[{"data":1,"prerenderedAt":1124},["ShallowReactive",2],{"cms-globals:en":3,"post:en:pages:security-advisories":454,"security-advisories":537},{"navigation":4,"chrome":347},{"header":5,"f1":193,"f2":315},{"items":6},[7,44,83,140,154],{"id":8,"title":9,"url":10,"target":11,"description":11,"xfn":11,"children":12},10815,"Products","#","",[13,19,24,29,34,39],{"id":14,"title":15,"url":16,"target":11,"description":11,"xfn":17,"parent":8,"children":18},10816,"What is the IACBOX?","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwhat-is-the-iacbox\u002F","highlight",[],{"id":20,"title":21,"url":22,"target":11,"description":11,"xfn":11,"parent":8,"children":23},10817,"Licenses","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Flicenses\u002F",[],{"id":25,"title":26,"url":27,"target":11,"description":11,"xfn":11,"parent":8,"children":28},10818,"Multi-Tenant","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fmulti-tenant\u002F",[],{"id":30,"title":31,"url":32,"target":11,"description":11,"xfn":11,"parent":8,"children":33},10819,"iacbox.cloud","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fiacbox-cloud\u002F",[],{"id":35,"title":36,"url":37,"target":11,"description":11,"xfn":11,"parent":8,"children":38},10820,"Modules","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fmodules\u002F",[],{"id":40,"title":41,"url":42,"target":11,"description":11,"xfn":11,"parent":8,"children":43},10821,"Hardware","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fhardware\u002F",[],{"id":45,"title":46,"url":10,"target":11,"description":11,"xfn":11,"children":47},10822,"Industries",[48,53,58,63,68,73,78],{"id":49,"title":50,"url":51,"target":11,"description":11,"xfn":11,"parent":45,"children":52},10823,"Hospitality","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fhospitality\u002F",[],{"id":54,"title":55,"url":56,"target":11,"description":11,"xfn":11,"parent":45,"children":57},10824,"Healthcare","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fhealthcare\u002F",[],{"id":59,"title":60,"url":61,"target":11,"description":11,"xfn":11,"parent":45,"children":62},10825,"Education","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Feducational-institutions\u002F",[],{"id":64,"title":65,"url":66,"target":11,"description":11,"xfn":11,"parent":45,"children":67},10826,"Retail & Shopping Centers","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fretail-shopping-centers\u002F",[],{"id":69,"title":70,"url":71,"target":11,"description":11,"xfn":11,"parent":45,"children":72},10827,"Corporate","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fenterprises\u002F",[],{"id":74,"title":75,"url":76,"target":11,"description":11,"xfn":11,"parent":45,"children":77},10829,"Maritime","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fmaritime\u002F",[],{"id":79,"title":80,"url":81,"target":11,"description":11,"xfn":11,"parent":45,"children":82},10830,"Public Sector","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fpublic-sector\u002F",[],{"id":84,"title":85,"url":10,"target":11,"description":11,"xfn":11,"children":86},10831,"Integrations",[87,126],{"id":88,"title":89,"url":10,"target":11,"description":11,"xfn":11,"parent":84,"children":90},11154,"Login Methods",[91,96,101,106,111,116,121],{"id":92,"title":93,"url":94,"target":11,"description":11,"xfn":11,"parent":88,"children":95},10833,"SMS & Email","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fsms-email\u002F",[],{"id":97,"title":98,"url":99,"target":11,"description":11,"xfn":11,"parent":88,"children":100},10834,"Online Payment","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fonline-payment\u002F",[],{"id":102,"title":103,"url":104,"target":11,"description":11,"xfn":11,"parent":88,"children":105},10835,"Social Logins","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fsocial-logins\u002F",[],{"id":107,"title":108,"url":109,"target":11,"description":11,"xfn":11,"parent":88,"children":110},10836,"PMS Integrations","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fpms-integrations\u002F",[],{"id":112,"title":113,"url":114,"target":11,"description":11,"xfn":11,"parent":88,"children":115},10837,"Shipboard PMS","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fshipboard-pms\u002F",[],{"id":117,"title":118,"url":119,"target":11,"description":11,"xfn":11,"parent":88,"children":120},10838,"HIS Integrations","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fhis-integrations\u002F",[],{"id":122,"title":123,"url":124,"target":11,"description":11,"xfn":11,"parent":88,"children":125},10839,"External Authentication","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fexternal-authentication\u002F",[],{"id":127,"title":128,"url":10,"target":11,"description":11,"xfn":11,"parent":84,"children":129},11155,"Technology & API",[130,135],{"id":131,"title":132,"url":133,"target":11,"description":11,"xfn":11,"parent":127,"children":134},10841,"APIs","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fapis\u002F",[],{"id":136,"title":137,"url":138,"target":11,"description":11,"xfn":11,"parent":127,"children":139},10842,"Custom Integrations","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fcustom-integrations\u002F",[],{"id":141,"title":142,"url":10,"target":11,"description":11,"xfn":11,"children":143},10843,"Partner",[144,149],{"id":145,"title":146,"url":147,"target":11,"description":11,"xfn":11,"parent":141,"children":148},10844,"Become a Partner","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fbecome-a-partner\u002F",[],{"id":150,"title":151,"url":152,"target":11,"description":11,"xfn":11,"parent":141,"children":153},10845,"Find a partner","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Ffind-a-partner\u002F",[],{"id":155,"title":156,"url":10,"target":11,"description":11,"xfn":11,"children":157},10846,"Resources",[158,163,168,173,178,183,188],{"id":159,"title":160,"url":161,"target":11,"description":11,"xfn":11,"parent":155,"children":162},10847,"Updates","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fupdates\u002F",[],{"id":164,"title":165,"url":166,"target":11,"description":11,"xfn":11,"parent":155,"children":167},10848,"Security Advisories","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fsecurity-advisories\u002F",[],{"id":169,"title":170,"url":171,"target":11,"description":11,"xfn":11,"parent":155,"children":172},10849,"Training","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Ftraining\u002F",[],{"id":174,"title":175,"url":176,"target":11,"description":11,"xfn":11,"parent":155,"children":177},10850,"Downloads","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fdownloads\u002F",[],{"id":179,"title":180,"url":181,"target":11,"description":11,"xfn":11,"parent":155,"children":182},10851,"Blog","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fblog\u002F",[],{"id":184,"title":185,"url":186,"target":11,"description":11,"xfn":11,"parent":155,"children":187},10852,"FAQ","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Ffaq\u002F",[],{"id":189,"title":190,"url":191,"target":11,"description":11,"xfn":11,"parent":155,"children":192},10854,"Contact","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fcontact\u002F",[],{"items":194},[195,213,238,268,277,301],{"id":196,"title":9,"url":10,"target":11,"description":11,"xfn":11,"children":197},10855,[198,201,204,207,210],{"id":199,"title":21,"url":22,"target":11,"description":11,"xfn":11,"parent":196,"children":200},10856,[],{"id":202,"title":26,"url":27,"target":11,"description":11,"xfn":11,"parent":196,"children":203},10857,[],{"id":205,"title":31,"url":32,"target":11,"description":11,"xfn":11,"parent":196,"children":206},10858,[],{"id":208,"title":36,"url":37,"target":11,"description":11,"xfn":11,"parent":196,"children":209},10859,[],{"id":211,"title":41,"url":42,"target":11,"description":11,"xfn":11,"parent":196,"children":212},10860,[],{"id":214,"title":46,"url":10,"target":11,"description":11,"xfn":11,"children":215},10861,[216,220,223,226,229,232,235],{"id":217,"title":218,"url":51,"target":11,"description":11,"xfn":11,"parent":214,"children":219},10862,"Hotel & Hospitality",[],{"id":221,"title":55,"url":56,"target":11,"description":11,"xfn":11,"parent":214,"children":222},10863,[],{"id":224,"title":60,"url":61,"target":11,"description":11,"xfn":11,"parent":214,"children":225},10864,[],{"id":227,"title":65,"url":66,"target":11,"description":11,"xfn":11,"parent":214,"children":228},10865,[],{"id":230,"title":70,"url":71,"target":11,"description":11,"xfn":11,"parent":214,"children":231},10866,[],{"id":233,"title":75,"url":76,"target":11,"description":11,"xfn":11,"parent":214,"children":234},10868,[],{"id":236,"title":80,"url":81,"target":11,"description":11,"xfn":11,"parent":214,"children":237},10869,[],{"id":239,"title":85,"url":10,"target":11,"description":11,"xfn":11,"children":240},10870,[241,244,247,250,253,256,259,262,265],{"id":242,"title":93,"url":94,"target":11,"description":11,"xfn":11,"parent":239,"children":243},10871,[],{"id":245,"title":98,"url":99,"target":11,"description":11,"xfn":11,"parent":239,"children":246},10872,[],{"id":248,"title":103,"url":104,"target":11,"description":11,"xfn":11,"parent":239,"children":249},10873,[],{"id":251,"title":108,"url":109,"target":11,"description":11,"xfn":11,"parent":239,"children":252},10874,[],{"id":254,"title":113,"url":114,"target":11,"description":11,"xfn":11,"parent":239,"children":255},10875,[],{"id":257,"title":118,"url":119,"target":11,"description":11,"xfn":11,"parent":239,"children":258},10876,[],{"id":260,"title":123,"url":124,"target":11,"description":11,"xfn":11,"parent":239,"children":261},10877,[],{"id":263,"title":132,"url":133,"target":11,"description":11,"xfn":11,"parent":239,"children":264},10878,[],{"id":266,"title":137,"url":138,"target":11,"description":11,"xfn":11,"parent":239,"children":267},10879,[],{"id":269,"title":142,"url":10,"target":11,"description":11,"xfn":11,"children":270},10880,[271,274],{"id":272,"title":146,"url":147,"target":11,"description":11,"xfn":11,"parent":269,"children":273},10881,[],{"id":275,"title":151,"url":152,"target":11,"description":11,"xfn":11,"parent":269,"children":276},10882,[],{"id":278,"title":156,"url":10,"target":11,"description":11,"xfn":11,"children":279},10883,[280,283,286,289,292,295,298],{"id":281,"title":160,"url":161,"target":11,"description":11,"xfn":11,"parent":278,"children":282},10884,[],{"id":284,"title":165,"url":166,"target":11,"description":11,"xfn":11,"parent":278,"children":285},10885,[],{"id":287,"title":170,"url":171,"target":11,"description":11,"xfn":11,"parent":278,"children":288},10886,[],{"id":290,"title":175,"url":176,"target":11,"description":11,"xfn":11,"parent":278,"children":291},10887,[],{"id":293,"title":180,"url":181,"target":11,"description":11,"xfn":11,"parent":278,"children":294},10888,[],{"id":296,"title":185,"url":186,"target":11,"description":11,"xfn":11,"parent":278,"children":297},10890,[],{"id":299,"title":190,"url":191,"target":11,"description":11,"xfn":11,"parent":278,"children":300},10891,[],{"id":302,"title":303,"url":10,"target":11,"description":11,"xfn":11,"children":304},10892,"Company",[305,310],{"id":306,"title":307,"url":308,"target":11,"description":11,"xfn":11,"parent":302,"children":309},10893,"Asteas","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fasteas\u002F",[],{"id":311,"title":312,"url":313,"target":11,"description":11,"xfn":11,"parent":302,"children":314},10894,"Jobs","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fjobs\u002F",[],{"items":316},[317,322,327,332,337,342],{"id":318,"title":319,"url":320,"target":11,"description":11,"xfn":11,"children":321},10895,"Newsletter","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fnewsletter\u002F",[],{"id":323,"title":324,"url":325,"target":11,"description":11,"xfn":11,"children":326},10896,"Terms and Conditions","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fterms-and-conditions\u002F",[],{"id":328,"title":329,"url":330,"target":11,"description":11,"xfn":11,"children":331},10897,"Terms of Service","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fterms-of-service\u002F",[],{"id":333,"title":334,"url":335,"target":11,"description":11,"xfn":11,"children":336},10898,"Legal notice","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Flegal-notice\u002F",[],{"id":338,"title":339,"url":340,"target":11,"description":11,"xfn":11,"children":341},10899,"Accessibility","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Faccessibility\u002F",[],{"id":343,"title":344,"url":345,"target":11,"description":11,"xfn":11,"children":346},10900,"Data Protection","https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fdata-protection\u002F",[],{"login_links":348,"reseller":357,"socialmedia":359,"phone":366,"email":367,"version":368,"logos":369,"integrations":408,"productNames":453},[349,354],{"link":350},{"url":351,"title":352,"target":353},"https:\u002F\u002Fmy.iacbox.com\u002F","my.iacbox","_blank",{"link":355},{"url":356,"title":31,"target":353},"https:\u002F\u002Fdashboard.iacbox.cloud",{"url":147,"title":358,"target":11},"Reseller",[360,363],{"url":361,"icon":362},"https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fiacbox\u002F","linkedin",{"url":364,"icon":365},"https:\u002F\u002Fwww.facebook.com\u002FIACBOX-519953261540603","facebook","+43 5442 