{"rows":[{"id":"CVE-2026-76461","publishedAt":1789406271113,"modifiedAt":1789476452497,"description":"A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-89"],"vendors":["cisco"],"products":["asyncos"],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461","tags":["US Government Resource"]}],"epssScore":0.02162,"epssPercentile":0.81239,"epssAt":1789502238955,"kev":true,"kevAddedAt":1789344000000,"kevDueDate":1789603200000,"kevRansomware":"Unknown","kevVendor":"Cisco","kevProduct":"Secure Email Gateway","kevName":"Cisco Secure Email Gateway SQL Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["https://github.com/HORKimhab/CVE-2026-76461","https://github.com/0xBlackash/CVE-2026-76461"],"pocFirstSeenAt":1789452817000,"firstNewsAt":1789387200000,"cna":"psirt@cisco.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway","aiSummary":"Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.","aiAdvice":"Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.","aiAffected":[{"vendor":"Cisco","product":"Secure Email Gateway (Cisco AsyncOS Software)","versions":""}],"aiExposure":"≈ tens of thousands of gateway deployments (order of 10,000–50,000 appliances) — Cisco Secure Email Gateway appliances are enterprise mail-security gateways that are internet-facing by design (they receive inbound MX traffic), and public scan engines typically show tens of thousands of Cisco email-security hosts…","aiExposureScale":"large","aiAt":1789407433024,"updatedAt":1789507039250},{"id":"CVE-2026-85706","publishedAt":1789182990473,"modifiedAt":1789395735323,"description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvssVersion":"3.1","severity":"critical","cwes":["CWE-22"],"vendors":["gitlab"],"products":["gitlab"],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/627748","tags":["Broken Link"]},{"url":"https://hackerone.com/reports/3909881","tags":["Permissions Required"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706","tags":["Third Party Advisory","US Government Resource"]}],"epssScore":0.11957,"epssPercentile":0.95887,"epssAt":1789490238314,"kev":true,"kevAddedAt":1789084800000,"kevDueDate":1789344000000,"kevRansomware":"Unknown","kevVendor":"GitLab","kevProduct":"Community Edition and Enterprise Edition","kevName":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":9,"pocUrls":["https://github.com/mhtsec/CVE-2026-85706","https://github.com/guneykabel/cve-2026-85706","https://github.com/solivaquaant/CVE-2026-85706-PoC","https://github.com/jithinkrishnanrs/gitlab-cve-2026-85706-ioc","https://github.com/solivaquaant/CVE-2026-85706","https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab","https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc","https://github.com/gabrielunknown/CVE-2026-85706","https://github.com/0xenesbayram/cve-2026-85706"],"pocFirstSeenAt":1789140262000,"firstNewsAt":1789114814000,"cna":"cve@gitlab.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE","aiSummary":"CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.","aiAdvice":"Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.","aiAffected":[{"vendor":"GitLab","product":"Community Edition","versions":""},{"vendor":"GitLab","product":"Enterprise Edition","versions":""}],"aiExposure":"Likely >1,000,000 aggregate users across hundreds of thousands of self-managed CE/EE deployments, with tens of thousands of instances directly exposed to the… — Public internet scans routinely index tens of thousands of exposed GitLab servers, and GitLab's self-managed CE/EE install base, used by many large organizations, plausibly serves well over a million users in aggregate.","aiExposureScale":"mass","aiAt":1789156617579,"updatedAt":1789507039250},{"id":"CVE-2026-87491","publishedAt":1788916625887,"modifiedAt":1789044542630,"description":"Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-787"],"vendors":["google"],"products":["chrome"],"references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/543557673","tags":["Permissions Required"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491","tags":["US Government Resource"]}],"epssScore":0.00859,"epssPercentile":0.56464,"epssAt":1789436234838,"kev":true,"kevAddedAt":1788912000000,"kevDueDate":1790121600000,"kevRansomware":"Unknown","kevVendor":"Google","kevProduct":"Chromium V8","kevName":"Google Chromium V8 Out of Bounds Write Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788929172000,"cna":"chrome-cve-admin@google.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Actively Exploited Out-of-Bounds Write in Google Chrome V8","aiSummary":"CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.","aiAdvice":"Update Google Chrome to 153.0.8010.36 or later immediately (open Help > About Google Chrome to force the update and relaunch), and verify the version on all endpoints. Also patch headless or automated Chrome deployments (CI runners, scrapers, kiosks, CDP-based tooling) that may lag auto-updates, and prioritize remediation per CISA KEV and BOD 26-04 requirements for federal systems. No public PoC is known and ransomware use is unknown, but confirmed in-the-wild exploitation warrants urgent patching.","aiAffected":[{"vendor":"Google","product":"Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8')","versions":"prior to 153.0.8010.36"}],"aiExposure":"billions of installations (Chrome's install base exceeds 3 billion users) — Chrome holds roughly two-thirds of global browser usage share with a multi-billion-user install base, so the number of potentially affected endpoints is in the billions, though rapid auto-updates shrink the persistently vulnerable window.","aiExposureScale":"mass","aiAt":1788981717938,"updatedAt":1789505839162},{"id":"CVE-2026-84869","publishedAt":1788898731147,"modifiedAt":1789186602757,"description":"A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.","cvssScore":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-269","CWE-862"],"vendors":["connectwise"],"products":["screenconnect"],"references":[{"url":"https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869","tags":["Third Party Advisory"]},{"url":"https://www.connectwise.com/company/trust/advisories","tags":["Vendor Advisory"]},{"url":"https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869","tags":["US Government Resource"]},{"url":"https://www.huntress.com/blog/rogue-screenconnect-installations","tags":["Third Party Advisory"]}],"epssScore":0.00691,"epssPercentile":0.50945,"epssAt":1789505839162,"kev":true,"kevAddedAt":1789084800000,"kevDueDate":1789344000000,"kevRansomware":"Unknown","kevVendor":"ConnectWise","kevProduct":"ScreenConnect","kevName":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788983208000,"cna":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Missing authorization in ScreenConnect client allows unauthorized file execution","aiSummary":"CVE-2026-84869 is a critical authorization flaw (CWE-862 missing authorization, CWE-269 improper privilege management) in the ScreenConnect client, the endpoint-side agent of ConnectWise's widely used remote access and remote support platform, in which files can be transferred to a machine and executed during an active remote session without the expected authorization or without confirmation by the Host (technician). It is triggered in certain circumstances during an active session, with a network attack vector, low attack complexity, low privileges required, and no user interaction per the CVSS 3.1 vector. An actor who obtains or already holds access to a session context could thereby push and run files on the managed endpoint, potentially achieving code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 score 9.9, scope changed). Only endpoints running the ScreenConnect client are affected; ScreenConnect servers are not impacted, and the affected client version ranges are governed by ConnectWise security advisory AV26-903 (not enumerated in the available data). The flaw is not currently known to be exploited: it is not in CISA KEV, no public proof of concept is known, and EPSS assigns a modest 0.4% probability of exploitation within the next 30 days (32nd percentile).","aiAdvice":"Follow ConnectWise security advisory AV26-903 and update ScreenConnect clients to the patched version it specifies, noting that ScreenConnect servers do not require remediation. Until patching is complete, monitor active remote sessions, require Host confirmation for file transfers, and review recent sessions on high-value endpoints for unexpected transferred or executed files; given no known exploitation and the active-session prerequisite, prioritize endpoints routinely accessed remotely.","aiAffected":[{"vendor":"ConnectWise","product":"ScreenConnect client (endpoint agent)","versions":""}],"aiExposure":"plausibly millions of managed endpoints running the ScreenConnect client agent — ScreenConnect is a market-leading remote access/remote support platform whose client agent is broadly deployed across large downstream endpoint fleets by thousands of managed service providers, plausibly totaling millions of installations;…","aiExposureScale":"mass","aiAt":1789081012762,"updatedAt":1789505839162},{"id":"CVE-2026-85880","publishedAt":1788891674087,"modifiedAt":1788931099193,"description":"Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-122","CWE-908"],"vendors":["microsoft"],"products":["windows 10 1607","windows 10 1809","windows 10 21h2","windows 10 22h2","windows server 2012","windows server 2016","windows server 2019","windows server 2022"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880","tags":["US Government Resource"]}],"epssScore":0.00572,"epssPercentile":0.45618,"epssAt":1789497438718,"kev":true,"kevAddedAt":1788825600000,"kevDueDate":1790035200000,"kevRansomware":"Unknown","kevVendor":"Microsoft","kevProduct":"Windows","kevName":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788868800000,"cna":"secure@microsoft.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation","aiSummary":"CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.","aiAdvice":"Apply Microsoft's September 2026 security (cumulative) updates for each affected Windows 10 and Windows Server build, as no public PoC or workaround is documented; CISA's KEV listing (added 2026-09-08) triggers BOD 26-04 patching requirements for federal agencies, so prioritize accordingly. Give priority to hosts where unprivileged users can log in — RDS/VDI servers, jump boxes, shared workstations — and to internet-exposed Windows servers, since an ALPC local privilege escalation is a common component in exploit chains combining remote code execution or browser flaws with elevation to SYSTEM. Organizations unable to patch promptly should follow BOD 26-04 guidance for cloud services or restrict local access to affected hosts until updates are applied.","aiAffected":[{"vendor":"Microsoft","product":"Windows 10","versions":"1607, 1809, 21H2, 22H2"},{"vendor":"Microsoft","product":"Windows Server","versions":"2012, 2016, 2019, 2022"}],"aiExposure":"≈100M+ Windows installations (Windows 10 1607–22H2 on consumer/enterprise endpoints plus widely deployed Windows Server 2012–2022) — Windows 10 runs on hundreds of millions of devices worldwide with 21H2/22H2 among the most common builds, and Windows Server 2012–2022 remain broadly deployed in enterprise and cloud-hosted estates, so the plausibly affected population is…","aiExposureScale":"mass","aiAt":1789078612632,"updatedAt":1789505839162},{"id":"CVE-2026-81963","publishedAt":1788891660090,"modifiedAt":1788931097173,"description":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-59","CWE-284"],"vendors":["microsoft"],"products":["windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows server 2025"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963","tags":["US Government Resource"]}],"epssScore":0.00631,"epssPercentile":0.48383,"epssAt":1789497438718,"kev":true,"kevAddedAt":1788825600000,"kevDueDate":1790035200000,"kevRansomware":"Unknown","kevVendor":"Microsoft","kevProduct":"Windows","kevName":"Microsoft Windows Link Following Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788868800000,"cna":"secure@microsoft.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Local Privilege Escalation via Link Following in Windows Update Stack","aiSummary":"CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.","aiAdvice":"Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.","aiAffected":[{"vendor":"Microsoft","product":"Windows 11","versions":"23H2, 24H2, 25H2, 26H1"},{"vendor":"Microsoft","product":"Windows Server 2025","versions":""}],"aiExposure":"well over 1,000,000 — on the order of hundreds of millions of Windows 11 devices running 23H2 or newer, plus broad Windows Server 2025 enterprise deployments — Windows 11's installed base runs to hundreds of millions of devices and the 23H2-and-later feature updates cover essentially the entire currently supported Windows 11 population, with Windows Server 2025 in wide enterprise use, so the…","aiExposureScale":"mass","aiAt":1789078612632,"updatedAt":1789505839162},{"id":"CVE-2026-75650","publishedAt":1788815850863,"modifiedAt":1788931087237,"description":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-1336"],"vendors":["adobe"],"products":["commerce","commerce b2b","magento"],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-146.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650","tags":["US Government Resource"]}],"epssScore":0.02148,"epssPercentile":0.81125,"epssAt":1789486638153,"kev":true,"kevAddedAt":1788825600000,"kevDueDate":1789084800000,"kevRansomware":"Unknown","kevVendor":"Adobe","kevProduct":"Commerce and Magento","kevName":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://github.com/dinosn/cve-2026-75650-magento-validation-lab"],"pocFirstSeenAt":1788845997000,"firstNewsAt":1788566400000,"cna":"psirt@adobe.