Security News Bulletin - July 2026

Apple Memory Corruption Vulnerability

CVE-2026-43707

Published: 2026-06-29 
Updated: 2026-06-29  

Vendor: Apple 
Product: Safari, iOS and iPadOS, macOS

Attack Tags: Memory Corruption, Malicious Web Content, Web Browser Exploitation, Denial of Service(DoS).

Severity: Medium (CVSS 6.5)

What Is CVE-2026-43707?
 

CVE-2026-43707 is a medium-severity memory corruption vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. The flaw is caused by improper memory handling when processing maliciously crafted web content. An attacker can entice a user to visit a specially crafted webpage, triggering memory corruption that may result in an unexpected browser or application process crash, leading to a denial-of-service condition. 

Affected Versions 

• affected from 0 before 26.5.2  

Observed Attack Activity 

As of this publication, there is no publicly confirmed evidence of active exploitation of CVE-2026-43707 in the wild, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should nevertheless apply the latest Apple security updates promptly, as browser vulnerabilities are frequently targeted after public disclosure. 

 Indicators of Compromise are: 

• Unexpected Safari or WebKit process crashes
• Crashes when visiting specific or untrusted websites
• Repeated browser instability triggered by particular web pages
• Crash reports referencing Safari or WebKit memory errors

Additional Resources  

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-43707 

2. Apple Safari Security Advisory 
   https://support.apple.com/en-us/127685 

3. Apple iOS & iPadOS Security Advisory 
   https://support.apple.com/en-us/127594 

4. Apple macOS Security Advisory 
   https://support.apple.com/en-us/127595 

---

Windows CTF Elevation of Privilege Vulnerability 

CVE-2026-45586  

Published: 2026-06-09 
Updated: 2026-07-15 

Vendor: Microsoft 
Product: Windows 10(1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 

Attack Tags: Elevation of Privilege (EoP), Local Privilege Escalation, Improper Link Resolution, Authenticated Local Attack.

Severity: High (CVSS 7.8)

What Is CVE-2026-45586?
 

CVE-2026-45586 is a high-severity elevation of privilege vulnerability in the Windows Collaborative Translation Framework (CTFMON). The flaw is caused by improper link resolution before file access, allowing an authenticated local attacker with low privileges to exploit symbolic link (link following) behavior and gain elevated privileges on the affected system. 

Successful exploitation could enable an attacker to obtain SYSTEM-level privileges, providing full control over the affected device. Attackers could then install programs, modify or delete data, create privileged accounts, or disable security controls. Since the vulnerability requires only local access and no user interaction, it poses a significant risk in post-compromise scenarios.  

Affected Versions 

Windows 10 Version 1607 

• affected from 10.0.14393.0 before 10.0.14393.9234  

Windows 10 Version 1809 

• affected from 10.0.17763.0 before 10.0.17763.8880 

Windows 11 version 23H2 

• affected from 10.0.22631.0 before 10.0.22631.7219 

Windows 11 Version 24H2 

• affected from 10.0.26100.0 before 10.0.26100.8655  

Other products and versions are also affected. For additional information, please refer to: https://www.cve.org/CVERecord?id=CVE-2026-45586. 

Observed Attack Activity 

There is no confirmed evidence of active exploitation in the wild, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, Microsoft has classified the vulnerability as High, and security researchers recommend prioritizing patching because it can be leveraged after an attacker gains an initial foothold on a system.  

 Indicators of Compromise are: 

• Unexpected privilege escalation to SYSTEM
• Suspicious symbolic link or junction creation
• Unauthorized modifications to protected system files
• Unusual execution of privileged processes
• Security logs indicating privilege elevation from low-privileged accounts

Additional Resources 

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-45586 

2. Microsoft Security Response Center 
   https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45586 

3. SentinelOne 
   https://www.sentinelone.com/vulnerability-database/cve-2026-45586/ 

4. National Vulnerability Database 
   https://nvd.nist.gov/vuln/detail/CVE-2026-45586 

---

TYPO3 CMS PHP Object Injection Vulnerability

CVE-2026-49740  

Published: 2026-06-09 
Updated: 2026-07-15  

Vendor: TYPO3 
Product: TYPO3 CMS  

Attack Tags: PHP Object Injection, Deserialization of Untrusted Data, Remote Code Execution, Local Privilege Abuse, Cache Poisoning. 

Severity: Medium (CVSS 6.3) 

What Is CVE-2026-49740?  
 

CVE-2026-49740 is a medium-severity vulnerability affecting TYPO3 CMS. The flaw is caused by unsafe deserialization of PHP objects in the VariableFrontend cache component and the Registry persistent key-value store. These components deserialize serialized PHP data without validating its integrity or restricting allowed classes. 

An attacker with write access to the underlying cache storage or the sys_registry database table can inject a specially crafted serialized payload, resulting in PHP Object Injection. By leveraging a suitable gadget chain, the vulnerability can potentially lead to remote code execution (RCE) or other high-impact actions. Exploitation requires local write access to the affected storage backend, such as the SQL database or file system. 