62877","service@iacbox.com","24.0",[370,380,387,395,401],{"image":371,"url":11,"size":377,"display":378,"id":379},{"url":372,"width":373,"height":374,"alt":11,"subtype":375,"mime_type":376},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002Flogo_intercityhotel.svg",134,20,"svg+xml","image\u002Fsvg+xml","145",[],0,{"image":381,"url":11,"size":377,"display":385,"id":386},{"url":382,"width":383,"height":384,"alt":11,"subtype":375,"mime_type":376},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002Flogo_robinson.svg",159,22,[],1,{"image":388,"url":11,"size":392,"display":393,"id":394},{"url":389,"width":390,"height":391,"alt":11,"subtype":375,"mime_type":376},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002Flogo_25hours-hotels.svg",51,35,"125",[],2,{"image":396,"url":11,"size":377,"display":399,"id":400},{"url":397,"width":398,"height":384,"alt":11,"subtype":375,"mime_type":376},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002Flogo_steigenberger.svg",112,[],3,{"image":402,"url":11,"size":392,"display":406,"id":407},{"url":403,"width":404,"height":405,"alt":11,"subtype":375,"mime_type":376},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002Fkempinski.svg",2102,2183,[],4,[409,417,421,425,429,433,438,443,448],{"image":410,"url":11,"size":415,"display":416,"id":379},{"url":411,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F1-1.png",2000,"png","image\u002Fpng","150",[],{"image":418,"url":11,"size":415,"display":420,"id":386},{"url":419,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F2-1.png",[],{"image":422,"url":11,"size":415,"display":424,"id":394},{"url":423,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F3.png",[],{"image":426,"url":11,"size":415,"display":428,"id":400},{"url":427,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F4.png",[],{"image":430,"url":11,"size":415,"display":432,"id":407},{"url":431,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F5.png",[],{"image":434,"url":11,"size":415,"display":436,"id":437},{"url":435,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F6.png",[],5,{"image":439,"url":11,"size":415,"display":441,"id":442},{"url":440,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F7.png",[],6,{"image":444,"url":11,"size":415,"display":446,"id":447},{"url":445,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F8.png",[],7,{"image":449,"url":11,"size":415,"display":451,"id":452},{"url":450,"width":412,"height":412,"alt":11,"subtype":413,"mime_type":414},"https:\u002F\u002Fcms2.iacbox.com\u002Fdocuments\u002F9.png",[],8,[],[455],{"id":456,"date":457,"date_gmt":457,"guid":458,"modified":460,"modified_gmt":460,"slug":461,"status":462,"type":463,"link":166,"title":464,"content":465,"excerpt":467,"author":394,"featured_media":379,"parent":379,"menu_order":468,"comment_status":469,"ping_status":469,"template":11,"meta":470,"class_list":471,"blocks":476,"acf":497,"wpml_current_locale":498,"wpml_translations":499,"_links":503},10748,"2026-09-08T07:30:59",{"rendered":459},"https:\u002F\u002Fcms2.iacbox.com\u002Fsecurity-advisories\u002F","2026-11-09T14:35:25","security-advisories","publish","page",{"rendered":165},{"rendered":11,"protected":466},false,{"rendered":11,"protected":466},50,"closed",{"_acf_changed":466,"footnotes":11},[472,463,473,474,475],"post-10748","type-page","status-publish","hentry",[477,493],{"name":478,"id":479,"fields":480},"acf\u002Fchapter","acf\u002Fchapter_6af3fe8103f3a",{"label":481,"headline":165,"description":482,"link":483,"ctas":486},"IACBOX","\u003Cp>If you have found a security issue, please report it immediately to \u003Ca href=\"mailto:security@iacbox.com\">security@iacbox.com\u003C\u002Fa>.\u003C\u002Fp>\n",{"title":484,"url":485,"target":353},"PGP Key","https:\u002F\u002Fwww.iacbox.com\u002F.well-known\u002Fsecurity-pub.asc",[487,489],{"link":488},{"title":484,"url":485,"target":353},{"link":490},{"title":491,"url":492,"target":353},"Vulnerability Disclosure Policy","https:\u002F\u002Fwww.iacbox.com\u002Fiacbox-vdp.txt",{"name":494,"id":495,"fields":496},"acf\u002Fsecurity-advisories","acf\u002Fsecurity-advisories_6af3fe8103fe9",[],{"meta_override":466,"documents":466,"headline":11,"description":11},"en_US",{"de_DE":500},{"locale":501,"id":502,"slug":461,"post_title":165,"href":459},"de_DE",1362,{"self":504,"collection":510,"about":513,"author":516,"replies":520,"version-history":523,"predecessor-version":526,"wp:attachment":530,"curies":533},[505],{"href":506,"targetHints":507},"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fpages\u002F10748",{"allow":508},[509],"GET",[511],{"href":512},"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fpages",[514],{"href":515},"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Ftypes\u002Fpage",[517],{"embeddable":518,"href":519},true,"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers\u002F2",[521],{"embeddable":518,"href":522},"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fcomments?post=10748",[524],{"count":386,"href":525},"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fpages\u002F10748\u002Frevisions",[527],{"id":528,"href":529},10749,"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fpages\u002F10748\u002Frevisions\u002F10749",[531],{"href":532},"https:\u002F\u002Fcms2.iacbox.com\u002Fen\u002Fwp-json\u002Fwp\u002Fv2\u002Fmedia?parent=10748",[534],{"name":535,"href":536,"templated":518},"wp","https:\u002F\u002Fapi.w.org\u002F{rel}",{"advisories":538,"generated":1123},[539,553,565,580,587,608,647,678,687,744,764,775,789,799,838,851,869,878,887,898,913,923,932,940,954,963,972,985,991,1002,1011,1021,1030,1038,1051,1061,1071,1080,1089,1097,1107,1114],{"id":540,"advisory_id":541,"released":542,"updated":543,"severity":544,"vuln_ids":545,"affected":518,"affected_version_from_incl":548,"affected_version_to_incl":549,"version_fixed":550,"title":551,"description":552},39,"IAC-2026-026","2026-10-31T10:00:00Z","2026-11-10T10:00:00Z","high",[546,547],"CVE-2026-98432","EUVD-2026-102025","17.0","24.3.7","24.3.8","Linux kernel vulnerability in the IPv4 TCP stack","\u003Cp> The Linux kernel has had a critical vulnerability in its IPv4 TCP code since version \u003Ctt>4.4\u003C\u002Ftt>. \u003C\u002Fp> \u003Cp> \u003Cb>Update: 2026-11-10:\u003C\u002Fb> The severity was downgraded to \u003Ctt>high\u003C\u002Ftt> as most ISPs filter such IP options and so the attack does not work over the internet. Still within a LAN this is a dangerous vulnerability and the update should be applied. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-98432\">CVE-2026-98432\u003C\u002Fa>\u003C\u002Fb> (CVSS 9.8): Use-after-free in the IPv4 TCP handshake. An unauthenticated attacker can send TCP SYN packets carrying IPv4 header options (Record Route \u002F Timestamp) and race the kernel while it builds the SYN-ACK reply. This can leak kernel memory to the attacker, corrupt kernel memory (possibly leading to remote code execution) or crash the system.\u003Cbr> Every TCP service of the IACBOX is reachable this way, from the guest network as well as from other connected networks. IPv6 is not affected. \u003C\u002Fp> \u003Cp> \u003Cb>Who is affected?\u003C\u002Fb>\u003Cbr> All IACBOX versions up to \u003Ctt>24.3.7\u003C\u002Ftt>, including \u003Ctt>17.x\u003C\u002Ftt>, \u003Ctt>18.x\u003C\u002Ftt>, \u003Ctt>19.x\u003C\u002Ftt> and \u003Ctt>21.x\u003C\u002Ftt>.\u003Cbr> The non-public exploit reported by Anthropic targets Multipath TCP (MPTCP) listeners. MPTCP is not built into the IACBOX kernel, but the vulnerable code is part of the regular IPv4 TCP stack, so the IACBOX is affected nevertheless. \u003C\u002Fp> \u003Cp> \u003Cb>Mitigation \u002F Fix\u003C\u002Fb>\u003Cbr> - Version \u003Ctt>24.3.8\u003C\u002Ftt> ships a firewall rule that drops TCP SYN packets carrying IPv4 header options. This blocks the attack. Regular clients do not send such packets.\u003Cbr> - The upcoming version \u003Ctt>24.4.0\u003C\u002Ftt> ships a new kernel \u003Ctt>6.12.114\u003C\u002Ftt>, which contains the fix. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> Update to \u003Ctt>24.3.8\u003C\u002Ftt> as soon as possible. IACBOXes running on older major versions have to be upgraded to \u003Ctt>24.x\u003C\u002Ftt> as these versions are already End-of-life. \u003C\u002Fp> ",{"id":554,"advisory_id":555,"released":556,"updated":556,"severity":557,"vuln_ids":558,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":549,"version_fixed":562,"title":563,"description":564},40,"IAC-2026-025","2026-11-02T12:00:00Z","medium",[559,560],"CVE-2026-108082","GHSA-r925-mgvr-h9cc","24.0.0","24.4.0","Denial of service vulnerability in Login Page PHP dependency","\u003Cp>A denial of service vulnerability was found in a PHP dependency of the IACBOX Login Page.\u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-108082\">CVE-2026-108082\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r925-mgvr-h9cc\">GHSA-r925-mgvr-h9cc\u003C\u002Fa>\u003C\u002Fb>: Affects the composer package \u003Ctt>symfony\u002Fhttp-foundation\u003C\u002Ftt> before \u003Ctt>7.4.19\u003C\u002Ftt>. The function \u003Ctt>HeaderUtils::split()\u003C\u002Ftt> uses a regular expression that is prone to catastrophic backtracking (ReDoS). It is triggered when parsing the \u003Ctt>Cache-Control\u003C\u002Ftt> request header, so a single crafted HTTP request can consume a large amount of CPU time. No authentication is required. \u003C\u002Fp> \u003Cp> \u003Cb>Who is affected?\u003C\u002Fb> On the IACBOX the package is used indirectly by the payment libraries of the Login Page. The vulnerable code is only reached when the login method \u003Cb>online payment\u003C\u002Fb> is enabled. WebAdmin is not affected. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> Updating the IACBOX to \u003Ctt>24.4.0\u003C\u002Ftt> is recommended for all users of the \u003Cb>online payment\u003C\u002Fb> login method. \u003C\u002Fp> ",{"id":566,"advisory_id":567,"released":568,"updated":569,"severity":570,"vuln_ids":571,"affected":518,"affected_version_from_incl":576,"affected_version_to_incl":577,"version_fixed":549,"title":578,"description":579},37,"IAC-2026-023","2026-10-21T14:00:00Z","2026-10-23T16:00:00Z","critical",[572,573,574,575],"CVE-2026-109618","CVE-2026-109619","GHSA-w8hw-w9fx-j79w","GHSA-6wmf-4rv5-p3rp","all","24.3.6","Critical PHP Security Update","\u003Cp>\u003Cb>SUMMARY\u003C\u002Fb>\u003C\u002Fp> PHP has two critical security vulnerabilities allowing remote-code-execution. Updates are available - update now! \u003Cp>\u003Cb>HISTORY\u003C\u002Fb>\u003C\u002Fp> - \u003Cb>Update: 2026-10-24 11:00\u003C\u002Fb>: Enforced update for remaining systems (incl. one reboot) - Integrity checks\u003Cbr> - \u003Cb>Update: 2026-10-23 11:00\u003C\u002Fb>: Work on integrity checks\u003Cbr> - \u003Cb>Update: 2026-10-22 17:00\u003C\u002Fb>: v21 Update \u003Ctt>21.0-p21653\u003C\u002Ftt> released\u003Cbr> - \u003Cb>Update: 2026-10-22 13:00\u003C\u002Fb>: Advisory Update\u003Cbr> - \u003Cb>Update: 2026-10-22 11:00\u003C\u002Fb>: Emergency Update for v24 without valid software maintenance released.\u003Cbr> - \u003Cb>Update: 2026-10-22 08:45\u003C\u002Fb>: Status update that a the emergency and a v21 update are under test\u003Cbr> - \u003Cb>Update: 2026-10-21 20:30\u003C\u002Fb>: Status update\u003Cbr> - \u003Cb>Update: 2026-10-21 17:00\u003C\u002Fb>: Fix released 24.3.7\u003Cbr> - \u003Cb>Update: 2026-10-21 16:10\u003C\u002Fb>: PHP released updates - working on the 24.3.7 update\u003Cbr> - \u003Cb>Inital statement 2026-10-21 14:00\u003C\u002Fb>: Warning about the urgent upcoming security release.\u003Cbr> \u003Cp> \u003Cb>Version 24\u003C\u002Fb> \u003Cbr> - Systems with valid software maintenance: Simply update to \u003Ctt>24.3.7\u003C\u002Ftt>\u003Cbr> - Systems without valid software maintenance: An out-of-order \u003Cb>emergency update\u003C\u002Fb> is available since 2026-10-22 11:00. You can re-register the system in WebAdmin or reboot your system. Note that this update will reboot the system again. Check if that update was successfully installed by visiting the WebAdmin dashboard, that should show a notification: \"Emergency Update Installed\"\u003Cbr> \u003C\u002Fp> \u003Cp> \u003Cb>Version 21\u003C\u002Fb> \u003Cbr> - An update \u003Ctt>21.0-p21653\u003C\u002Ftt> with a patched PHP version is available since 2026-10-22 17:00. Start the online update as soon as possible.\u003Cbr> - Version 21 is already End-of-Life, but we've updated the used PHP version 7.4 (which is EoL by itself) as this is a severe security risk.\u003Cbr> \u003C\u002Fp> \u003Cp> \u003Cb>Versions older than 21\u003C\u002Fb> \u003Cbr> This versions are unpatched for years now and should not be operated since a long time.\u003Cbr> \u003C\u002Fp> \u003Cp> \u003Cp>\u003Cb>MITIGATIONS\u003C\u002Fb>\u003C\u002Fp> \u003Cb>Mitigations for users that cannot update\u003C\u002Fb>\u003Cbr> \u003Cbr> - For WebAdmin: take care that WebAdmin is not reachable from public internet until you are able to update\u003Cbr> - Except where you have a trusted user-base, it's not safe to operate an unpatched system. It's recommended to shutdown the system till you're able to update to a safe version. \u003C\u002Fp> \u003Cp> \u003Cp>\u003Cb>Integrity checks\u003C\u002Fb>\u003C\u002Fp> We're working on advanced system integrity checks to find possibly compromised systems.\u003Cbr> In an ongoing effort we're searching for suspicious activities. \u003C\u002Fp> \u003Cp> \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php#2026-10-21-5\">PHP Security Advisory with technical details\u003C\u002Fa>\u003Cbr> \u003Ca href=\"https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-018\">CERT-EU Advisory\u003C\u002Fa>\u003Cbr> \u003Ca href=\"https:\u002F\u002Fwww.enisa.europa.eu\u002Fnews\u002Fjoint-statement-on-critical-php-vulnerabilities\">ENISA Statement\u003C\u002Fa> \u003C\u002Fp> ",{"id":581,"advisory_id":582,"released":568,"updated":568,"severity":557,"vuln_ids":583,"affected":518,"affected_version_from_incl":576,"affected_version_to_incl":577,"version_fixed":549,"title":585,"description":586},38,"IAC-2026-024",[584],"CVE-2026-111943","Compromised CA certificates distrusted","\u003Cb>A Certificate Authority included in public trust stores has been compromised, which allowed attackers to obtain valid TLS certificates for arbitrary domains.\u003C\u002Fb>\u003Cbr>\u003Cbr> Software on the IACBOX that verifies TLS server certificates against the system trust store or the Go standard library would accept such certificates as valid. This update removes the trust in the affected certificates. \u003Ch3>Impact on the IACBOX\u003C\u002Fh3> \u003Cp> All IACBOX software updates, including the updater itself, are cryptographically signed and verified independently of TLS. The update process is therefore not affected.\u003Cbr>\u003Cbr> Other outgoing HTTPS connections of the IACBOX, e.g. to external services used by login methods, could be exposed to man-in-the-middle attacks. A successful attack requires that the attacker\u003Cbr> - knows which external domains a specific IACBOX connects to,\u003Cbr> - holds a fraudulently issued certificate for exactly that domain and\u003Cbr> - is able to redirect the outgoing traffic of the IACBOX, e.g. by DNS spoofing in the network of the IACBOX.