Tuesday 1 September
interestingTuesday, September 1, 20262 findings, 3 signals3 min read

A public exploit turns Avast's own sandbox into a SYSTEM shell for any standard Windows user, and no patch exists; separately, Zimbra servers running an optional SNMP package are being compromised through SMTP input that becomes a shell command.

SecurityAffairs and Cyber Kendra reported the same claimed capability and that no vendor fix and no CVE were public at the time they checked. Exploitation requires SMTP reachability to a Zimbra server that has the optional zimbra-snmp package installed, snmp_notify enabled, and swatchdog running.

Priority findings2
01
High
Privilege — Windows
Provisional

A standard Windows user can get a SYSTEM shell through Avast's sandbox, and there is no patch.

Public code, claimed to work against fully patched Avast on patched Windows 11 25H2.

Affects

GenDigital Avast Antivirus, endpoint antivirus software on Windows desktops.

What it enables

Local SYSTEM command execution from a standard Windows account

Attacker runs code as a standard local Windows user.The PoC abuses Avast Sandbox.The PoC reads the Windows SAM database and starts a SYSTEM shell.
Why this matters

An ordinary local privilege escalation lands with a fix attached. This one has the code in public and nothing to install: the vendor had shipped no fix and there was no CVE when the outlets that covered it checked. The component doing the escalating is the security product itself, which is on the endpoint precisely because someone decided a standard user should not be able to do this.

Detail and 5 sources
Required access

Run code as a standard local Windows user on a Windows host with Avast Antivirus installed.

Affected versions

Researcher claims any Avast Antivirus version; tested on fully patched Avast Antivirus with patched Windows 11 25H2.

Proof of concept

Public exploit code

The proof of concept abuses the Avast Sandbox to read the Windows SAM database and start a SYSTEM shell. The entry requirement is code execution as a standard local user on a machine with Avast installed — no administrator, no second bug, no user prompt in the middle.

The repository claims the exploit works against fully patched Avast on patched Windows 11 25H2, and two outlets reported the same claimed capability along with the absence of a vendor fix or CVE at the time they looked.

We are carrying this as provisional and want to be exact about why: nobody here ran it. The capability rests on the repository's own description plus secondhand reporting. What would settle it is a reproduction on a current Avast build showing the sandbox path still reachable from an unprivileged token.

One gap worth stating rather than writing around: our privilege surface could not reach CISA KEV or several other sources this run, so we cannot tell you whether anyone is tracking this as exploited in the wild. Absence of that line here is a blocked fetch, not a negative result.

Evidence
The public PrettyPrague repository states that the PoC works against fully patched Avast Antivirus on patched Windows 11 25H2 and spawns a SYSTEM shell.SecurityAffairs and Cyber Kendra reported the same claimed capability and that no vendor fix or CVE was public at the time they checked.
02
High
Remote execution — Zimbra
Confirmed
CVE-2026-73570

Zimbra servers are being compromised through SMTP input that ends up as a shell command running as the zimbra user.

Only with the optional zimbra-snmp package installed, snmp_notify enabled, and swatchdog running — which is the first thing to check, in both directions.

Affects

Zimbra Collaboration Suite, a self-hosted enterprise email and collaboration server.

What it enables

Unauthenticated operating-system command execution as the zimbra service user

Send a crafted unauthenticated SMTP request to the exposed mail serviceCause attacker-controlled service-status content to be processed by the enabled SNMP notification pathInject an operating-system commandExecute the command as the zimbra service account
Why this matters

CERT Polska confirms active exploitation, unauthenticated shell execution as zimbra, the required configuration, and forensic artifacts for detection.

Detail and 3 sources
Required access

SMTP reachability to a Zimbra server with the optional zimbra-snmp package installed, snmp_notify enabled, and swatchdog running

Affected versions

Zimbra Collaboration Suite before 10.1.20 when zimbra-snmp and SNMP notifications are enabled

Fix removes the capability

Yes

CERT Polska confirms active exploitation: attacker-controlled service-status text arriving over SMTP is processed by the enabled SNMP notification path, a command is injected, and it runs as the zimbra service account. Their write-up includes forensic artifacts, which is what to use if the preconditions match your install.

The preconditions are genuinely narrow — the optional zimbra-snmp package, snmp_notify turned on, swatchdog running — and that is why the reach here is niche rather than broad. It is also not a configuration most administrators can recall from memory, and recent reporting counts compromised internet-facing instances in the hundreds.

Evidence
CERT Polska confirms active exploitation, unauthenticated shell execution as zimbra, required configuration, and forensic artifactsThe CVE record identifies crafted SMTP as the input path and version 10.1.20 as the boundaryRecent reporting documented hundreds of compromised internet-facing instances
Signals3
interesting · Privilege — sudo

A user allowed one command through sudo intercept can run denied programs through execveat.

Affects

sudo, the command-delegation and privilege-control utility used on Unix and Linux systems.

sudo's ptrace-based interceptor checked the execve family but not execveat, so a denied executable invoked through execveat — or through fexecve, which is implemented on top of it — runs without a policy check and without the subcommand logging that would have recorded it. It runs with the authorized command's runas identity, which in most real sudoers rules is root.

Detail and 4 sources

The upstream commit is explicit that sudo had deliberately allowed execveat through, and adds path resolution and intercept handling for it. The affected enforcement modes, intercept and log_subcmds, are optional — this only bites where someone chose them, which is to say where someone was specifically trying to contain a command they had to allow.