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":["E-commerce"],"aiStatus":"done","aiTitle":"Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)","aiSummary":"Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.","aiAdvice":"Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.","aiAffected":[{"vendor":"Adobe","product":"Adobe Commerce","versions":""},{"vendor":"Adobe","product":"Adobe Commerce B2B","versions":""},{"vendor":"Adobe","product":"Magento (open-source)","versions":""}],"aiExposure":"roughly 100,000-300,000 internet-facing storefronts — Public technology surveys consistently rank Magento/Adobe Commerce among the most widely deployed e-commerce platforms, with on the order of 200k-300k live storefronts that are by nature internet-facing, so this is an estimate of the…","aiExposureScale":"mass","aiAt":1789078612632,"updatedAt":1789505839162},{"id":"CVE-2026-86218","publishedAt":1788664637373,"modifiedAt":1788931099490,"description":"N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.","cvssScore":10,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-96"],"vendors":["n-able"],"products":["n-central"],"references":[{"url":"https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218","tags":["US Government Resource"]}],"epssScore":0.00744,"epssPercentile":0.52837,"epssAt":1789486638153,"kev":true,"kevAddedAt":1788825600000,"kevDueDate":1789084800000,"kevRansomware":"Unknown","kevVendor":"N-able","kevProduct":"N-central","kevName":"N-able N-central Static Code Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://github.com/jithinkrishnanrs/CVE-2026-86218-N-central-IOC-Toolkit"],"pocFirstSeenAt":1789210884000,"firstNewsAt":1788692400000,"cna":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)","aiSummary":"CVE-2026-86218 is a static code injection flaw (CWE-96) in N-able's N-central on-premises remote monitoring and management (RMM) platform, carrying a maximum CVSS 4.0 score of 10.0. An unauthenticated, remote attacker triggers it by sending crafted network input to the N-central server that is improperly neutralized and persisted into application-managed code, which the server then executes — no privileges (PR:N) or user interaction (UI:N) are required. Successful exploitation yields full server compromise with high impact on confidentiality, integrity, and availability, and because N-central acts as the management hub for downstream customer endpoints, compromise can expose the entire managed estate. Any organization running an affected N-central release (before 2026.3.1.14) — primarily MSPs and corporate IT departments using N-able RMM — is affected. The flaw is confirmed exploited in the wild: N-able patched it as a zero-day, CISA added it to the KEV catalog on 2026-09-08, and it is the fourth N-central hotfix in five weeks, though no public PoC is known and ransomware use is unknown.","aiAdvice":"Upgrade N-central to 2026.3.1.14 or later (or apply N-able's hotfix) immediately, as the flaw is in CISA's KEV catalog and BOD 26-04 timelines apply to federal stakeholders. Until patched, remove direct internet exposure of the N-central server (restrict to VPN/management networks via firewall allowlists) since no authentication is needed for exploitation. Because in-the-wild exploitation is confirmed, review internet-facing N-central servers for indicators of compromise such as unexpected processes, unusual child processes of the web service, and new or suspicious accounts.","aiAffected":[{"vendor":"N-able","product":"N-central","versions":"before 2026.3.1.14"}],"aiExposure":"≈ tens of thousands of deployed/internet-exposed N-central servers (order of magnitude ~10k+), each managing many downstream customer endpoints — No install counts were provided in the data; this estimate is based on N-central being a widely deployed on-premises RMM platform run by thousands of MSPs and IT departments, consistent with public internet-scan counts from earlier…","aiExposureScale":"large","aiAt":1789078612632,"updatedAt":1789505839162},{"id":"CVE-2026-86060","publishedAt":1788639438703,"modifiedAt":1789131136507,"description":"RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)","cvssScore":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-88"],"vendors":["mikrotik"],"products":["routeros"],"references":[{"url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","tags":["Third Party Advisory"]},{"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","tags":["Mitigation","Third Party Advisory"]},{"url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","tags":["Release Notes"]},{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","tags":["Release Notes"]},{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","tags":["Release Notes"]},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","tags":["Vendor Advisory"]},{"url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060","tags":["US Government Resource"]}],"epssScore":0.01057,"epssPercentile":0.62635,"epssAt":1789486638153,"kev":true,"kevAddedAt":1788998400000,"kevDueDate":1789257600000,"kevRansomware":"Unknown","kevVendor":"MikroTik","kevProduct":"RouterOS","kevName":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["https://github.com/bahirul/cve-2026-86060","https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"],"pocFirstSeenAt":1789010378000,"firstNewsAt":1788702362000,"cna":"cvd@cert.pl","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation","aiSummary":"CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.","aiAdvice":"Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').","aiAffected":[{"vendor":"MikroTik","product":"RouterOS v6 (Long-term channel)","versions":"versions prior to 6.49.21 (fixed in 6.49.21)"},{"vendor":"MikroTik","product":"RouterOS v7 (Long-term channel)","versions":"versions prior to 7.23.4 (fixed in 7.23.4)"},{"vendor":"MikroTik","product":"RouterOS v7 (Stable channel)","versions":"versions prior to 7.24.2 (fixed in 7.24.2)"}],"aiExposure":"≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN — MikroTik RouterOS is one of the most widely deployed router platforms across SOHO, ISP/WISP and hosting environments, and long-running public internet scans (e.g., Shodan/Censys) consistently surface hundreds of thousands to over a million…","aiExposureScale":"mass","aiAt":1788988074314,"updatedAt":1789505839162},{"id":"CVE-2026-67277","publishedAt":1788639438120,"modifiedAt":1789131149533,"description":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)","cvssScore":8.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"high","cwes":["CWE-306"],"vendors":["mikrotik"],"products":["routeros"],"references":[{"url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","tags":["Third Party Advisory"]},{"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","tags":["Mitigation","Third Party Advisory"]},{"url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","tags":["Release Notes"]},{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","tags":["Release Notes"]},{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","tags":["Release Notes"]},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","tags":["Vendor Advisory"]},{"url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277","tags":["US Government Resource"]}],"epssScore":0.00869,"epssPercentile":0.56832,"epssAt":1789486638153,"kev":true,"kevAddedAt":1788998400000,"kevDueDate":1789257600000,"kevRansomware":"Unknown","kevVendor":"MikroTik","kevProduct":"RouterOS","kevName":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"],"pocFirstSeenAt":null,"firstNewsAt":1788739200000,"cna":"cvd@cert.pl","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest","aiSummary":"CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service of MikroTik RouterOS: the service accepts a \"related\" btest connection before the primary session has completed authentication, so an unauthenticated remote client can start an IPv4 UDP bandwidth test. When the test runs with \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer, leaking a small amount of kernel memory, and a separate unchecked, inverted packet-size interval causes an unsigned integer underflow that produces anomalously large fragmented output capable of restarting the RouterOS kernel. An unauthenticated network attacker therefore gains limited information disclosure and, more significantly, a remote denial of service through repeated router crashes, with no credentials or user interaction required (CVSS 4.0: 8.8 High). Any MikroTik device running an unpatched RouterOS version with the bandwidth-test server enabled and reachable from an untrusted network is affected. No public PoC or CISA KEV listing exists for this CVE and EPSS is low (0.4%), but it is part of the batch of RouterOS fixes in MikroTik advisory AV26-887 that attackers have recently chained to hijack routers, so in-the-wild exploitation of the flaw set is reported.","aiAdvice":"Upgrade to RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable), matching your release channel. Until patched, disable the Bandwidth Test Server (btest) or restrict access to it with firewall rules to trusted hosts only. Given reports of recent RouterOS flaws being chained to hijack routers, also review devices for signs of compromise such as unexpected configuration changes or unfamiliar scheduled tasks.","aiAffected":[{"vendor":"MikroTik","product":"RouterOS (Long-term channel, v6)","versions":"All versions prior to 6.49.21 (fixed in 6.49.21)"},{"vendor":"MikroTik","product":"RouterOS (Long-term channel, v7)","versions":"All versions prior to 7.23.4 (fixed in 7.23.4)"},{"vendor":"MikroTik","product":"RouterOS (Stable channel)","versions":"All versions prior to 7.24.2 (fixed in 7.24.2)"}],"aiExposure":"≈1M+ internet-exposed MikroTik RouterOS devices in public scans; the exploitable subset with the btest service reachable is plausibly ≥100k — MikroTik RouterOS is one of the most widely deployed router operating systems, with public internet scans (e.g., Shodan/Censys) repeatedly showing on the order of a million exposed RouterOS devices, though only devices with the…","aiExposureScale":"mass","aiAt":1788979317770,"updatedAt":1789505839162},{"id":"CVE-2026-85046","publishedAt":1788466644210,"modifiedAt":1788879304093,"description":"Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-843"],"vendors":["google"],"products":["chrome","v8"],"references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/542403045","tags":["Permissions Required"]},{"url":"https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67","tags":["Patch"]},{"url":"https://news.ycombinator.com/item?id=49570669","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046","tags":["US Government Resource"]}],"epssScore":0.01462,"epssPercentile":0.72176,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788480000000,"kevDueDate":1789689600000,"kevRansomware":"Unknown","kevVendor":"Google","kevProduct":"Chromium V8","kevName":"Google Chromium V8 Type Confusion Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":5,"pocUrls":["https://github.com/Eliot-code/CVE-2026-85046","https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md","https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/","https://github.com/SneakyNachos/CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm","https://github.com/atiilla/CVE-2026-85046"],"pocFirstSeenAt":1788757175000,"firstNewsAt":1788347756000,"cna":"chrome-cve-admin@google.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)","aiSummary":"Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.","aiAdvice":"Update Google Chrome to 152.0.7977.82 or later immediately, and apply the corresponding V8 fix in any Chromium-based browser in use. Federal agencies must apply mitigations in line with CISA BOD 26-04 and its cloud-services requirements, evaluating each asset's internet exposure. Because public reporting shows this flaw chained with Windows zero-days in 'BlueMoon' attacks, patch the related Windows vulnerabilities as well and hunt for signs of exploit-chain activity on high-exposure endpoints.","aiAffected":[{"vendor":"Google","product":"Chrome","versions":"prior to 152.0.7977.82"},{"vendor":"Google","product":"Chromium V8","versions":"V8 engine versions bundled with Chrome prior to 152.0.7977.82"}],"aiExposure":"multiple billions of users/installs (Chrome is the dominant desktop browser at roughly 65% market share, with an estimated 3+ billion active users, plus… — Chrome's browser market share (~two-thirds of desktop usage) and multi-billion active-user base make this effectively universal exposure among desktop users, with additional exposure via other Chromium-derived browsers that embed the V8…","aiExposureScale":"mass","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-83549","publishedAt":1788301033290,"modifiedAt":1788440776230,"description":"Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-78"],"vendors":["sonicwall"],"products":["sma8200v","sma6210 firmware","sma7210 firmware"],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549","tags":["US Government Resource"]}],"epssScore":0.08505,"epssPercentile":0.94734,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1788566400000,"kevRansomware":"Unknown","kevVendor":"SonicWall","kevProduct":"SMA1000 Appliances","kevName":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788307200000,"cna":"PSIRT@sonicwall.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console","aiSummary":"CVE-2026-83549 is a post-authentication OS command injection flaw (CWE-78) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. An attacker who authenticates to the AMC with administrator privileges can, under specific conditions, inject arbitrary operating system commands and achieve remote code execution on the appliance. Only organizations running SMA1000-series appliances, including the SMA 6210, SMA 7210, and SMA 8200v models cited in the data, are affected. CISA added the flaw to the KEV catalog on 2026-09-02, and news reports describe active exploitation, possibly chained with companion zero-day CVE-2026-83548, with reverse shells and cryptocurrency miners observed; no public proof-of-concept is known. EPSS assigns an 8.5% probability of exploitation within 30 days (95th percentile).","aiAdvice":"Apply the fixed firmware from SonicWall advisory AV26-872 (Update 1) on all SMA1000-series appliances immediately, consistent with CISA's KEV required action and BOD 26-04 guidance. Restrict access to the AMC to trusted networks and audit administrator logins for unexpected sources. Hunt for signs of compromise, including reverse shells and cryptomining activity, and ensure companion flaw CVE-2026-83548 is remediated as part of the same update.","aiAffected":[{"vendor":"SonicWall","product":"SMA1000 series appliances - Appliance Management Console (AMC)","versions":""},{"vendor":"SonicWall","product":"SMA 6210 (SMA1000 series firmware)","versions":""},{"vendor":"SonicWall","product":"SMA 7210 (SMA1000 series firmware)","versions":""},{"vendor":"SonicWall","product":"SMA 8200v (SMA1000 series)","versions":""}],"aiExposure":"Likely on the order of 10,000-100,000 deployed SMA1000-series appliances, with a smaller subset exposing the AMC to the internet; exact counts unknown — This estimate reflects SonicWall SMA's broad enterprise deployment and public internet-exposure scans showing thousands to tens of thousands of SonicWall SMA appliances reachable online, though the SMA1000 line is a subset of the wider SMA…","aiExposureScale":"moderate","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-83548","publishedAt":1788301033170,"modifiedAt":1788440776053,"description":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-441","CWE-918"],"vendors":["sonicwall"],"products":["sma8200v","sma6210 firmware","sma7210 firmware"],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548","tags":["US Government Resource"]}],"epssScore":0.04667,"epssPercentile":0.91256,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1788566400000,"kevRansomware":"Unknown","kevVendor":"SonicWall","kevProduct":"SMA1000 Appliances","kevName":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788307200000,"cna":"PSIRT@sonicwall.