\u003Cbr>\u003Cbr> An attack is therefore limited to individual deployments and is non-trivial to carry out. \u003C\u002Fp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111943\">CVE-2026-111943\u003C\u002Fa> - Go standard library\u003C\u002Fh3> \u003Cp> \u003Ctt>crypto\u002Fx509\u003C\u002Ftt>: On systems where the trust store is not up to date, Go versions before \u003Ctt>1.26.10\u003C\u002Ftt> accept certificate chains containing the compromised intermediate certificates. Go \u003Ctt>1.26.10\u003C\u002Ftt> adds a denylist, so \u003Ctt>Certificate.Verify\u003C\u002Ftt> rejects such chains.\u003Cbr> Find all details in the \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002F66pojueaQek\">Go Security Announcement\u003C\u002Fa>. \u003C\u002Fp> \u003Ch3>Changes in this update\u003C\u002Fh3> \u003Cp> - The system CA bundle was updated and no longer contains the root certificates \u003Ctt>emSign ECC Root CA - G3\u003C\u002Ftt>, \u003Ctt>emSign Root CA - C1\u003C\u002Ftt> and \u003Ctt>emSign ECC Root CA - C3\u003C\u002Ftt>.\u003Cbr> - All go binaries that make outgoing connections were recompiled with \u003Ctt>go 1.26.10\u003C\u002Ftt>. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation:\u003C\u002Fb> We strongly recommend updating to IACBOX version \u003Ctt>24.3.7\u003C\u002Ftt>. \u003C\u002Fp> ",{"id":588,"advisory_id":589,"released":590,"updated":590,"severity":591,"vuln_ids":592,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":577,"version_fixed":562,"title":606,"description":607},42,"IAC-2026-022","2026-10-19T10:00:00Z","low",[593,594,595,596,597,598,599,600,601,602,603,604,605],"CVE-2026-35189","CVE-2026-35191","CVE-2026-42772","CVE-2026-54872","CVE-2026-54873","CVE-2026-54875","CVE-2026-72897","CVE-2026-75804","CVE-2026-75805","CVE-2026-75806","CVE-2026-77696","CVE-2026-84782","CVE-2026-84784","OpenSSL security vulnerabilities","\u003Cp>The OpenSSL project has published 13 security vulnerabilities, fixed in OpenSSL \u003Ctt>3.5.9\u003C\u002Ftt>. The IACBOX shipped OpenSSL \u003Ctt>3.5.8\u003C\u002Ftt>, which has now been updated to \u003Ctt>3.5.9\u003C\u002Ftt>. Only one of these issues affects the IACBOX. It can lead to a denial of service of the 802.1x authentication, but not of the Login Page or the WebAdmin. Therefore this advisory is rated \u003Cb>low\u003C\u002Fb>.\u003Cbr> The vulnerability rated \u003Cb>high\u003C\u002Fb> by the OpenSSL project (\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-84782\">CVE-2026-84782\u003C\u002Fa>) does \u003Cb>not\u003C\u002Fb> affect the IACBOX, because no service on the IACBOX uses DTLS.\u003C\u002Fp> \u003Ch3>CVE-2026-35189\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35189\">CVE-2026-35189\u003C\u002Fa>\u003C\u002Fb> (low, excessive memory allocation in CRL distribution point processing): A crafted certificate with many relative CRL distribution points makes OpenSSL allocate several hundred MiB of memory during a TLS handshake. Servers that request client certificates and TLS clients are affected. On the IACBOX, the RADIUS server for 802.1x requests client certificates (EAP-TLS). A WiFi client can send such a certificate before it is authenticated. Many concurrent attempts can exhaust the memory of the RADIUS server and interrupt 802.1x authentication (denial of service). This only applies if 802.1x is in use. Outgoing connections of the IACBOX (e.g. to PMS, payment or SMS services) can only be attacked by a malicious server or a man-in-the-middle. The web server for the Login Page and the WebAdmin does not request client certificates and is not affected.\u003C\u002Fp> \u003Ch3>Not affected\u003C\u002Fh3> \u003Cp>The IACBOX is \u003Cb>not affected\u003C\u002Fb> by the remaining 12 issues, because the affected feature is not used:\u003Cbr> \u003Cb>DTLS\u003C\u002Fb>: \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-84782\">CVE-2026-84782\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-75806\">CVE-2026-75806\u003C\u002Fa>\u003Cbr> \u003Cb>QUIC\u003C\u002Fb>: \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35191\">CVE-2026-35191\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42772\">CVE-2026-42772\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54873\">CVE-2026-54873\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-75804\">CVE-2026-75804\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-84784\">CVE-2026-84784\u003C\u002Fa>\u003Cbr> \u003Cb>SM2 and non-NIST curves\u003C\u002Fb> (the IACBOX uses RSA and P-256 keys): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54872\">CVE-2026-54872\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54875\">CVE-2026-54875\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-77696\">CVE-2026-77696\u003C\u002Fa>\u003Cbr> \u003Cb>CMP\u003C\u002Fb>: \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-75805\">CVE-2026-75805\u003C\u002Fa>\u003Cbr> \u003Cb>Different OpenSSL providers per virtual host\u003C\u002Fb>: \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-72897\">CVE-2026-72897\u003C\u002Fa>\u003C\u002Fp> \u003Cp>Find all details on the \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fopenssl-library.org\u002Fnews\u002Fvulnerabilities\u002F\">OpenSSL vulnerabilities page\u003C\u002Fa>.\u003C\u002Fp> \u003Cp>\u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> OpenSSL has been updated to \u003Ctt>3.5.9\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.4.0\u003C\u002Ftt> is recommended for all installations, especially those using 802.1x.\u003C\u002Fp> ",{"id":609,"advisory_id":610,"released":590,"updated":590,"severity":591,"vuln_ids":611,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":577,"version_fixed":562,"title":645,"description":646},41,"IAC-2026-021",[612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644],"CVE-2026-92387","CVE-2026-92392","CVE-2026-19931","CVE-2026-18924","CVE-2026-94265","CVE-2026-86413","CVE-2026-87861","CVE-2026-86414","CVE-2026-94266","CVE-2026-107929","CVE-2026-107928","CVE-2026-92386","CVE-2026-86412","CVE-2026-80255","CVE-2026-82209","CVE-2026-87862","CVE-2026-87863","CVE-2026-92388","CVE-2026-86411","CVE-2026-92389","CVE-2026-87864","CVE-2026-92390","CVE-2026-86410","CVE-2026-87865","CVE-2026-92391","CVE-2026-86409","CVE-2026-87866","CVE-2026-82208","CVE-2026-86415","CVE-2026-80230","CVE-2026-80231","CVE-2026-80229","CVE-2026-13608","curl security vulnerabilities","\u003Cp>The curl project has published 33 security vulnerabilities in \u003Ctt>curl\u003C\u002Ftt> and \u003Ctt>libcurl\u003C\u002Ftt>, fixed in curl \u003Ctt>8.22.0\u003C\u002Ftt> and \u003Ctt>8.23.0\u003C\u002Ftt>. The IACBOX shipped curl \u003Ctt>8.21.0\u003C\u002Ftt>, which has now been updated to \u003Ctt>8.23.0\u003C\u002Ftt>. Only one of these issues affects the IACBOX. It can only be triggered by a remote server the IACBOX connects to, not by guests on the public Login Page. Therefore this advisory is rated \u003Cb>low\u003C\u002Fb>.\u003Cbr> The vulnerability rated \u003Cb>high\u003C\u002Fb> by the curl project (\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92392\">CVE-2026-92392\u003C\u002Fa>) does \u003Cb>not\u003C\u002Fb> affect the IACBOX, because curl on the IACBOX is built without HTTP\u002F2 support.\u003C\u002Fp> \u003Ch3>CVE-2026-92387\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92387\">CVE-2026-92387\u003C\u002Fa>\u003C\u002Fb> (low, endless response loop in FTP\u002FIMAP\u002FPOP3\u002FSMTP): A malicious server can send an unlimited stream of non-final response lines. libcurl keeps reading them and never checks the transfer timeout, so the request hangs. On the IACBOX, requests to whitelisted Free2Use websites follow redirects, and libcurl allows redirects to \u003Ctt>ftp:\u002F\u002F\u003C\u002Ftt> by default. A whitelisted website reachable via plain HTTP, or an attacker on the network path to it, can redirect such a request to a malicious FTP server and block a Login Page worker process. Repeated requests can make the Login Page unresponsive (denial of service). Exploitation requires control over a whitelisted website or a man-in-the-middle position.\u003C\u002Fp> \u003Ch3>Not affected\u003C\u002Fh3> \u003Cp>The IACBOX is \u003Cb>not affected\u003C\u002Fb> by the remaining 32 issues, because the affected feature is not compiled in or not used:\u003Cbr> \u003Cb>HTTP\u002F2\u003C\u002Fb> (not compiled in): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92392\">CVE-2026-92392\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-18924\">CVE-2026-18924\u003C\u002Fa>\u003Cbr> \u003Cb>Negotiate\u002FGSS-API\u003C\u002Fb> (not compiled in): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-19931\">CVE-2026-19931\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-94265\">CVE-2026-94265\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86413\">CVE-2026-86413\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87861\">CVE-2026-87861\u003C\u002Fa>\u003Cbr> \u003Cb>GnuTLS, wolfSSL, Schannel\u003C\u002Fb> (the IACBOX uses OpenSSL): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-107928\">CVE-2026-107928\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87866\">CVE-2026-87866\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82208\">CVE-2026-82208\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86415\">CVE-2026-86415\u003C\u002Fa>\u003Cbr> \u003Cb>SFTP\u002FSCP, libssh2\u003C\u002Fb> (not compiled in): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86410\">CVE-2026-86410\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87865\">CVE-2026-87865\u003C\u002Fa>\u003Cbr> \u003Cb>LDAP\u003C\u002Fb> (not compiled in): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-13608\">CVE-2026-13608\u003C\u002Fa>\u003Cbr> \u003Cb>Cookie engine, cookie jar, PSL\u003C\u002Fb> (not used): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92386\">CVE-2026-92386\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86412\">CVE-2026-86412\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80255\">CVE-2026-80255\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82209\">CVE-2026-82209\u003C\u002Fa>\u003Cbr> \u003Cb>HSTS cache\u003C\u002Fb> (not used): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87862\">CVE-2026-87862\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87863\">CVE-2026-87863\u003C\u002Fa>\u003Cbr> \u003Cb>Other options and protocols\u003C\u002Fb> (not used by the IACBOX): \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86414\">CVE-2026-86414\u003C\u002Fa> (HTTP proxy), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-94266\">CVE-2026-94266\u003C\u002Fa> (\u003Ctt>.netrc\u003C\u002Ftt>), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-107929\">CVE-2026-107929\u003C\u002Fa> (\u003Ctt>CURLOPT_INTERFACE\u003C\u002Ftt>), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92388\">CVE-2026-92388\u003C\u002Fa> (FTP wildcard matching), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86411\">CVE-2026-86411\u003C\u002Fa> (FTP with client certificates), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92389\">CVE-2026-92389\u003C\u002Fa> (TFTP), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87864\">CVE-2026-87864\u003C\u002Fa> (IMAP with \u003Ctt>CURLOPT_CRLF\u003C\u002Ftt>), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92390\">CVE-2026-92390\u003C\u002Fa> (curl tool option \u003Ctt>-J\u003C\u002Ftt>), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92391\">CVE-2026-92391\u003C\u002Fa> (nested MIME parts), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86409\">CVE-2026-86409\u003C\u002Fa> (AWS SigV4), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80230\">CVE-2026-80230\u003C\u002Fa> (public key pinning), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80231\">CVE-2026-80231\u003C\u002Fa> (native CA store), \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80229\">CVE-2026-80229\u003C\u002Fa> (OpenSSL providers with the multi interface)\u003C\u002Fp> \u003Cp>Find all details on the \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fcurl.se\u002Fdocs\u002Fsecurity.html\">curl security page\u003C\u002Fa>.\u003C\u002Fp> \u003Cp>\u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> curl has been updated to \u003Ctt>8.23.0\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.4.0\u003C\u002Ftt> is recommended for all installations.\u003C\u002Fp> ",{"id":648,"advisory_id":649,"released":650,"updated":650,"severity":591,"vuln_ids":651,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":675,"version_fixed":577,"title":676,"description":677},36,"IAC-2026-020","2026-10-05T12:00:00Z",[652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674],"CVE-2026-91767","GHSA-xr7j-rvgx-xq5p","CVE-2026-91769","GHSA-vvx9-73fr-5jjx","CVE-2026-6103","GHSA-j3wh-g957-2m85","CVE-2026-93682","GHSA-7875-c8px-7q5f","CVE-2025-14181","GHSA-cj93-vc83-wgqv","CVE-2026-91765","GHSA-rgrp-mwpx-f6rm","CVE-2026-91766","GHSA-fpwc-w8rq-cr92","CVE-2026-91768","GHSA-62xp-839h-2637","CVE-2025-1218","GHSA-r6x9-5r99-36j7","CVE-2026-92842","GHSA-88hq-2827-7pg6","GHSA-ch8v-r6jh-4vvr","CVE-2026-17545","GHSA-9f67-6fw4-hpfp","24.3.5","PHP security vulnerabilities","\u003Cp>Several security vulnerabilities were fixed in PHP. All issues have been fixed by updating PHP to \u003Ctt>8.2.34\u003C\u002Ftt>. Four of the issues are reachable on the IACBOX. Each one requires either a malicious or compromised remote server that the IACBOX connects to, or an \u003Cb>authenticated WebAdmin\u003C\u002Fb> user. None of them can be triggered by guests on the public Login Page. Therefore this advisory is rated \u003Cb>low\u003C\u002Fb>.\u003C\u002Fp> \u003Ch3>CVE-2026-91767\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91767\">CVE-2026-91767\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xr7j-rvgx-xq5p\">GHSA-xr7j-rvgx-xq5p\u003C\u002Fa>\u003C\u002Fb> (Moderate, CVSS 6.5, heap buffer over-read in the \u003Ctt>openssl\u003C\u002Ftt> extension): A crafted wildcard name in a TLS server certificate causes an out-of-bounds read during hostname verification. The IACBOX uses PHP streams for some outbound HTTPS connections, for example to PMS and newsletter interfaces. Exploitation requires a malicious server, or a man-in-the-middle with a certificate that passes certificate chain verification. It can lead to a crash of the request or to memory disclosure.