Search CVEs, research… / diras.sa

RESEARCH · ADVISORIES · THREAT INTEL

Offensive research from the Diras threat intelligence team.

Vulnerability disclosures, CVEs, malware teardowns and dark web investigations. Published openly for defenders across the Kingdom and the region.

Read latest research Open CVE Radar

labs latest --type cve

  • NEW RESEARCH · ANALYZING THE MIRAI ARM BASED IOT MALWARE
  • CVE-2026-67378 · CRITICAL 9
  • CVE-2026-67636 · CRITICAL 9
  • TLP:CLEAR

01 / RESEARCH

Latest research

Illustration of a router infected with Mirai, connected to IoT devices such as cameras and smart speakers across a world mapFEATURED

MALWARE ANALYSIS · MIRAI

Analyzing the Mirai ARM-Based IoT Malware

Most samples a malware analyst sees are x86_64 Windows binaries. IoT incidents keep growing, and nearly all of them belong to one family: Mirai. This is a look inside an ARM build.

Diras Labs 6 min read

02 / CVE RADAR

Latest CVEs worth your attention

Third-party vulnerabilities curated daily by our analysts, with a short Diras take on exposure in the region. Sources: NVD, CISA KEV, vendor advisories.

CVE-2026-67378 CRITICAL 9

Microsoft Microsoft SQL Server 2019 (CU 32)

Microsoft SQL Server untrusted pointer dereference leads to remote code execution

  • PATCH AVAILABLE

DIRAS TAKE

Urgent: treat this as high priority because the vulnerability allows unauthenticated remote code execution over the network; apply the vendor fixes or block access to SQL Server instances until patched.

CVE Program

CVE-2026-67636 CRITICAL 9

Microsoft Microsoft SQL Server 2019 (CU 32)

Microsoft SQL Server out-of-bounds read leads to remote code execution

  • PATCH AVAILABLE

DIRAS TAKE

Urgent: this flaw can be exploited without authentication, so prioritize installing the vendor fixes for your branch or immediately restrict SQL Server network exposure until you can update.

CVE Program

CVE-2026-76420 CRITICAL 9

Cisco Cisco Secure Firewall Management Center (FMC)

Cisco Secure FMC AJP connector pre-auth remote root execution

DIRAS TAKE

Urgent: this is a remote, unauthenticated root-capable flaw with no patch available for affected 7.x releases; immediately restrict access to the AJP connector and follow the vendor's mitigation guidance.

CVE Program

CVE-2026-67278 CRITICAL 9.1

MikroTik RouterOS

RouterOS RSA signature verification allows TLS/SSH impersonation

  • PATCH AVAILABLE

DIRAS TAKE

Urgent: no authentication is required to exploit this verification bypass, so prioritize updates; MikroTik published fixes in 7.23.6 and 7.24.3. If you cannot patch immediately, restrict exposure of affected devices and monitor connections for suspicious TLS/SSH activity.

CVE Program

CVE-2026-86131 CRITICAL 9.2

WatchGuard Fireware OS

WatchGuard Fireware OS BOVPN Over TLS code injection remote root execution

  • PATCH AVAILABLE

DIRAS TAKE

Urgent — this is a remote root code execution triggered by a malicious BOVPN Over TLS server and fixed builds are available; prioritize installing the listed fixes or block untrusted BOVPN endpoints immediately.

CVE Program

CVE-2026-101891 CRITICAL 9.3

WatchGuard WatchGuard AP

WatchGuard AP improper access control allows unauthenticated API session

  • PATCH AVAILABLE

DIRAS TAKE

Urgent: this vulnerability lets an unauthenticated actor get an API session simply by reaching the AP on the network; apply the vendor fix (3.4.8) or isolate AP management interfaces immediately.

CVE Program

Updated daily · /cves.json · RSS Open full CVE radar

03 / COORDINATED DISCLOSURE

Found something? We coordinate with vendors before we publish.

Our default window is 90 days from vendor notification. Reports are encrypted end to end.

security@diras.sa Disclosure policy
  1. D+0Report receivedAcknowledged within 2 business days.
  2. D+7Vendor notifiedTechnical details shared over an encrypted channel.
  3. D+90Public advisoryPublished here, with CVE, earlier if a fix ships.
  4. CreditResearchers are credited unless they ask otherwise.

PGP · 4F2A 9C1E 7B30 D55A 01EF 8C42 A1B9 3E07 6D2C 11F4