PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 54 By PatchDayAlert

Edge type confusion at CVSS 9.0 and a one-variable path to SYSTEM via Parsec

Two Chromium/Edge RCEs (CVE-2026-58289, CVE-2026-58299), a clean local privesc in Parsec's parsecd.exe service (CVE-2026-54424, CVSS 8.4), and a GraphQL resource exhaustion bug in Red Hat ACS Central.

Patch now
0
Within 24h
1
This week
3
Exploited
0
Unity ParsecWindowsMicrosoft EdgeChromiumRed Hat ACSRHACSKubernetesLinuxCloudAndroidJairiidriss Restaurant Website Php Mysql

Two worth your attention this morning. A type confusion bug in Chromium under Microsoft Edge (CVE-2026-58289, CVSS 9.0) lets an attacker run code through a malicious webpage with no auth required. Nobody's exploiting it in the wild yet, but a CVSS 9.0 browser RCE won't stay quiet for long. Patch Edge first, then check if Parsec is running anywhere in your environment, because a clean local privilege escalation to SYSTEM (CVE-2026-54424, CVSS 8.4) just dropped for it too.

Today's CVEs

Sorted by urgency

01

CVE-2026-54424

NVD
8.4
CVSS EPSS 0.24%
Patch this week HIGH
Unity ParsecWindows

An attacker with local access to a Windows machine running Parsec can trick the parsecd.exe service into running as SYSTEM with a user-controlled environment variable. That gives them full local privilege escalation, going from a normal user to SYSTEM. Exploitation requires local access and the ability to manipulate the AppData environment variable, so this isn't remotely exploitable, but it's a clean path to SYSTEM on any box running Parsec.

Affected estate
Windows admins running Unity Parsec for remote desktop or streaming, especially in shared or multi-user environments
How to check
Check the Parsec version in the app's About/Settings page or look at the parsecd.exe file version. Anything older than 150-104a is vulnerable.
Included because
local privilege escalation; CVSS 8.4; common remote-access tool; straightforward exploit path
Action
Update Parsec for Windows to version 150-104a.
Why it matters
A local user can escalate to NT AUTHORITY\SYSTEM, giving them complete control of the host.

Evidence trail

02

CVE-2026-58289

NVD
9.0
CVSS EPSS 0.53%
Patch within 24h CRITICAL
Microsoft EdgeChromiumWindows

A type confusion bug in the Chromium engine under Microsoft Edge lets an attacker run code on your machine over the network. No authentication required. In practice, this likely means a malicious or compromised webpage can trigger code execution in the browser process. CVSS 9.0 makes this one of the nastiest browser bugs in a while.

Affected estate
Anyone managing endpoints with Microsoft Edge installed, including desktops, kiosks, and VDI images
How to check
Open Edge, go to edge://settings/help and check the version number. Or query via PowerShell: (Get-Item 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe').VersionInfo.ProductVersion.
Included because
unauthenticated; network-exploitable; CVSS 9.0; ubiquitous browser; type confusion often leads to reliable exploitation
Action
Push the latest Edge stable channel update to all managed endpoints.
Why it matters
An attacker can execute code remotely through a crafted webpage with no user authentication needed, just a page visit.

Evidence trail

03

CVE-2026-9165

NVD
7.7
CVSS
Patch this week HIGH
Red Hat ACSRHACSKubernetesLinuxCloud

An authenticated user can send deeply nested GraphQL queries to Red Hat Advanced Cluster Security (RHACS) Central and exhaust its resources. This crashes or degrades the RHACS management plane, meaning you lose visibility and policy enforcement on your Kubernetes clusters. The attacker needs a valid API token, so this isn't open to the internet by default, but any user or service account with API access can pull it off.

Affected estate
Teams running Red Hat Advanced Cluster Security (RHACS) for Kubernetes with Central exposed to authenticated users or service accounts
How to check
Check your RHACS Central version via the UI dashboard or 'roxctl central whoami'. Confirm whether the GraphQL endpoint is reachable by authenticated users or service accounts.
Included because
authenticated; denial of service against security management plane; CVSS 7.7; Kubernetes security tooling
Action
Update RHACS Central to the patched version when available. Audit and revoke unnecessary API tokens now.
Why it matters
Losing the RHACS management plane means no security policy enforcement or visibility across your Kubernetes clusters during an outage.
Source
Red Hat advisory

Evidence trail

04

CVE-2026-58299

NVD
7.5
CVSS EPSS 0.28%
Patch this week HIGH
Microsoft EdgeChromiumAndroid

A race condition (TOCTOU) in Microsoft Edge for Android lets an attacker execute code over the network without authentication. Exploitation depends on winning a timing window, which makes it less reliable than a straight memory corruption bug, but it's still remote code execution on a mobile browser. CVSS 7.5.

Affected estate
Mobile device admins managing Android devices with Microsoft Edge deployed, including MDM/EMM-managed fleets
How to check
Check the Edge version on managed Android devices through your MDM inventory or manually via Edge > Settings > About Microsoft Edge.
Included because
unauthenticated; network-exploitable; CVSS 7.5; widely deployed mobile browser
Action
Deploy the latest Edge for Android update via MDM or Google Play managed updates.
Why it matters
Remote code execution on mobile endpoints, even if the race condition reduces reliability, still poses real risk to corporate data on managed Android devices.

Evidence trail

05

CVE-2026-14622

NVD
7.3
CVSS EPSS 0.52%
Track HIGH
Jairiidriss Restaurant Website Php MysqlLinuxWindows

The admin AJAX endpoints in the jairiidriss restaurant-website-php-mysql project have no authentication at all. Anyone who can reach the /admin/ajax_files path can hit admin functions remotely without logging in. This is an open-source demo/hobby project, not a commercial product, so the real risk is if someone forked it and deployed it in production without adding auth.

Affected estate
Anyone who deployed or forked the jairiidriss/restaurant-website-php-mysql project into a production or internet-facing environment
How to check
Check if /admin/ajax_files is reachable without a session or login cookie. A simple unauthenticated GET or POST to those endpoints will confirm exposure.
Included because
unauthenticated; internet-facing; public exploit available; missing authentication on admin endpoints
Action
Add server-side authentication to all /admin/ajax_files endpoints. If no fix is available upstream, implement it yourself or take the app offline.
Why it matters
Unauthenticated access to admin functions means anyone on the internet can modify or extract data from your site.

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →