Executive assessment
Today's brief leads with Puppet Enterprise: OS Command Injection. All 8 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 01 leads today because it is HIGH, has proof-of-concept exploitation, and lists fixed Puppet Enterprise versions, making it both urgent and directly actionable. Finding 03 is the next strongest high-severity item because fixed Linux versions are listed, but exploitation is none reported. Themes: Proof-of-concept exploitation; Linux vulnerability remediation; Access restriction and least privilege. Patch order: Finding 01 (HIGH with proof-of-concept exploitation and fixed versions listed for Puppet Enterprise 2023.8.4 and 2025.4.0); Finding 03 (HIGH Linux USB gadget use-after-free with no reported exploitation and fixed Linux versions listed); Finding 02 (HIGH multiple Linux vulnerabilities with exploitation and fixed-version details unknown in the listing); Finding 06 (MEDIUM with proof-of-concept exploitation and no fixed version listed; controls focus on blocking path traversal and restricting endpoint access); Finding 05 (MEDIUM with proof-of-concept exploitation and no fixed version listed; controls focus on network restriction, WAF rules, and alerting on parameter manipulation).
Finding 01 — Puppet Enterprise: OS Command Injection
What changed: A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
Technical evidence: CVE-2025-5459; CVSS v4.0 8.6; weakness CWE-78; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Remove ‘Operators’ privileges from accounts that do not require them, and restrict node-group configuration editing. Monitor PUT requests to /api/classifier/groups/ and changes to configData. Gruppo TIM Security Red Team Research publishes step-by-step PoC instructions and demonstrates a root reverse shell. ([gruppotim.it](https://www.gruppotim.it/it/footer/red-team/2025/CVE-2025-5459-PuppetEnterprise.html), [cve.org](https://www.cve.org/CVERecord?id=CVE-2025-5459))
Affected: Puppet Enterprise 2018.1.8 through 2023.8.3, and 2025.3. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2025-5459))
Fix: Puppet Enterprise 2023.8.4 and 2025.4.0. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2025-5459))
Action: Map CVE-2025-5459 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-5459)
Finding 02 — Multiple vulnerabilities in Linux
What changed: CVE coverage: CVE-2026-64329, CVE-2026-64330, CVE-2026-64339, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344. The cited advisories disclose: kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccg_irq_handler calls ucsi_notify_common , which on a connector-change event calls ucsi_connector_change and schedules connector work.
Technical evidence: CVE-2026-64329; CVSS v3.1 7.8; weakness CWE-416; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-64329 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-64329)
Finding 03 — Linux USB gadget use-after-free (CVE-2026-64346)
What changed: A race between usb_del_gadget() and gadget_match_driver() can leave Linux USB gadget code accessing a freed UDC structure, causing a use-after-free and NULL-pointer dereference. The kernel fix keeps the UDC structure allocated until the gadget is released.
Technical evidence: CVE-2026-64346; CVSS v3.1 7.8; weakness CWE-416; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict configfs write permissions on /sys/kernel/config/usb_gadget/ to trusted administrators. Avoid runtime mode switching on dual-role controllers by pinning the controller to host or peripheral mode. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-64346/), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-64346))
Affected: Linux kernel versions from 5.19 are affected, with stable-branch cut-offs at the fixed versions listed below. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-64346))
Fix: Linux 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4 and 7.2. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-64346))
Action: Map CVE-2026-64346 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-64346)
Finding 04 — Scada-LTS up to 2.7.8.1: Cross-Site Request Forgery
What changed: A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function.