\u003C\u002Fp> \u003Ch3>CVE-2026-91769\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91769\">CVE-2026-91769\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vvx9-73fr-5jjx\">GHSA-vvx9-73fr-5jjx\u003C\u002Fa>\u003C\u002Fb> (Moderate, CVSS 4.3, TLS hostname verification in the \u003Ctt>openssl\u003C\u002Ftt> extension): If none of a certificate's subjectAltName entries match, hostname verification falls back to the Common Name. This affects the same outbound HTTPS connections. Exploitation requires a man-in-the-middle position and a certificate from a trusted CA whose Common Name matches the target host while its subjectAltName does not.\u003C\u002Fp> \u003Ch3>CVE-2026-6103\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6103\">CVE-2026-6103\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-j3wh-g957-2m85\">GHSA-j3wh-g957-2m85\u003C\u002Fa>\u003C\u002Fb> (Moderate, CVSS 4.0, integer overflow in the \u003Ctt>phar\u003C\u002Ftt> extension): A crafted TAR archive can inject entries that other TAR tools do not see. The IACBOX uses this code path when \u003Ctt>.tar.gz\u003C\u002Ftt> archives (Login Pages, Themes and Extensions) are uploaded in the WebAdmin. Exploitation requires an \u003Cb>authenticated WebAdmin\u003C\u002Fb> user.\u003C\u002Fp> \u003Ch3>CVE-2026-93682\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-93682\">CVE-2026-93682\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7875-c8px-7q5f\">GHSA-7875-c8px-7q5f\u003C\u002Fa>\u003C\u002Fb> (Moderate, CVSS 5.3, out-of-bounds read in the HTTP stream wrapper): A redirect with an empty \u003Ctt>Location\u003C\u002Ftt> header causes a one-byte out-of-bounds read. Some outbound HTTP requests of the IACBOX follow redirects. Exploitation requires a malicious remote server. The byte is never disclosed and only influences the redirect target.\u003C\u002Fp> \u003Ch3>Not affected\u003C\u002Fh3> \u003Cp>The IACBOX is \u003Cb>not affected\u003C\u002Fb> by the remaining issues fixed in PHP \u003Ctt>8.2.34\u003C\u002Ftt>:\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-14181\">CVE-2025-14181\u003C\u002Fa>\u003C\u002Fb> (SOAP client HTTP parsing): Exploitation requires a response of several gigabytes. The PHP \u003Ctt>memory_limit\u003C\u002Ftt> configured on the IACBOX aborts such a request before the overflow can occur.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91765\">CVE-2026-91765\u003C\u002Fa>\u003C\u002Fb> (SOAP server recursion): The IACBOX does not provide a SOAP server.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91766\">CVE-2026-91766\u003C\u002Fa>\u003C\u002Fb> (credential leak on HTTP redirects): Requests that send credentials do not follow redirects.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91768\">CVE-2026-91768\u003C\u002Fa>\u003C\u002Fb> (PHP-FPM IPv6 ACL bypass): PHP-FPM is not used.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-1218\">CVE-2025-1218\u003C\u002Fa>\u003C\u002Fb> (mysqlnd packet over-reads): The IACBOX does not connect to MySQL servers with mysqlnd.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-92842\">CVE-2026-92842\u003C\u002Fa>\u003C\u002Fb> (\u003Ctt>convert.*\u003C\u002Ftt> stream filters) and \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-ch8v-r6jh-4vvr\">GHSA-ch8v-r6jh-4vvr\u003C\u002Fa>\u003C\u002Fb> (\u003Ctt>FILTER_SANITIZE_ENCODED\u003C\u002Ftt>): The affected functions are not used.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-17545\">CVE-2026-17545\u003C\u002Fa>\u003C\u002Fb> (reserved device names): This issue affects Windows only.\u003C\u002Fp> \u003Cp>\u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> PHP has been updated to \u003Ctt>8.2.34\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.3.6\u003C\u002Ftt> is recommended for all installations.\u003C\u002Fp> ",{"id":391,"advisory_id":679,"released":650,"updated":650,"severity":591,"vuln_ids":680,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":675,"version_fixed":577,"title":685,"description":686},"IAC-2026-019",[681,682,683,684],"CVE-2026-84732","CVE-2026-84471","CVE-2026-12996","CVE-2026-40215","Multiple vulnerabilities in OpenVPN (iacbox.cloud VPN connection)","The IACBOX uses \u003Ctt>OpenVPN\u003C\u002Ftt> exclusively as a client for the VPN connection to the iacbox.cloud. The shipped version \u003Ctt>OpenVPN 2.6.12\u003C\u002Ftt> is affected by several vulnerabilities that were fixed upstream between \u003Ctt>2.6.13\u003C\u002Ftt> and \u003Ctt>2.6.23\u003C\u002Ftt>. \u003Cp> The OpenVPN releases up to \u003Ctt>2.6.23\u003C\u002Ftt> contain 19 CVEs in total. Most of them do not affect the IACBOX, because they concern Windows only, the OpenVPN server role, or features that the iacbox.cloud connection does not use (\u003Ctt>tls-crypt-v2\u003C\u002Ftt>, \u003Ctt>auth-gen-token\u003C\u002Ftt>, HTTP proxy \u002F NTLM authentication, dynamic tls-crypt). The following vulnerabilities affect the OpenVPN client on the IACBOX. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-84732\">CVE-2026-84732\u003C\u002Fa>\u003C\u002Fh3> Bugs in the reliability layer of the control channel (ACK handling and an unbounded retransmit timeout) allow a remote attacker to cause a denial of service of the VPN connection. \u003C\u002Fp> \u003Cp> \u003Ch3>OpenVPN private issue #181 (no CVE assigned)\u003C\u002Fh3> A client that does not use \u003Ctt>tls-crypt-v2\u003C\u002Ftt> could be crashed by a crafted initial reset packet from the peer, before the peer is authenticated. This results in a denial of service of the VPN connection. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-84471\">CVE-2026-84471\u003C\u002Fa>\u003C\u002Fh3> A possible double-free during TLS key renegotiation (lame-duck key state). \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-12996\">CVE-2026-12996\u003C\u002Fa> and \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40215\">CVE-2026-40215\u003C\u002Fa>\u003C\u002Fh3> Use-after-free conditions during the promotion of a new TLS session, which may lead to a crash or to leaking heap memory. Exploitation requires an authenticated peer. \u003C\u002Fp> \u003Cp> \u003Cb>Impact on the IACBOX\u003C\u002Fb>\u003Cbr> The iacbox.cloud VPN connection uses mutual TLS authentication with certificates and an additional \u003Ctt>tls-auth\u003C\u002Ftt> HMAC key. Every control channel packet has to pass the HMAC check and must come from the configured iacbox.cloud server address. To exploit these vulnerabilities, an attacker would need both the \u003Ctt>tls-auth\u003C\u002Ftt> key and a position in the network path between the IACBOX and the iacbox.cloud, or control over an iacbox.cloud server. In the worst case, the connection to the iacbox.cloud is interrupted. The guest network, the Login Page and all other IACBOX services are not affected. Therefore we rate the severity as \u003Cb>low\u003C\u002Fb>. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> IACBOX \u003Ctt>24.3.6\u003C\u002Ftt> ships \u003Ctt>OpenVPN 2.6.23\u003C\u002Ftt>, which fixes all of the vulnerabilities above. We recommend updating to IACBOX \u003Ctt>24.3.6\u003C\u002Ftt> or later, if the \u003Cb>iacbox.cloud\u003C\u002Fb> module is active. \u003C\u002Fp> \u003Cp> Find all details in the \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fgithub.com\u002FOpenVPN\u002Fopenvpn\u002Fblob\u002Frelease\u002F2.6\u002FChanges.rst\">OpenVPN 2.6 changelog\u003C\u002Fa>. \u003C\u002Fp> ",{"id":688,"advisory_id":689,"released":690,"updated":690,"severity":691,"vuln_ids":692,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":11,"title":742,"description":743},34,"IAC-2026-018","2026-08-25T08:30:00Z","not_affected",[693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741],"CVE-2025-8713","CVE-2025-8714","CVE-2025-8715","CVE-2025-12817","CVE-2025-12818","CVE-2026-2003","CVE-2026-2004","CVE-2026-2005","CVE-2026-2006","CVE-2026-2007","CVE-2026-6464","CVE-2026-6469","CVE-2026-6470","CVE-2026-6471","CVE-2026-6472","CVE-2026-6473","CVE-2026-6474","CVE-2026-6475","CVE-2026-6476","CVE-2026-6477","CVE-2026-6478","CVE-2026-6479","CVE-2026-6575","CVE-2026-6637","CVE-2026-6638","CVE-2026-14662","CVE-2026-14663","CVE-2026-14664","CVE-2026-14666","CVE-2026-14668","CVE-2026-14669","CVE-2026-14670","CVE-2026-14671","CVE-2026-14672","CVE-2026-14673","CVE-2026-14676","CVE-2026-14677","CVE-2026-14678","CVE-2026-14679","CVE-2026-14680","CVE-2026-14681","CVE-2026-15741","CVE-2026-15742","CVE-2026-16238","CVE-2026-16239","CVE-2026-16241","CVE-2026-18024","CVE-2026-18408","CVE-2026-19385","PostgreSQL security updates","\u003Cp> The PostgreSQL database server of the IACBOX has been updated to \u003Ctt>15.19\u003C\u002Ftt>. This closes 49 vulnerabilities published upstream in the releases \u003Ctt>15.14\u003C\u002Ftt>, \u003Ctt>15.15\u003C\u002Ftt>, \u003Ctt>15.16\u003C\u002Ftt>, \u003Ctt>15.18\u003C\u002Ftt> and \u003Ctt>15.19\u003C\u002Ftt> (\u003Ctt>15.17\u003C\u002Ftt> contained no security fixes). \u003C\u002Fp> \u003Cp> \u003Cb>The IACBOX is not affected by any of these vulnerabilities.\u003C\u002Fb> Each one was triaged individually against the configuration actually shipped on the IACBOX. The database is not reachable from the network. \u003C\u002Fp> \u003Ch3>Triage result\u003C\u002Fh3> \u003Cp> \u003Cb>Not installed\u003C\u002Fb> - the affected extension or procedural language is not present, only \u003Ctt>plpgsql\u003C\u002Ftt> is:\u003Cbr> CVE-2026-2004, CVE-2026-2005, CVE-2026-6637, CVE-2026-14663, CVE-2026-14670, CVE-2026-14671, CVE-2026-14673, CVE-2026-14676, CVE-2026-14677, CVE-2026-14678, CVE-2026-15742 \u003C\u002Fp> \u003Cp> \u003Cb>Requires own SQL or DDL\u003C\u002Fb> - the IACBOX services only issue fixed statements and there is no low privileged database role that these flaws could escalate from:\u003Cbr> CVE-2025-8713, CVE-2025-8715, CVE-2025-12817, CVE-2026-2003, CVE-2026-2006, CVE-2026-6469, CVE-2026-6470, CVE-2026-6472, CVE-2026-14664, CVE-2026-14666, CVE-2026-14668, CVE-2026-14679, CVE-2026-14680, CVE-2026-15741, CVE-2026-16238, CVE-2026-16239, CVE-2026-18024, CVE-2026-19385 \u003C\u002Fp> \u003Cp> \u003Cb>Feature not used\u003C\u002Fb> - replication, logical decoding, large objects, full text search, the affected date and time functions and embedded SQL are not used:\u003Cbr> CVE-2026-6471, CVE-2026-6474, CVE-2026-6475, CVE-2026-6477, CVE-2026-14662, CVE-2026-14669, CVE-2026-16241 \u003C\u002Fp> \u003Cp> \u003Cb>PostgreSQL 15 not affected\u003C\u002Fb> - the flaw only exists in PostgreSQL 16, 17 or 18:\u003Cbr> CVE-2026-2007, CVE-2026-6476, CVE-2026-6575, CVE-2026-6638 \u003C\u002Fp> \u003Cp> \u003Cb>Not reachable over the network\u003C\u002Fb> - the database port is blocked by the firewall on all interfaces, TLS and GSSAPI are disabled and no password authentication is used:\u003Cbr> CVE-2026-6478, CVE-2026-6479, CVE-2026-14672, CVE-2026-14681 \u003C\u002Fp> \u003Cp> \u003Cb>Requires a hostile database server\u003C\u002Fb> - these are client side flaws, and the IACBOX clients only connect to the local database:\u003Cbr> CVE-2025-8714, CVE-2025-12818, CVE-2026-18408 \u003C\u002Fp> \u003Cp> \u003Cb>CVE-2026-6473\u003C\u002Fb> - requires values in the gigabyte range to be passed to database functions, which no IACBOX component does. \u003C\u002Fp> \u003Cp> \u003Cb>CVE-2026-6464\u003C\u002Fb> - affects \u003Ctt>psql\u003C\u002Ftt> when a \u003Ctt>COPY FROM STDIN\u003C\u002Ftt> fails early. Data written by guests cannot become a \u003Ctt>psql\u003C\u002Ftt> command, because \u003Ctt>pg_dump\u003C\u002Ftt> escapes line breaks and backslashes in the dumped data. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> No action is required to protect against these vulnerabilities. The updated PostgreSQL version is shipped with the regular online update. \u003C\u002Fp> \u003Cp> \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fwww.postgresql.org\u002Fabout\u002Fnews\u002Fpostgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365\u002F\">See the upstream release announcement for more details\u003C\u002Fa> \u003C\u002Fp> ",{"id":745,"advisory_id":746,"released":747,"updated":747,"severity":557,"vuln_ids":748,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":760,"version_fixed":761,"title":762,"description":763},33,"IAC-2026-017","2026-08-10T14:00:00Z",[749,750,751,752,753,754,755,756,757,758,759],"CVE-2026-69246","CVE-2026-69245","CVE-2026-67354","CVE-2026-67355","CVE-2026-67353","CVE-2026-67339","CVE-2026-59883","CVE-2026-55767","CVE-2026-55568","CVE-2026-59882","CVE-2026-55766","24.3.3","24.3.4","Security updates for PHP HTTP client dependencies","\u003Cp> Eleven vulnerabilities have been published for the PHP HTTP client libraries \u003Ctt>guzzlehttp\u002Fguzzle\u003C\u002Ftt> and \u003Ctt>guzzlehttp\u002Fpsr7\u003C\u002Ftt>. Both packages are used by the \u003Cb>Login Page\u003C\u002Fb> of the IACBOX, where they are pulled in as transitive dependencies of the payment gateway integrations \u003Cb>PayPal\u003C\u002Fb>, \u003Cb>Klarna\u003C\u002Fb>, and \u003Cb>VrPayment\u003C\u002Fb> and of the error reporting library Sentry. \u003C\u002Fp> \u003Cp> Both packages have been updated: \u003Ctt>guzzlehttp\u002Fguzzle\u003C\u002Ftt> from \u003Ctt>7.10.0\u003C\u002Ftt> to \u003Ctt>7.15.2\u003C\u002Ftt> and \u003Ctt>guzzlehttp\u002Fpsr7\u003C\u002Ftt> from \u003Ctt>2.11.0\u003C\u002Ftt> to \u003Ctt>2.13.0\u003C\u002Ftt>. These versions contain the fixes for all vulnerabilities listed below. \u003C\u002Fp> \u003Ch3>Host validation\u003C\u002Fh3> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69246\">CVE-2026-69246\u003C\u002Fa>\u003C\u002Fb> (high) and \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59882\">CVE-2026-59882\u003C\u002Fa>\u003C\u002Fb>: Differences between the way Guzzle parses a host name and the way the underlying transport resolves it allow a noncanonical host to pass host-based checks. Malformed hosts containing authority delimiters, embedded ports or badly framed IPv6 brackets were accepted, so the host reported by the library could differ from the host actually contacted. In an application that validates request URIs against an allow list this can be used to reach an excluded host or to trigger a server-side request forgery. \u003C\u002Fp> \u003Ch3>Cookie handling\u003C\u002Fh3> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69245\">CVE-2026-69245\u003C\u002Fa>\u003C\u002Fb>, \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67355\">CVE-2026-67355\u003C\u002Fa>\u003C\u002Fb>, \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59883\">CVE-2026-59883\u003C\u002Fa>\u003C\u002Fb> and \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55767\">CVE-2026-55767\u003C\u002Fa>\u003C\u002Fb>: Several flaws in the cookie jar caused cookies to be matched against hosts they were not scoped to. Noncanonical IP address spellings kept their subdomain scope, host-only cookies lost their host restriction, IP address domains were mismatched, and a cookie with a dot-only domain matched every host. Each of these can lead to a cookie being sent to, or accepted from, the wrong host. \u003C\u002Fp> \u003Ch3>Information disclosure and denial of service\u003C\u002Fh3> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67354\">CVE-2026-67354\u003C\u002Fa>\u003C\u002Fb>: URI fragments were disclosed in the \u003Ctt>Referer\u003C\u002Ftt> header when a request was redirected.