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface","aiSummary":"CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known.","aiAdvice":"Apply the fixes/mitigations from SonicWall security advisory AV26-872 (Update 1) immediately, prioritizing internet-exposed SMA 1000 appliances, and treat companion zero-day CVE-2026-83549 as requiring remediation in the same maintenance window. Review SMA 1000 logs for signs of exploitation (unexpected access to or requests against the Workplace interface) and reduce internet exposure of that interface where feasible. Per the CISA KEV required action and BOD 26-04, patch per vendor instructions or, where mitigations are unavailable, evaluate each asset's internet exposure and discontinue use of the product until remediated.","aiAffected":[{"vendor":"SonicWall","product":"SMA1000 appliance Workplace interface","versions":""},{"vendor":"SonicWall","product":"SMA 8200v","versions":""},{"vendor":"SonicWall","product":"SMA 6210 firmware","versions":""},{"vendor":"SonicWall","product":"SMA 7210 firmware","versions":""}],"aiExposure":"≈1,000–10,000 internet-exposed SMA 1000 appliances (order-of-magnitude estimate) — No published install count was in the source data; the estimate rests on SMA 1000 being SonicWall's higher-end enterprise remote-access line with a much smaller installed base than the SMB-oriented SMA 100 series, for which SonicWall has…","aiExposureScale":"moderate","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-82329","publishedAt":1787948421293,"modifiedAt":1788440775630,"description":"JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-287"],"vendors":["jfrog"],"products":["artifactory"],"references":[{"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","tags":["Release Notes"]},{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329","tags":["Third Party Advisory","US Government Resource"]}],"epssScore":0.07666,"epssPercentile":0.94254,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1788566400000,"kevRansomware":"Unknown","kevVendor":"JFrog","kevProduct":"Artifactory","kevName":"JFrog Artifactory Improper Authentication Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["https://github.com/0xTerror/CVE-2026-82329-JFrog-Artifactory-","https://github.com/tc4dy/CVE-2026-82329-PoC-Exploit"],"pocFirstSeenAt":1788785707000,"firstNewsAt":1788296753000,"cna":"reefs@jfrog.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access","aiSummary":"JFrog Artifactory contains an improper authentication flaw (CWE-287) that, under the product's default configuration, can let an unauthenticated attacker with network access obtain administrative privileges. The weakness is reachable over the network with no privileges or user interaction required, which is why it carries a critical 9.8 CVSS 3.1 score; an attacker who succeeds effectively gains full administrator control of the artifact repository, and public reporting describes attackers using the flaw to mint admin tokens days after disclosure. Any organization running JFrog Artifactory is in scope — CISA's entry lists the product without version detail, so deployments should verify their versions against JFrog's advisory (AV26-867, Update 1) — with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: CISA added the CVE to its Known Exploited Vulnerabilities Catalog on 2026-09-02, a public proof-of-concept is available, and news headlines report active exploitation alongside related Artifactory flaws CVE-2026-42016 and CVE-2026-42018.","aiAdvice":"Upgrade Artifactory to a fixed release per JFrog's advisory AV26-867 (Update 1) — the exact affected and fixed versions are not specified in this data, so check the advisory before patching. Until patched, restrict network access to the Artifactory UI and APIs to trusted sources (VPN/firewall allowlists) and review the instance for unauthorized admin tokens or accounts, as in-the-wield attackers have been minting admin tokens. CISA KEV stakeholders must apply mitigations in line with BOD 26-04 within the required timeline or discontinue use of the product.","aiAffected":[{"vendor":"jfrog","product":"artifactory","versions":""}],"aiExposure":"tens of thousands of deployments, many of them internet-exposed (estimate) — Estimate based on Artifactory's ubiquity as the dominant enterprise binary/artifact repository (the vendor reports thousands of corporate customers) and public internet-wide scans that have historically indexed tens of thousands of exposed…","aiExposureScale":"large","aiAt":1789094213534,"updatedAt":1789507039250},{"id":"CVE-2026-82078","publishedAt":1787933911240,"modifiedAt":1789345016777,"description":"An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.","cvssScore":9.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-470"],"vendors":["papercut"],"products":["papercut mf","papercut ng"],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/21842","tags":["Issue Tracking","Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078","tags":["Patch","Third Party Advisory","US Government Resource"]}],"epssScore":0.01691,"epssPercentile":0.7584,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788134400000,"kevDueDate":1789344000000,"kevRansomware":"Unknown","kevVendor":"PaperCut","kevProduct":"NG/MF","kevName":"PaperCut NG/MF Unsafe Reflection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787911752000,"cna":"eb41dac7-0af8-4f84-9f6d-0272772514f4","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks","aiSummary":"CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).","aiAdvice":"Upgrade PaperCut NG and MF to the patched release specified in PaperCut's security advisory (exact fixed versions were not provided in this data), prioritizing internet-exposed print servers; the KEV listing means agencies must remediate per CISA BOD 26-04 or discontinue/mitigate per its cloud-service guidance. Restrict the PaperCut web interface from direct internet exposure (VPN/allowlist), review administrator accounts and database driver configuration for tampering, and hunt for post-exploitation activity, since this flaw is being actively chained with the authentication bypass CVE-2026-81578.","aiAffected":[{"vendor":"PaperCut","product":"PaperCut NG","versions":""},{"vendor":"PaperCut","product":"PaperCut MF","versions":""}],"aiExposure":"≈100,000+ organizations / plausibly millions of end users (vendor-cited install base); tens of thousands of on-prem servers with a smaller but significant… — PaperCut markets NG/MF as a leading print-management platform used by over 100,000 organizations (education, enterprise, libraries), implying an end-user population in the millions, though only a fraction of on-prem print servers is…","aiExposureScale":"mass","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-81578","publishedAt":1787933909600,"modifiedAt":1789345016207,"description":"An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.","cvssScore":8.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"high","cwes":["CWE-305"],"vendors":["papercut"],"products":["papercut mf","papercut ng"],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/21842","tags":["Issue Tracking","Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578","tags":["Patch","Third Party Advisory","US Government Resource"]}],"epssScore":0.01617,"epssPercentile":0.74719,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788134400000,"kevDueDate":1789344000000,"kevRansomware":"Unknown","kevVendor":"PaperCut","kevProduct":"NG/MF","kevName":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787911752000,"cna":"eb41dac7-0af8-4f84-9f6d-0272772514f4","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Missing Authentication for Critical Function in PaperCut NG/MF Web Interface","aiSummary":"CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.","aiAdvice":"Apply the vendor's patches for PaperCut NG/MF per vendor instructions, as required by CISA BOD 26-04, ensuring the fix also covers companion CVE-2026-82078; prioritize internet-facing print servers. Until patched, restrict the PaperCut web management interface to trusted networks only. Given the active AI-orchestrated campaign hitting 395+ organizations, review PaperCut servers for unexpected configuration changes and other indicators of compromise.","aiAffected":[{"vendor":"PaperCut","product":"PaperCut MF","versions":""},{"vendor":"PaperCut","product":"PaperCut NG","versions":""}],"aiExposure":"tens of thousands of PaperCut NG/MF servers, plausibly ~10,000–100,000 internet-reachable instances across the ~100,000+ organizations reported to use PaperCut — PaperCut NG/MF is a widely deployed self-hosted print-management platform used by roughly 100,000+ organizations, and public internet scans of its web management interface routinely reveal tens of thousands of reachable servers.","aiExposureScale":"large","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-60004","publishedAt":1787775476010,"modifiedAt":1788890191000,"description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-94"],"vendors":["gitea"],"products":["gitea"],"references":[{"url":"https://blog.gitea.com/release-of-1.27.1/","tags":["Release Notes"]},{"url":"https://github.com/0xBlackash/CVE-2026-60004","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.runzero.com/blog/gitea/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004","tags":["US Government Resource"]}],"epssScore":0.86777,"epssPercentile":0.99732,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787616000000,"kevDueDate":1787875200000,"kevRansomware":"Unknown","kevVendor":"Gitea","kevProduct":"Gitea","kevName":"Gitea Code Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":4,"pocUrls":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004","https://github.com/0xBlackash/CVE-2026-60004","https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","https://github.com/erberkan/CVE-2026-60004-PoC"],"pocFirstSeenAt":1785450256000,"firstNewsAt":1785319140000,"cna":"cve@mitre.org","ghsaId":"GHSA-rcr6-4jqh-j84m","ghsaSeverity":"critical","ecosystems":["go"],"aiStatus":"done","aiTitle":"Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection","aiSummary":"Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.","aiAdvice":"Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.","aiAffected":[{"vendor":"Gitea","product":"Gitea","versions":"all versions before 1.27.1"}],"aiExposure":"≈8,300+ internet-exposed Gitea servers (public scan count) — Public internet-wide scans identified more than 8,300 Gitea servers vulnerable to this flaw; the total number of self-hosted instances, including internal-only deployments, is unknown but likely higher.","aiExposureScale":"moderate","aiAt":1789088213202,"updatedAt":1789507039250},{"id":"CVE-2026-72530","publishedAt":1787160061130,"modifiedAt":1787285895903,"description":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.","cvssScore":9.5,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-94"],"vendors":["trueconf"],"products":["trueconf server"],"references":[{"url":"https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/","tags":["Third Party Advisory"]},{"url":"https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530","tags":["US Government Resource"]}],"epssScore":0.01827,"epssPercentile":0.77663,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787184000000,"kevDueDate":1788393600000,"kevRansomware":"Unknown","kevVendor":"TrueConf","kevProduct":"Server","kevName":"TrueConf Server Code Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/"],"pocFirstSeenAt":null,"firstNewsAt":1787300570000,"cna":"vulnerability@kaspersky.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Code Injection Sandbox Escape in TrueConf Server Allows Host RCE via TCP 4307","aiSummary":"TrueConf Server contains a code injection flaw (CWE-94) that allows a remote, unauthenticated attacker with network access to TCP port 4307 to send a specially crafted script that breaks out of the server's isolated environment and executes arbitrary code on the underlying host. The flaw affects TrueConf Server 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases. A successful attack yields full code execution on the host system, not just the conferencing application, although the critical CVSS 4.0 score of 9.5 includes high attack complexity and attack-requirements factors. Organizations running self-hosted TrueConf video conferencing servers, especially those with port 4307 exposed to untrusted networks, are in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-20, a public PoC exists, and Kaspersky's Securelist reports the Head Mare threat actor has actively targeted TrueConf Server to deploy PhantomCore malware.","aiAdvice":"Upgrade TrueConf Server to a fixed release beyond the affected ranges (later than 5.5.5, per vendor instructions) as the primary remediation. Until patched, restrict access to TCP port 4307 so it is not reachable from untrusted networks and review server logs for signs of exploitation. U.S. federal agencies must apply these mitigations in accordance with BOD 26-04 following the KEV listing (added 2026-08-20), or discontinue use of the product if mitigations are unavailable.","aiAffected":[{"vendor":"TrueConf","product":"TrueConf Server","versions":"5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier versions"}],"aiExposure":"≈ low thousands of self-hosted server deployments; exact install base not published — TrueConf Server is a self-hosted enterprise video conferencing platform concentrated in Russian/CIS enterprise and government environments, implying deployments in the thousands rather than hundreds of thousands, with internet exposure…","aiExposureScale":"moderate","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-72529","publishedAt":1787160060990,"modifiedAt":1787285895753,"description":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.","cvssScore":9.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-306"],"vendors":["trueconf"],"products":["trueconf server"],"references":[{"url":"https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/","tags":["Third Party Advisory"]},{"url":"https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529","tags":["US Government Resource"]}],"epssScore":0.01554,"epssPercentile":0.73805,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787184000000,"kevDueDate":1787443200000,"kevRansomware":"Unknown","kevVendor":"TrueConf","kevProduct":"Server","kevName":"TrueConf Server Missing Authentication for Critical Function Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/"],"pocFirstSeenAt":null,"firstNewsAt":1787300570000,"cna":"vulnerability@kaspersky.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated RCE in TrueConf Server via undocumented function on port 4307","aiSummary":"CVE-2026-72529 is a missing-authentication vulnerability (CWE-306) in TrueConf Server that lets a remote, unauthenticated attacker reach an undocumented function over TCP port 4307 and execute an arbitrary script on the server. It is triggered simply by sending crafted requests to that port on an affected build, with no credentials or user interaction required. Successful exploitation yields code execution with high impact on the server's confidentiality, integrity, and availability (CVSS 4.0 base score 9.3). Any organization running TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, or earlier versions is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-20, and a public Kaspersky (Securelist) report documents the Head Mare threat actor targeting TrueConf Server with the PhantomCore backdoor, confirming in-the-wild exploitation; EPSS currently estimates a 1.6% chance of exploitation in the next 30 days.","aiAdvice":"Upgrade all TrueConf Server deployments to a release newer than 5.5.5 (the highest listed affected version) per vendor instructions, and until patched restrict access to TCP port 4307 from untrusted networks and confirm the server is not internet-exposed. Federal agencies must apply mitigations consistent with CISA BOD 26-04 or discontinue use of the product. Hunt for compromise indicators on affected servers, since Head Mare has been observed exploiting this flaw to deploy the PhantomCore backdoor.","aiAffected":[{"vendor":"TrueConf","product":"TrueConf Server","versions":"5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and all earlier versions"}],"aiExposure":"several thousand to tens of thousands of on-premises server deployments (exact count unknown) — No public install counts or internet-exposure scan data were provided, so the estimate is based on TrueConf Server's deployment pattern as a self-hosted enterprise videoconferencing product concentrated in the Russian/CIS market rather…","aiExposureScale":"moderate","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-19490","publishedAt":1787145465000,"modifiedAt":1789044490453,"description":"Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","cvssScore":9.