7-Zip Vulnerability CVE-2026-14266 Enables Arbitrary Code Execution Through Malicious XZ Archives
A dangerous vulnerability has been discovered in the widely used file compression utility 7-Zip, identified as CVE-2026-14266. The flaw enables an attacker to execute arbitrary code on a victim’s system by tricking them into opening a specially prepared XZ archive.
The root cause lies in a buffer overflow that occurs during the processing of fragmented XZ data. When the application attempts to handle such malformed archives, it can write data outside the boundaries of allocated memory. Successful exploitation grants the attacker the ability to run malicious code with the same privileges as the current 7-Zip process.
Although the attack requires user participation, the vector is highly effective for phishing operations. Attackers can disguise the malicious file as a software update, backup archive, document package, or ordinary attachment delivered through messengers or email. Once opened, the payload may install malware, steal accessible data, modify files, or crash the system.
The vulnerability received a CVSS score of 7 out of 10. No authentication or prior access to the target device is required, increasing its potential severity in targeted scenarios. Researchers have not yet observed active exploitation of CVE-2026-14266 in the wild; however, technical details have already been published, providing a clear roadmap for threat actors seeking to develop working exploits.
Developers addressed the issue in 7-Zip 26.0. Security experts recommend that all users upgrade to the patched version without delay and avoid opening unexpected XZ archives from untrusted sources. Files bearing names such as “documents_important.xz” should be treated with particular caution, as they may contain not documents but actively malicious code.
Related articles
SQL Injection in Oracle Escalates to SYSTEM Execution on Windows via Embedded Java Compilation
A real-world intrusion chain demonstrates how a basic SQL injection can lead to command execution on Windows with SYSTEM privileges. Attackers leveraged Oracle Database's ability to load, compile, and run Java code inside the database engine itself. After gaining initial database access through an internet-exposed application, the threat actors introduced Java source code, converted it into schema objects, and compiled it directly on the server. This technique, tracked under the artifact name khunt and linked to Huntress telemetry, minimizes reliance on traditional disk binaries and shifts tooling into the less-monitored database engine. When the Oracle process runs with elevated rights on Windows, the chained execution inherits high privileges up to SYSTEM level. The incident underscores the need for parameterized queries, disabling unnecessary Java functionality in Oracle, and monitoring specific DDL events such as CREATE JAVA SOURCE and CREATE JAVA CLASS.
Critical Django Vulnerability CVE-2026-15307 Enables Remote Code Execution via GDALRaster Spatial Queries
The Django project has released versions 6.0.8 and 5.2.17 to address four vulnerabilities that could result in arbitrary file writes, unauthorized requests, denial of service, and cross-site scripting attacks. The most severe issue, tracked as CVE-2026-15307, impacts spatial queries that process raster data through the GDALRaster interface. Attackers can supply specially crafted values that cause the Django process to write files or initiate external connections under its own permissions, potentially leading to remote code execution in certain configurations. Exploitation is also possible through the Django admin panel when a staff user has view permissions on models containing geographic fields. The patches have been backported to the 5.2 and 6.0 branches as well as the upcoming 6.1 release candidate. In addition to fixing the flaw, the updates alter query behavior to reject dictionaries and strings that do not represent valid geometries.
Certificate Transparency Logs Fail to Block Rogue CA Man-in-the-Middle Attacks
A detailed technical analysis reveals that Certificate Transparency logs do not effectively protect users from man-in-the-middle attacks carried out with certificates issued by compromised or sloppy certificate authorities. The author attempted to verify SCT entries from real browser certificates using public CT log APIs such as get-proof-by-hash but consistently received 404 Not Found responses. Tools including Windows certutil also reported every SCT as not found in the logs. A practical proof-of-concept attack was then constructed by creating a self-signed CA that exactly replicated the certificate chain of habr.com and serving it through nginx with matching extensions and attributes. The resulting MITM connection was accepted by browsers without warnings despite HSTS, because the pre-certificate in the log differs from the presented certificate only in public key bytes. A publicly accessible demonstration was deployed on Yandex Cloud allowing anyone to test the bypass by overriding DNS for habr.com.
Progress MarkLogic Server Patched for 10 Vulnerabilities Including Seven Critical Issues
Progress Software has released security updates for its MarkLogic Server database product after disclosing ten vulnerabilities, seven of which carry CVSS v3.1 base scores of 9.0 or higher. Three flaws, tracked as CVE-2026-7329, CVE-2026-8709, and CVE-2026-9193, were each rated 9.9 and allow low-privileged users to escalate rights or access restricted data. CVE-2026-7329 enables a user holding only a REST role to obtain administrator privileges through crafted queries, granting unauthorized operations on the database. CVE-2026-8709 stems from improper handling of REST document patches and similarly permits privilege escalation, while CVE-2026-9193 arises from insufficient access controls in the Hadoop integration feature. The advisory was published on 5 August 2026 and urges immediate application of the available patches.