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67339\">CVE-2026-67339\u003C\u002Fa>\u003C\u002Fb>: The \u003Ctt>Proxy-Authorization\u003C\u002Ftt> header could be forwarded to the origin server instead of being kept for the proxy.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55568\">CVE-2026-55568\u003C\u002Fa>\u003C\u002Fb>: A connection to an HTTPS proxy could be silently downgraded to cleartext.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67353\">CVE-2026-67353\u003C\u002Fa>\u003C\u002Fb>: The number of cookies accepted from a response was unbounded, so a hostile endpoint could exhaust memory.\u003Cbr> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55766\">CVE-2026-55766\u003C\u002Fa>\u003C\u002Fb>: Insufficient validation when serializing the HTTP start line allowed CRLF injection, and therefore request splitting, if untrusted data reached the request line. \u003C\u002Fp> \u003Ch3>Impact on the IACBOX\u003C\u002Fh3> \u003Cp> No code of the Login Page creates a Guzzle client directly. The library is only used for outbound server-to-server requests to fixed payment provider endpoints, so the request URIs are not controlled by a guest in the WiFi network, no host allow list is evaluated on untrusted input, and the Guzzle cookie jar is not used in these flows. The proxy related issues only apply when an outbound proxy is configured. For this reason no directly exploitable attack path from the guest network was identified, and the overall severity for the IACBOX is rated \u003Cb>medium\u003C\u002Fb> rather than following the upstream CVSS ratings. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> The affected composer packages have been updated in \u003Ctt>24.3.4\u003C\u002Ftt>. Updating the IACBOX to this version is recommended for all installations, and in particular for installations that use the \u003Cb>payment gateways\u003C\u002Fb> of the Login Page. \u003C\u002Fp> ",{"id":765,"advisory_id":766,"released":747,"updated":747,"severity":557,"vuln_ids":767,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":760,"version_fixed":761,"title":676,"description":774},32,"IAC-2026-016",[768,769,770,771,772,773],"CVE-2026-17543","GHSA-7qpv-r5mr-78m4","CVE-2026-9672","CVE-2026-7260","GHSA-vc5h-9ppw-p5f3","CVE-2026-14355","\u003Cp>Several security vulnerabilities were fixed in PHP. The IACBOX uses PHP (as \u003Ctt>mod_php\u003C\u002Ftt>) for the WebAdmin and the Login Pages. All issues have been fixed by updating PHP to \u003Ctt>8.2.33\u003C\u002Ftt>. The highest-rated issue is an SQL injection in the PostgreSQL extension, but it is \u003Cb>not exploitable on the IACBOX\u003C\u002Fb> because of the PostgreSQL server configuration we ship. The remaining reachable issues require an already \u003Cb>authenticated WebAdmin\u003C\u002Fb> session – therefore this advisory is rated \u003Cb>medium\u003C\u002Fb>.\u003C\u002Fp> \u003Ch3>CVE-2026-17543\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-17543\">CVE-2026-17543\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7qpv-r5mr-78m4\">GHSA-7qpv-r5mr-78m4\u003C\u002Fa>\u003C\u002Fb> (High, CVSS 8.1, SQL injection in the \u003Ctt>pgsql\u003C\u002Ftt> extension): Backslashes in attacker-supplied parameters are escaped improperly, which allows a trivial SQL injection through an \u003Ctt>E'...'\u003C\u002Ftt> backslash breakout. Most of the IACBOX code uses \u003Ctt>PDO\u003C\u002Ftt>, which is not affected. All other code paths are also not affected, because the IACBOX ships PostgreSQL with settings that avoid this backslash breakout. \u003Cb>The IACBOX is therefore not exploitable through this vulnerability\u003C\u002Fb>, but PHP is updated so the fix no longer depends on a single database setting.\u003C\u002Fp> \u003Ch3>CVE-2026-9672\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9672\">CVE-2026-9672\u003C\u002Fa>\u003C\u002Fb> (memory-safety issue in the bundled \u003Ctt>libgd\u003C\u002Ftt> GIF decoder): An incorrect table initialisation in the LZW decoder of \u003Ctt>gd_gif_in.c\u003C\u002Ftt> can be triggered by a crafted GIF image. The IACBOX uses GD to read and scale images uploaded in the Login Page Editor, and GIF is an accepted upload format, so the vulnerable decoder is reachable. Exploitation requires an \u003Cb>authenticated WebAdmin\u003C\u002Fb> user who uploads a crafted GIF; the public Login Page is not exposed to this code path.\u003C\u002Fp> \u003Ch3>CVE-2026-7260\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7260\">CVE-2026-7260\u003C\u002Fa>\u003C\u002Fb> \u002F \u003Cb>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vc5h-9ppw-p5f3\">GHSA-vc5h-9ppw-p5f3\u003C\u002Fa>\u003C\u002Fb> (Moderate, CVSS 5.4, crash via recursive symlinks in the \u003Ctt>phar\u003C\u002Ftt> extension): Circular symbolic links inside an archive cause unbounded recursion that exhausts the C stack and crashes the PHP process. The IACBOX has affected code paths when dealing with uploaded archives (Login Pages and Themes). A crafted archive can therefore crash the request handler (denial of service). This also requires an \u003Cb>authenticated WebAdmin\u003C\u002Fb> user and has no effect beyond the crashed request.\u003C\u002Fp> \u003Ch3>CVE-2026-14355\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-14355\">CVE-2026-14355\u003C\u002Fa>\u003C\u002Fb> (Moderate, CVSS 5.3, heap memory corruption in the \u003Ctt>openssl\u003C\u002Ftt> extension): The IACBOX is not affected, as the \u003Ctt>AES-WRAP-PAD\u003C\u002Ftt> mode is never used and the cipher is never user-controlled.\u003C\u002Fp> \u003Cp>\u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> PHP has been updated to \u003Ctt>8.2.33\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.3.4\u003C\u002Ftt> is recommended for all installations, and especially for installations where WebAdmin access is granted to more than one administrator.\u003C\u002Fp> ",{"id":776,"advisory_id":777,"released":778,"updated":778,"severity":557,"vuln_ids":779,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":786,"version_fixed":787,"title":676,"description":788},31,"IAC-2026-015","2026-06-10T12:00:00Z",[780,781,782,783,784,785],"CVE-2026-6722","CVE-2026-7261","CVE-2026-7262","CVE-2026-7259","CVE-2026-7568","CVE-2026-7258","24.2.8","24.3.0","\u003Cp>Several security vulnerabilities were fixed in PHP. The IACBOX uses PHP (as \u003Ctt>mod_php\u003C\u002Ftt>) for the WebAdmin and the Login Pages. All issues have been fixed by updating PHP to \u003Ctt>8.2.31\u003C\u002Ftt>. The highest-rated issue is an RCE in the SOAP extension, but it is only reachable when a login method that uses a SOAP endpoint is configured, which is not the case in a default IACBOX setup – therefore this advisory is rated \u003Cb>medium\u003C\u002Fb>.\u003C\u002Fp> \u003Ch3>CVE-2026-6722\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6722\">CVE-2026-6722\u003C\u002Fa>\u003C\u002Fb> (High, RCE \u002F use-after-free in the SOAP extension): A \u003Ctt>SoapServer\u003C\u002Ftt>\u002F\u003Ctt>SoapClient\u003C\u002Ftt> processing a SOAP envelope containing an \u003Ctt>apache:Map\u003C\u002Ftt> node can trigger a use-after-free leading to remote code execution. This affects the IACBOX \u003Cb>only when a login method using a SOAP endpoint is in use\u003C\u002Fb>. The default IACBOX setup does not use any SOAP-based login method and is therefore not exposed.\u003C\u002Fp> \u003Ch3>CVE-2026-7261\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7261\">CVE-2026-7261\u003C\u002Fa>\u003C\u002Fb> (Moderate, use-after-free in SOAP): Requires \u003Ctt>setPersistence(SOAP_PERSISTENCE_SESSION)\u003C\u002Ftt> together with a faulting header handler. The IACBOX does not use SOAP session persistence and is not affected.\u003C\u002Fp> \u003Ch3>CVE-2026-7262\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7262\">CVE-2026-7262\u003C\u002Fa>\u003C\u002Fb> (Moderate, DoS in SOAP): A \u003Ctt>SoapServer\u003C\u002Ftt> configured with a \u003Ctt>typemap\u003C\u002Ftt> can be crashed by a malicious \u003Ctt>apache:Map\u003C\u002Ftt> missing a \u003Ctt><value>\u003C\u002Ftt> element. The IACBOX does not use SOAP typemaps and is not affected.\u003C\u002Fp> \u003Ch3>CVE-2026-7259\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7259\">CVE-2026-7259\u003C\u002Fa>\u003C\u002Fb> (Low, DoS in the mbstring extension): A user-controlled encoding reaching \u003Ctt>mb_regex_encoding()\u003C\u002Ftt> followed by an mbregex search can cause a segfault. \u003Ctt>mbstring\u003C\u002Ftt> is used throughout the IACBOX, so this code path is potentially reachable.\u003C\u002Fp> \u003Ch3>CVE-2026-7568, CVE-2026-7258\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7568\">CVE-2026-7568\u003C\u002Fa>\u003C\u002Fb> and \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-7258\">CVE-2026-7258\u003C\u002Fa>\u003C\u002Fb> (both Low): Low-level hardening\u002Fcorrectness fixes in the PHP standard library. These apply universally but are very hard to weaponize and pose low practical risk.\u003C\u002Fp> \u003Cp>Note: \u003Cb>CVE-2026-6735\u003C\u002Fb> (php-fpm status page XSS) and \u003Cb>CVE-2025-14179\u003C\u002Fb> (PDO_Firebird SQLi) do not apply to the IACBOX, as it runs \u003Ctt>mod_php\u003C\u002Ftt> (not php-fpm) and does not load the PDO_Firebird driver.\u003C\u002Fp> \u003Cp>\u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> PHP has been updated to \u003Ctt>8.2.31\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.3.0\u003C\u002Ftt> is recommended, and strongly recommended for installations that use a SOAP-based login method like \u003Cb>Guestline PMS\u003C\u002Fb>.\u003C\u002Fp> ",{"id":790,"advisory_id":791,"released":778,"updated":778,"severity":557,"vuln_ids":792,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":786,"version_fixed":787,"title":797,"description":798},30,"IAC-2026-014",[793,794,795,796],"CVE-2026-43951","CVE-2026-44185","CVE-2026-44119","CVE-2026-44631","Apache HTTP Server vulnerabilities","\u003Cp>13 security vulnerabilities were found in the Apache HTTP Server (\u003Ctt>httpd\u003C\u002Ftt>) shipped with the IACBOX. 4 of those apply to the IACBOX and only two could really have an impaact. All vulnerabilities have been fixed in apache version \u003Ctt>2.4.68\u003C\u002Ftt>.\u003C\u002Fp> \u003Ch3>CVE-2026-43951\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-43951\">CVE-2026-43951\u003C\u002Fa>\u003C\u002Fb> (CVSS 6.5, Medium): An out-of-bounds read in the \u003Ctt>merge_response_headers\u003C\u002Ftt> function affects servers with both \u003Ctt>mod_headers\u003C\u002Ftt> and \u003Ctt>mod_mime\u003C\u002Ftt> loaded when handling responses with multiple content languages. This can lead to minor information disclosure or instability.\u003C\u002Fp> \u003Ch3>CVE-2026-44185\u003C\u002Fh3> \u003Cp>\u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44185\">CVE-2026-44185\u003C\u002Fa>\u003C\u002Fb> (CVSS 7.3, High): A stack buffer over-read in \u003Ctt>mod_ssl\u003C\u002Ftt> occurs when processing OCSP responses from an attacker-controlled server. Exploitation requires the attacker to control the OCSP responder URL.\u003C\u002Fp> \u003Ch3>CVE-2026-44119, CVE-2026-44631\u003C\u002Fh3> \u003Cp>These two are very low level and not really exploitable in the context of the IACBOX as closed system.\u003C\u002Fp> \u003Cp>\u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> Apache has been updated to \u003Ctt>2.4.68\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.3.0\u003C\u002Ftt> is strongly recommended.