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-288"],"vendors":["citrix"],"products":["netscaler application delivery controller","netscaler gateway"],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490","tags":["US Government Resource"]}],"epssScore":0.05597,"epssPercentile":0.92475,"epssAt":1789487838250,"kev":true,"kevAddedAt":1788912000000,"kevDueDate":1789171200000,"kevRansomware":"Unknown","kevVendor":"Citrix","kevProduct":"NetScaler","kevName":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://github.com/BishopFox/CVE-2026-19490-check"],"pocFirstSeenAt":1789053183000,"firstNewsAt":1787097600000,"cna":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway","aiSummary":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).","aiAdvice":"Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected.","aiAffected":[{"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","versions":"Not specified in available data; see Citrix advisory AL26-019 (also related to CVE-2026-19489) for affected and fixed releases"}],"aiExposure":"on the order of 10,000-100,000 internet-exposed NetScaler ADC/Gateway appliances — Public internet scans of NetScaler Gateway/ADC endpoints and the product's prevalence as an enterprise edge VPN and load-balancing appliance support this range, though only appliances configured as AAA virtual servers or Gateways are…","aiExposureScale":"large","aiAt":1788981717938,"updatedAt":1789505839162},{"id":"CVE-2026-64849","publishedAt":1787005043580,"modifiedAt":1787253417867,"description":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.","cvssScore":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvssVersion":"3.1","severity":"critical","cwes":["CWE-918"],"vendors":["lfprojects"],"products":["mlflow"],"references":[{"url":"https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","tags":["Patch"]},{"url":"https://github.com/mlflow/mlflow/issues/24179","tags":["Exploit","Issue Tracking","Mitigation"]},{"url":"https://github.com/mlflow/mlflow/pull/24258","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/mlflow/mlflow/releases/tag/v3.15.0","tags":["Release Notes"]},{"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849","tags":["US Government Resource"]}],"epssScore":0.1641,"epssPercentile":0.96799,"epssAt":1789484237952,"kev":true,"kevAddedAt":1787097600000,"kevDueDate":1788307200000,"kevRansomware":"Unknown","kevVendor":"MLflow","kevProduct":"MLflow","kevName":"MLflow Server-Side Request Forgery Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":3,"pocUrls":["https://github.com/isaca0315/CVE-2026-64849-poc-lab","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j"],"pocFirstSeenAt":null,"firstNewsAt":1787204931000,"cna":"security-advisories@github.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets","aiSummary":"MLflow versions prior to 3.15.0 contain a server-side request forgery flaw (CWE-918) in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The webhook URL is validated only for the original request, but delivery follows redirects and re-resolves the hostname without pinning the validated address, letting an attacker redirect server-side requests to internal network services or cloud instance metadata endpoints. Because the endpoint returns response_status and response_body, attackers can read internal service responses and, per public reporting, steal cloud credentials and secrets from metadata services. Any self-hosted MLflow deployment is affected, with internet-exposed servers at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-19, and headlines report active attacks stealing cloud credentials; EPSS puts 30-day exploitation probability at 16.4% (97th percentile).","aiAdvice":"Upgrade to MLflow 3.15.0 or later immediately, prioritizing any MLflow server reachable from the internet. Until patched, restrict network access to MLflow (especially the /api/2.0/mlflow/webhooks/{id}/test endpoint), place it behind authentication or a reverse proxy, and review webhook logs for unexpected test requests and cloud metadata endpoint access; rotate cloud credentials and secrets if compromise indicators are found. Federal agencies must apply vendor mitigations in accordance with CISA BOD 26-04 guidance or discontinue use if mitigations are unavailable.","aiAffected":[{"vendor":"lfprojects","product":"MLflow","versions":"All versions prior to 3.15.0 (fixed in 3.15.0)"}],"aiExposure":"likely thousands of internet-exposed MLflow servers, from a substantially larger installed base (estimate) — No install-base or public-scan counts were supplied in the data, so this is an estimate based on MLflow's popularity as a self-hosted open-source AI/ML platform, where public scans typically show thousands of exposed servers and many…","aiExposureScale":"moderate","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2026-73570","publishedAt":1786637946003,"modifiedAt":1787577557577,"description":"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.","cvssScore":8.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cvssVersion":"3.1","severity":"high","cwes":["CWE-78"],"vendors":["synacor"],"products":["zimbra collaboration suite"],"references":[{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570","tags":["US Government Resource"]}],"epssScore":0.32383,"epssPercentile":0.98234,"epssAt":1789484237952,"kev":true,"kevAddedAt":1787270400000,"kevDueDate":1787529600000,"kevRansomware":"Unknown","kevVendor":"Synacor","kevProduct":"Zimbra Collaboration Suite (ZCS)","kevName":"Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":4,"pocUrls":["https://github.com/juanpoch/CVE-2026-73570","https://github.com/hainhc/CVE-2026-73570","https://github.com/dahnutz/zimbra-cve-2026-73570-ir","https://github.com/gabrielunknown/CVE-2026-73570"],"pocFirstSeenAt":1787715014000,"firstNewsAt":1787303644000,"cna":"cve@mitre.org","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite","aiSummary":"CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.","aiAdvice":"Upgrade to Zimbra Collaboration Suite 10.1.20 or later per vendor instructions; as an interim mitigation, disable SNMP notifications or remove the zimbra-snmp package on hosts that do not need it. Federal operators must satisfy the CISA KEV/BOD 26-04 requirement, and all administrators of internet-facing Zimbra servers should hunt for signs of compromise (unexpected processes or persistence under the zimbra user) since unpatched systems are already being exploited.","aiAffected":[{"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","versions":"before 10.1.20 (when the optional zimbra-snmp package is installed and SNMP notifications are enabled)"}],"aiExposure":"≈10,000-50,000 internet-exposed ZCS servers, with only the subset running zimbra-snmp with notifications enabled actually vulnerable — Public internet scans have historically shown tens of thousands of exposed Zimbra servers across service providers, government, and education, but the optional SNMP-enabled condition narrows this to an unknown subset, so this is an…","aiExposureScale":"large","aiAt":1789093013498,"updatedAt":1789507039250},{"id":"CVE-2026-42018","publishedAt":1786558649473,"modifiedAt":1789186593587,"description":"JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssVersion":"3.1","severity":"high","cwes":["CWE-287"],"vendors":["jfrog"],"products":["artifactory"],"references":[{"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","tags":["Release Notes"]},{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018","tags":["US Government Resource"]},{"url":"https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","tags":["Third Party Advisory"]}],"epssScore":0.0092,"epssPercentile":0.58393,"epssAt":1789498638818,"kev":true,"kevAddedAt":1789084800000,"kevDueDate":1790294400000,"kevRansomware":"Unknown","kevVendor":"JFrog","kevProduct":"Artifactory","kevName":"JFrog Artifactory Improper Authentication Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1789067040000,"cna":"reefs@jfrog.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens","aiSummary":"JFrog Artifactory contains an improper authentication flaw (CWE-287) in which the server may return its internal anonymous-user token to an unauthenticated caller, even on instances where anonymous access is disabled. An attacker triggers the issue by sending unauthenticated requests to the affected Artifactory interface over the network; the vector requires no privileges or user interaction and is of low complexity. Successful abuse yields the internal anonymous-user token, which can then be used to reach sensitive resources (such as repositories or artifacts) that should be protected when anonymous access is disabled, with high confidentiality impact but no integrity or availability impact. Any organization running an affected JFrog Artifactory deployment - particularly those relying on disabled anonymous access as a control - is affected, though only instances where the vulnerable endpoint is reachable are actually exposed. Exploitation has been reported in the wild as part of an ongoing Artifactory attack campaign alongside CVE-2026-42016 and CVE-2026-82329, although there is no public PoC and the flaw is not yet in the CISA KEV catalog.","aiAdvice":"Upgrade Artifactory to the fixed release identified in JFrog's security advisory (JFrog is the assigning CNA; exact version numbers are not included in the available data). Until patched, restrict unauthenticated network access to Artifactory, verify the anonymous-access configuration, and review logs for unauthenticated requests that retrieved tokens or accessed sensitive resources. Because in-the-wild exploitation has been reported alongside CVE-2026-42016 and CVE-2026-82329, patch for all three and consider rotating internal/anonymous tokens and auditing artifact access.","aiAffected":[{"vendor":"JFrog","product":"Artifactory","versions":""}],"aiExposure":"≈ tens of thousands of deployments (only the subset with anonymous access disabled and a reachable endpoint is affected) — Artifactory is among the most widely deployed enterprise artifact repositories and public scans typically show tens of thousands of internet-exposed instances, but the flaw only applies where anonymous access is disabled, so this is an…","aiExposureScale":"large","aiAt":1789067812046,"updatedAt":1789505839162},{"id":"CVE-2026-66384","publishedAt":1786551434520,"modifiedAt":1787919707053,"description":"An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.","cvssScore":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssVersion":"3.1","severity":"medium","cwes":["CWE-22"],"vendors":["jfrog"],"products":["artifactory"],"references":[{"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","tags":["Vendor Advisory"]},{"url":"https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf","tags":["Technical Description"]},{"url":"https://openai.com/index/hugging-face-incident-and-the-road-ahead/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384","tags":["US Government Resource"]}],"epssScore":0.00579,"epssPercentile":0.45948,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787788800000,"kevDueDate":1788998400000,"kevRansomware":"Unknown","kevVendor":"JFrog","kevProduct":"Artifactory","kevName":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787832000000,"cna":"reefs@jfrog.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Authenticated Path Traversal Write in JFrog Artifactory Exploited in the Wild","aiSummary":"CVE-2026-66384 is a directory/path-restriction bypass (CWE-22) in JFrog Artifactory in which an authenticated user can write data outside the intended Docker cache path when specific remote-repository conditions are met. The attack is carried out over the network using valid low-privilege credentials and requires no user interaction, but the triggering conditions are specific enough that the CVSS vector rates exploit complexity as high. A successful attacker gains unauthorized modification of files outside the cache directory (integrity impact only per the CVSS vector, with no confidentiality or availability impact scored), potentially tampering with stored content or system files depending on the deployment. Any organization running JFrog Artifactory with Docker remote repositories is potentially affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild; no public proof-of-concept is known and ransomware use is not confirmed.","aiAdvice":"Check JFrog's security advisory for CVE-2026-66384 and upgrade Artifactory to the fixed release it specifies (no version numbers are provided in the available data). Because the flaw is on the CISA KEV list (added 2026-08-27), federal agencies must remediate per BOD 26-04 timelines or discontinue use, and all operators should review Docker remote-repository configurations for the triggering conditions and audit for unexpected writes outside the Docker cache path. Restricting authenticated Artifactory access to trusted users and CI systems limits exposure while patching is completed.","aiAffected":[{"vendor":"JFrog","product":"Artifactory","versions":""}],"aiExposure":"≈tens of thousands of deployments (order-of-magnitude; likely more counting internal-only installs) — Artifactory is a widely deployed enterprise artifact repository in both self-hosted and JFrog cloud form, with public internet scans historically showing on the order of tens of thousands of exposed instances and Docker remote repositories…","aiExposureScale":"large","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-65400","publishedAt":1786054694533,"modifiedAt":1789476432333,"description":"An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-287"],"vendors":["apple"],"products":["macos"],"references":[{"url":"https://support.apple.com/en-us/148170","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/148171","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/148172","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149035","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149042","tags":["Release Notes","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2026/Aug/36","tags":["Mailing List"]},{"url":"http://seclists.org/fulldisclosure/2026/Aug/37","tags":["Broken Link"]},{"url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400","tags":["US Government Resource"]}],"epssScore":0.10461,"epssPercentile":0.95488,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787011200000,"kevDueDate":1787270400000,"kevRansomware":"Unknown","kevVendor":"Apple","kevProduct":"macOS","kevName":"Apple macOS Improper Authentication Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1786374204000,"cna":"product-security@apple.