Linux kernel privesc and ownCloud auth bypass both exploited in the wild
3 actively exploited bugs today: a Linux IPv6 privilege escalation, a JFrog Artifactory path traversal, and an ownCloud file-access bypass needing zero authentication. Plus an 8.8 Outlook RCE and a SharePoint code injection waiting in the wings.
Three bugs are already exploited in the wild right now, and two more are sitting at CVSS 8.8 waiting their turn. The headliner is a privilege escalation in the Linux kernel's IPv6 stack (CVE-2026-53362) with sparse details but confirmed exploitation, so check your distro's advisory and patch your Linux hosts first.
Today's CVEs
Sorted by urgencyCVE-2026-53362
CISA KEVAn attacker can escalate privileges through a bug in the Linux kernel's IPv6 networking subsystem. Details are sparse, but this one is already exploited in the wild, which means someone is actively using it to gain elevated access on Linux hosts. It affects any distro shipping a vulnerable kernel, including SUSE and Red Hat.
- Affected estate
- Anyone running Linux systems with IPv6 enabled, including SUSE, Red Hat, and derivative distros
- How to check
- Run 'uname -r' to get your running kernel version and compare against your distro's security advisory for patched versions. Check 'sysctl net.ipv6.conf.all.disable_ipv6' to confirm whether IPv6 is active.
- Included because
- exploited in the wild; privilege escalation; extremely common product; affects all major Linux distros
- Action
- Update to the patched kernel package from your distro vendor and reboot. If immediate reboot is not possible, consider disabling IPv6 as a stopgap.
- Why it matters
- Privilege escalation exploited in the wild means attackers with low-level access on your Linux hosts can become root.
Evidence trail
- NVD: View source
CVE-2026-66384
CISA KEVAn authenticated user on JFrog Artifactory can write files outside the intended Docker cache directory when specific remote-repository conditions are met. This is a path traversal bug, and it's being exploited in the wild. The auth requirement lowers the risk a bit, but any user with repo access could potentially overwrite critical files on the Artifactory server.
- Affected estate
- Teams running self-hosted JFrog Artifactory instances with Docker remote repositories configured
- How to check
- Check your Artifactory version in the Admin panel or via the REST API endpoint '/api/system/version'. Compare against JFrog's security advisory for patched versions.
- Included because
- exploited in the wild; path traversal; authenticated but common access level; artifact repositories are high-value targets
- Action
- Upgrade Artifactory to the latest patched release. Audit the Docker cache directory for any files written outside the expected path.
- Why it matters
- An authenticated attacker can write arbitrary files on your Artifactory server, potentially overwriting configs or planting malicious artifacts.
Evidence trail
- NVD: View source
CVE-2023-49105
CISA KEVIf you run ownCloud and a user doesn't have a signing key configured, an attacker who knows that user's username can access, modify, or delete any of their files with zero authentication. No password, no token, nothing. This is exploited in the wild, and the EPSS score is at the 96th percentile, meaning exploit activity is well above average.
- Affected estate
- Anyone running self-hosted ownCloud instances
- How to check
- Check your ownCloud version via the admin panel or 'occ status' command. Review user accounts for missing signing-key configurations.
- Included because
- unauthenticated; exploited in the wild; EPSS 96th percentile; internet-facing file sharing platform; trivial exploitation requirements
- Action
- Upgrade ownCloud to the patched release. Immediately enforce signing keys on all user accounts to close the unauthenticated access path.
- Why it matters
- Unauthenticated file access, modification, and deletion. An attacker only needs to know a username to own that user's entire file store.
Evidence trail
- NVD: View source
CVE-2026-70329
MSRCAn integer overflow in Outlook lets an attacker execute code over the network without needing valid credentials. The CVSS 8.8 reflects how little effort this takes: send a crafted message or calendar invite, and code runs in the context of the victim. Not yet exploited in the wild, but network-accessible RCE in Outlook is a magnet for attackers.
- Affected estate
- Anyone running Microsoft 365 Apps, Office 2019, or Office LTSC 2021 (32-bit or 64-bit)
- How to check
- Open any Office app, go to File > Account > About, and check the build number. Compare against Microsoft's security update guide for the patched build.
- Included because
- unauthenticated; network-accessible RCE; CVSS 8.8; extremely common product; email is the top attack vector
- Action
- Deploy the latest Office security update via WSUS, Intune, SCCM, or Windows Update. Target externally-facing mailbox endpoints first.
- Why it matters
- Network-based remote code execution in Outlook. An attacker doesn't need credentials, just the ability to send you a message.
- Source
- Microsoft Security Update Guide
Evidence trail
- NVD: View source
CVE-2026-65660
MSRCA code injection bug in SharePoint lets an authenticated attacker execute arbitrary code on the server over the network. The CVSS 8.8 and "authorized attacker" language mean you need valid SharePoint credentials, but any authenticated user could potentially take over the server. Not yet exploited in the wild.
- Affected estate
- SharePoint admins running SharePoint Server 2016, 2019, or Subscription Edition on-prem
- How to check
- Open SharePoint Central Administration > Upgrade and Migration > Check product and patch installation status. Compare the installed build number against Microsoft's advisory.
- Included because
- authenticated; network-accessible code execution; CVSS 8.8; common enterprise product; on-prem SharePoint is a high-value target
- Action
- Apply the SharePoint cumulative update or security patch from Microsoft. Audit SharePoint user accounts and tighten permissions to limit who could exploit this.
- Why it matters
- Authenticated code execution on your SharePoint server. Any user with valid credentials could potentially run arbitrary code on the box.
- Source
- Microsoft Security Update Guide
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
Read the rest of the field notes →