-service condition. Synology has rated both vulnerabilities as Critical with a CVSS score of 9.8.
 

CVE-2026-13684 is an improper encoding or escaping of output vulnerability in the DSM SCGI component. Successful exploitation may allow a remote, unauthenticated attacker to read or write arbitrary files and disrupt system availability.
CVE-2026-13639 is an insufficient entropy vulnerability in DSM login logic. This weakness may allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Both vulnerabilities share the following characteristics:
 

• Network-exploitable
• Low attack complexity
• No privileges required
• No user interaction required

IMPACT
Successful exploitation could allow an attacker to:

• Read sensitive files stored on the NAS.
• Create, modify, or overwrite files.
• Tamper with system configurations or hosted services.
• Cause service disruption or denial-of-service conditions.
   

Compromise the confidentiality, integrity, and availability of data managed by the DSM system.
Because these vulnerabilities can be exploited remotely without authentication, internet-exposed NAS devices should be treated as high-priority remediation targets.

AFFECTED PRODUCTS

RECOMMENDATIONS

1. Disable unnecessary port forwarding and Universal Plug and Play (UPnP) on routers and NAS devices.
2. Update DSM to the applicable fixed release listed above through Control Panel → Update & Restore → DSM Update or use Synology’s official update process.
3. Reset administrator and other privilege account passwords, revoke active sessions, and review multi-factor authentication (MFA) settings.

REFERENCES

https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

https://mallory.ai/vulnerabilities/CVE-2026-13684

https://www.ionix.io/threat-center/cve-2026-13639/

BACKGROUND

CVSS Score Base 9.6 Critical

An untrusted search path vulnerability has been found in Zoom Clients for Windows operating
system, allowing an unauthenticated attacker to escalate privileges via network access. This can
be achieved by placing a malicious DLL in a location that the Zoom client search without
specifying absolute paths. This vulnerability can lead to privilege escalation, arbitrary code
execution, and compromise of system integrity and availability.

IMPACT

• Unauthorized attackers can gain elevated privileges on a target Windows system through
  network exploitation.
• Attackers may potentially execute arbitrary code.
• Sensitive systems may be exposed and compromised without proper authentication.

AFFECTED PRODUCTS

RECOMMENDATIONS

• Immediately update Zoom Clients for Windows to the latest version (6.3.0 or later) that
  contains the patch for this vulnerability. Latest updates can be downloaded at
  https://zoom.us/download
• Enable automatic updates for the Zoom client software to ensure timely patching in the
  future.
• Monitor network access and investigate any signs of unauthorized privilege escalation
  attempts.
• Review and implement network access controls to limit exposure of Zoom client
  installations.
• Enforce least-privilege access controls to limit the potential impact if a system is
  compromised.
• Install antivirus software and keep it up to date.

REFERENCES

https://www.zoom.com/en/trust/security-bulletin/zsb-25030/

https://zeropath.com/blog/cve-2025-49457-zoom-untrusted-search-path-summary

https://securityonline.info/zoom-patches-critical-flaw-cve-2025-49457-windows-usersface-
privilege-escalation-risk/

BACKGROUND

CVSS Score: Base 9.8 Critical

A critical remote code execution vulnerability, tracked as CVE-2025-53770, has been
actively exploited in the wild. It targets on-premises Microsoft SharePoint Server
deployments. The flaw involves deserialization of untrusted data, allowing attackers to
execute arbitrary code remotely without authentication. This vulnerability has led to
mass attacks, compromising over 75 organizations, enabling threat actors to move
laterally, persist, and blend with legitimate SharePoint activity, making detection more
difficult.

Note: SharePoint Online (Microsoft 365) is not affected.

IMPACT

• Enables unauthorized attackers to execute code over a network.
• Bypasses identity controls, including Multi Factor Authentication (MFA) and Single Sign-On (SSO).
• Allows theft of MachineKey theft.

AFFECTED PRODUCTS

RECOMMENDATIONS

• To mitigate potential attacks, customers should:
• Use supported versions of on-premises SharePoint Server.
• Apply the latest security patches with immediate e􀆯ect.
• Ensure the Antimalware Scan Interface (AMSI) is turned on and configured correctly, with an antivirus solution such as Microsoft Defender Antivirus.
• Deploy Microsoft Defender for Endpoint protection, or equivalent threat solutions
• Rotate SharePoint Server ASP.NET machine keys.
• NOTE: SharePoint Server 2016 users should monitor Microsoft’s update guidance
  and apply patches once available.

REFERENCES

• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepointvulnerability-
  cve-2025-53770/
• https://support.microsoft.com/en-us/topic/description-of-the-security-updatefor-
  sharepoint-server-2019-july-8-2025-kb5002741-d860f51b-fcdf-41e4-89de-
  9ce487c06548
• https://support.microsoft.com/en-us/topic/description-of-the-security-updatefor-
  sharepoint-enterprise-server-2016-july-8-2025-kb5002744-9196e240-c76d-
  4bb0-b16c-6f7d6645a1f0
• https://www.microsoft.com/en-us/download/details.aspx?id=108285
• https://www.microsoft.com/en-us/download/details.aspx?id=108286
• https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releasesguidance-
  exploitation-sharepoint-vulnerability-cve-2025-53770

BACKGROUND

CVSS Score: Base 8.1 High
 

Google has released a security update to address an actively exploited zero-day vulnerability in the V8
JavaScript engine used in Google Chrome. This vulnerability enables remote code execution (RCE) if
exploited successfully.

IMPACT

• May allow remote attackers to execute arbitrary code which could result in the execution of
  malicious code, spyware, or conduct further system compromise.
• May cause memory corruption and crashes.

AFFECTED OPERATING SYSTEMS & FIXED VERSIONS

The vulnerability affects all major platforms running Chrome, including Windows, macOS, and Linux.

RECOMMENDATIONS

Users and administrators are advised to install the latest available Chrome updates accordingly.

REFERENCE
https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html

https://nvd.nist.gov/vuln/detail/CVE-2025-6554

BACKGROUND

CVSSv3 Score: Base 8.5 High

Palo Alto Networks has issued an advisory regarding a critical vulnerability, tracked as CVE-2025-4232,
affecting its GlobalProtect app on macOS.

An improper neutralization of wildcard characters exists in the log collection feature of the GlobalProtect
app. This flaw can be exploited by an authenticated but non-administrative user to execute arbitrary code
with root privileges.

Exploiting this vulnerability can result in privilege escalation to root, granting the attacker full control over
the a􀆯ected macOS system. This includes the ability to install programs, view, modify, or delete data, and
create new user accounts with full privileges.

IMPACT

• Successful exploitation may allow privilege escalation to root access, granting the attacker full
  control over the a􀆯ected macOS system
• Ability to install software, view, modify or delete data, and create new user accounts with full
  privileges.

SYSTEMS AFFECTED

RECOMMENDATIONS

• Apply updates to the a􀆯ected versions as soon as possible.
• Upgrade to the fixed or latest version released by Palo Alto Networks.
   

REFERENCES

https://security.paloaltonetworks.com/CVE-2025-4232

A new phishing campaign, including Business Email Compromise (BEC), has been discovered using Microsoft 365’s legitimate infrastructure. It poses a significant threat to user credentials and account security, leading to credential theft, data breaches, financial fraud, and malware spread.

Targeted Users:

• High-level targets
• Organizations handling sensitive data
• Users with privileged access (administrative)
• Organizations using Microsoft ADFS (Active Directory Federation Services)
• General Microsoft 365 users

Recommendations:

• Implement Multi-Factor Authentication (MFA)
• Regularly review and audit Microsoft 365 tenant configuration
• Educate users about phishing tactics and security best practice
• Implement robust email and application security solutions
• Enforce sign-in risk policies
   

References:

https://www.securityweek.com/microsoft-365-targeted-in-new-phishing-account-takeover-attacks/

https://www.securitymagazine.com/articles/101483-phishing-campaign-leverages-microsoft-365-infrastructure-for-attacks/

A new phishing campaign, including Business Email Compromise (BEC), has been discovered using Microsoft 365’s legitimate infrastructure. It poses a significant threat to user credentials and account security, leading to credential theft, data breaches, financial fraud, and malware spread.

Targeted Users:

• High-level targets
• Organizations handling sensitive data
• Users with privileged access (administrative)
• Organizations using Microsoft ADFS (Active Directory Federation Services)
• General Microsoft 365 users
   

Recommendations:

• Implement Multi-Factor Authentication (MFA)
• Regularly review and audit Microsoft 365 tenant configuration
• Educate users about phishing tactics and security best practice
• Implement robust email and application security solutions
• Enforce sign-in risk policies
   

References:

https://www.securityweek.com/microsoft-365-targeted-in-new-phishing-account-takeover-attacks/
https://www.securitymagazine.com/articles/101483-phishing-campaign-leverages-microsoft-365-infrastructure-for-attacks/

BACKGROUND
 

CVSS Score: Base 9.8 Critical
Synology has disclosed a critical security vulnerability affecting several of its products, including Synology BeeStation Manager (BSM), Synology DiskStation Manager (DSM), and Synology Unified Controller (DSMUC).
It involves improper encoding or escaping of output vulnerabilities in the system plugin daemon within the affected products, allowing remote attackers to execute arbitrary code without user interaction.

IMPACT

• Allows remote attackers to execute arbitrary code via unspecified vectors.
• Enables unauthorized file access and modification.
• Poses a significant risk of system compromise and data breaches.

RECOMMENDATIONS

• Immediately update to the latest versions of BSM, DSM, and DSMUC.
• Implement network segmentation to limit remote access to vulnerable systems.
• Configure firewalls to restrict unnecessary network exposure.
• Regularly monitor systems and networks for signs of unauthorized access or unusual activity.
• Conduct regular vulnerability scans on Synology devices to identify and address potential security weaknesses.

REFERENCES

https://www.synology.com/en-global/security/advisory/Synology_SA_24_23

https://securityonline.info/cve-2024-10441-cvss-9-8-synology-patches-critical-code-execution-flaw-in-multiple-products/

CVSSv3 Score: Base 9.6 Critical

BACKGROUND

Another critical vulnerability addressed by Fortinet is CVE-2023-37936, a hard-coded cryptographic key in Fortinet FortiSwitch. This flaw allows a remote, unauthenticated attacker with access to the hard-coded key to execute unauthorized code via crafted cryptographic requests.

IMPACT 

• Unauthorized code execution by exploiting the hard-coded cryptographic key flaw.
• Bypassing authentication mechanisms through crafted cryptographic requests, allowing 
  attackers to gain unauthorized access to the system.
• Gaining control over FortiSwitch devices, potentially compromising the entire internal 
  network they manage.
• Attackers can intercept or manipulate sensitive data transmitted through or stored on 
  compromised devices.
• Attackers can disrupt the network by sending harmful data, changing settings, or shutting 
  down devices using the compromised devices.

AFFECTED PRODUCTS

RECOMMENDATIONS

• Apply the appropriate updates provided by Fortinet to vulnerable systems after thorough 
  testing.
• Regularly review system logs and monitor for any unauthorized access or unusual activities.
• Limit access to management interfaces and ensure they are not exposed to untrusted 
  networks.

REFERENCES

https://www.fortiguard.com/psirt/FG-IR-23-260 

https://www.securityweek.com/fortinet-confirms-new-zero-day-exploitation/