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Authentication Bypass in Apple macOS Screen Sharing","aiSummary":"CVE-2026-65400 is a critical (CVSS 9.8) improper authentication flaw (CWE-287) in Apple macOS's Screen Sharing service, caused by an authentication state-management defect. An attacker who can reach a vulnerable Mac's Screen Sharing service over the network can authenticate without valid credentials, gaining full remote access with high impact to confidentiality, integrity, and availability. All three currently supported macOS branches are affected: Sequoia, Sonoma, and Tahoe, in versions prior to the fixed releases. The flaw is being actively exploited on the internet, with public reporting that attackers use the bypass to deploy Monero cryptominers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18. EPSS estimates a 9.9% probability of exploitation within 30 days (95th percentile).","aiAdvice":"Upgrade to macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, or macOS Tahoe 26.6.1 (or later) immediately; patching is mandatory for federal agencies under CISA BOD 26-04 given the KEV listing. As an interim mitigation, disable Screen Sharing or restrict it via firewall/VPN so VNC (port 5900) is not reachable from the internet. Review internet-exposed Macs for signs of compromise, especially unexplained Monero miner processes or abnormal CPU usage.","aiAffected":[{"vendor":"Apple","product":"macOS (Screen Sharing service)","versions":"supported macOS releases prior to the fixed builds listed below"},{"vendor":"Apple","product":"macOS Sequoia","versions":"all versions prior to 15.7.9"},{"vendor":"Apple","product":"macOS Sonoma","versions":"all versions prior to 14.8.9"},{"vendor":"Apple","product":"macOS Tahoe","versions":"all versions prior to 26.6.1"}],"aiExposure":"on the order of 100M+ Macs run affected macOS versions; the directly exploitable subset is Macs with Screen Sharing enabled and internet-reachable — macOS's roughly 10-15% share of a desktop installed base exceeding one billion devices implies more than 100 million Macs on the affected branches, though only systems with the Screen Sharing/VNC service (port 5900) enabled and exposed to…","aiExposureScale":"mass","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-59310","publishedAt":1785417413993,"modifiedAt":1787113044940,"description":"VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-22"],"vendors":["vmware"],"products":["vcenter server"],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","tags":["Vendor Advisory"]},{"url":"https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff","tags":["Third Party Advisory"]},{"url":"https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310","tags":["US Government Resource"]}],"epssScore":0.45878,"epssPercentile":0.98735,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787011200000,"kevDueDate":1787270400000,"kevRansomware":"Known","kevVendor":"Broadcom","kevProduct":"VMware vCenter","kevName":"Broadcom VMware vCenter Path Traversal Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1785330171000,"cna":"security@vmware.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog","aiSummary":"CVE-2026-59310 is a directory traversal (CWE-22) vulnerability in the Syslog server component of VMware vCenter Server, rated critical at CVSS 9.8. It can be triggered over the network without authentication or user interaction, allowing a malicious actor with network access to vCenter to achieve arbitrary code execution. An attacker who exploits it gains code execution on the vCenter appliance, and reported campaigns show it has been used to establish persistent remote access and, by a suspected China-nexus actor, to deploy Babuk ransomware. Any organization running an affected version of vCenter Server is exposed, especially where the management interface is reachable from the internet; the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18, it was reportedly exploited just five days after disclosure, and EPSS estimates a 45.9% probability of exploitation within 30 days (99th percentile).","aiAdvice":"Upgrade vCenter Server to the patched release identified in Broadcom's advisory (no specific version ranges are provided in this data) and prioritize any vCenter that is internet-facing, in line with CISA KEV and BOD 26-04 requirements for federal agencies. Until patched, restrict access to the vCenter management interface to trusted networks and verify whether the vCenter Syslog server is enabled. Hunt for compromise indicators, including unexplained remote-access persistence and Babuk ransomware artifacts, given the documented China-nexus exploitation.","aiAffected":[{"vendor":"Broadcom (VMware)","product":"vCenter Server","versions":""}],"aiExposure":"Approximately 50,000-100,000 internet-exposed vCenter Server instances, with total deployments (including internal-only) likely in the hundreds of thousands — vCenter is the dominant enterprise vSphere management platform, and public internet scan counts during previous vCenter vulnerability campaigns have consistently reported tens of thousands of exposed instances, with internal-only…","aiExposureScale":"large","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2026-42016","publishedAt":1785183399613,"modifiedAt":1789186592483,"description":"JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-863"],"vendors":["jfrog"],"products":["artifactory"],"references":[{"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","tags":["Release Notes"]},{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016","tags":["US Government Resource"]},{"url":"https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","tags":["Third Party Advisory"]}],"epssScore":0.00886,"epssPercentile":0.57342,"epssAt":1789498638818,"kev":true,"kevAddedAt":1789084800000,"kevDueDate":1790294400000,"kevRansomware":"Unknown","kevVendor":"JFrog","kevProduct":"Artifactory","kevName":"JFrog Artifactory Incorrect Authorization Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1789067040000,"cna":"reefs@jfrog.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory","aiSummary":"JFrog Artifactory (Self-Hosted) versions before 7.133.11 fail to validate a token's scope, checking only the token's signature and issuer, which constitutes an incorrect authorization flaw (CWE-863). A remote, authenticated user with low privileges can obtain or present a token whose scope is never verified, bypassing authorization checks and escalating to higher privileges. Successful attackers gain administrative control of the Artifactory instance; in observed attacks this flaw has been chained with CVE-2026-42018 and CVE-2026-82329 to bypass authentication, take admin control, and deploy backdoor malware. Only self-hosted Artifactory deployments are within the stated affected scope. Exploitation is confirmed in the wild and the vulnerability was added to CISA's KEV catalog on 2026-09-11, although no public proof-of-concept code is known.","aiAdvice":"Upgrade self-hosted Artifactory to version 7.133.11 or later immediately, in line with vendor instructions and CISA KEV/BOD 26-04 timelines. Audit issued tokens and logs for tokens carrying elevated scope granted to low-privilege users, and look for signs of compromise such as unexpected admin accounts or persistence, given reported backdoor deployments. Also patch CVE-2026-42018 and CVE-2026-82329, which attackers are chaining with this flaw.","aiAffected":[{"vendor":"JFrog","product":"Artifactory (Self-Hosted)","versions":"All versions before 7.133.11"}],"aiExposure":"tens of thousands of self-hosted instances (subset internet-exposed) — Artifactory is one of the most widely deployed binary repository managers among enterprise development teams, but the affected scope is limited to self-hosted installations, of which only a portion are internet-exposed, supporting an…","aiExposureScale":"large","aiAt":1789153017287,"updatedAt":1789505839162},{"id":"CVE-2026-9586","publishedAt":1784308638150,"modifiedAt":1788440785427,"description":"An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.","cvssScore":9.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-89"],"vendors":["sangoma"],"products":["switchvox"],"references":[{"url":"https://labs.sra.io/posts/switchvox/","tags":["Third Party Advisory"]},{"url":"https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026","tags":["Release Notes"]},{"url":"https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586","tags":["Third Party Advisory","US Government Resource"]}],"epssScore":0.11845,"epssPercentile":0.95859,"epssAt":1789485438053,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1788566400000,"kevRansomware":"Unknown","kevVendor":"Sangoma","kevProduct":"Switchvox","kevName":"Sangoma Switchvox SQL Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#"],"pocFirstSeenAt":null,"firstNewsAt":1788256860000,"cna":"57dba5dd-1a03-47f6-8b36-e84e47d335d8","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition","aiSummary":"Sangoma Switchvox SMB Edition 8.3 (build 104997) contains an unauthenticated SQL injection flaw (CWE-89) in its /pa endpoint, where the user-controlled PhoneIP value from XML input is concatenated directly into PostgreSQL queries without sanitization or parameterization. A single crafted request lets a remote, unauthenticated attacker execute arbitrary SQL statements against the backend PostgreSQL database, which can be escalated to remote code execution on the server. Any organization running the affected Switchvox SMB Edition build is exposed, especially appliances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-09-02, and researchers have observed attackers using it without credentials to deploy reverse shells and cryptocurrency miners.","aiAdvice":"Identify all Switchvox SMB Edition deployments and verify the running build (affected: 8.3, build 104997), then upgrade to the patched release specified in Sangoma's advisory. If patching is delayed, restrict or remove internet exposure of the Switchvox web interface, including the /pa endpoint. Hunt for indicators of compromise such as unexpected reverse shells, new processes, or crypto-miner activity, as active exploitation is confirmed and the flaw is on CISA's KEV catalog, making it subject to BOD 26-04 patching guidance for federal stakeholders.","aiAffected":[{"vendor":"Sangoma","product":"Switchvox SMB Edition","versions":"8.3 (build 104997)"}],"aiExposure":"likely on the order of thousands of on-prem PBX deployments (est.) — Switchvox is an on-premises SMB PBX typically deployed one instance per organization and commonly internet-exposed for remote telephony and web access; no public install counts or scan totals are provided in the data, so this is a…","aiExposureScale":"moderate","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2026-55040","publishedAt":1784053095413,"modifiedAt":1787113043540,"description":"Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.","cvssScore":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssVersion":"3.1","severity":"critical","cwes":["CWE-1390"],"vendors":["microsoft"],"products":["sharepoint server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/sfewer-r7/CVE-2026-55040","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/","tags":["US Government Resource"]}],"epssScore":0.50585,"epssPercentile":0.98851,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787011200000,"kevDueDate":1787270400000,"kevRansomware":"Unknown","kevVendor":"Microsoft","kevProduct":"SharePoint","kevName":"Microsoft SharePoint Weak Authentication Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["https://github.com/sfewer-r7/CVE-2026-55040","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040"],"pocFirstSeenAt":null,"firstNewsAt":1784073600000,"cna":"secure@microsoft.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Authentication Bypass in Microsoft SharePoint Server","aiSummary":"Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).","aiAdvice":"Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated.","aiAffected":[{"vendor":"Microsoft","product":"SharePoint Server","versions":""}],"aiExposure":"≈tens of thousands of internet-exposed SharePoint Server instances, within an installed base spanning hundreds of thousands of enterprise and government… — SharePoint Server is one of the most widely deployed on-premises collaboration platforms in enterprise and government environments, and public internet scans typically surface on the order of tens of thousands of exposed SharePoint…","aiExposureScale":"mass","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2026-59822","publishedAt":1783541817683,"modifiedAt":1788440759573,"description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.","cvssScore":8.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"high","cwes":["CWE-287","CWE-306"],"vendors":["litellm"],"products":["litellm"],"references":[{"url":"https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c","tags":["Patch"]},{"url":"https://github.com/BerriAI/litellm/pull/26463","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.84.0","tags":["Product","Release Notes"]},{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822","tags":["US Government Resource"]},{"url":"https://www.wiz.io/blog/ai-infrastructure-honeypot","tags":["Third Party Advisory"]}],"epssScore":0.0087,"epssPercentile":0.56878,"epssAt":1789485438053,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1789516800000,"kevRansomware":"Unknown","kevVendor":"BerriAI","kevProduct":"LiteLLM","kevName":"BerriAI LiteLLM Improper Authentication Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1788350400000,"cna":"security-advisories@github.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM","aiSummary":"BerriAI LiteLLM, a widely used self-hosted AI gateway and proxy server for calling LLM APIs, fails to properly authenticate requests to its MCP Streamable HTTP endpoint in versions prior to 1.84.0. An unauthenticated attacker can send a fabricated Authorization header that triggers an OAuth2 passthrough fallback, which replaces failed LiteLLM key validation with an empty UserAPIKeyAuth() object and lets the request reach MCP tooling without any valid LiteLLM key. Successful exploitation grants unauthenticated access to the gateway's MCP tooling with high confidentiality impact per the CVSS 4.0 score of 8.8, and public reporting describes attackers chaining LiteLLM weaknesses from authentication bypass to root code execution and cloud credential theft. Any organization running LiteLLM before 1.84.0 is affected, particularly gateways exposed to the internet. