{"vulnerability": "CVE-2021-26419", "sightings": [{"uuid": "c8b6b0cb-abd7-4a48-96cc-2255d01e7bbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "MISP/48108aaa-f46a-49de-8e5e-7201c19be4c7", "content": "", "creation_timestamp": "2024-11-14T06:09:07.000000Z"}, {"uuid": "23984346-159b-4aa1-acad-4bee701294b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/421", "content": "CVE-2021-26419 Internet Explorer jscript9.dll \u5167\u5b58\u640d\u58de\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-26419_Internet_Explorer_jscript9.dll_%E5%85%A7%E5%AD%98%E6%90%8D%E5%A3%9E%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-14T01:54:45.000000Z"}, {"uuid": "3f159042-9ab6-4ea8-8204-7cd0bc7b794c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4306", "content": "#Fuzzing\nFuzzing Closed-Source JavaScript Engines with Coverage Feedback\nhttps://googleprojectzero.blogspot.com/2021/09/fuzzing-closed-source-javascript.html\n]-> CVE-2021-26419:  https://bugs.chromium.org/p/project-zero/issues/detail?id=2157\n]-> CVE-2021-31959:  https://bugs.chromium.org/p/project-zero/issues/detail?id=2168\n]-> CVE-2021-34480:  https://bugs.chromium.org/p/project-zero/issues/detail?id=2188", "creation_timestamp": "2022-07-12T11:36:29.000000Z"}, {"uuid": "43cc9b18-27e5-4d12-81fc-12b3bcfa95e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/cissp/4366", "content": "Fuzzing Closed-Source JavaScript Engines with Coverage Feedback\nhttps://googleprojectzero.blogspot.com/2021/09/fuzzing-closed-source-javascript.html\n]-> CVE-2021-26419:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2157\n]-> CVE-2021-31959:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2168\n]-> CVE-2021-34480:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2188\n\nexploit\nCVE-2021-40539:\nZoho ManageEngine ADSelfService \ud83d\ude43Plus <=6113 is vulnerable to REST API authentication bypass with resultant RCE (Patch + PoC)\nhttps://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis\n\nThreat Research\n1. Web Shells Lead to ZeroLogon and Application Impersonation Attacks\ud83d\ude0a\nhttps://www.fortinet.com/blog/threat-research/more-proxyshell-web-shells-lead-to-zerologon-and-application-impersonation-attacks\n2. Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus\nhttps://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html", "creation_timestamp": "2026-09-01T17:00:40.475545Z"}, {"uuid": "dd0f4783-09bd-4461-944f-7dc4edaba021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/hacking_Attack/8311", "content": "is impacted as well. Definitely put this on the top of your test-and-deploy list.\u201d CVE-2021-26419This second critical bug affecting Microsoft\u2019s legacy browser allows RCE, and offers several avenues of attack, according to researchers.\n\n\u201cIn a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website,\u201d explained Feldman. \u201cAn attacker could also embed an ActiveX control marked \u2018safe for initialization\u2019 in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.\u201d\nSee Also: Offensive Security Tool: EyeWitness The best way to counteract this bug is ditching IE, noted Breen.\n\n\u201cInternet Explorer needs to die \u2013 and I\u2019m not the only one that thinks so,\u201d he told Threatpost. \u201cIf you are an organization that has to provide IE11 to support legacy applications, consider enforcing a policy on the users that restricts the domains that can be accessed by IE11 to only those legacy applications. All other web browsing should be performed with a supported browser.\u201d CVE-2021-31194The third critical bug exists in the Microsoft Windows OLE Automation, which in and of itself should place it on the priority-patch list, according to researchers.\n\n\u201cTo exploit the vulnerability, an attacker could host a specially crafted website designed to invoke OLE automation through a web browser,\u201d explained Justin Knapp, Automox researcher. \u201cHowever, this approach requires that the attacker bait a user into visiting the maliciously crafted website.\u201d\n\nHe pointed out that OLE technology has frequently been used to mask malicious code within documents and for linking to external files that infect systems with malware.\n\n\u201cIn 2020, the CISA released an alert detailing the top 10 routinely exploited vulnerabilities, which identified Microsoft\u2019s OLE as the most commonly exploited technology by state-sponsored cyber-actors,\u201d he said. \u201cConsidering the prevalent exploitation of OLE vulnerabilities, including those that had been flagged years ago, organizations should immediately prioritize patching all outstanding OLE vulnerabilities.\u201d See Also: Hacking Stories: Xbox UndergroundCVE-2021-28476The last critical bug is found in Windows Hyper-V, which is a native hypervisor that can create and run virtual machines on x86-64 systems running Windows. It can allow an attacker to execute arbitrary code, Knapp said:\u00a0\u201cTo exploit this vulnerability, an attacker could run a specially crafted application on a Hyper-V guest that could cause the Hyper-V host operating system to execute arbitrary code when it fails to properly validate vSMB packet data. Successful exploitation could enable an attacker to run malicious binaries on Hyper-V virtual machines or execute arbitrary code on the host system itself.\u201d\n\nThat said, Microsoft noted that an attacker is more likely to abuse the bug for DoS attacks in the form of a system crash rather than RCE, Childs pointed out, which mitigates the vulnerability\u2019s CVSS score of 9.9.\n\n\u201cBecause of this, it could be argued that the attack complexity would be high, which changes the CVSS rating to 8.5,\u201d he said. \u201cThat still rates as high-severity, but not critical. Still, the bug check [system crash] alone is worth making sure your Hyper-V systems get this update.