PaperCut exploited in the wild again, plus unauthenticated RCE in Windows SSTP

A double-free bug in Windows SSTP (Secure Socket Tunneling Protocol) lets an unauthenticated attacker execute code over the network. SSTP is used by Windows VPN services, so any server running RRAS with SSTP enabled is exposed. No exploit has been spotted in the wild yet, but unauthenticated network-based RCE at CVSS 8.1 is worth patching fast.

Affected estate

Windows sysadmins running RRAS/VPN servers with SSTP enabled, particularly on Windows 10 1607, 1809, and 21H2

How to check

Run 'winver' to confirm OS build. Check if RRAS is installed and SSTP is enabled: open Server Manager > Roles > Network Policy and Access Services, or run 'Get-RemoteAccess' in PowerShell.

Included because

unauthenticated; network-facing VPN service; remote code execution; CVSS 8.1

Action

Install the latest cumulative update from Microsoft. If SSTP isn't needed, disable it on the RRAS server.

Why it matters

Unauthenticated remote code execution against a network-facing VPN service. If your SSTP port (TCP 443) is internet-exposed, an attacker doesn't need credentials to hit this.

Source

Microsoft Security Response Center

SmallRye GraphQL doesn't properly validate the size of numeric inputs during BigInteger coercion. An unauthenticated attacker can send a crafted GraphQL query with a huge exponent value, forcing the server to allocate a massive BigInteger object. That eats CPU and memory until the service crashes or becomes unresponsive.

Affected estate

Java developers and operators running applications that use SmallRye GraphQL, including Quarkus-based services with GraphQL endpoints

How to check

Check your project's dependency tree: 'mvn dependency:tree | grep smallrye-graphql' or 'gradle dependencies | grep smallrye-graphql'. Compare the version against the vendor's fix announcement.

Included because

unauthenticated; denial of service; CVSS 7.5; internet-facing GraphQL endpoints common

Action

Update the SmallRye GraphQL dependency to the patched version. Redeploy affected services.

Why it matters

An unauthenticated attacker can take down your GraphQL service with a single crafted query, causing a denial of service.

Source

Red Hat Security Advisory

An Ebyte product uses a weak, deprecated hashing algorithm in its authentication flow. If an attacker can intercept or predict the authentication exchange, they can bypass authentication and gain unauthorized access. The CVSS 9.8 score reflects that this is effectively an auth bypass with no special conditions required.

Affected estate

Anyone deploying Ebyte hardware or firmware in their environment, particularly in IoT or industrial network segments

How to check

Inventory your Ebyte devices, check their firmware version against the vendor advisory, and verify whether authentication traffic uses the deprecated hash (vendor documentation or a packet capture of the auth exchange can confirm).

Included because

CVSS 9.8; authentication bypass; weak cryptography; IoT/embedded devices often lack monitoring

Action

Apply the vendor firmware update. If unavailable, segment the device off untrusted networks and restrict access to management interfaces.

Why it matters

A CVSS 9.8 auth bypass means an attacker can gain full access to the device without credentials under the right conditions.

The Qute template engine used by Quarkus has a sandbox bypass in its ReflectionValueResolver. It fails to block access to sensitive Java internals when processing certain data types like Enums. An attacker who can control or influence template content can exploit this to execute arbitrary commands on the server.

Affected estate

Developers and operators running Quarkus applications that use Qute templates, especially where any part of the template content comes from user input or untrusted sources

How to check

Check your project dependencies: 'mvn dependency:tree | grep quarkus-qute' or 'gradle dependencies | grep qute'. Compare the version against the patched release in the vendor advisory.

Included because

remote code execution; CVSS 8.8; common Java framework; sandbox bypass in template engine

Action

Update Quarkus to the patched version that fixes the ReflectionValueResolver bypass. Redeploy affected services.

Why it matters

If an attacker can influence template text, they can execute arbitrary commands on your server. CVSS 8.8 with a clear path to full server compromise.

Source

Red Hat Security Advisory