Joel Traber AG

CVE-2021-22005 — VMware vCenter Server File Upload Vulnerability

CVE-2021-21985 — VMware vCenter Server Improper Input Validation Vulnerability

CVE-2021-38647 — Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

CVE-2021-38647 is a 3-year-old advisory with no mention of active manufacturing-sector campaigns; patch status should be verified in WSUS/Defender logs rather than treated as urgent novel threat.

CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CISA KEV listing indicates active exploitation in the wild; prioritize FortiGate/FortiProxy patching before 2025-01-21 deadline to prevent unauthorized administrative access.

CVE-2021-21972 — VMware vCenter Server Remote Code Execution Vulnerability

CVE-2021-31166 — Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

CVE-2024-21762 — Fortinet FortiOS Out-of-Bound Write Vulnerability

CVE-2023-27997 — Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

CVE-2013-3346 — Adobe Reader and Acrobat Memory Corruption Vulnerability

CVE-2024-38812 — VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2025-59287 — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

WSUS deserialization flaws are historically exploited for lateral movement and supply-chain poisoning to distribute malicious updates across enterprise networks.

CVE-2022-26501 — Veeam Backup & Replication Remote Code Execution Vulnerability

CVE-2024-23113 — Fortinet Multiple Products Format String Vulnerability

CVE-2018-13382 — Fortinet FortiOS and FortiProxy Improper Authorization

CVE-2021-34527 — Microsoft Windows Print Spooler Remote Code Execution Vulnerability

CVE-2017-8464 — Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

CVE-2022-41080 — Microsoft Exchange Server Privilege Escalation Vulnerability

CVE-2009-0927 — Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

CVE-2017-0146 — Microsoft Windows SMB Remote Code Execution Vulnerability

CVE-2018-17463 — Google Chromium V8 Remote Code Execution Vulnerability

CVE-2009-3953 — Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

CVE-2021-21017 — Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

CVE-2011-3402 — Microsoft Windows Remote Code Execution Vulnerability

CVE-2019-0541 — Microsoft MSHTML Remote Code Execution Vulnerability

CVE-2021-37975 — Google Chromium V8 Use-After-Free Vulnerability

CVE-2025-49704 — Microsoft SharePoint Code Injection Vulnerability

Alert emphasizes decommissioning EOL/EOS SharePoint Server instances rather than patching; suggests vulnerability is actively exploited against public-facing legacy deployments.

CVE-2016-7256 — Microsoft Windows Open Type Font Remote Code Execution Vulnerability

CVE-2023-4762 — Google Chromium V8 Type Confusion Vulnerability

CVE-2025-33053 — Microsoft Windows External Control of File Name or Path Vulnerability

CISA KEV listing confirms active exploitation in the wild; July 1, 2025 deadline suggests imminent weaponization—prioritize patching Windows Server infrastructure ahead of deadline.

CVE-2020-12812 — Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Vulnerability

CVE-2026-24858 — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2021-37973 — Google Chromium Portals Use-After-Free Vulnerability

CVE-2022-4135 — Google Chromium GPU Heap Buffer Overflow Vulnerability

CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

CISA KEV listing signals imminent active exploitation; race condition in ESXi could enable privilege escalation or VM escape if weaponized, requiring immediate patching despite mitigation availability.

CVE-2017-0148 — Microsoft SMBv1 Server Remote Code Execution Vulnerability

CVE-2020-4006 — Multiple VMware Products Command Injection Vulnerability

CVE-2022-41082 — Microsoft Exchange Server Remote Code Execution Vulnerability

This 2022 CVE was actively exploited by Hafnium/APT40 (China-linked) against European manufacturing and critical infrastructure; relevant for DACH firms even without Exchange if mail gateway or hybrid cloud email is present.

