Impact
| Version(s) | Toggle summary | ||||
|---|---|---|---|---|---|
| CVE-2026-98432 | Critical | CVE-2026-98432 | 4.x | ||
We are aware of the Linux TCP flaw which impacts the Red Hat Operating System This impacts all 4.x customers. It is important to note that while this vulnerability is reported as a critical Remote Code Execution (RCE) issue, this designation was originally disputed by Red Hat who had the CVE down as Moderate / Important and a Denial of Service (DoS) issue. The original payload and exploit required a Multipath Path TCP (MPTCP) listener to successfully exploit RCE, which is off by default in the VQCM. The 4.10 VQCM release will contain the fixed kernel version and we encourage all customers to upgrade to 4.10 to ensure they are up to date with the latest security fixes There is no known workaround or mitigation for this vulnerability – Some filtering rules have been suggested by Red Hat, but they stress that these are not complete mitigations – https://access.redhat.com/security/vulnerabilities/RHSB-2026-016 | |||||
| CVE-2026-111497 | High | CVE-2026-111497 | 4.x Metro | ||
We are aware of Brotli decoder flaw which impacts Node.js This impacts all 4.x customers, but only Metro uses the impacted code path for external connections. Customers who use the Metro Outlook Plugin are not impacted. It is important to note that while this vulnerability is reported as a Remote Code Execution (RCE) issue, a public Proof-of-Concept (PoC) published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved. Subsequent PoC have required multiple attempts to achieve RCE. The impacted components within the VQCM are all served as micro-services, adding additional defence in depth for the VQCM product as a whole and further mitigating direct access to the host VM. Customers who use Metro WebRTC and the Metro App should contact VQ Communications Support. We are currently working on a VQCM release which will have a fixed version of Node.js instance and will update customers once this is available. There is no known workaround or mitigation for this vulnerability – Companies such as Vercel have implemented Web Application Firewall (WAF) rules to block the inbound attack vector traffic. This will reduce exposure but does not replace patching. We are not aware of any public rules that have been made available at the moment, but as this vulnerability impacts Brotli based compression, customers with externally exposed instance should be focused on traffic using ‘Content-Encoding: br’. | |||||
| RHSB-2026-011 Network Stack Privilege Escalations | Low | CVE-2026-80844,CVE-2026-81000 & CVE-2026-74469,CVE-2026-68121 | <4.5.1 | ||
A recent Red Hat Security Bulletin (RHSB) has been posted which covers the following high profile CVEs: CVE-2026-80844 (DirtyAH6) CVE-2026-81000 (TUNderflow) CVE-2026-68121 (PPPoEject) CVE-2026-74469 (DiagSpill) It is important to note that these vulnerabilities all require local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. Or for a user with admin level access, who would already have sufficient permissions and access that they would not need to exploit any known vulnerabilities to carry out destructive actions. As such these are vulnerabilities are not considered ‘exploitable’ under practical operational conditions. The following CVEs: CVE-2026-80844 (DirtyAH6) CVE-2026-81000 (TUNderflow) CVE-2026-68121 (PPPoEject) Are mitigated by default in all 4.x VQCM instances due to the preset user.max_user_namespaces value (0). All 4.5.1 or later VQCMs are also protected against CVE-2026-74469 (DiagSpill) as the impacted module (sctp) is blacklisted by default. A playbook to mitigate CVE-2026-74469 (DiagSpill) has been put together to ensure the impacted module (sctp) is not loaded and that the default mitigation for CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow) and CVE-2026-68121 (PPPoEject) is inplace. Customers who are on VQCMs older than 4.5.1 or who believe the defaults within their VQCM VM may have been altered, please raise a support ticket (via support@vqcomms.com) to request access to the mitigation playbook. If customers are unsure if they need to raise a support ticket, they can run the following commands (via the CLI to check). These commands will require elevated privileges to run: grep -E ‘^(blacklist sctp|install sctp /bin/false)’ /etc/modprobe.d/blacklist.conf The above should return two lines: blacklist sctp install sctp /bin/false If their is no return value, this is a finding and you need to raise a ticket with VQ Support To ensure that the default mitigation is in place, please run: sysctl user.max_user_namespaces This should show user.max_user_namespaces = 0 If the value is anything different, this is a finding and you need to raise a ticket with VQ Support If customers have any questions or concerns, please email security@vqcomms.com | |||||
