{"uuid": "dd0f4783-09bd-4461-944f-7dc4edaba021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/hacking_Attack/8311", "content": "is impacted as well. Definitely put this on the top of your test-and-deploy list.\u201d CVE-2021-26419This second critical bug affecting Microsoft\u2019s legacy browser allows RCE, and offers several avenues of attack, according to researchers.\n\n\u201cIn a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website,\u201d explained Feldman. \u201cAn attacker could also embed an ActiveX control marked \u2018safe for initialization\u2019 in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.\u201d\nSee Also: Offensive Security Tool: EyeWitness The best way to counteract this bug is ditching IE, noted Breen.\n\n\u201cInternet Explorer needs to die \u2013 and I\u2019m not the only one that thinks so,\u201d he told Threatpost. \u201cIf you are an organization that has to provide IE11 to support legacy applications, consider enforcing a policy on the users that restricts the domains that can be accessed by IE11 to only those legacy applications. All other web browsing should be performed with a supported browser.\u201d CVE-2021-31194The third critical bug exists in the Microsoft Windows OLE Automation, which in and of itself should place it on the priority-patch list, according to researchers.\n\n\u201cTo exploit the vulnerability, an attacker could host a specially crafted website designed to invoke OLE automation through a web browser,\u201d explained Justin Knapp, Automox researcher. \u201cHowever, this approach requires that the attacker bait a user into visiting the maliciously crafted website.\u201d\n\nHe pointed out that OLE technology has frequently been used to mask malicious code within documents and for linking to external files that infect systems with malware.\n\n\u201cIn 2020, the CISA released an alert detailing the top 10 routinely exploited vulnerabilities, which identified Microsoft\u2019s OLE as the most commonly exploited technology by state-sponsored cyber-actors,\u201d he said. \u201cConsidering the prevalent exploitation of OLE vulnerabilities, including those that had been flagged years ago, organizations should immediately prioritize patching all outstanding OLE vulnerabilities.\u201d See Also: Hacking Stories: Xbox UndergroundCVE-2021-28476The last critical bug is found in Windows Hyper-V, which is a native hypervisor that can create and run virtual machines on x86-64 systems running Windows. It can allow an attacker to execute arbitrary code, Knapp said:\u00a0\u201cTo exploit this vulnerability, an attacker could run a specially crafted application on a Hyper-V guest that could cause the Hyper-V host operating system to execute arbitrary code when it fails to properly validate vSMB packet data. Successful exploitation could enable an attacker to run malicious binaries on Hyper-V virtual machines or execute arbitrary code on the host system itself.\u201d\n\nThat said, Microsoft noted that an attacker is more likely to abuse the bug for DoS attacks in the form of a system crash rather than RCE, Childs pointed out, which mitigates the vulnerability\u2019s CVSS score of 9.9.\n\n\u201cBecause of this, it could be argued that the attack complexity would be high, which changes the CVSS rating to 8.5,\u201d he said. \u201cThat still rates as high-severity, but not critical. Still, the bug check [system crash] alone is worth making sure your Hyper-V systems get this update.\u201d Publicly Disclosed VulnerabilitiesChris Goettl, senior director of product management at Ivanti, told Threatpost that the biggest patching priority should be the publicly disclosed bugs \u2013 even though there is as yet no known malicious exploitation.\n\n\u201cThe top concern from the Microsoft updates this month is the update for Microsoft Exchange that[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:42.841056Z"}