Affected Versions 

• affected from 0 before 10.4.57 
• affected from 11.0.0 before 11.5.51 
• affected from 12.0.0 before 12.4.46 
• affected from 13.0.0 before 13.4.31 
• affected from 14.0.0 before 14.3.3 

Observed Attack Activity 

There is no publicly confirmed evidence of active exploitation of CVE-2026-49740 in the wild, and no public reports indicate that the vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, because successful exploitation can result in PHP Object Injection and potential remote code execution, organizations running affected TYPO3 instances should apply the available security updates as soon as possible. 

Indicators of Compromise are: 

• Unexpected writes to the sys_registry table
• Unauthorized modifications to TYPO3 cache storage
• Suspicious serialized PHP objects in cache entries
• Unusual execution of PHP processes or commands
• Unexpected application behavior or crashes after cache retrieval

Additional Resources 

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-49740 

2. Typo3 Security Advisory 
   https://news.typo3.com/security/advisory/typo3-core-sa-2026-018 

3. GitHub.com 
   https://github.com/TYPO3/typo3/commit/87cd7c5b710c44d3606fed277b040a75dc6a9c02 

---

Android Privilege Escalation Vulnerability 

CVE-2025-48595 

Published: 2026-06-01 
Updated: 2026-06-01  

Vendor: Google 
Product: Android  

Attack Tags: Integer Overflow, Local Privilege Escalation, Arbitrary Code Execution, Memory Corruption, Android Framework. 

Severity: High (CVSS 8.4) 

What Is CVE-2025-48595?  
 

CVE-2025-48595 is a high-severity integer overflow vulnerability in the Android Framework. The flaw exists in multiple framework components where improper handling of integer values can lead to memory corruption and arbitrary code execution. An attacker can exploit the vulnerability to achieve local privilege escalation without requiring additional execution privileges or user interaction. 

Successful exploitation could allow an attacker to execute code with elevated privileges, potentially compromising the confidentiality, integrity, and availability of the affected Android device.  

Affected Versions 

• affected at 16-qpr2 
• affected at 16 
• affected at 15
• affected at 14 

Observed Attack Activity 

Active exploitation has been reported. Google has indicated that CVE-2025-48595 may be under limited, targeted exploitation in the wild, and the vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. Organizations managing Android devices should prioritize deploying the latest security updates to mitigate the risk of compromise.  

Indicators of Compromise are: 

• Unexpected privilege escalation on Android devices  

• Suspicious execution of privileged processes  

• Unexplained system instability or crashes  

• Unauthorized access to protected system resources  

• Indicators of malware gaining elevated permissions without user interaction  

Additional Resources 

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2025-48595 

2. CISA.GOV 
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595 

3. Android Security Bulletin 
   https://source.android.com/docs/security/bulletin/2026/2026-06-01 

4. National Vulnerability Database 
   https://nvd.nist.gov/vuln/detail/CVE-2025-48595 

---

React Router RCE Vulnerability 

CVE-2026-42211 

Published: 2026-06-02 
Updated: 2026-06-02  

Vendor: remix-run 
Product: React-router  

Attack Tags: Prototype Pollution, Deserialization of Untrusted Data, External Request Exploitation, Framework Mode, Web Application Security. 

Severity: High (CVSS 8.1) 

What Is CVE-2026-42211? 
 

CVE-2026-42211 is a high-severity remote code execution vulnerability affecting React Router when running in Framework Mode. The vulnerability stems from unsafe deserialization behavior that can be exploited only if the application already contains a prototype pollution vulnerability. Attackers can leverage this weakness in a two-step attack to trigger unauthorized remote code execution on the server through specially crafted external requests. 

The vulnerability does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).  

The issue has been patched in React Router version 7.14.2. 

Affected Versions 

• affected at >= 7.0.0, < 7.14.2  

Observed Attack Activity 

At the time of publication, there is no publicly confirmed evidence of active exploitation of CVE-2026-42211 in the wild. According to the available advisories, exploitation requires specific preconditions, including an existing prototype pollution vulnerability in the application, making the attack more complex. However, because successful exploitation can result in unauthorized remote code execution, organizations using React Router Framework Mode should upgrade to the latest patched release as a priority. 

Indicators of Compromise are: 

• Unexpected server-side code execution  

• Suspicious external HTTP requests targeting Framework Mode endpoints  

• Evidence of prototype pollution within the application  

• Unauthorized modifications to application state or objects  

• Unusual server logs or unexpected process execution  

Additional Resources 

1. Official CVE Record — CVE.org 
   https://www.cve.org/CVERecord?id=CVE-2026-42211 

2. SentinelOne 
   https://www.sentinelone.com/vulnerability-database/cve-2026-42211/ 

3. GitHub.com 
   https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h 

4. National Vulnerability Database 
   https://nvd.nist.gov/vuln/detail/CVE-2026-42211 

Back to Newsletter Home