CVE-2017-11882 — Microsoft Office Memory Corruption Vulnerability

CVE-2017-0261 — Microsoft Office Use-After-Free Vulnerability

CVE-2021-40449 — Microsoft Windows Win32k Privilege Escalation Vulnerability

CVE-2016-0099 — Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

CVE-2021-1732 — Microsoft Win32k Privilege Escalation Vulnerability

This is a 2021 vulnerability with a patch deadline 3+ years in the past; it adds no novel intelligence beyond standard patch management and likely indicates stale alert feeds.

CVE-2013-0641 — Adobe Reader Buffer Overflow Vulnerability

CVE-2024-49138 — Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

CVE-2014-4113 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2019-0841 — Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

CVE-2025-21333 — Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

CVE-2020-1054 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2018-8453 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2023-21608 — Adobe Acrobat and Reader Use-After-Free Vulnerability

CVE-2021-1647 — Microsoft Defender Remote Code Execution Vulnerability

CVE-2018-8440 — Microsoft Windows Privilege Escalation Vulnerability

This is a stale patch reminder from 2022; verify if systems have already been patched to Windows Server 2022/2019 current baselines.

CVE-2021-26858 — Microsoft Exchange Server Remote Code Execution Vulnerability

This CVE (ProxyLogon) was actively exploited by state-sponsored actors (HAFNIUM/China) and is already covered by BSI/CISA advisories; news reminder adds no new intelligence beyond patch guidance.

CVE-2010-0232 — Microsoft Windows Kernel Exception Handler Vulnerability

CVE-2015-1642 — Microsoft Office Memory Corruption Vulnerability

CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability

CVE-2023-28252 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

CVE-2021-38646 — Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

CVE-2018-8589 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2019-0903 — Microsoft GDI Remote Code Execution Vulnerability

CVE-2026-21513 — Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

CVE-2021-21148 — Google Chromium V8 Heap Buffer Overflow Vulnerability

CVE-2024-30040 — Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability

CVE-2021-21206 — Google Chromium Blink Use-After-Free Vulnerability

CVE-2022-4262 — Google Chromium V8 Type Confusion Vulnerability

CVE-2026-21510 — Microsoft Windows Shell Protection Mechanism Failure Vulnerability

CVE-2025-13223 — Google Chromium V8 Type Confusion Vulnerability

CVE-2024-4761 — Google Chromium V8 Out-of-Bounds Memory Write Vulnerability

CVE-2026-3910 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability

CVE-2024-38112 — Microsoft Windows MSHTML Platform Spoofing Vulnerability

CVE-2017-0147 — Microsoft Windows SMBv1 Information Disclosure Vulnerability

CVE-2021-33742 — Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability

Alert references 2021 CVE with patch deadline from 2021; no novel attack campaign or victim-sector intelligence provided beyond standard patch guidance.

CVE-2017-0213 — Microsoft Windows Privilege Escalation Vulnerability

CVE-2023-24955 — Microsoft SharePoint Server Code Injection Vulnerability

CVE-2024-37085 — VMware ESXi Authentication Bypass Vulnerability

CVE-2024-43572 — Microsoft Windows Management Console Remote Code Execution Vulnerability

CVE-2024-30051 — Microsoft DWM Core Library Privilege Escalation Vulnerability

CVE-2019-1322 — Microsoft Windows Privilege Escalation Vulnerability

This is a dated patch reminder (5+ years old with expired deadline); no active campaign or novel attack details provided beyond standard patch guidance.

CVE-2024-26169 — Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

CVE-2016-0151 — Microsoft Windows CSRSS Security Feature Bypass Vulnerability

CVE-2020-0683 — Microsoft Windows Installer Privilege Escalation Vulnerability

CVE-2019-0543 — Microsoft Windows Privilege Escalation Vulnerability

CVE-2020-17087 — Microsoft Windows Kernel Privilege Escalation Vulnerability

CVE-2020-3950 — VMware Multiple Products Privilege Escalation Vulnerability

CVE-2024-38080 — Microsoft Windows Hyper-V Privilege Escalation Vulnerability

CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2026-21533 — Microsoft Windows Improper Privilege Management Vulnerability

This is a standard CISA Known Exploited Vulnerabilities (KEV) bulletin with BOD 22-01 compliance deadline; no novel attack campaign, victim attribution, or TTP disclosure beyond vendor mitigation guidance.

