Loading story…
German government CERT advisories disclosed multiple QEMU vulnerabilities that affect virtualized environments and could let attackers trigger denial of service, expose sensitive information, and in one case manipulate data. One advisory describes a flaw leading to service disruption and information disclosure, while a later notice expands the impact to include data manipulation, indicating broader risk to guest or host operations depending on deployment and exposure.
The advisories identify QEMU as the affected component and warn that organizations relying on the emulator and virtualization stack may face risks to availability, confidentiality, and integrity. Operators of cloud, server, and lab environments using QEMU should review the relevant vendor guidance and apply available updates or mitigations to reduce the chance of exploitation against virtual machines and supporting infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1062 for QEMU, describing a separate vulnerability that could enable data manipulation, information disclosure, and denial of service.
dCERT published advisory 2026-0456 for QEMU, warning that a vulnerability could allow denial of service and information disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German CERT published two advisories affecting **Proxmox Virtual Environment (PVE)**, including one issue that can lead to **information disclosure** and a later notice covering **multiple vulnerabilities** in the virtualization platform. The advisories, `2026-1012` and `2026-1243`, indicate that organizations running Proxmox should review exposed management infrastructure and assess whether sensitive data or administrative functions could be affected. The notices provide limited public detail, but the combination of an information disclosure flaw and additional unspecified weaknesses raises concern for enterprises using Proxmox to host virtual machines and manage clustered infrastructure. Security teams should identify all PVE deployments, monitor vendor and CERT updates for affected versions and patches, and prioritize remediation or compensating controls on internet-reachable or business-critical systems.
Jun 29, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
STAR Labs disclosed two vulnerabilities in QEMU’s **QXL** para-virtualized video device, tracked as `CVE-2021-4206` and `CVE-2021-4207`, that can trigger heap overflows during cursor handling. In the first flaw, guest-controlled cursor width and height values can cause an integer overflow in `cursor_alloc()`, leading to an undersized heap allocation before `qxl_unpack_chunks()` copies more data than allocated with `memcpy()`. In the second, a race condition allows guest-controlled cursor metadata to change after allocation but before size calculations, creating a mismatch that again lets `qxl_unpack_chunks()` write past the heap buffer.
Jun 29, 2026