Technical evidence: CVE-2025-13790; CVSS v4.0 5.3; weakness CWE-352, CWE-862; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Re-enable Spring Security CSRF protection for session-based interfaces. For API clients that cannot use cookies or CSRF tokens, expose dedicated stateless endpoints while retaining CSRF protection for browser traffic. VulDB reports that the public exploit is declared as proof-of-concept. ([raw.githubusercontent.com](https://raw.githubusercontent.com/Xzzz111/exps/main/archives/Scada-LTS-CSRF-1/report.md), [vuldb.com](https://vuldb.com/vuln/333794))
Affected: All releases through commit 1cfaed4b35117e4871bc3dfeae073f61d8e3bb3d are affected. ([raw.githubusercontent.com](https://raw.githubusercontent.com/Xzzz111/exps/main/archives/Scada-LTS-CSRF-1/report.md))
Action: Map CVE-2025-13790 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13790)
Finding 05 — orionsec orion-ops: Improper Authorization
What changed: A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler.
Technical evidence: CVE-2025-13808; CVSS v4.0 6.9; weakness CWE-285, CWE-266; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Restrict network access to the application, and deploy WAF rules to detect and block parameter manipulation attempts. Alert when a user attempts to modify a profile other than their own. VulDB reports that the public exploit is a proof of concept. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-13808/), [vuldb.com](https://vuldb.com/vuln/333818), [raw.githubusercontent.com](https://raw.githubusercontent.com/Xzzz111/exps/main/archives/orion-ops-privilege-escalation-1/report.md))
Affected: Through master commit 5925824997a3109651bbde07460958a7be249ed1, inclusive. ([raw.githubusercontent.com](https://raw.githubusercontent.com/Xzzz111/exps/main/archives/orion-ops-privilege-escalation-1/report.md))
Action: Map CVE-2025-13808 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13808)
Finding 06 — jsnjfz WebStack-Guns 1.0: Path Traversal
What changed: A vulnerability was found in jsnjfz WebStack-Guns 1.0. This affects the function renderPicture of the file src/main/java/com/jsnjfz/manage/modular/system/controller/KaptchaController.java.
Technical evidence: CVE-2025-13810; CVSS v4.0 6.9; weakness CWE-22; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Reject path-traversal characters in pictureId or enforce a strict filename allowlist. If the endpoint is not needed publicly, require authentication for /kaptcha/. VulDB reports that the public exploit is a proof of concept. ([github.com](https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-PathTraversal-1/report.md), [vuldb.com](https://vuldb.com/?id.333820))
Action: Map CVE-2025-13810 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13810)
Finding 07 — jsnjfz WebStack-Guns 1.0: SQL Injection
What changed: A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/constant/factory/PageFactory.java.
Technical evidence: CVE-2025-13811; CVSS v4.0 5.3; weakness CWE-89, CWE-74; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Restrict access to WebStack-Guns administrative interfaces to trusted networks only and consider disabling sorting until a fix is implemented. Deploy a WAF with SQL injection protection and monitor logs for signs of exploitation. VulDB reports the public exploit as proof-of-concept. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-13811/), [vuldb.com](https://vuldb.com/?id.333821), [github.com](https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-SQLInjection-1/report.md))
Affected: WebStack-Guns 1.0, identified by the researcher as the current master at testing. ([github.com](https://github.com/Xzzz111/exps/blob/main/archives/WebStack-Guns-SQLInjection-1/report.md))
Action: Map CVE-2025-13811 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13811)
Finding 08 — Multiple vulnerabilities in moxi159753 Mogu Blog v2
What changed: CVE coverage: CVE-2025-13813, CVE-2025-13816. The cited advisories disclose: This issue affects some unknown processing of the file /storage/ of the component Storage Management Endpoint; The impacted element is the function FileOperation.unzip of the file /networkDisk/unzipFile of the component ZIP File Handler.
Technical evidence: CVE-2025-13813; CVSS v4.0 6.3; weakness CWE-862, CWE-863; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Require authentication and role-based access control for /storage/, and audit-log storage quota changes. Restrict network-disk access, run the application with minimal filesystem permissions, and log all ZIP extraction operations. NVD reports public exploits for both CVEs, and each linked GitHub report contains a proof-of-concept section. ([github.com](https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md), [github.com](https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-zip_slip-1/report.md), [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13813), +1 more)
Affected: Mogu Blog v2 5.0, 5.1 and 5.2. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13813), [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13816))
Action: Map CVE-2025-13813 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-13813)