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02, while EPSS currently estimates a 0.9% probability of exploitation in the next 30 days.","aiAdvice":"Upgrade LiteLLM to version 1.84.0 or later immediately, in line with the CISA KEV required action and BOD 26-04 guidance for internet-exposed assets. Audit whether the MCP endpoint is reachable from the internet and check for signs of exploitation, including unexpected MCP tool calls, use of fabricated Authorization headers, and use of default or example admin keys such as 'sk-1234'. Until patched, restrict access to the MCP endpoint and review cloud credentials accessible from the gateway host for signs of theft or root-level activity.","aiAffected":[{"vendor":"BerriAI","product":"LiteLLM","versions":"all versions prior to 1.84.0 (fixed in 1.84.0)"}],"aiExposure":"on the order of thousands of internet-exposed LiteLLM gateway instances (estimate; no authoritative total) — Public internet-scan coverage of exposed LiteLLM gateways (e.g., reporting that roughly 1 in 10 exposed gateways accepted the example 'sk-1234' admin key) indicates a scan-visible population in the low thousands, consistent with LiteLLM…","aiExposureScale":"moderate","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-53362","publishedAt":1783167422113,"modifiedAt":1787948290133,"description":"In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 (\"ipv6: avoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-787","CWE-122"],"vendors":["linux"],"products":["linux kernel"],"references":[{"url":"https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e","tags":["Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362","tags":["US Government Resource"]}],"epssScore":0.0051,"epssPercentile":0.4208,"epssAt":1789484237952,"kev":true,"kevAddedAt":1787788800000,"kevDueDate":1788048000000,"kevRansomware":"Unknown","kevVendor":"Linux","kevProduct":"Kernel","kevName":"Linux Kernel Unspecified Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787832000000,"cna":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Out-of-Bounds Write in Linux Kernel IPv6 Stack via UDPv6 MSG_SPLICE_PAGES","aiSummary":"CVE-2026-53362 is an out-of-bounds write (CWE-787) in the Linux kernel's IPv6 output path: __ip6_append_data() mis-accounts fraggap bytes on the paged-allocation branch, leaving the new skb's linear area undersized so the copy of carried-over fragment-gap data spills past skb->end into the trailing skb_shared_info. An unprivileged local user can trigger the corruption by sending over a UDPv6 socket using MSG_MORE combined with MSG_SPLICE_PAGES; the bad accounting was introduced by commit 773ba4fe9104 ('ipv6: avoid partial copy for zc') and became triggerable when commit ce650a166335 allowed the MSG_SPLICE_PAGES case to proceed instead of returning -EINVAL. Successful triggering causes kernel memory corruption that, per the high confidentiality/integrity/availability scores, can lead to loss of data confidentiality, integrity and availability — potentially local privilege escalation or a system crash. Any Linux system running a kernel with the affected code is exposed; the source data provides no specific affected version numbers, only the introducing and trigger commits. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, indicating known in-the-wild exploitation (ransomware use unknown), with EPSS at 0.5% and no public PoC known.","aiAdvice":"Apply the kernel fix per vendor instructions: upgrade to Linux kernel builds containing the fraggap-accounting resolution for __ip6_append_data(), following CISA's BOD 26-04 patching requirements (for cloud services, follow BOD guidance or discontinue use if mitigations are unavailable); no fixed version numbers were provided in the source data, so confirm with your distribution/vendor that the fix commit is included. Until patched, prioritize multi-user hosts and systems where untrusted local users can open UDPv6 sockets, since exploitation requires local unprivileged access with MSG_MORE and MSG_SPLICE_PAGES. Track KEV-required remediation deadlines, as the flaw is cataloged as exploited in the wild (added 2026-08-27).","aiAffected":[{"vendor":"Linux","product":"Linux kernel","versions":""}],"aiExposure":"≈1 billion+ devices (Linux kernel ubiquity across servers, Android, cloud and embedded; exploitation requires local unprivileged access) — The flaw sits in the core IPv6 stack shipped in every Linux kernel, and Linux is the dominant kernel on internet-facing servers, Android handsets (on the order of billions of devices) and embedded systems, so any affected kernel with IPv6…","aiExposureScale":"mass","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-8452","publishedAt":1782825573450,"modifiedAt":1787804280787,"description":"Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server","cvssScore":8.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"high","cwes":["CWE-119"],"vendors":["citrix"],"products":["netscaler application delivery controller","netscaler gateway"],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452","tags":["US Government Resource"]}],"epssScore":0.01606,"epssPercentile":0.74555,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787702400000,"kevDueDate":1787961600000,"kevRansomware":"Unknown","kevVendor":"Citrix","kevProduct":"NetScaler ADC and NetScaler Gateway","kevName":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1783007390000,"cna":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild","aiSummary":"CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.","aiAdvice":"Upgrade NetScaler ADC and Gateway to the fixed releases identified in Citrix security advisory AV26-645 (Update 3); no fixed version numbers were included in this data, so consult the advisory directly. Prioritize any appliance with an internet-exposed Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, and given the KEV listing and reports of exploitation, perform log and forensics review for signs of prior compromise per CISA's Forensics Triage Requirements — federal agencies must comply with BOD 26-04 timelines. Where patching cannot happen immediately, restrict or disable exposed Gateway/AAA configurations as an interim mitigation.","aiAffected":[{"vendor":"Citrix","product":"NetScaler ADC","versions":""},{"vendor":"Citrix","product":"NetScaler Gateway","versions":""}],"aiExposure":"Tens of thousands of internet-exposed appliances (a Gateway/AAA-configured subset of the roughly 100k+ NetScaler devices visible in public internet scans) —… — NetScaler is a widely deployed enterprise edge and remote-access appliance with on the order of 100,000+ internet-exposed devices seen in public scans, and only appliances configured as Gateway (SSL VPN/ICA/CVPN/RDP) or AAA virtual servers…","aiExposureScale":"large","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-49869","publishedAt":1782512192113,"modifiedAt":1788440755387,"description":"Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-78","CWE-184","CWE-287","CWE-918"],"vendors":["kestra"],"products":["kestra"],"references":[{"url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869","tags":["US Government Resource"]}],"epssScore":0.01917,"epssPercentile":0.78751,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1788566400000,"kevRansomware":"Unknown","kevVendor":"Kestra","kevProduct":"Kestra OSS","kevName":"Kestra OSS OS Command Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"],"pocFirstSeenAt":null,"firstNewsAt":1788350400000,"cna":"security-advisories@github.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Authentication bypass leading to unauthenticated RCE in Kestra OSS","aiSummary":"CVE-2026-49869 is a critical (CVSS 3.1: 10.0) authentication bypass in the open-source Kestra event-driven orchestration platform: the AuthenticationFilter exempts the public configuration endpoint from Basic Auth using a suffix match (request paths ending in \"/configs\") rather than an exact path comparison. As a result, an unauthenticated remote attacker can call any API URL whose final path segment is \"configs\", which is enough to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly yields unauthenticated remote code execution as root inside the Kestra worker container. All Kestra OSS deployments prior to 1.0.45 and 1.3.21 are affected, with the greatest risk for instances whose API is reachable from the internet or untrusted networks. The flaw is being actively exploited: CISA added it to the KEV catalog on 2026-09-02 (EPSS 1.9%, percentile 79), and headlines covering the KEV batch report attackers deploying reverse shells and crypto miners.","aiAdvice":"Upgrade to Kestra 1.0.45 (for the 1.0.x line) or 1.3.21 (for the 1.3.x line), or later releases that incorporate the fix. If immediate patching is not possible, restrict network access to the Kestra API (firewall/ACL or a reverse proxy that enforces authentication for all paths, including any ending in /configs). Given active exploitation, audit instances for signs of compromise such as unexplained workflows, reverse shells, or cryptomining processes in worker containers; federal agencies must patch per CISA BOD 26-04 timelines.","aiAffected":[{"vendor":"kestra","product":"Kestra OSS (kestra)","versions":"All versions prior to 1.0.45 and prior to 1.3.21; fixed in 1.0.45 and 1.3.21"}],"aiExposure":"likely low thousands of internet-exposed Kestra instances (estimate; no authoritative install or scan counts in source data) — Kestra is a moderately adopted open-source orchestrator that is typically self-hosted and kept on internal networks, so based on typical deployment patterns only a fraction of its install base is directly internet-exposed, plausibly on the…","aiExposureScale":"moderate","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2026-48710","publishedAt":1779833804020,"modifiedAt":1788537569557,"description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssVersion":"3.1","severity":"medium","cwes":["CWE-444","CWE-1289"],"vendors":["encode","redhat"],"products":["starlette","ai inference server","ansible automation platform","migration toolkit for applications","openshift ai","openshift lightspeed","satellite","enterprise linux ai"],"references":[{"url":"https://badhost.org","tags":["Mitigation","Third Party Advisory"]},{"url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","tags":["Patch"]},{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","tags":["Vendor Advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml","tags":["Third Party Advisory"]},{"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.secwest.net/starlette","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22992","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22993","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23346","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26226","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34456","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34526","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34532","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43038","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44696","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51357","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63337","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48710","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.wiz.io/blog/ai-infrastructure-honeypot","tags":["Exploit","Third Party Advisory"]},{"url":"https:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points","tags":["Broken Link"]}],"epssScore":0.36257,"epssPercentile":0.98392,"epssAt":1789484237952,"kev":true,"kevAddedAt":1788307200000,"kevDueDate":1789516800000,"kevRansomware":"Unknown","kevVendor":"Kludex","kevProduct":"Starlette","kevName":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":3,"pocUrls":["https://www.secwest.net/starlette","https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette","https://www.wiz.io/blog/ai-infrastructure-honeypot"],"pocFirstSeenAt":null,"firstNewsAt":1788350400000,"cna":"security-advisories@github.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)","aiSummary":"Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days.","aiAdvice":"Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions.","aiAffected":[{"vendor":"Kludex (Encode)","product":"Starlette","versions":"All versions prior to 1.0.1"},{"vendor":"Red Hat","product":"AI Inference Server","versions":""},{"vendor":"Red Hat","product":"Ansible Automation Platform","versions":""},{"vendor":"Red Hat","product":"Migration Toolkit for Applications","versions":""},{"vendor":"Red Hat","product":"OpenShift AI","versions":""},{"vendor":"Red Hat","product":"OpenShift Lightspeed","versions":""},{"vendor":"Red Hat","product":"Satellite","versions":""},{"vendor":"Red Hat","product":"Enterprise Linux AI","versions":""}],"aiExposure":">1M library deployments (Starlette is the core ASGI dependency beneath FastAPI and much of the Python AI-serving stack, with hundreds of millions of monthly… — Starlette is one of the most-downloaded Python web packages and is embedded both directly and via frameworks and AI gateways (including LiteLLM-based services and the listed Red Hat products), making the installed base clearly in the…","aiExposureScale":"mass","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2026-33824","publishedAt":1776190654767,"modifiedAt":1787113018560,"description":"Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-415"],"vendors":["microsoft"],"products":["windows 10 1607","windows 10 1809","windows 10 21h2","windows 10 22h2","windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows server 2016","windows server 2019","windows server 2022","windows server 2022 23h2"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824","tags":["Vendor Advisory"]},{"url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824","tags":["US Government Resource"]}],"epssScore":0.72695,"epssPercentile":0.99414,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787011200000,"kevDueDate":1787270400000,"kevRansomware":"Unknown","kevVendor":"Microsoft","kevProduct":"Internet Key Exchange (IKE) Service Extensions","kevName":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1785425157000,"cna":"secure@microsoft.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension","aiSummary":"A double-free memory-corruption flaw (CWE-415) in the Microsoft Windows Internet Key Exchange (IKE) service extension allows a remote, unauthenticated attacker to trigger the bug with crafted network traffic, with no privileges or user interaction required. Successful exploitation yields remote code execution with full system impact, reflected in the critical 9.8 CVSS score (high confidentiality, integrity, and availability). The vulnerable IKE component is present in Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016, 2019, and 2022 (including 23H2), which ship it as a built-in feature. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-18, and security reporting confirms it is being actively exploited in the wild, though ransomware use is not yet confirmed. No public proof-of-concept is known, but the high EPSS score (72.7%, 99th percentile) signals a very strong likelihood of imminent or ongoing exploitation.","aiAdvice":"Apply Microsoft's security updates for CVE-2026-33824 to all affected Windows 10, Windows 11, and Windows Server releases, prioritizing internet-exposed systems where IKE/VPN is reachable (UDP 500/4500), per BOD 26-04 requirements. Organizations unable to patch promptly should restrict or discontinue use of exposed IKE/VPN services on affected hosts until updated. Triage VPN endpoints and remote-access servers for crashes or suspicious IKE traffic given confirmed in-the-wild exploitation.","aiAffected":[{"vendor":"Microsoft","product":"Windows 10","versions":"1607"},{"vendor":"Microsoft","product":"Windows 10","versions":"1809"},{"vendor":"Microsoft","product":"Windows 10","versions":"21H2"},{"vendor":"Microsoft","product":"Windows 10","versions":"22H2"},{"vendor":"Microsoft","product":"Windows 11","versions":"23H2"},{"vendor":"Microsoft","product":"Windows 11","versions":"24H2"},{"vendor":"Microsoft","product":"Windows 11","versions":"25H2"},{"vendor":"Microsoft","product":"Windows 11","versions":"26H1"},{"vendor":"Microsoft","product":"Windows Server","versions":"2016"},{"vendor":"Microsoft","product":"Windows Server","versions":"2019"},{"vendor":"Microsoft","product":"Windows Server","versions":"2022"},{"vendor":"Microsoft","product":"Windows Server","versions":"2022 (23H2)"}],"aiExposure":"well over 1B Windows devices include the built-in IKE extension; internet-exposed VPN/IKE endpoints plausibly number in the hundreds of thousands — IKE is a built-in Windows component present in every listed Windows 10/11/Server release, whose combined install base exceeds a billion devices, and the subset reachable over the network (VPN gateways and remote-access hosts) remains far…","aiExposureScale":"mass","aiAt":1789090613354,"updatedAt":1789505839162},{"id":"CVE-2026-20079","publishedAt":1772648184230,"modifiedAt":1789044497580,"description":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-288"],"vendors":["cisco"],"products":["secure firewall management center"],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2","tags":["Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2026/Aug/80","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079","tags":["US Government Resource"]}],"epssScore":0.75752,"epssPercentile":0.99494,"epssAt":1789490238314,"kev":true,"kevAddedAt":1788912000000,"kevDueDate":1789171200000,"kevRansomware":"Unknown","kevVendor":"Cisco","kevProduct":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","kevName":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["http://seclists.org/fulldisclosure/2026/Aug/80","https://blog.talosintelligence.com/fmc-ongoing-exploitation/"],"pocFirstSeenAt":null,"firstNewsAt":1785369600000,"cna":"psirt@cisco.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Authentication bypass to root access in Cisco Secure Firewall Management Center","aiSummary":"CVE-2026-20079 is an authentication bypass (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, caused by an improper system process created at boot time. An unauthenticated, remote attacker can exploit it by sending crafted HTTP requests to the FMC web interface, which allows the execution of script files and commands on the device. A successful exploit grants the attacker root access to the underlying operating system, giving full control of the management platform (CVSS 3.1: 10.0, network-exploitable, no privileges or user interaction required, scope changed). The flaw affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management deployments. Cisco has confirmed the vulnerability is being exploited in active attacks, it carries a 35.9% EPSS score (98th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.","aiAdvice":"Upgrade FMC (and SCC Firewall Management tenants) to the fixed release specified in Cisco's advisory, prioritizing internet-exposed or externally reachable management interfaces; CISA KEV action applies to federal agencies under BOD 26-04. Until patching, restrict FMC web interface access to trusted management networks and VPNs and check devices for signs of exploitation such as unexpected script execution, unfamiliar processes, or root-level changes. Triage per CISA's Forensics Triage Requirements if compromise is suspected.","aiAffected":[{"vendor":"Cisco","product":"Secure Firewall Management Center (FMC) Software (web interface)","versions":"Affected release ranges not specified in source data; consult the Cisco security advisory for affected and fixed versions"},{"vendor":"Cisco","product":"Security Cloud Control (SCC) Firewall Management","versions":"Affected release ranges not specified in source data; consult the Cisco security advisory for affected and fixed versions"}],"aiExposure":"plausibly tens of thousands of FMC deployments worldwide (internet-exposed instances likely a smaller subset, likely thousands) — FMC is the centralized management hub for Cisco Secure Firewall (formerly Firepower), one of the largest enterprise firewall installed bases, but Cisco does not publish deployment counts and FMC web interfaces are frequently kept on…","aiExposureScale":"large","aiAt":1789012176070,"updatedAt":1789505839162},{"id":"CVE-2026-21962","publishedAt":1768947359110,"modifiedAt":1787631491067,"description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvssVersion":"3.1","severity":"critical","cwes":["CWE-284"],"vendors":["oracle"],"products":["http server","weblogic server proxy plug-in"],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2026.html","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1","tags":["Broken Link","Not Applicable"]},{"url":"https://web.archive.org/web/20260129165916/https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1","tags":["Issue Tracking"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962","tags":["US Government Resource"]},{"url":"https://x.com/0xacb/status/2015473216844620280","tags":["Not Applicable"]}],"epssScore":0.4202,"epssPercentile":0.98615,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787529600000,"kevDueDate":1787788800000,"kevRansomware":"Unknown","kevVendor":"Oracle","kevProduct":"HTTP Server and Oracle Weblogic Server Proxy Plug-in","kevName":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787596969000,"cna":"secalert_us@oracle.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in","aiSummary":"CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (components: the plug-in for Apache HTTP Server and the plug-in for IIS), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can trivially exploit it, and the scope-change designation means a successful attack can significantly impact additional products beyond the plug-in itself. The attacker gains unauthorized access to critical data (potentially all accessible data) as well as the ability to create, delete, or modify critical data, reflected in the maximum CVSS 10.0 score with high confidentiality and integrity impacts and no availability impact. Organizations running the affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the Apache plug-in, and 12.2.1.4.0 only for the IIS plug-in - especially those with internet-facing Apache/IIS/OHS front ends proxying WebLogic applications, are exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-24, and EPSS assigns a 42% probability of exploitation within 30 days, though no public proof-of-concept is known.","aiAdvice":"Apply the fixes from Oracle's January 2026 quarterly update (advisory AV26-042) or later for Oracle HTTP Server and the WebLogic Server Proxy Plug-in on all affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 (IIS plug-in affected at 12.2.1.4.0 only). Prioritize internet-facing OHS, Apache and IIS front ends per CISA BOD 26-04 and the KEV required actions, and where patching is delayed, restrict HTTP access to trusted networks and review logs for signs of unauthorized data access or modification.","aiAffected":[{"vendor":"Oracle","product":"Oracle HTTP Server (Oracle Fusion Middleware)","versions":"12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0"},{"vendor":"Oracle","product":"Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server","versions":"12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0"},{"vendor":"Oracle","product":"Oracle WebLogic Server Proxy Plug-in for IIS","versions":"12.2.1.4.0"}],"aiExposure":"~10,000-100,000 internet-exposed Oracle HTTP Server / WebLogic proxy front ends — Public internet scans of Oracle HTTP Server and Apache/IIS servers proxying WebLogic typically surface on the order of tens of thousands of exposed hosts, with a broader installed base of internal enterprise deployments not directly…","aiExposureScale":"large","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2025-25249","publishedAt":1768324556910,"modifiedAt":1789044479933,"description":"A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-122","CWE-787"],"vendors":["fortinet","siemens"],"products":["fortios","fortiswitchmanager","fortisase","ruggedcom ape1808 firmware"],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-084","tags":["Vendor Advisory","Mitigation"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-864900.html","tags":["Third Party Advisory"]},{"url":"https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249","tags":["US Government Resource"]}],"epssScore":0.02403,"epssPercentile":0.83154,"epssAt":1789493838556,"kev":true,"kevAddedAt":1788912000000,"kevDueDate":1789171200000,"kevRansomware":"Unknown","kevVendor":"Fortinet","kevProduct":"Multiple Products","kevName":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/"],"pocFirstSeenAt":null,"firstNewsAt":1788861627000,"cna":"psirt@fortinet.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE","aiSummary":"CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.","aiAdvice":"Upgrade FortiOS, FortiSwitchManager, and FortiSASE in accordance with Fortinet's advisory (specific fixed versions are not listed in the available data), prioritizing internet-exposed FortiGate firewalls per CISA KEV and BOD 26-04 timelines. Hunt for signs of compromise, including custom Node.js malware and the PivotC2 RAT, on FortiGate devices, and review exposure and access logs for admin/SSL-VPN interfaces. If patching is not possible, apply vendor-recommended mitigations or, per BOD 26-04, discontinue use of the exposed product.","aiAffected":[{"vendor":"Fortinet","product":"FortiOS","versions":"not specified in available data"},{"vendor":"Fortinet","product":"FortiSwitchManager","versions":"not specified in available data"},{"vendor":"Fortinet","product":"FortiSASE","versions":"not specified in available data"}],"aiExposure":"≈300,000–500,000 internet-exposed FortiGate/FortiOS devices (plus FortiSASE cloud tenants) — Public internet scans (e.g., Shodan/Censys) routinely index hundreds of thousands of exposed Fortinet SSL-VPN/admin interfaces, and FortiOS is one of the most widely deployed firewall platforms, while FortiSwitchManager is far more niche.","aiExposureScale":"mass","aiAt":1788981717938,"updatedAt":1789505839162},{"id":"CVE-2025-62593","publishedAt":1764198947927,"modifiedAt":1787026600860,"description":"Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string \"Mozilla\" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.","cvssScore":9.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","severity":"critical","cwes":["CWE-94","CWE-352"],"vendors":["anyscale"],"products":["ray"],"references":[{"url":"https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09","tags":["Patch"]},{"url":"https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593","tags":["US Government Resource"]}],"epssScore":0.16888,"epssPercentile":0.96878,"epssAt":1789485438053,"kev":true,"kevAddedAt":1786924800000,"kevDueDate":1787184000000,"kevRansomware":"Unknown","kevVendor":"Ray-Project","kevProduct":"Ray","kevName":"Ray-Project Ray Code Injection Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":1,"pocUrls":["https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v"],"pocFirstSeenAt":null,"firstNewsAt":1787034860000,"cna":"security-advisories@github.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Actively Exploited Browser-Based RCE in Ray AI Compute Engine","aiSummary":"Ray, the open-source AI compute engine, is vulnerable to a critical remote code execution flaw (CVE-2025-62593, CWE-94/CWE-352) in versions prior to 2.52.0, caused by an insufficient guard against browser-based attacks: the software distinguishes browser traffic only by checking that the User-Agent header starts with 'Mozilla', but the fetch specification allows that header to be modified. An attacker can combine DNS rebinding with a crafted User-Agent so that a developer's Firefox or Safari browser silently sends malicious requests to locally running Ray services after the developer visits an attacker-controlled website or is served a malicious advertisement (malvertising). Successful exploitation yields full remote code execution on the machine running Ray, with high confidentiality, integrity and availability impact reflected in the CVSS 4.0 score of 9.4. Affected users are developers running Ray as a development tool on any version before 2.52.0, which is the fixed release. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-17, a public proof of concept is available in the project's GitHub security advisory (GHSA-q279-jhrf-cc6v), and EPSS estimates a 16.9% probability of exploitation in the next 30 days.","aiAdvice":"Upgrade Ray to version 2.52.0 or later immediately, in line with CISA KEV and BOD 26-04 patching requirements. Until patched, avoid browsing untrusted websites (including ad-serving pages) while Ray development services are running, and restrict network access to locally running Ray services. Focus triage on machines where developers use Firefox or Safari alongside Ray, and hunt for signs of compromise since the flaw is actively exploited.","aiAffected":[{"vendor":"Ray-Project (Anyscale)","product":"Ray","versions":"All versions prior to 2.52.0 (patched in 2.52.0)"}],"aiExposure":"Tens of thousands of developer machines/environments running vulnerable Ray (estimate) — No install counts or internet-exposure scan data were provided, so the order of magnitude is based on deployment patterns: Ray is a widely used open-source AI compute framework, but exploitation additionally requires a developer to be…","aiExposureScale":"large","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2023-49105","publishedAt":1700604908613,"modifiedAt":1787919669753,"description":"An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-287"],"vendors":["owncloud"],"products":["owncloud server"],"references":[{"url":"https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","tags":["Vendor Advisory"]},{"url":"https://owncloud.org/security","tags":["Product"]},{"url":"https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","tags":["Vendor Advisory"]},{"url":"https://owncloud.org/security","tags":["Product"]},{"url":"https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105","tags":["US Government Resource"]}],"epssScore":0.43205,"epssPercentile":0.9865,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787788800000,"kevDueDate":1788048000000,"kevRansomware":"Unknown","kevVendor":"ownCloud","kevProduct":"ownCloud","kevName":"ownCloud Improper Authentication Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787832000000,"cna":"cve@mitre.org","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Improper Authentication in ownCloud Server Allows Unauthenticated File Access","aiSummary":"ownCloud Server versions from 10.6.0 up to (but not including) 10.13.1 accept WebDAV