Cisco Patches High-Severity Privilege Escalation Flaws in IOS XR Software Cisco has released high-severity software updates to address two critical privilege escalation vulnerabilities in its IOS XR Software, which could allow authenticated, local attackers to gain root-level access or full administrative control over affected devices. Given the role of these routers in enterprise networks, the flaws pose a significant security risk. ### Vulnerability Details Both vulnerabilities are rated High severity (CVSS 8.8/10) and can be exploited independently: 1. CVE-2026-20040 – A CLI privilege escalation flaw caused by improper validation of user-supplied arguments in certain commands. A low-privileged attacker could execute arbitrary commands as root on the underlying OS. 2. CVE-2026-20046 – A CLI privilege escalation issue in Cisco IOS XRv 9000 Routers, stemming from incorrect command-to-task-group mapping. Attackers could bypass security checks to perform unauthorized administrative actions. Cisco confirmed that IOS, IOS XE, and NX-OS Software are not affected by these flaws. ### Mitigation & Patching Cisco urges administrators to upgrade to fixed software versions (e.g., 25.2.21, 25.4.2) or apply Software Maintenance Updates (SMUs). For CVE-2026-20040, patching is mandatory, as no workarounds exist. For CVE-2026-20046, organizations using TACACS+ AAA command authorization can restrict unauthorized command access as a temporary measure. Systems running older versions (25.1 or earlier, 25.3 branch) are particularly vulnerable and should migrate to patched releases immediately.

Hackers Exploit Critical React Native Metro Vulnerability (CVE-2025-11953) for Cross-Platform Attacks Hackers are actively exploiting CVE-2025-11953, a critical vulnerability in the Metro server for React Native, to deliver malicious payloads targeting Windows and Linux systems. The flaw, discovered by JFrog in early November 2025, allows unauthenticated attackers to execute arbitrary OS commands via a crafted POST request to the `/open-url` endpoint. Metro, the default JavaScript bundler for React Native, is widely used in development environments. The vulnerability stems from unsanitized user-supplied URLs passed to the `open()` function, affecting @react-native-community/cli-server-api versions 4.8.0 through 20.0.0-alpha.2. A patch was released in version 20.0.0. Exploitation Timeline & Impact VulnCheck first observed attacks on December 21, 2025, with follow-up activity on January 4 and 21, 2025. Dubbed Metro4Shell, the campaign delivers base-64 encoded PowerShell payloads that: - Disable Microsoft Defender protections by adding exclusion paths. - Establish a raw TCP connection to attacker-controlled infrastructure. - Download and execute a Rust-based UPX-packed binary with anti-analysis features. The same infrastructure hosts payloads for both Windows and Linux, confirming cross-platform targeting. Scans via ZoomEye identified ~3,500 exposed Metro servers online. Despite active exploitation, the vulnerability remains low-scoring in the Exploit Prediction Scoring System (EPSS), highlighting a gap in risk prioritization. VulnCheck’s report includes indicators of compromise (IoCs) for the attacker’s infrastructure and payloads.

Hackers Revive Five-Year-Old ShowDoc Vulnerability in Global Attacks A critical security flaw in ShowDoc, a PHP-based document collaboration tool popular in China, is being actively exploited by threat actors worldwide over five years after a patch was released. The vulnerability, tracked as CVE-2025-0520 (CVSS 9.4), allows unrestricted file uploads, enabling attackers to deploy malicious PHP files and gain remote code execution (RCE) on vulnerable servers. ### Exploitation Details - The flaw stems from improper file-type validation, letting attackers upload web shells malicious scripts that grant unauthorized remote control. - Security firm VulnCheck detected active exploitation, including an attack on a U.S.-based "canary" honeypot running an outdated ShowDoc version. - While ShowDoc has a smaller user base than tools like SharePoint or Confluence, over 2,000 exposed instances remain online, primarily in China. ### Why the Bug Persists - The vulnerability was fixed in ShowDoc 2.8.7 (October 2020), but many users failed to update, leaving systems exposed. - Threat actors are leveraging this as an N-day vulnerability an old, known flaw that remains unpatched in legacy systems. - The latest safe version is ShowDoc 3.8.1, but unpatched deployments continue to be targeted. ### Expert Insights - Caitlin Condon (VulnCheck) noted that attackers are increasingly exploiting long-tail vulnerabilities in niche software to establish footholds for further attacks. - Will Baxter (Team Cymru) warned that even low-profile tools can serve as stepping stones for lateral movement or command-and-control operations, often evading internal security visibility. The resurgence of this exploit underscores the risks of unpatched legacy software, particularly in tools with limited enterprise oversight. Organizations using ShowDoc are advised to verify their versions and apply updates immediately.