| PostGREShell | High | CVE-2026-6471 | HA (All) | ||
We are aware of Postgres replication vulnerability known as ‘PostGREShell’ Within a standard VQ Conference Manager (VQCM) instance the PostgreSQL instance is not externally exposed, therefore requiring CLI access to the VQCM itself to attempt to exploit. At the point of access an attacker can already carry code execution on the host system. On a VQCM High Availability (HA) deployment an attacker would need to have credentials for a valid replication user, this would initially require access to a VQCM HA instance, which again would allow the attacker to carry out code execution without exploitation of this vulnerability in the first instance. This vulnerability impacts all VQCM HA releases, we are currently working on a VQCM HA release which will have a fixed version of the PostgreSQL instance and will update customers once this is available. Customers with existing VQCM HA instances that they can not upgrade or who wish to discuss this CVE and their own risk profile should email security@vqcomms.com | |||||
| SCTPhantom | Informational | CVE-2026-64564 | 4.x | ||
We are aware of the high profile ‘SCTPhantom’ exploit which impacts the Linux kernel. It is important to note that this exploit requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. The impacted kernel modules are also not loaded by default within the VQCM VM and by default are blacklisted in the kernel. As such there should be no need for action to mitigate unless customers have specifically enabled this module. If customers are unsure or if you have any questions about this CVE, please email security@vqcomms.com | |||||
| OVSwrap | Low | CVE-2026-64531 | 4.9.0 | ||
We are aware of the high profile ‘OVSwrap’ exploit which impacts the RHEL 9 kernel. It is important to note that this exploit only impacts VQCM 4.9.0 and that it requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. The impacted kernel modules are also not loaded by default within the VQCM VM, preventing exploitation without a privileged user first having loaded these modules. To ensure peace of mind for our customers and meet the our high levels of security and transparency we have made available a mitigation playbook which can be applied to a running VQCM instance. This will make sure the impacted modules are not loaded and prevent them from being loaded in the future. This should not impact the running VQCM instance at all and there should be no down time. If you have any questions about this CVE, please email security@vqcomms.com To request access to the playbook, please email support@vqcomms.com | |||||
| RefluXFS | Medium | CVE-2026-64600 | 4.x | ||
We are aware of the recent Local Privilege Escalations (LPEs) exploit RefluXFS. It is important to note that this exploit requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. The recently released VQCM 4.9.0 (and all older versions) are impacted by this vulnerability, as such we have put together a playbook to apply the updated kernel version. This should be run on a VQCM 4.9.0 as this version also contains multiple other security fixes. Customers who are on 4.9.0 and wish to apply this patch should contact VQ Support. Please be aware that for the fix to take effect the VQCM instance will need to be rebooted, so this patch can not be run during operational hours. | |||||
| GhostLock | Low | CVE-2026-43499 | 4.x | ||
We are aware of the recent Local Privilege Escalations (LPEs) exploit GhostLock. It is important to note that this exploit requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. At the time of writing Red Hat have not released an upstream patch or fix, so current advice to customers to ensure the security of their system is to prevent untrusted actors or unauthorised users from accessing the VQ Conference Manager in the first instance. Customers with externally exposed SSH or admin portals instances will be most at risk. Customers who are concerned about this issue are advised to get in contact via support@vqcomms.com | |||||
| Bad Epoll | Informational | CVE-2026-46242 | 4.x | ||
We are aware of the recent Local Privilege Escalations (LPEs) exploit Bad Epoll. This vulnerability, while wide spread does not impact the Red Hat Enterprise Linux 8 Operating System (OS). This is the OS used by all 4.x VQ Conference Manager releases to date. The next VQ Conference Manager release will be on a later OS, but will released with a patched kernel version. No action is or will be needed by customers. | |||||
| Dirty Clone and pedit COW | Informational | CVE-2026-43503 and CVE-2026-46331 | 4.x | ||