Composition to watch
Local account is permitted one specific command through sudoThat command starts under ptrace-based intercept or log_subcmds enforcementA denied executable is invoked with execveat directly, or with fexecveThe interceptor performs no policy check and writes no subcommand log entryThe denied program runs with the sudo rule's runas identityWhether the major distributions have shipped the execveat interceptor fix, and how long the window stays open for hosts that rely on intercept as their containment boundary.
Unverified compositionTrack the distribution tracker entry for CVE-2026-82474 on your platform, and in the meantime test your own build by calling a denied binary through fexecve from inside an intercepted command.
interesting · Privilege — Ubuntu

A narrow sudoedit grant on Ubuntu 26.04 can be turned into arbitrary privileged file placement.

Affects

sudo-rs, the Rust sudo and su implementation shipped by Ubuntu 26.04 LTS.

Ubuntu describes a time-of-check/time-of-use race in sudo-rs sudoedit path handling: a local user granted the right to edit specific named files can win the race and have files placed in directories of their choosing instead. The point of a fine-grained sudoedit rule is that the list of files is the boundary, and this removes the boundary while leaving the rule looking intact.

Detail and 1 source

Ubuntu says the issue only affects systems configured with fine-grained sudoedit file editing permissions, which is not the default configuration.

Composition to watch
Local account holds sudoedit permission for specific named filesAttacker wins the sudo-rs path-handling race during the editsudo-rs writes the attacker-controlled file into a directory outside the grantA placed file is picked up and run by an administrator or a serviceThe exact file target that converts arbitrary privileged placement into reliable root code execution on stock Ubuntu 26.04 is not documented in the notice.
Unverified compositionRead the Launchpad bug or the patch and test common targets against a configured sudoedit rule — writable root-owned configuration paths, or service drop-ins.

The step nobody has written down is which target turns arbitrary privileged placement into reliable root execution on a stock 26.04 host — the notice does not say, and until someone does, this is a boundary failure rather than a demonstrated escalation.

interesting · Bluetooth — robotics

An authenticated Reachy Mini Bluetooth session can make the robot run an attacker-chosen script as root.

Affects

Pollen Robotics Reachy Mini, a small robot whose daemon exposes Bluetooth setup and command services on the robot host.

The CMD_ handler in the robot's Bluetooth command service joins attacker-controlled input into a script path and calls sudo on the result. Absolute paths and ../ traversal both escape the commands/ directory the design assumed, so anything already on the filesystem ending in .sh can be selected. Reaching it takes Bluetooth range and an authenticated command session.

Detail and 6 sources

The reason to watch this rather than file it is composition. JFrog names a separate media-sounds upload flaw as one way to get a .sh file onto the device, and describes a Bluetooth authentication bypass as the remaining step toward compromise with no credentials at all. Each piece is documented; the assembled version is what would matter.

The vendor advisory carries failing regression tests for both relative and absolute traversal payloads, and the public fix commit strips slashes and constrains command names to a basename character set before joining them under commands/.

Composition to watch
Attacker places a .sh file on the robot filesystem, for example through the named media-sounds upload flawAttacker authenticates to the Bluetooth command service with the expected PIN or another valid sessionAttacker writes a CMD_ payload containing an absolute path or ../ traversal to the command characteristicThe daemon resolves a path outside commands/ and invokes sudo on the attacker-selected scriptWhether the Bluetooth authentication bypass named by the advisories composes end-to-end with the upload step on shipping firmware, removing the authenticated-session requirement entirely.
Unverified compositionRead the JFrog write-up for the authentication-bypass step, then test on current firmware whether an unpaired peer in range can reach the CMD_ characteristic at all.

A specialized robot is a small population, and that is the honest reason this sits here rather than higher.

Sources
Also noted0

No additional findings today.

What was checked · 4 quiet, 4 not fully checked
Boot chain & TPMPartly checked

Returned a preamble and no conclusion. No signed-component revocations or bootloader changes were reported to us, but nobody finished looking.

Wi-FiQuiet

No new capability-changing frame found; the accessible upstream material was maintenance and robustness work or non-radio router management. Two hostap commits — PMKSA entry removal and Extended RSN Capabilities parsing — could not be retrieved, so this is not a fully quiet claim either.

Zero-clickQuiet

Nothing new. The closest items were routine Chrome and Mozilla advisories with bug details still restricted. The August Android vulnerability table again failed to render in both the English and Chinese pages, which is the one thing that would have made this a clean quiet claim.

FirmwarePartly checked

Returned a preamble and no conclusion. Unchecked, not quiet — and the open question about the remaining Fireware 2026.2.2 CVEs stays open, since the WatchGuard item this week's JPCERT report carries is a different advisory.

Physical accessPartly checked

Returned a preamble and no conclusion. Treat as unchecked.

Edge devicesQuiet

No new unauthenticated-to-execution primitive on an internet-facing appliance. The Bishop Fox NetScaler follow-up confirms the CVE-2026-8452 patch is comprehensive and contributes only a 512/513-byte patch-state oracle for target selection; the exploited Cisco ASA/FTD SSL VPN bug has not been re-rated. CISA returned 403 for every ICS advisory fetch, so Hitachi Energy APM Edge and Johnson Controls Metasys went unread rather than closed.

MobileQuiet

There is no September Android bulletin yet — the 2026-09-01 URL 404s and August (published 2026-08-03) is still the index's latest. Samsung remains on SMR-AUG-2026 with nothing remote beyond a user-interaction Dialer issue, and no September Qualcomm bulletin exists. New adbd proof-of-concept code for CVE-2026-0073 adds mDNS port discovery and PTY shells but keeps the same LAN-peer, wireless-debugging-enabled, previously-paired preconditions.

ResearchPartly checked

Returned a preamble and no conclusion. Original-research coverage for the day is unverified.

PreviousEarliest reportNextLatest report

fullchain.sh follows the day’s disclosures from bug to shell — what each one enables, what it links to, and where the fix left the primitive in place. A CVE is an input, not an event. When nothing qualifies, the brief says so. Every morning.

Tuesday, September 1, 2026