\u201d Publicly Disclosed VulnerabilitiesChris Goettl, senior director of product management at Ivanti, told Threatpost that the biggest patching priority should be the publicly disclosed bugs \u2013 even though there is as yet no known malicious exploitation.\n\n\u201cThe top concern from the Microsoft updates this month is the update for Microsoft Exchange that[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:42.841056Z"}, {"uuid": "85daf0e9-9ba9-4f73-8b75-f6393133b2eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:43.612112Z"}, {"uuid": "28ea27ba-8fa7-470d-bc20-fa3a9015348e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/hacking_Attack/8311", "content": "is impacted as well. Definitely put this on the top of your test-and-deploy list.\u201d CVE-2021-26419This second critical bug affecting Microsoft\u2019s legacy browser allows RCE, and offers several avenues of attack, according to researchers.\n\n\u201cIn a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website,\u201d explained Feldman. \u201cAn attacker could also embed an ActiveX control marked \u2018safe for initialization\u2019 in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.\u201d\nSee Also: Offensive Security Tool: EyeWitness The best way to counteract this bug is ditching IE, noted Breen.\n\n\u201cInternet Explorer needs to die \u2013 and I\u2019m not the only one that thinks so,\u201d he told Threatpost. \u201cIf you are an organization that has to provide IE11 to support legacy applications, consider enforcing a policy on the users that restricts the domains that can be accessed by IE11 to only those legacy applications. All other web browsing should be performed with a supported browser.\u201d CVE-2021-31194The third critical bug exists in the Microsoft Windows OLE Automation, which in and of itself should place it on the priority-patch list, according to researchers.\n\n\u201cTo exploit the vulnerability, an attacker could host a specially crafted website designed to invoke OLE automation through a web browser,\u201d explained Justin Knapp, Automox researcher. \u201cHowever, this approach requires that the attacker bait a user into visiting the maliciously crafted website.\u201d\n\nHe pointed out that OLE technology has frequently been used to mask malicious code within documents and for linking to external files that infect systems with malware.\n\n\u201cIn 2020, the CISA released an alert detailing the top 10 routinely exploited vulnerabilities, which identified Microsoft\u2019s OLE as the most commonly exploited technology by state-sponsored cyber-actors,\u201d he said. \u201cConsidering the prevalent exploitation of OLE vulnerabilities, including those that had been flagged years ago, organizations should immediately prioritize patching all outstanding OLE vulnerabilities.\u201d See Also: Hacking Stories: Xbox UndergroundCVE-2021-28476The last critical bug is found in Windows Hyper-V, which is a native hypervisor that can create and run virtual machines on x86-64 systems running Windows. It can allow an attacker to execute arbitrary code, Knapp said:\u00a0\u201cTo exploit this vulnerability, an attacker could run a specially crafted application on a Hyper-V guest that could cause the Hyper-V host operating system to execute arbitrary code when it fails to properly validate vSMB packet data. Successful exploitation could enable an attacker to run malicious binaries on Hyper-V virtual machines or execute arbitrary code on the host system itself.\u201d\n\nThat said, Microsoft noted that an attacker is more likely to abuse the bug for DoS attacks in the form of a system crash rather than RCE, Childs pointed out, which mitigates the vulnerability\u2019s CVSS score of 9.9.\n\n\u201cBecause of this, it could be argued that the attack complexity would be high, which changes the CVSS rating to 8.5,\u201d he said. \u201cThat still rates as high-severity, but not critical. Still, the bug check [system crash] alone is worth making sure your Hyper-V systems get this update.\u201d Publicly Disclosed VulnerabilitiesChris Goettl, senior director of product management at Ivanti, told Threatpost that the biggest patching priority should be the publicly disclosed bugs \u2013 even though there is as yet no known malicious exploitation.\n\n\u201cThe top concern from the Microsoft updates this month is the update for Microsoft Exchange that[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:19.000577Z"}, {"uuid": "0095baf9-a959-4dd5-bbb0-a4836329e286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:19.086697Z"}, {"uuid": "c57adf4f-194a-4116-a0b5-b60ccd54f519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26419", "type": "seen", "source": "https://t.me/cissp/4366", "content": "Fuzzing Closed-Source JavaScript Engines with Coverage Feedback\nhttps://googleprojectzero.blogspot.com/2021/09/fuzzing-closed-source-javascript.html\n]-> CVE-2021-26419:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2157\n]-> CVE-2021-31959:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2168\n]-> CVE-2021-34480:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2188\n\nexploit\nCVE-2021-40539:\nZoho ManageEngine ADSelfService \ud83d\ude43Plus <=6113 is vulnerable to REST API authentication bypass with resultant RCE (Patch + PoC)\nhttps://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis\n\nThreat Research\n1. Web Shells Lead to ZeroLogon and Application Impersonation Attacks\ud83d\ude0a\nhttps://www.fortinet.com/blog/threat-research/more-proxyshell-web-shells-lead-to-zerologon-and-application-impersonation-attacks\n2. Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus\nhttps://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html", "creation_timestamp": "2026-09-02T01:04:25.412578Z"}]}