We are aware of the recent Local Privilege Escalations (LPEs) exploits impacting the Linux kernel (Dirty Clone and pedit COW). It is important to note that these exploits requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. Both vulnerabilities (and associated exploits) are mitigated by having the user.max_user_namespaces set to 0. This is the default value for the 4.x VQCM, as such no action should need to be taken by customers. If customers believe there is a chance their kernel value has been changed or they wish to discuss these vulnerabilities (or any other security issues) please get in contact via support@vqcomms.com | |||||
| Copy Fail | Low | CVE-2026-31431 | 4.x | ||
We are aware of the high profile ‘Copy Fail’ vulnerability which impacts all Linux kernel versions since 2017 (CVE-2026-31431). It is important to note that this vulnerability requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. The vast majority of our micro-services all run with allowPrivilegeEscalation set to false which further lows the potential risk. However given the volatile nature of cyber security, and to ensure we continue to meet high levels of security and transparency we have made available a mitigation playbook which can be applied to a running VQCM instance. This will require a restart of VQCM VM for the mitigation to take effect, and will disable the vulnerable Linux kernel module If you have any questions about this CVE, please email security@vqcomms.com To request access to the playbook, please email support@vqcomms.com | |||||
| Dirty Frag | Low | CVE-2026-43284 and CVE-2026-43500 | 4.x | ||
We are aware of the high profile ‘Dirty Frag’ exploit which impacts all current Linux kernel versions. It is important to note that this exploit requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. The impacted kernel modules are also not loaded by default within the VQCM VM, preventing exploitation without a privileged user first having loaded these modules. To ensure peace of mind for our customers and meet the our high levels of security and transparency we have made available a mitigation playbook which can be applied to a running VQCM instance. This will make sure the impacted modules are not loaded and prevent them from being loaded in the future. This should not impact the running VQCM instance at all and there should be no down time. If you have any questions about this CVE, please email security@vqcomms.com To request access to the playbook, please email support@vqcomms.com | |||||
| PinTheft | Low | CVE-2026-46333 | 4.x | ||
We are aware of the recent CVE-2026-46333 which has a public exploit (‘PinTheft’) and impacts major Linux kernel versions, RHEL included. It is important to note that this exploit requires local access to a system to be exploited, something that would require an issue with the running micro-services or associated services to have been exposed and exploited in the first instance. The impacted kernel modules are also not loaded by default within the VQCM VM, preventing exploitation without a privileged user first having loaded these modules. To ensure peace of mind for our customers and meet the our high levels of security and transparency we have made available a mitigation playbook which can be applied to a running VQCM instance. This will make sure the required changes are made the to the kernel ptrace scope. If you have any questions about this CVE, please email security@vqcomms.com To request access to the playbook, please email support@vqcomms.com | |||||
| AspNetCore.DataProtection – Privilege Escalation | Informational | CVE-2026-40372 | 4.8.0 | ||
We are aware of the recent security advisories around CVE-2026-40372 which impacts the Microsoft.AspNetCore.DataProtection.* NuGet packages (10.0.0-10.0.6). This is a vulnerability which allows for padding attacks against impacted systems, this is a non-trivial attack vector which requires network access to impacted systems for an extended period of time. We have carried out a review of our systems and found that this does not impact the VQCM instance as we do not load or use a NuGet Microsoft.AspNetCore.DataProtection.* at runtime. However out of an abundance of caution and to ensure we continue to meet high levels of security and transparency we have made available a patch playbook. This will replace the Identity Server image on the VQCM, which handles authentication and token generation for user sessions. Once the playbook has been run users will need to shut down any open browsers sessions to the VQCM instance and log back in. If you experience issues logging in we suggest clearing your browser history and using a new private browsing session to avoid issues with session caching. | |||||
No advisories match the current filter.
Showing 1 – 20 of 14