\u003C\u002Fp> ",{"id":800,"advisory_id":801,"released":802,"updated":802,"severity":591,"vuln_ids":803,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":786,"version_fixed":787,"title":836,"description":837},29,"IAC-2026-013","2026-05-27T10:00:00Z",[804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835],"CVE-2026-42501","CVE-2026-39825","CVE-2026-39836","CVE-2026-42499","CVE-2026-39820","CVE-2026-39819","CVE-2026-39817","CVE-2026-33814","CVE-2026-39826","CVE-2026-33811","CVE-2026-39823","CVE-2026-46598","CVE-2026-46597","CVE-2026-39828","CVE-2026-39835","CVE-2026-39833","CVE-2026-39832","CVE-2026-39827","CVE-2026-39830","CVE-2026-39829","CVE-2026-39831","CVE-2026-39834","CVE-2026-42508","CVE-2026-46595","CVE-2026-42506","CVE-2026-39821","CVE-2026-42502","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-39824","CVE-2026-27145","Go standard library and x\u002Fcrypto, x\u002Fnet, x\u002Fsys vulnerabilities","\u003Cp> A large batch of vulnerabilities was disclosed for the Go standard library and the supplementary modules \u003Ctt>golang.org\u002Fx\u002Fcrypto\u003C\u002Ftt>, \u003Ctt>golang.org\u002Fx\u002Fnet\u003C\u002Ftt> and \u003Ctt>golang.org\u002Fx\u002Fsys\u003C\u002Ftt>. The IACBOX go binaries (\u003Ctt>cloud-agent\u003C\u002Ftt>, \u003Ctt>srvctl\u003C\u002Ftt>, \u003Ctt>backup\u003C\u002Ftt>, \u003Ctt>whsrv\u003C\u002Ftt> and \u003Ctt>CoreDNS\u003C\u002Ftt>) have been recompiled with \u003Ctt>go 1.26.4\u003C\u002Ftt> and updated module dependencies. \u003C\u002Fp> \u003Cp> \u003Cb>The overall severity for the IACBOX is rated \u003Ctt>low\u003C\u002Ftt>\u003C\u002Fb> because the high\u002Fcritical-severity issues are located in components that the IACBOX does not use. The complete list of CVEs is included for transparency, but most of them are not exploitable in the IACBOX context. The summary below groups the vulnerabilities by component and explains the IACBOX impact. \u003C\u002Fp> \u003Cp> \u003Ch3>Go standard library\u003C\u002Fh3> \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002FqcCIEXso47M\">Go 1.26.3 announcement\u003C\u002Fa>\u003Cbr> \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002FtKs3rmcBcKw\">Go 1.26.4 announcement\u003C\u002Fa>\u003Cbr> \u003Cb>Not relevant to the IACBOX:\u003C\u002Fb>\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39836\">CVE-2026-39836\u003C\u002Fa> (\u003Ctt>net\u003C\u002Ftt> panic on Windows - the IACBOX runs only on Linux),\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42499\">CVE-2026-42499\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39820\">CVE-2026-39820\u003C\u002Fa> (DoS in \u003Ctt>net\u002Fmail\u003C\u002Ftt> address\u002Fcomment parsing - \u003Ctt>net\u002Fmail\u003C\u002Ftt> is not used),\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42501\">CVE-2026-42501\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39819\">CVE-2026-39819\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39817\">CVE-2026-39817\u003C\u002Fa> (issues in the \u003Ctt>go\u003C\u002Ftt> toolchain itself - not shipped on the IACBOX),\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39826\">CVE-2026-39826\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39823\">CVE-2026-39823\u003C\u002Fa> (XSS in \u003Ctt>html\u002Ftemplate\u003C\u002Ftt> - the IACBOX go services do not render HTML through \u003Ctt>html\u002Ftemplate\u003C\u002Ftt>). \u003C\u002Fp> \u003Cp> \u003Cb>Theoretically relevant but low impact:\u003C\u002Fb>\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39825\">CVE-2026-39825\u003C\u002Fa> (\u003Ctt>net\u002Fhttp\u002Fhttputil.ReverseProxy\u003C\u002Ftt> forwards query parameters past the configured limit),\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33814\">CVE-2026-33814\u003C\u002Fa> (\u003Ctt>net\u002Fhttp2\u003C\u002Ftt> client infinite loop on a malicious server's \u003Ctt>SETTINGS_MAX_FRAME_SIZE\u003C\u002Ftt>),\u003Cbr> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33811\">CVE-2026-33811\u003C\u002Fa> (cgo resolver crash on overlong CNAME records - the IACBOX uses the pure-Go resolver). \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27145\">CVE-2026-27145\u003C\u002Fa> (crypto\u002Fx509: split candidate hostname only once - DoS on certificates with large SAN lists). \u003C\u002Fp> \u003Cp> \u003Ch3>golang.org\u002Fx\u002Fcrypto v0.52.0 - \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002Fa082jnz-LvI\">announcement\u003C\u002Fa>\u003C\u002Fh3> This module is used by the IACBOX \u003Cb>only inside the \u003Cb>backup tool\u003C\u002Fb> for outbound SSH\u002FSFTP connections\u003C\u002Fb>. No SSH server from within go appliactions is exposed by the IACBOX. The bulk of the disclosed issues affect SSH server implementations (\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-46597\">CVE-2026-46597\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39828\">CVE-2026-39828\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39835\">CVE-2026-39835\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39827\">CVE-2026-39827\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-46595\">CVE-2026-46595\u003C\u002Fa>), the ssh-agent (\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-46598\">CVE-2026-46598\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39833\">CVE-2026-39833\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39832\">CVE-2026-39832\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39831\">CVE-2026-39831\u003C\u002Fa>) or otherwise require an interactive SSH peer (\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39830\">CVE-2026-39830\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39829\">CVE-2026-39829\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39834\">CVE-2026-39834\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42508\">CVE-2026-42508\u003C\u002Fa>). None of these are reachable in the IACBOX's outbound-only backup SSH usage, but the module has been updated as a precaution. \u003C\u002Fp> \u003Cp> \u003Ch3>golang.org\u002Fx\u002Fnet v0.55.0 - \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002FiI-mYSI0lu8\">announcement\u003C\u002Fa>\u003C\u002Fh3> The HTML-parser issues (\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42506\">CVE-2026-42506\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42502\">CVE-2026-42502\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25680\">CVE-2026-25680\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25681\">CVE-2026-25681\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27136\">CVE-2026-27136\u003C\u002Fa>) are \u003Cb>not relevant\u003C\u002Fb> because the IACBOX go services do not parse HTML. \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39821\">CVE-2026-39821\u003C\u002Fa> in the \u003Ctt>idna\u003C\u002Ftt> package is also not exploitable in the IACBOX since it does not perform privileged decisions based on IDN labels. \u003C\u002Fp> \u003Cp> \u003Ch3>golang.org\u002Fx\u002Fsys v0.45.0 - \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002F6MMI8Lj-Atg\">announcement\u003C\u002Fa>\u003C\u002Fh3> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39824\">CVE-2026-39824\u003C\u002Fa> affects only the Windows-specific portion of the package and is \u003Cb>not relevant\u003C\u002Fb> for the Linux-based IACBOX. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> Updating the IACBOX to version \u003Ctt>24.3.0\u003C\u002Ftt> or later is recommended to ship the rebuilt go binaries against an up-to-date toolchain and dependency set. \u003C\u002Fp> ",{"id":839,"advisory_id":840,"released":841,"updated":842,"severity":557,"vuln_ids":843,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":847,"version_fixed":848,"title":849,"description":850},28,"IAC-2026-012","2026-05-08T14:00:00Z","2026-05-15T14:00:00Z",[844,845,846],"CVE-2026-43284","CVE-2026-43500","CVE-2026-46300","24.2.6","24.2.7","Linux kernel privilege escalation 'Dirty Frag' and 'Fragnesia' (esp4\u002Fesp6\u002Frxrpc)","\u003Cp> \u003Cb>2026-05-15 Update\u003C\u002Fb>\u003Cbr> \u003Cb>Fragnesia\u003C\u002Fb> - \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-46300\">CVE-2026-46300\u003C\u002Fa> is similar to Dirty Frag as it's also located in the same kernel module \u003Ctt>rxrpc\u003C\u002Ftt> and so \u003Cb>has the same mitigations\u003C\u002Fb>.\u003Cbr> IACBOX version \u003Ctt>24.2.7\u003C\u002Ftt> fixes this variation of the vulnerability too. \u003C\u002Fp> \u003Cp> \u003Cb>2026-05-08\u003C\u002Fb>\u003Cbr> \u003Cb>Dirty Frag\u003C\u002Fb> is a chained Linux kernel privilege escalation vulnerability that combines two separate bugs in the networking subsystem to gain root privileges on most Linux distributions. A working public proof-of-concept exists, allowing any local unprivileged user to obtain root in a single command. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-43284\">CVE-2026-43284\u003C\u002Fa>\u003C\u002Fb> affects the IPSec ESP (xfrm-ESP) implementation in the \u003Ctt>esp4\u003C\u002Ftt> and \u003Ctt>esp6\u003C\u002Ftt> kernel modules. The in-place decryption fast path performs cryptographic operations directly over externally-backed paged fragments (e.g. pipe pages attached via \u003Ctt>splice(2)\u003C\u002Ftt>, \u003Ctt>sendfile(2)\u003C\u002Ftt> or \u003Ctt>MSG_SPLICE_PAGES\u003C\u002Ftt>) that are not privately owned by the kernel. This exposes or corrupts plaintext that an unprivileged process still holds a reference to. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-43500\">CVE-2026-43500\u003C\u002Fa>\u003C\u002Fb> affects the \u003Ctt>rxrpc\u003C\u002Ftt> kernel module with the same class of Page-Cache Write issue. Chaining both bugs allows a local unprivileged user to corrupt the page cache of read-only files such as \u003Ctt>\u002Fetc\u002Fpasswd\u003C\u002Ftt> or \u003Ctt>\u002Fusr\u002Fbin\u002Fsu\u003C\u002Ftt> and elevate to root. \u003C\u002Fp> \u003Cp> The IACBOX is a closed appliance without general user accounts for executing arbitrary code, which significantly reduces the practical exploitability. The severity is therefore rated as \u003Cb>medium\u003C\u002Fb> for IACBOX deployments. \u003C\u002Fp> \u003Cp> The mitigation in IACBOX \u003Ctt>24.2.7\u003C\u002Ftt> disables the affected \u003Ctt>esp4\u003C\u002Ftt>, \u003Ctt>esp6\u003C\u002Ftt> and \u003Ctt>rxrpc\u003C\u002Ftt> kernel modules via \u003Ctt>modprobe\u003C\u002Ftt> configuration. None of these modules are required for IACBOX functionality - \u003Ctt>esp4\u003C\u002Ftt>\u002F\u003Ctt>esp6\u003C\u002Ftt> are used for IPsec termination which the IACBOX does not perform, and \u003Ctt>rxrpc\u003C\u002Ftt> is also unused - so disabling them has no impact on normal operation. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> Updating the IACBOX to version \u003Ctt>24.2.7\u003C\u002Ftt> or later is recommended to mitigate this vulnerability. \u003C\u002Fp> ",{"id":852,"advisory_id":853,"released":854,"updated":854,"severity":591,"vuln_ids":855,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":847,"version_fixed":848,"title":867,"description":868},27,"IAC-2026-011","2026-05-08T12:00:00Z",[856,857,858,859,860,861,862,863,864,865,866],"CVE-2026-23918","CVE-2026-28780","CVE-2026-24072","CVE-2026-29168","CVE-2026-29169","CVE-2026-33006","CVE-2026-33007","CVE-2026-33523","CVE-2026-33857","CVE-2026-34032","CVE-2026-34059","Multiple apache HTTP Server vulnerabilities","\u003Cp> The apache HTTP Server shipped with the IACBOX has been updated from \u003Ctt>2.4.66\u003C\u002Ftt> to \u003Ctt>2.4.67\u003C\u002Ftt>, which addresses 11 security vulnerabilities. While the IACBOX binary contains the vulnerable code, the practical impact is \u003Cb>low\u003C\u002Fb> for IACBOX deployments because the affected modules are either not loaded or the documented preconditions for exploitation are not met in the IACBOX configuration. Patching is performed as a defence-in-depth measure. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-23918\">CVE-2026-23918\u003C\u002Fa>\u003C\u002Fh3> Double-free \u002F possible remote code execution in \u003Ctt>mod_http2\u003C\u002Ftt> via early stream reset. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_http2\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28780\">CVE-2026-28780\u003C\u002Fa>\u003C\u002Fh3> Heap buffer overflow in \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> via \u003Ctt>ajp_msg_check_header()\u003C\u002Ftt> when a malicious AJP server replies. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> is not loaded and the IACBOX proxies over HTTPS, not AJP. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24072\">CVE-2026-24072\u003C\u002Fa>\u003C\u002Fh3> Local authors of \u003Ctt>.htaccess\u003C\u002Ftt> files can read files as the httpd user via \u003Ctt>ap_expr\u003C\u002Ftt> expressions in \u003Ctt>mod_rewrite\u003C\u002Ftt> and other modules. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> the IACBOX is a closed appliance with no untrusted parties able to author \u003Ctt>.htaccess\u003C\u002Ftt> files. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-29168\">CVE-2026-29168\u003C\u002Fa>\u003C\u002Fh3> Resource exhaustion DoS in \u003Ctt>mod_md\u003C\u002Ftt> via unrestricted OCSP responses. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_md\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-29169\">CVE-2026-29169\u003C\u002Fa>\u003C\u002Fh3> NULL pointer dereference and crash in \u003Ctt>mod_dav_lock\u003C\u002Ftt> via a malicious request. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_dav_lock\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33006\">CVE-2026-33006\u003C\u002Fa>\u003C\u002Fh3> Timing attack allowing Digest authentication bypass in \u003Ctt>mod_auth_digest\u003C\u002Ftt>. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_auth_digest\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33007\">CVE-2026-33007\u003C\u002Fa>\u003C\u002Fh3> NULL pointer dereference and child crash in \u003Ctt>mod_authn_socache\u003C\u002Ftt> in caching forward proxy configurations. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_authn_socache\u003C\u002Ftt> is not loaded and the IACBOX is not configured as a caching forward proxy. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33523\">CVE-2026-33523\u003C\u002Fa>\u003C\u002Fh3> HTTP response splitting via a malicious status line forwarded from an untrusted backend. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> the front apache only proxies to its own backend apache on \u003Ctt>127.0.0.1:8443\u003C\u002Ftt>, which is fully under IACBOX control and not attacker-controlled. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33857\">CVE-2026-33857\u003C\u002Fa>\u003C\u002Fh3> Off-by-one out-of-bounds reads in AJP getter functions in \u003Ctt>mod_proxy_ajp\u003C\u002Ftt>. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34032\">CVE-2026-34032\u003C\u002Fa>\u003C\u002Fh3> Heap buffer over-read in \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> due to a missing null-termination check in \u003Ctt>ajp_msg_get_string\u003C\u002Ftt>. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ch3>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34059\">CVE-2026-34059\u003C\u002Fa>\u003C\u002Fh3> Heap over-read and memory disclosure in \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> via \u003Ctt>ajp_parse_data()\u003C\u002Ftt>. \u003Cb>Not exploitable on the IACBOX:\u003C\u002Fb> \u003Ctt>mod_proxy_ajp\u003C\u002Ftt> is not loaded. \u003C\u002Fp> \u003Cp> \u003Ca href=\"https:\u002F\u002Fdownloads.apache.org\u002Fhttpd\u002FCHANGES_2.4\">See the apache changelog for details\u003C\u002Fa> \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> While none of these vulnerabilities represent a meaningful attack path on the IACBOX as configured, updating to \u003Ctt>24.2.7\u003C\u002Ftt> or later is recommended as a defence-in-depth measure and to guard against future configuration changes that could activate one of the affected modules. \u003C\u002Fp> ",{"id":870,"advisory_id":871,"released":872,"updated":872,"severity":557,"vuln_ids":873,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":875,"version_fixed":847,"title":876,"description":877},26,"IAC-2026-010","2026-05-04T12:00:00Z",[874],"CVE-2026-31431","24.2.5","Linux kernel privilege escalation via algif_aead","\u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31431\">CVE-2026-31431\u003C\u002Fa>\u003C\u002Fb> is a privilege escalation vulnerability in the Linux kernel's \u003Ctt>algif_aead\u003C\u002Ftt> module (AEAD authenticated encryption cipher interface). The module incorrectly performs in-place cryptographic operations when source and destination buffers originate from different memory mappings. A local user can exploit this to gain root privileges. The vulnerability is rated \u003Cb>HIGH\u003C\u002Fb> (CVSS 7.8) upstream and has been added to the CISA Known Exploited Vulnerabilities catalog as of May 2026. \u003C\u002Fp> \u003Cp> The IACBOX is a closed system without general user access for executing custom code, which significantly reduces the practical exploitability. The severity is therefore rated as \u003Cb>medium\u003C\u002Fb> for IACBOX deployments. \u003C\u002Fp> \u003Cp> The fix avoids loading the \u003Ctt>algif_aead\u003C\u002Ftt> kernel module by disabling it. This module is not required for IACBOX functionality, so disabling it has no impact on normal operation. