VulnSocial

CVE-2026-26399Disclosure

MEDIUMCVSS 5.3 · MEDIUM

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.

Back to dashboard
5.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-562

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Exploit tooling references are present in monitored signal
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-04-21)
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-02-11: 1Mentions · 2026-04-19: 1Mentions · 2026-04-21: 2Exploit Tool / Code · 2026-02-11: 1Active Exploitation · 2026-02-11: 1Technical Details · 2026-04-21: 202-1104-1904-21
Signal classification3 categories
Disclosure
250.0%
Active Exploitation
125.0%
General
125.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-02-111
Active Exploitation1
2026-04-191
General1
2026-04-212
Disclosure2
Full discourse4 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-26399 A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on th… https://www.cve.org/CVERecord?id=CVE-2026-26399 ----- Traducción: CVE-2026-26399 Exi… http://infoflow.cloud`

    Post summary

    The note announces CVE-2026-26399 as a stack‑use‑after‑return flaw in Arduino_Core_STM32 before version 1.7.0, with no evidence of exploitation, PoC, or patch.

    0000016
    72 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-26399 A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on th… https://www.cve.org/CVERecord?id=CVE-2026-26399

    Post summary

    The post discloses a stack-use-after-return vulnerability in Arduino_Core_STM32 prior to version 1.7.0, without mentioning a patch, PoC, or active exploitation.

    00000104
    57.2K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-26399 CVE-2026-26399 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26399 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    The post simply lists CVE-2026-26399 and links to a vulnerability details page on Vulmon, with no technical, exploit, patch, or active exploitation information.

    0000049
    4.0K followersView on X
  • ThreatSynop@ThreatSynop
    Active Exploitation

    🚨 SolarWinds Web Help Desk Flaws Actively Exploited to Deploy C2, Tunnels, and SSH Backdoors Attackers are exploiting SolarWinds Web Help Desk vulnerabilities (CVE-2025-40551, CVE-2026-26399) for initial access, then installing a maliciously configured Zoho ManageEngine Assist agent for AD recon and abusing an older Velociraptor build as a C2 framework—plus Cloudflared tunneling and a QEMU-launched SSH backdoor for persistence. At least three orgs have been hit, signaling real-world weaponization and a fast patch/IR priority for exposed WHD instances. (abused tools: Zoho ManageEngine Assist, Velociraptor, Cloudflared, QEMU) 🎯 Target: Global/Enterprise (SolarWinds WHD users) #️⃣ Category: #Vulnerability #TargetedAttacks #BlueTeam 🔗 URL: https://www.scworld.com/brief/solarwinds-whd-vulnerabilities-under-attack

    Post summary

    SolarWinds Web Help Desk vulnerabilities CVE-2025-40551 and CVE-2026-26399 are actively exploited in the wild, with attackers using Zoho ManageEngine Assist, Velociraptor, Cloudflared, and QEMU backdoors for persistence across at least three organizations.

    00000111
    191 followersView on X

Explore more

Back to dashboard