1) CVE-2018-14634 – Linux Kernel Integer Overflow (Local Privilege Escalation)
Type: Integer overflow in the Linux kernel’s create_elf_tables() function.
Impact: A local, unprivileged user with access to a SUID or privileged binary could trigger an integer overflow and escalate to root privileges.
Affected Versions: Older kernel series (e.g., 2.6.x, 3.10.x, 4.14.x) – mostly legacy systems still in operation.
Remediation:
- Patch/Upgrade: Update to a non-vulnerable kernel release or apply vendor-supplied patches.
- Mitigation: Restrict local access to systems and avoid unsafe SUID binaries. Use kernel hardening features (e.g., SELinux, AppArmor).
Notes: Although originally disclosed in 2018, evidence of active exploitation or relevance in specific environments brought this long-standing flaw into KEV.
2) CVE-2025-52691 – SmarterTools SmarterMail Arbitrary File Upload (Remote Code Execution)
Type: Unauthenticated arbitrary file upload leading to remote code execution (RCE).
Impact: Attackers can upload files to arbitrary locations on the mail server and achieve RCE, which may result in full server compromise.
Affected Versions: SmarterMail Builds 9406 and earlier.
Remediation:
- Patch/Upgrade: Upgrade SmarterMail to Build 9413 or later per vendor instructions.
- Mitigation: Restrict access to mail server interfaces, monitor for anomalous uploads, and use IDS/IPS to detect suspicious traffic.
Notes: Rated CVSS 10.0 (Critical), with extremely low exploit complexity and no authentication requirement.
3) CVE-2026-21509 – Microsoft Office Security Feature Bypass
Type: Security feature bypass affecting Microsoft Office products.
Impact: Attackers can bypass built-in Office security protections (such as COM/OLE control restrictions), enabling execution of malicious content when a user opens a crafted file.
Affected Versions: Multiple Office versions — including Office 2016, Office 2019, Office LTSC, and Microsoft 365 Apps for Enterprise.
Remediation:
- Patch: Apply Microsoft’s out-of-band security update released alongside this discovery.
- Mitigation: Until patched, block or disable loading of untrusted COM/OLE controls via registry kill-bits or group policy settings.
Notes: Active exploitation in the wild prompted emergency patching; attackers typically need victims to open malicious Office files.
4) CVE-2026-23760 – SmarterTools SmarterMail Authentication Bypass
Type: Authentication bypass in SmarterMail’s password reset API.
Impact: An attacker could bypass authentication controls, potentially resetting administrative credentials and gaining full admin access.
Affected Versions: SmarterMail versions prior to Build 9511.
Remediation:
- Patch/Upgrade: Update to a safe build (≥9511) that incorporates the fix.
- Mitigation: Restrict external access to the password reset API and enforce strong multi-factor authentication.
Notes: This bypass is especially dangerous on internet-exposed mail servers; evidence of active exploitation or credible exploit tooling led to KEV inclusion.
5) CVE-2026-24061 – GNU Inetutils telnetd Argument Injection (Auth Bypass/Privilege Escalation)
Type: Argument injection vulnerability in Inetutils Telnet Daemon (telnetd).
Impact: Unsanitized environment variables or arguments could allow attackers to bypass authentication and attain root or equivalent access on systems running Telnet services.
Affected Versions: Systems running vulnerable versions of GNU Inetutils Telnet Daemon — typically older, embedded, or legacy Unix/Linux hosts.
Remediation:
- Patch/Upgrade: Apply vendor patches or remove Telnet services entirely.
- Mitigation: Disable Telnet and replace with secure alternatives like SSH; use network ACLs to block Telnet traffic.
Notes: Although Telnet itself is deprecated in most environments, legacy exposures on critical devices make this flaw exploitable and dangerous.
Prioritization & Actions
Remediation Deadline: February 16, 2026 under CISA’s BOD 22-01 for federal agencies — but all organizations should prioritize patching immediately.