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> Updating the IACBOX to version \u003Ctt>24.2.6\u003C\u002Ftt> or later is recommended to mitigate this vulnerability. \u003C\u002Fp> ",{"id":879,"advisory_id":880,"released":881,"updated":881,"severity":691,"vuln_ids":882,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":11,"title":885,"description":886},25,"IAC-2026-009","2026-04-28T15:00:00Z",[883,884],"CVE-2026-41651","GHSA-f55j-vvr9-69xv","PackageKit TOCTOU race condition","\u003Cp>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41651\">CVE-2026-41651\u003C\u002Fa> is a time-of-check time-of-use (TOCTOU) race condition in \u003Ctt>PackageKit\u003C\u002Ftt> (versions \u003Ctt>1.0.2\u003C\u002Ftt> through \u003Ctt>1.3.4\u003C\u002Ftt>) that allows unprivileged local users to install arbitrary RPM packages with root privileges, resulting in local privilege escalation.\u003C\u002Fp> \u003Cp>The IACBOX is not affected because \u003Ctt>PackageKit\u003C\u002Ftt> is not installed or used.\u003C\u002Fp> ",{"id":888,"advisory_id":889,"released":890,"updated":890,"severity":691,"vuln_ids":891,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":11,"title":896,"description":897},24,"IAC-2026-008","2026-04-27T09:00:00Z",[892,893,894,895],"CVE-2026-26018","GHSA-h75p-j8xm-m278","CVE-2026-26017","GHSA-c9v3-4pv7-87pr","CoreDNS security vulnerabilities","\u003Cp>CoreDNS has been updated to version \u003Ctt>1.14.2\u003C\u002Ftt>, which addresses two security vulnerabilities. The IACBOX is not affected by either of them. \u003Cb>But as go 1.26 got security updates itself, CoreDNS is compiled with go \u003Ctt>1.26.2\u003C\u002Ftt> and shipped with IACBOX \u003Ctt>24.2.4\u003C\u002Ftt>\u003C\u002Fb>\u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26018\">CVE-2026-26018\u003C\u002Fa> \u002F \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fcoredns\u002Fcoredns\u002Fsecurity\u002Fadvisories\u002FGHSA-h75p-j8xm-m278\">GHSA-h75p-j8xm-m278\u003C\u002Fa>\u003C\u002Fb>: A denial of service vulnerability in the CoreDNS \u003Ctt>loop\u003C\u002Ftt> plugin allows an attacker to crash the DNS server by sending specially crafted HINFO queries. The plugin uses a predictable pseudo-random number generator for its self-test query name, and terminates the process via a fatal error handler when a loop is falsely detected.\u003Cbr> The IACBOX is \u003Cb>not affected\u003C\u002Fb>, because the \u003Ctt>loop\u003C\u002Ftt> plugin is not used in our CoreDNS configuration. While the plugin is compiled into the binary, it is not enabled. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26017\">CVE-2026-26017\u003C\u002Fa> \u002F \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fcoredns\u002Fcoredns\u002Fsecurity\u002Fadvisories\u002FGHSA-c9v3-4pv7-87pr\">GHSA-c9v3-4pv7-87pr\u003C\u002Fa>\u003C\u002Fb>: A logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default plugin execution order. Security plugins such as \u003Ctt>acl\u003C\u002Ftt> are evaluated before the \u003Ctt>rewrite\u003C\u002Ftt> plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw that can expose restricted internal services.\u003Cbr> The IACBOX is \u003Cb>not affected\u003C\u002Fb>, because we do not use any of the security plugins (\u003Ctt>acl\u003C\u002Ftt>, \u003Ctt>firewall\u003C\u002Ftt>, \u003Ctt>opa\u003C\u002Ftt>) that are affected by this ordering issue. \u003C\u002Fp> ",{"id":899,"advisory_id":900,"released":890,"updated":890,"severity":557,"vuln_ids":901,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":909,"version_fixed":910,"title":911,"description":912},23,"IAC-2026-007",[902,903,904,905,906,907,908],"CVE-2026-32282","CVE-2026-32289","CVE-2026-33810","CVE-2026-32288","CVE-2026-32283","CVE-2026-32280","CVE-2026-32281","24.2.3","24.2.4","Multiple vulnerabilities in Go","\u003Cp>Multiple vulnerabilities have been found in the Go standard library up to \u003Ctt>go 1.26.1\u003C\u002Ftt>. The IACBOX ships several Go applications compiled with Go, and this update delivers binaries recompiled with \u003Ctt>go 1.26.2\u003C\u002Ftt>.\u003Cbr> Find all details on the \u003Ca target=\"_blank\" href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002F0uYbvbPZRWU\">Go Security Advisory\u003C\u002Fa>. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32282\">CVE-2026-32282 - os\u003C\u002Fa>\u003C\u002Fb> \u003Ctt>os.Root.Chmod\u003C\u002Ftt> on Linux could follow symlinks outside the root directory when the target is replaced during operation. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32289\">CVE-2026-32289 — html\u002Ftemplate\u003C\u002Fa>\u003C\u002Fb> JavaScript template literal context tracking was flawed across branches, causing improper escaping that could lead to XSS vulnerabilities in templates using actions within JS literals. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33810\">CVE-2026-33810 — crypto\u002Fx509\u003C\u002Fa>\u003C\u002Fb> Excluded DNS name constraints were not properly enforced against wildcard domains with differing letter cases, potentially allowing invalid certificates to pass validation. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32288\">CVE-2026-32288 — archive\u002Ftar\u003C\u002Fa>\u003C\u002Fb> Parsing malicious tar archives in old GNU format with excessive sparse regions could cause unbounded memory allocation, enabling denial-of-service attacks. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32283\">CVE-2026-32283 — crypto\u002Ftls\u003C\u002Fa>\u003C\u002Fb> Multiple post-handshake key update messages in TLS 1.3 could deadlock connections, enabling resource exhaustion attacks. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32280\">CVE-2026-32280 — crypto\u002Fx509\u003C\u002Fa>\u003C\u002Fb> Certificate chain building did not properly limit work when processing chains with excessive intermediate certificates, enabling denial-of-service attacks. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32281\">CVE-2026-32281 — crypto\u002Fx509\u003C\u002Fa>\u003C\u002Fb> Certificate chains with extensive policy mappings caused inefficient validation, enabling denial-of-service attacks. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> The IACBOX go applications have been recompiled with \u003Ctt>go 1.26.2\u003C\u002Ftt>. Updating the IACBOX to version \u003Ctt>24.2.4\u003C\u002Ftt> is recommended. \u003C\u002Fp> ",{"id":384,"advisory_id":914,"released":915,"updated":915,"severity":557,"vuln_ids":916,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":920,"version_fixed":909,"title":921,"description":922},"IAC-2026-006","2026-04-08T15:00:00Z",[917,918,919],"CVE-2026-4587","GHSA-r3hf-q3mf-7h6w","CVE-2025-64500","24.2.2","Two vulnerabilities in PHP dependencies","\u003Cp>There have been two vulnerabilities in PHP dependencies found.\u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4587\">CVE-2026-4587\u003C\u002Fa>\u003C\u002Fb>: Affects the composer package \u003Ctt>hybridauth\u002Fhybridauth\u003C\u002Ftt>. A vulnerability was found in HybridAuth up to \u003Ctt>3.12.2\u003C\u002Ftt>. This issue affects some unknown processing of the file src\u002FHttpClient\u002FCurl.php of the component SSL Handler. The manipulation of the argument curlOptions results in improper certificate validation. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. \u003C\u002Fp> \u003Cp> \u003Cb>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-64500\">CVE-2025-64500\u003C\u002Fa>\u003C\u002Fb>: The composer package \u003Ctt>symfony\u002Fhttp\u003C\u002Ftt> did not handle paths safely. This vulnerability is rated as HIGH, but as the IACBOX does not use this package for authentication\u002Fauthorization we're not affected directly. To avoid possible unknown issues with this in third party libs, this package is updated to a safe version. \u003C\u002Fp> \u003Cp> \u003Cb>Update recommendation\u003C\u002Fb>\u003Cbr> The affected composer packages have been updated. Updating the IACBOX to this version is recommended for users of any \u003Cb>OAuth2 authentication\u003C\u002Fb> like the Social logins and Microsoft Entry ID (Azure AD). \u003C\u002Fp> ",{"id":924,"advisory_id":925,"released":926,"updated":926,"severity":691,"vuln_ids":927,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":920,"title":930,"description":931},21,"IAC-2026-005","2026-03-09T10:00:00Z",[928,929],"CVE-2025-11187","CVE-2025-15467","openssl 3.5.x vulnerabilities","\u003Cp>There are two vulnerabilities in openssl 3.5.x. This update delivers openssl 3.5.5, which contains the fixes for these vulnerabilities.\u003C\u002Fp>\u003Cp>CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification. Currently certificates are only supported in PKCS#1\u002F8 format, so this vulnerability does not affect normal IACBOX operation.\u003Cbr>CVE-2025-15467: Stack buffer overflow in CMS (Auth)EnvelopedData parsing could theoretically be used for DoS attacks, so this vulnerability is rated as \u003Cb>High\u003C\u002Fb> by openssl. But as CMS is not used on the IACBOX, this code is never reached.\u003C\u002Fp>\u003Cbr>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fopenssl-library.org\u002Fnews\u002Fvulnerabilities\u002F#CVE-2025-11187\">More details on CVE-2025-11187\u003C\u002Fa>\u003Cbr>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fopenssl-library.org\u002Fnews\u002Fvulnerabilities\u002F#CVE-2025-15467\">More details on CVE-2025-15467\u003C\u002Fa>\u003Cbr>\u003Cbr>openssl is updated anyway to the latest version with \u003Ctt>24.2.2\u003C\u002Ftt>.",{"id":374,"advisory_id":933,"released":926,"updated":926,"severity":591,"vuln_ids":934,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":937,"version_fixed":920,"title":938,"description":939},"IAC-2026-004",[935,936],"CVE-2025-68121","CVE-2025-61732","24.2.1","Two vulnerabilities in go","There are two vulnerabilities in the Go standard library up to \u003Ctt>go 1.25.6\u003C\u002Ftt>. To our knowledge, these vulnerabilities do not affect our go code,but may occur in depencencies of the go libs. This update delivers go binaries compiled with \u003Ctt>go 1.25.7\u003C\u002Ftt>.\u003Cp>CVE-2025-68121: crypto\u002Ftls: Fixes a possible validation bypass if third-party libs manipulate the TLS config.\u003Cbr>CVE-2025-61732: This vulnerability affects only the go toolchain and is not relevant for the IACBOX itself.\u003C\u002Fp>\u003Cp>Find all details on the \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002FK09ubi9FQFk\">Go Security Advisory\u003C\u002Fa>\u003Cbr>\u003C\u002Fp>",{"id":941,"advisory_id":942,"released":943,"updated":943,"severity":557,"vuln_ids":944,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":950,"version_fixed":951,"title":952,"description":953},19,"IAC-2026-003","2026-01-29T13:00:00Z",[945,946,935,947,948,949],"CVE-2025-61728","CVE-2025-61726","CVE-2025-61731","CVE-2025-68119","CVE-2025-61730","24.1.x","24.2.0","Multiple vulnerabilities in go","There are multiple vulnerabilities in the Go standard library that could lead to Denial of Service (DoS) attacks or information leaks.There is no high risk for normal IACBOX operation.\u003Cp>CVE-2025-61728: archive\u002Fzip: Potential DoS attack when unpacking a malicious archive.\u003Cbr>CVE-2025-61726: net\u002Fhttp: Potential DoS attack due to memory exhaustion on malicious URLs.\u003Cbr>CVE-2025-68121: crypto\u002Ftls: Potential bypass a check of the full TLS certificate chain.\u003Cbr>CVE-2025-61730: crypto\u002Ftls: Potential minor information leakage during TLS handshake.\u003Cbr>CVE-2025-61731, CVE-2025-68119: This vulnerabilities affect only the go toolchain.\u003C\u002Fp>\u003Cp>Find all details on the \u003Ca href=\"https:\u002F\u002Fgroups.google.com\u002Fg\u002Fgolang-announce\u002Fc\u002FVd2tYVM8eUc\">Go Security Advisory\u003C\u002Fa>\u003Cbr>\u003C\u002Fp>",{"id":955,"advisory_id":956,"released":943,"updated":943,"severity":557,"vuln_ids":957,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":950,"version_fixed":951,"title":961,"description":962},18,"IAC-2026-002",[958,959,960],"GHSA-8xr5-qppj-gvwj","GHSA-3237-qqm7-mfv7","GHSA-h96m-rvf9-jgm2","Multiple vulnerabilities in PHP","\u003Cp>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-8xr5-qppj-gvwj\">GHSA-8xr5-qppj-gvwj\u003C\u002Fa>\u003Cbr>NULL Pointer Dereference in PDO quoting - could lead to DoS attacks\u003C\u002Fp>\u003Cp>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-3237-qqm7-mfv7\">GHSA-3237-qqm7-mfv7\u003C\u002Fa>\u003Cbr>Information Leak of Memory\u003C\u002Fp>\u003Cp>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-h96m-rvf9-jgm2\">GHSA-h96m-rvf9-jgm2\u003C\u002Fa>\u003Cbr>Heap buffer overflow in array_merge() - could lead to DoS attacks with crafted input\u003C\u002Fp>\u003Cp>We recommend upgrading to the latest IACBOX version \u003Ctt>24.2.0\u003C\u002Ftt> to mitigate these vulnerabilities.\u003C\u002Fp>",{"id":964,"advisory_id":965,"released":966,"updated":966,"severity":691,"vuln_ids":967,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":11,"title":970,"description":971},17,"IAC-2026-001","2026-01-09T09:00:00Z",[968,969],"EUVD-2026-1173","CVE-2026-22184","zlib \u002F untgz vulnerability","\u003Cp>The optional command line utility \u003Ctt>untgz\u003C\u002Ftt> has a critical vulnerability that allows an attacker to execute arbitrary code on the system. This vulnerability is due to a buffer overflow in the \u003Ctt>untgz\u003C\u002Ftt> utility.