One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public
2026-06-09T01:24:11Z•cd7f96036478950fcc4bfb0a1bde935528560d7613d2a7de848e38752521be48
IKEv1active-exploitationcertificate-validationcheck-pointcisco-sd-wancisco-unified-cmcontainer-escapeeverest-formsffmpeggithub-wormlinux-kernelnf_tablesnpmprivilege-escalationrcesupply-chainuse-after-freevpnwordpresszero-days
What happened
Multiple high-impact vulnerabilities and active exploitation campaigns were reported across enterprise infrastructure and open-source ecosystems. Notable issues include a public exploit for a one-character Linux kernel use-after-free in nf_tables (CVE-2026-23111) enabling local root and container escapes; active exploitation of a critical Check Point IKEv1 certificate-validation bypass (CVE-2026-50751, CVSS 9.3); Cisco Catalyst SD‑WAN Manager under active attack (CVE-2026-20245); a Cisco Unified CM SSRF-to-root PoC (CVE-2026-20230); and an actively exploited Everest Forms Pro RCE (CVE-2026-330
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- cd7f96036478950fcc4bfb0a1bde935528560d7613d2a7de848e38752521be48
- Enrichment time
- 2026-06-09T01:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.