CVE-2018-8611 — Microsoft Windows Kernel Privilege Escalation Vulnerability

This is a 2018 vulnerability with a June 2022 patch deadline noted; no active exploitation campaign or novel TTPs described—purely a patch reminder already covered by CISA/Microsoft advisories.

CVE-2017-0005 — Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability

This is a 2017 vulnerability with a 2022 patch deadline already expired; no novel attack campaign or tactical development is described.

CVE-2024-38014 — Microsoft Windows Installer Improper Privilege Management Vulnerability

CVE-2019-1064 — Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

CVE-2020-1027 — Microsoft Windows Kernel Privilege Escalation Vulnerability

CVE-2020-1464 — Microsoft Windows Spoofing Vulnerability

CVE-2019-1315 — Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

This is a historical patch reminder from 2019 with expired deadline (2022-04-05); no indication of active exploitation or novel campaign—verify internal patch compliance rather than treat as emerging threat.

CVE-2022-24521 — Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

CVE-2025-21334 — Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2016-0165 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2019-0863 — Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability

CVE-2021-40450 — Microsoft Win32k Privilege Escalation Vulnerability

CVE-2019-0880 — Microsoft Windows Privilege Escalation Vulnerability

CVE-2025-59230 — Microsoft Windows Improper Access Control Vulnerability

CVE-2024-38107 — Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

CVE-2025-62221 — Microsoft Windows Use After Free Vulnerability

CVE-2021-34484 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability

CVE-2025-24990 — Microsoft Windows Untrusted Pointer Dereference Vulnerability

CVE-2019-1129 — Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

CVE-2019-1130 — Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

CVE-2025-24993 — Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

CVE-2021-36948 — Microsoft Windows Update Medic Service Privilege Escalation Vulnerability

CVE-2025-30400 — Microsoft Windows DWM Core Library Use-After-Free Vulnerability

CISA KEV listing confirms active in-the-wild exploitation; prioritize patching Windows Server 2022/2019 and client systems before 2025-06-03 deadline.

CVE-2022-41125 — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

CVE-2021-27059 — Microsoft Office Remote Code Execution Vulnerability

CVE-2019-5825 — Google Chromium V8 Out-of-Bounds Write Vulnerability

CVE-2024-38178 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability

CVE-2025-58034 — Fortinet FortiWeb OS Command Injection Vulnerability

CVE-2023-38831 — RARLAB WinRAR Code Execution Vulnerability

This is a publicly disclosed patch-and-exploit vulnerability from 2023; no novel active campaign data added by news sources beyond CISA KEV listing.

CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability

CVE-2023-0386 — Linux Kernel Improper Ownership Management Vulnerability

CVE-2023-28229 — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

CVE-2025-62215 — Microsoft Windows Race Condition Vulnerability

CVE-2025-24983 — Microsoft Windows Win32k Use-After-Free Vulnerability

CVE-2024-38106 — Microsoft Windows Kernel Privilege Escalation Vulnerability

CVE-2022-21919 — Microsoft Windows User Profile Service Privilege Escalation Vulnerability

CVE-2021-34448 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability

CVE-2020-1472 — Microsoft Netlogon Privilege Escalation Vulnerability

CVE-2024-43573 — Microsoft Windows MSHTML Platform Spoofing Vulnerability

CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

No active attack campaign or victim sector details disclosed; this is a standard CISA KEV patch advisory without operational intelligence beyond standard mitigation guidance.

CVE-2022-2856 — Google Chromium Intents Insufficient Input Validation Vulnerability

CVE-2021-22017 — VMware vCenter Server Improper Access Control

CVE-2026-20805 — Microsoft Windows Information Disclosure Vulnerability

CVE-2025-24991 — Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

CVE-2022-41049 — Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

MOTW bypass allows attackers to execute malware from internet-downloaded files without security warnings—critical for manufacturing environments where CAD/ERP file sharing is common.