\u003Cp>The IACBOX is not affected, because \u003Ctt>untgz\u003C\u002Ftt> is not installed, only \u003Ctt>zlib\u003C\u002Ftt> is installed, which does not have this vulnerability.\u003Cp>\u003Cbr>\u003Ca href=\"https:\u002F\u002Feuvd.enisa.europa.eu\u002Fvulnerability\u002FCVE-2026-22184\">See external page for more details\u003C\u002Fa>",{"id":973,"advisory_id":974,"released":975,"updated":975,"severity":557,"vuln_ids":976,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":981,"version_fixed":982,"title":983,"description":984},16,"IAC-2025-008","2025-10-06T09:00:00Z",[977,978,979,980],"EUVD-2025-30195","CVE-2025-47906","EUVD-2025-23921","CVE-2025-47907","24.0.11","24.1.0","go-lang security vulnerabilities","The go standard library is vulnerable to this security vulnerabilities:\u003Cbr>\u003Cp>\u003Ch3>EUVD-2025-30195, CVE-2025-47906\u003C\u002Fh3>If the PATH environment variable contains paths which are executables (rather than just directories),passing certain strings to LookPath (\"\", \".\", and \"..\"), can result in the binaries listed in the PATH being unexpectedly returned.\u003C\u002Fp>\u003Cp>\u003Ch3>EUVD-2025-23921, CVE-2025-47907\u003C\u002Fh3>Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of thereturned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race conditionthat may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected resultsfrom the other query or an error.\u003C\u002Fp>\u003Cp>The go version was updated to \u003Ctt>1.25.1\u003C\u002Ftt> and all affected go binaries were recompiled.\u003C\u002Fp>",{"id":986,"advisory_id":987,"released":975,"updated":975,"severity":557,"vuln_ids":988,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":981,"version_fixed":982,"title":989,"description":990},15,"IAC-2025-007",[],"openssl 3.1 End Of Life","IACBOX version 24 used \u003Cb>openssl 3.1\u003C\u002Fb> which is End Of Life.\u003Cbr>The update to IACBOX 24.1.0 updates openssl to version 3.5.x which is the latest LTS version with updates till 2030.\u003Cbr>",{"id":992,"advisory_id":993,"released":994,"updated":994,"severity":557,"vuln_ids":995,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":998,"version_fixed":999,"title":1000,"description":1001},14,"IAC-2025-006","2025-07-14T12:00:00Z",[996,997],"CVE-2025-1735","GHSA-hrwm-9436-5mv3","24.0.8","24.0.9","Possible SQL injection via pgsql extension","Missing error checking could result in SQL injection and missing error handling could lead to crashes due to null pointer dereferences.\u003Cp>\u003Cb>Further Information\u003C\u002Fb>\u003Cbr>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-hrwm-9436-5mv3\" target=\"_blank\">https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-hrwm-9436-5mv3\u003C\u002Fa>\u003Cbr>\u003C\u002Fp>",{"id":1003,"advisory_id":1004,"released":1005,"updated":1005,"severity":691,"vuln_ids":1006,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":11,"title":1009,"description":1010},13,"IAC-2025-005","2025-07-02T08:00:00Z",[1007,1008],"CVE-2025-32462","CVE-2025-32463","sudo Vulnerability","The IACBOX is not affected by the \u003Ctt>sudo\u003C\u002Ftt> vulnerability, as none of our versions ever had \"sudo\" installed.",{"id":1012,"advisory_id":1013,"released":1014,"updated":1014,"severity":557,"vuln_ids":1015,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":1017,"version_fixed":1018,"title":1019,"description":1020},12,"IAC-2025-004","2025-05-22T12:00:00Z",[1016],"CVE-2025-1094","24.0.6","24.0.7","Vulnerability in PostgreSQL","A vulnerability in PostgreSQL allowing to inject malicious SQL queries as well as local code execution via interactive psql tool.\u003Cp>\u003Cb>Further Information\u003C\u002Fb>\u003Cbr>\u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2025-1094\" target=\"_blank\">https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2025-1094\u003C\u002Fa>\u003Cbr>\u003Ca href=\"https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002F2025\u002F02\u002F13\u002Fcve-2025-1094-postgresql-psql-sql-injection-fixed\u002F\" target=\"_blank\">https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002F2025\u002F02\u002F13\u002Fcve-2025-1094-postgresql-psql-sql-injection-fixed\u002F\u003C\u002Fa>\u003C\u002Fp>",{"id":1022,"advisory_id":1023,"released":1024,"updated":1024,"severity":557,"vuln_ids":1025,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":1027,"version_fixed":1017,"title":1028,"description":1029},11,"IAC-2025-003","2025-05-13T12:00:00Z",[1026],"CVE-2025-31115","24.0.5","Vulnerabilities in xz\u002Fliblzma","A vulnerability in xz\u002Fliblzma can lead to a crash if an invalid\u002Fmanipulated xz archive gets decoded.\u003Cp>For all details please visit: \u003Ca href=\"https:\u002F\u002Ftukaani.org\u002Fxz\u002Fthreaded-decoder-early-free.html\" target=\"_blank\">https:\u002F\u002Ftukaani.org\u002Fxz\u002Fthreaded-decoder-early-free.html\u003C\u002Fa>\u003C\u002Fp>",{"id":1031,"advisory_id":1032,"released":1024,"updated":1024,"severity":591,"vuln_ids":1033,"affected":518,"affected_version_from_incl":561,"affected_version_to_incl":1027,"version_fixed":1017,"title":1036,"description":1037},10,"IAC-2025-002",[1034,1035],"CVE-2024-13176","CVE-2024-9143","Multiple vulnerabilities in openssl","Multiple vulnerabilities have been found in openssl:\u003Cp>- Fixed timing side-channel in ECDSA signature computation. (CVE-2024-13176)- Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic curve parameters. (CVE-2024-9143)\u003C\u002Fp>This bugs are not critical for the system and have a low severity.\u003Cp>",{"id":1039,"advisory_id":1040,"released":1041,"updated":1042,"severity":557,"vuln_ids":1043,"affected":518,"affected_version_from_incl":1046,"affected_version_to_incl":1047,"version_fixed":1048,"title":1049,"description":1050},9,"IAC-2025-001","2025-01-16T12:00:00Z","2025-01-22T09:00:00Z",[1044,1045],"CVE-2024-12087","CVE-2024-12088","21.0-p21004, 24.0.0","21.0-p21592, 24.0.1","21.0-p21595, 24.0.2","Multiple vulnerabilities in rsync","Multiple vulnerabilities have been found in rsync, but most of them affect only the rsync daemon, which is not in use on the IACBOX.\u003Cbr>But the rsync client is also affected if connected to unknown servers that are maybe controlled by an attacker.\u003Cp>\u003Cb>Which versions are affected?\u003C\u002Fb>\u003Cbr>\u003Cp>\u003Cb>All versions up to v21\u003C\u002Fb> are affected as they are using rsync. The impact is rated only as MEDIUM as an IACBOX is only connecting to Asteas controlled update servers, so there is no real attack surface, except for a possible local exploitation.\u003Cbr>The rsync package is updated anyway to eliminate any possibly left over risk.\u003Cbr>This issue is fixed with the current version \u003Ctt>21.0-p21595\u003C\u002Ftt>.\u003C\u002Fp>\u003Cp>\u003Cb>Version 24\u003C\u002Fb> is not using rsync anymore, but as the binary is installed it get's updated to the latest rsync version \u003Ctt>3.4.1\u003C\u002Ftt> too.\u003Cbr>The new rsync version is shipped with version \u003Ctt>24.0.2\u003C\u002Ftt>, released on 22 Jan 2025.\u003C\u002Fp>\u003Cp>For all details please visit: \u003Ca href=\"https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F952657\" target=\"_blank\">https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F952657\u003C\u002Fa>\u003C\u002Fp>",{"id":452,"advisory_id":1052,"released":1053,"updated":1053,"severity":691,"vuln_ids":1054,"affected":466,"affected_version_from_incl":11,"affected_version_to_incl":11,"version_fixed":11,"title":1059,"description":1060},"IAC-2024-008","2024-09-30T09:00:00Z",[1055,1056,1057,1058],"CVE-2024-47177","CVE-2024-47175","CVE-2024-47076","CVE-2024-47176","CUPS vulnerability","The IACBOX does not use \u003Cb>CUPS\u003C\u002Fb> and is not affected.",{"id":447,"advisory_id":1062,"released":1063,"updated":1063,"severity":557,"vuln_ids":1064,"affected":518,"affected_version_from_incl":1066,"affected_version_to_incl":1067,"version_fixed":1068,"title":1069,"description":1070},"IAC-2024-007","2024-09-09T12:00:00Z",[1065],"CVE-2024-40725","21.0-p21004","21.0-p21569","21.0-p21573","Webserver source code disclosure (part 2)","The webserver shipped with an IACBOX (apache) had a source code disclosure vulnerability in version \u003Ctt>2.4.60\u003C\u002Ftt>.\u003Cbr>This was only partially fixed with version \u003Ctt>2.4.61\u003C\u002Ftt> that has already been shipped with IACBOX version \u003Ctt>21.0-p21566\u003C\u002Ftt>.\u003Cbr>We have not been able to trigger this vulnerability anymore, but to be safe, we advise you to update to the latest version \u003Ctt>21.0-p21573\u003C\u002Ftt>\u003Cp>\u003Ca href=\"https:\u002F\u002Fdownloads.apache.org\u002Fhttpd\u002FCHANGES_2.4.62\">See the apache changelog for details\u003C\u002Fa>\u003C\u002Fp>",{"id":442,"advisory_id":1072,"released":1073,"updated":1073,"severity":557,"vuln_ids":1074,"affected":518,"affected_version_from_incl":1066,"affected_version_to_incl":1076,"version_fixed":1077,"title":1078,"description":1079},"IAC-2024-006","2024-07-15T12:00:00Z",[1075],"CVE-2024-3596","21.0-p21561","21.0-p21566","Radius vulnerability","The discovered \u003Cb>vulenerability in the RADIUS protocol\u003C\u002Fb> called \u003Ci>Blast-RADIUS\u003C\u002Fi> affects Radius and iPass authentication on the IACBOX.\u003Cp>\u003Cb>Who is affected?\u003C\u002Fb>\u003Cbr>Only systems with activated external authentication method \u003Cb>Radius\u003C\u002Fb> or \u003Cb>iPass\u003C\u002Fb> are affected as plain Radius (without EAP) is in use.\u003Cbr>- Note that Radius can also be used as authentication method for WebAdmin logins which is also affected.\u003Cbr>- Radius as part of \u003Cb>802.1x\u003C\u002Fb> is \u003Cb>not affected\u003C\u002Fb> as EAP should always be in use there.\u003C\u002Fp>\u003Cp>There's a possible MITM attack that can change a denied authentication into a successful authentication.\u003Cbr>The attacker needs to craft a matching MD5-HMAC within the clients timeout, so this needs resources and time, so this is not easy to exploit.\u003C\u002Fp>\u003Cp>\u003Cb>Changes\u003C\u002Fb>\u003Cbr>- From now on Radius requests always have the \u003Ctt>Message-Authenticator\u003C\u002Ftt> attribute set\u003Cbr>- There's a new Radius setting in WebAdmin under Login Methods -> External Authentication -> Radius: \u003Cb>Force Message Authentication\u003C\u002Fb>which checks if a Radius response has the attribute \u003Ctt>Message-Authenticator\u003C\u002Ftt>.\u003Cbr>\u003Cb>This new option has to be switched on manually\u003C\u002Fb> as it's maybe not backwards compatible with your Radius server that does not send this attribute.\u003C\u002Fp>\u003Cp>\u003Cb>Further Information\u003C\u002Fb>\u003Cbr>\u003Ca href=\"https:\u002F\u002Fwww.blastradius.fail\u002F\">See the blastradius.fail page for more details\u003C\u002Fa>\u003C\u002Fp>",{"id":437,"advisory_id":1081,"released":1073,"updated":1073,"severity":544,"vuln_ids":1082,"affected":518,"affected_version_from_incl":1066,"affected_version_to_incl":1076,"version_fixed":1077,"title":1087,"description":1088},"IAC-2024-005",[1083,1084,1085,1086],"CVE-2024-38477","CVE-2024-38475","CVE-2024-38476","CVE-2024-39884","Multiple webserver vulnerabilities","The webserver shipped with an IACBOX (apache) has multiple vulnerabilities which have been fixed with httpd version\u003Ctt>2.4.60\u003C\u002Ftt> and \u003Ctt>2.4.61\u003C\u002Ftt>.\u003Cbr>As some of the vulnerabilities allow DoS attacks, all users are advised to update their systems to \u003Ctt>21.0-p21566\u003C\u002Ftt>.\u003Cbr>\u003Cp>\u003Ca href=\"https:\u002F\u002Fdownloads.apache.org\u002Fhttpd\u002FCHANGES_2.4\">See the apache changelog for details\u003C\u002Fa>\u003C\u002Fp>",{"id":407,"advisory_id":1090,"released":1091,"updated":1091,"severity":544,"vuln_ids":1092,"affected":518,"affected_version_from_incl":1066,"affected_version_to_incl":1094,"version_fixed":1076,"title":1095,"description":1096},"IAC-2024-004","2024-07-03T08:30:00Z",[1093],"CVE-2024-6387","21.0-p21556","OpenSSH regreSSHion vulnerability","OpenSSH has a serious remote code execution vulnerability which gets fixed with 21.0-p21561.\u003Cbr>\u003Ca target=\"_blank\" href=\"https:\u002F\u002Fwww.qualys.com\u002Fregresshion-cve-2024-6387\">See all details in the Qualys report (regreSSHion)\u003C\u002Fa>\u003Cbr>\u003Cb>Workaround for systems that can't be updated right now:\u003C\u002Fb> Disable SSH access from all interfaces or add rules to your firewall so that SSH port (TCP\u002F22) is not reachable.",{"id":394,"advisory_id":1098,"released":1099,"updated":1100,"severity":544,"vuln_ids":1101,"affected":518,"affected_version_from_incl":1066,"affected_version_to_incl":1103,"version_fixed":1104,"title":1105,"description":1106},"IAC-2024-003","2024-04-12T09:00:00Z","2024-04-17T09:00:00Z",[1102],"CVE-2023-6546","21.0-p21530","21.0-p21543","Linux kernel vulnerability","There's a possible local priviledge escalation in the Linux kernel GSM module. Also if the module is not used it can be loaded and exploited\u003Cbr>\u003Cb>UPDATE:\u003C\u002Fb> Patchlevel update \u003Ctt>21.0-p21543\u003C\u002Ftt> replaces update \u003Ctt>21.0-p21536\u003C\u002Ftt> which provided a workaround for this issue.",{"id":386,"advisory_id":1108,"released":1109,"updated":1109,"severity":691,"vuln_ids":1110,"affected":466,"affected_version_from_incl":1066,"affected_version_to_incl":1066,"version_fixed":1066,"title":1112,"description":1113},"IAC-2024-002","2024-03-31T09:00:00Z",[1111],"CVE-2024-3094","liblzma\u002Fxz\u002Fsshd vulnerability","The IACBOX is not affected as the used liblzma version does not contain this vulnerability.",{"id":400,"advisory_id":1115,"released":1116,"updated":1116,"severity":557,"vuln_ids":1117,"affected":518,"affected_version_from_incl":1066,"affected_version_to_incl":1119,"version_fixed":1120,"title":1121,"description":1122},"IAC-2024-001","2024-02-01T09:00:00Z",[1118],"CVE-2023-48795","21.0-p21510","21.0-p21518","OpenSSH vulnerability","An OpenSSH connection can be downgraded during handshake (Terrapin attack). As SSH is only rarely used for remote control connections this does not really affect normal operation.","2026-11-11T06:35:21+01:00",1794375321964]