Vulnerabilities
CVE-2026-81964: Windows Update Orchestrator Service Bypass via Hard‑Coded Credentials
An attacker with local privileges can exploit hard‑coded credentials in the Windows Update Orchestrator Service to bypass a security feature. The flaw, identified as CVE‑2026‑81964, affects all Windows versions that run the service. Defenders should apply the latest Microsoft security update and review service permissions.
What happened
The Windows Update Orchestrator Service contains hard‑coded credentials that an attacker with local access can use to bypass a built‑in security feature. The flaw is catalogued as CVE‑2026‑81964.
Impact
Any Windows system running the Update Orchestrator Service can be compromised by a local user who gains elevated privileges through the bypass. The vulnerability does not require remote access or network connectivity.
Mitigation
- Install the latest Microsoft security update that removes the hard‑coded credentials.
- Temporarily disable the Update Orchestrator Service if a patch cannot be applied immediately.
- Restrict local account permissions and enforce least‑privilege policies.
Recommendations
Verify that the service is running the patched version (check via Windows Update history or the CVE database). Monitor for anomalous privilege escalation attempts and review audit logs for unexpected use of the Update Orchestrator Service.
Related vulnerabilities
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Grid Protection Alliance openPDC & openHistorian Vulnerabilities: CVE-2026-100730 and Related Issues
Grid Protection Alliance’s openPDC and openHistorian contain multiple critical flaws, including deserialization of untrusted data, missing authentication, SSRF, hard‑coded credentials, and unsafe reflection. Versions below 2.9.482 (openPDC) and 2.8.585 (openHistorian) are affected. Administrators should update to the latest releases and review authentication settings.
Read briefing
CVE-2026-70095: Windows iSCSI Target Service Remote Code Execution
A critical RCE flaw in the Windows iSCSI Target Service allows remote attackers to execute code via crafted iSCSI requests. The issue impacts Windows Server 2019 and 2022. Defenders should apply the latest cumulative update and restrict iSCSI traffic.
Read briefing
Johnson Controls EasyIO FG Firmware Vulnerabilities CVE-2026-27872/27873: Hard-Coded Credentials Enable Full Device Compromise
Johnson Controls EasyIO FG firmware versions ≤2.0b52 are vulnerable to CVE-2026-27872 and CVE-2026-27873, allowing attackers to gain full unauthorized access via hard‑coded credentials and improper privilege management. The product is EOL/EOS with no patch available, so defenders must isolate the devices, enforce strict network segmentation, and migrate to supported models such as EasyIO Neo R1.
Read briefing