CVE-2021-31199 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability

No novel attack campaign or DACH-specific targeting identified; alert appears to be routine patch reminder from CISA KEV catalogue.

CVE-2021-22600 — Linux Kernel Privilege Escalation Vulnerability

CVE-2025-24984 — Microsoft Windows NTFS Information Disclosure Vulnerability

CVE-2022-2586 — Linux Kernel Use-After-Free Vulnerability

ZDI-26-204: (Pwn2Own) Canon imageCLASS MF654Cdw XPS Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability

Pwn2Own-disclosed RCE requiring no authentication on Canon MFP model likely in use across manufacturing sites; patch/network segmentation required urgently.

ZDI-26-189: (Pwn2Own) VMware ESXi VMXNET3 Integer Overflow Local Privilege Escalation Vulnerability

Integer overflow in VMXNET3 driver allows local privilege escalation on ESXi; patching required for vSphere 8.x infrastructure.

ZDI-26-115: Fortinet FortiClient VPN FCConfig Utility Link Following Local Privilege Escalation Vulnerability

FCConfig utility symlink-following flaw enables unprivileged users to escalate to higher privilege levels on VPN client installations; requires prior code execution but no authentication.

ZDI-26-178: Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability

Windows cdd component LPE with high CVSS; requires local code execution first, limiting exposure but high impact if combined with remote code execution.

ZDI-26-238: Linux Kernel AoE Driver Use-After-Free Local Privilege Escalation Vulnerability

AoE (ATA over Ethernet) driver vulnerability; exploitation requires local code execution first, making it a second-stage privilege escalation risk in multi-tenant or compromised-host scenarios.

Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha

This is a detection logic error in Microsoft Defender that incorrectly flags legitimate DigiCert certificates as malware; it requires immediate awareness and potential signature/policy remediation to prevent legitimate business certificate validation failures.

Linux-Lücke „Copy Fail“ wird bereits angegriffen

Active in-the-wild exploitation of Linux "Copy Fail" vulnerability signals rapid weaponization; manufacturing systems running Ubuntu 24.04 require immediate kernel patching.

Update-Panne: Microsoft Defender löscht Root-Zertifikate von Digicert

A Microsoft Defender update bug deleted DigiCert root certificates, potentially breaking certificate validation across systems — this is an operational incident requiring immediate verification of certificate store integrity, not a patch reminder.

Bypassing Administrator Protection by Abusing UI Access

Project Zero discloses novel UAC/Administrator Protection bypass exploiting kernel token integrity level mechanisms; demonstrates that Microsoft's post-Vista privilege boundary protections remain bypassable through UI manipulation attacks.

“Legitimate” phishing: how attackers weaponize Amazon SES to bypass email security

Attackers abuse legitimate Amazon SES infrastructure to bypass email filters and authentication checks, enabling scaled phishing and BEC attacks that bypass traditional sender reputation filters.

[UPDATE] Linux Kernel: Mehrere Schwachstellen

BSI UPDATE advisory signals kernel vulnerabilities with potential for RCE/privilege escalation; impact scope unspecified without CVE details—requires follow-up on which kernel versions and Ubuntu releases are affected.

[UPDATE] Linux Kernel: Mehrere Schwachstellen

BSI warning indicates multiple active kernel CVEs; patching status unclear without specific CVE identifiers—requires follow-up on CVSS scores and KEV catalog inclusion to prioritize.

Microsoft Patch Tuesday, March 2026 Edition

March 2026 Patch Tuesday addresses 77 vulnerabilities with no zero-days; routine monthly advisory without active exploitation intelligence or novel attack campaigns.

[UPDATE] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

BSI advisory on multiple Linux kernel DoS flaws; specifics are vague (no CVE list provided), limiting immediate patch/remediation planning—clarification from BSI or vendor advisories needed.