pre-signed URLs even when no signing key is configured for the file owner, an improper authentication flaw (CWE-287). A remote attacker who knows a victim's username can therefore access, modify, or delete that user's files without any credentials, with no privileges or user interaction required (CVSS 9.8). Any organization running a self-hosted ownCloud Server instance in the affected version range is exposed, especially internet-facing deployments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild, and EPSS assigns a 43.2% probability of exploitation within 30 days (99th percentile). No public proof-of-concept code is known, but recent press reports of attacks against ownCloud (including theft of records at a Philippine research body) indicate active targeting of ownCloud flaws.","aiAdvice":"Upgrade to ownCloud Server 10.13.1 or later immediately, prioritizing internet-facing instances, as the flaw is on CISA's KEV list with BOD 26-04 patching deadlines. Until patched, configure signing keys for users where possible and restrict internet exposure of the pre-signed URL/WebDAV endpoints, and review server logs for unauthenticated file access, modification, or deletion tied to known usernames. If mitigations are not available for a given deployment, follow BOD 26-04 guidance for cloud services or discontinue use of the product.","aiAffected":[{"vendor":"ownCloud","product":"ownCloud Server (owncloud/core)","versions":"10.6.0 through all versions before 10.13.1; fixed in 10.13.1"}],"aiExposure":"likely on the order of tens of thousands of self-hosted server deployments worldwide (no authoritative public install counts) — ownCloud Server is a widely deployed self-hosted file sync and share platform used by enterprises, universities, and public-sector bodies, but since no authoritative install counts are available this order-of-magnitude estimate is based on…","aiExposureScale":"large","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2022-0995","publishedAt":1648235710520,"modifiedAt":1787804199223,"description":"An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-787"],"vendors":["linux","fedoraproject","netapp"],"products":["linux kernel","fedora","h300e firmware","h300s firmware","h410c firmware","h410s firmware","h500e firmware","h500s firmware","h610c firmware","h610s firmware","h615c firmware","h700e firmware"],"references":[{"url":"http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063786","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb","tags":["Patch","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220429-0001/","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063786","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb","tags":["Patch","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220429-0001/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0995","tags":["US Government Resource"]}],"epssScore":0.09518,"epssPercentile":0.9517,"epssAt":1789486638153,"kev":true,"kevAddedAt":1787702400000,"kevDueDate":1788912000000,"kevRansomware":"Unknown","kevVendor":"Linux","kevProduct":"Kernel","kevName":"Linux Kernel Out-of-Bounds Write Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html","http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html"],"pocFirstSeenAt":null,"firstNewsAt":1787788800000,"cna":"secalert@redhat.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation","aiSummary":"CVE-2022-0995 is an out-of-bounds (OOB) memory write in the Linux kernel's watch_queue event notification subsystem (CWE-787) that can overwrite parts of kernel state. A local user can trigger it through the watch_queue interface, for example by supplying a crafted event filter definition, causing the kernel to write beyond allocated memory when event notifications are processed. Successful exploitation may allow the local user to gain privileged (kernel/root) access or crash the system, yielding high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector). Affected systems include mainstream Linux kernels (Fedora is explicitly listed) and NetApp HCI appliance firmware products that ship the affected kernel. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, two public proof-of-concepts are available, and EPSS puts 30-day exploitation probability at 9.5% (95th percentile), though ransomware use is unconfirmed.","aiAdvice":"Apply updated kernels from your distribution or vendor (Fedora kernel updates; NetApp fixes are delivered via the HCI firmware updates in its security advisory) and prioritize internet-exposed, multi-user hosts per CISA BOD 26-04, including the required forensics triage checks. Because exploitation requires local access, restrict untrusted local code execution and shell access on unpatched systems, and hunt for signs of local privilege escalation on high-exposure hosts. After remediation, verify the patched kernel package is installed and that the running kernel has actually been booted into the fixed version.","aiAffected":[{"vendor":"Linux","product":"Linux kernel","versions":"Kernels shipping the watch_queue event notification subsystem prior to patched/upstream fixes (see distribution advisories for exact affected and fixed versions"},{"vendor":"Fedora Project","product":"Fedora","versions":"Fedora releases with affected kernel packages prior to the issued kernel updates (see Fedora/Red Hat advisories)"},{"vendor":"NetApp","product":"h300e firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h300s firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h410c firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h410s firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h500e firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h500s firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h610c firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h610s firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h615c firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"},{"vendor":"NetApp","product":"h700e firmware","versions":"Affected firmware versions per NetApp security advisory (fixed versions listed there)"}],"aiExposure":"millions of Linux systems (kernel flaw spans mainstream distributions, Fedora, and NetApp HCI appliance firmware; only builds with the watch_queue subsystem… — Estimated from the near-ubiquity of the Linux kernel across servers, cloud instances, and appliances, corroborated by the KEV listing and vendor CPEs covering both Fedora and the NetApp HCI fleet; the vulnerable watch_queue subsystem is…","aiExposureScale":"mass","aiAt":1789094213534,"updatedAt":1789505839162},{"id":"CVE-2021-23758","publishedAt":1638562507557,"modifiedAt":1787804198863,"description":"All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"critical","cwes":["CWE-502"],"vendors":["ajaxpro.2 project","michaelschwarz"],"products":["ajaxpro.2","ajax.net professional"],"references":[{"url":"http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html","tags":["Exploit","VDB Entry"]},{"url":"https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57","tags":["Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html","tags":["Exploit","VDB Entry"]},{"url":"https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57","tags":["Patch","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971","tags":["Third Party Advisory"]},{"url":"https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758","tags":["US Government Resource"]}],"epssScore":0.83633,"epssPercentile":0.99671,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787702400000,"kevDueDate":1788912000000,"kevRansomware":"Unknown","kevVendor":"Ajax.NET Professional","kevProduct":"Ajax.NET Professional","kevName":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":2,"pocUrls":["http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html","https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/"],"pocFirstSeenAt":null,"firstNewsAt":1787788800000,"cna":"report@snyk.io","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)","aiSummary":"Ajax.NET Professional (distributed as the ajaxpro.2 package) is vulnerable to insecure deserialization (CWE-502): it deserializes arbitrary .NET classes supplied by the client without validating which types may be instantiated. Because AjaxPro exposes HTTP endpoints for browser-to-server AJAX calls, a remote, unauthenticated attacker can send a crafted serialized payload to any reachable AjaxPro endpoint and abuse .NET deserialization gadget chains to execute code on the server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 9.8, network vector, no privileges or user interaction required). Any application running any version of ajaxpro.2 / Ajax.NET Professional is affected; the provided data specifies no fixed version, so defenders must rely on vendor guidance for patched releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, carries an EPSS 30-day exploitation probability of 83.6%, has public PoC code available, and Talos Intelligence reporting links it to the Chinese-speaking threat actor UAT-10147, which deploys the SPECTRE malware with an EDR bypass and a Linux rootkit in post-compromise operations.","aiAdvice":"Inventory your ASP.NET estate for AjaxPro usage (web.config references, AjaxPro HTTP handlers) and prioritize any internet-facing instance for remediation. Upgrade ajaxpro.2 to the latest vendor release per vendor instructions — the provided data specifies no fixed version — or, if patching is not immediately possible, restrict or block access to AjaxPro endpoints from the internet. Because the flaw is on CISA's KEV under BOD 26-04, apply mitigations within the required timeline and hunt exposed servers for post-compromise tooling, as Talos reports UAT-10147 deploying SPECTRE with an EDR bypass and a Linux rootkit.","aiAffected":[{"vendor":"michaelschwarz (ajaxpro.2 project)","product":"ajaxpro.2 (package)","versions":"All versions are vulnerable; no fixed version specified in the provided data"},{"vendor":"michaelschwarz","product":"Ajax.NET Professional","versions":"All versions are vulnerable; no fixed version specified in the provided data"}],"aiExposure":"unknown (no public install-base or internet-exposure counts available for this legacy library) — The provided data contains no download counts, active-install figures, or internet-exposed device scan results for the legacy Ajax.NET Professional / ajaxpro.2 library, which is typically embedded in aging ASP.NET applications whose…","aiExposureScale":"unknown","aiAt":1789089413303,"updatedAt":1789505839162},{"id":"CVE-2019-1068","publishedAt":1563218116983,"modifiedAt":1787804198583,"description":"A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","severity":"high","cwes":["CWE-20"],"vendors":["microsoft"],"products":["sql server","sql server 2016","sql server 2017"],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068","tags":["Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068","tags":["US Government Resource"]}],"epssScore":0.52845,"epssPercentile":0.9891,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787702400000,"kevDueDate":1787961600000,"kevRansomware":"Unknown","kevVendor":"Microsoft","kevProduct":"SQL Server","kevName":"Microsoft SQL Server Remote Code Execution Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787788800000,"cna":"secure@microsoft.com","ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Remote Code Execution in Microsoft SQL Server 2016 and 2017","aiSummary":"CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server caused by improper handling of the processing of internal functions (CWE-20, improper input validation). An attacker who can reach SQL Server over the network with low-privileged credentials can trigger the flawed code path and execute arbitrary code, gaining high confidentiality, integrity, and availability impact on the database host. Any organization running affected Microsoft SQL Server versions — including SQL Server 2016 and SQL Server 2017 — is affected. The flaw carries a high EPSS score (52.8% probability of exploitation within 30 days, 99th percentile) and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, with headlines reporting it being exploited in active attacks. No public proof-of-concept is known, but the in-the-wild exploitation documented by CISA makes patching urgent; the fix shipped in Microsoft's July 2019 Patch Tuesday security updates.","aiAdvice":"Apply Microsoft's July 2019 security updates (cumulative updates) for SQL Server 2016 and SQL Server 2017 as directed in the vendor advisory, and inventory all SQL Server instances — especially those reachable on TCP 1433 from the internet — prioritizing exposed or low-privilege-accessible instances. Given the KEV listing, CISA's BOD 26-04 requires patching per vendor instructions (or discontinuing use if mitigation is unavailable) on a prioritized timeline; restrict network access to SQL Server and confirm no unexpected low-privileged accounts or unusual process activity on database hosts as a triage check.","aiAffected":[{"vendor":"microsoft","product":"Microsoft SQL Server","versions":""},{"vendor":"microsoft","product":"SQL Server 2016","versions":""},{"vendor":"microsoft","product":"SQL Server 2017","versions":""}],"aiExposure":"millions of SQL Server deployments worldwide, with roughly 1M+ instances exposed on TCP 1433 in public internet scans — Microsoft SQL Server has one of the largest database installed bases globally and internet-wide scans routinely show on the order of a million or more SQL Server instances listening on port 1433, so the number of potentially affected…","aiExposureScale":"mass","aiAt":1789093013498,"updatedAt":1789505839162},{"id":"CVE-2015-5287","publishedAt":null,"modifiedAt":0,"description":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","cvssScore":null,"cvssVector":null,"cvssVersion":null,"severity":null,"cwes":null,"vendors":["Red Hat"],"products":["Automatic Bug Reporting Tool"],"references":null,"epssScore":0.04962,"epssPercentile":0.9171,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787702400000,"kevDueDate":1788912000000,"kevRansomware":"Unknown","kevVendor":"Red Hat","kevProduct":"Automatic Bug Reporting Tool","kevName":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787788800000,"cna":null,"ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Local Privilege Escalation via Symlink Attack in Red Hat ABRT","aiSummary":"CVE-2015-5287 is a privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool (ABRT) in which a local user with certain permissions can gain elevated privileges via a symlink attack against a file with a predictable name. Exploitation requires local access to an affected system; an attacker who triggers the flawed file-handling behavior can elevate their privileges on that machine. It affects deployments running ABRT, which ships by default with Red Hat Enterprise Linux and related distributions, including systems that may now be end-of-life or end-of-service. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-26, indicating exploitation has been observed in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile).","aiAdvice":"Prioritize remediation per CISA BOD 26-04: inventory systems running ABRT (including EoL/EoS hosts), apply the updated abrt packages from Red Hat's security advisories, and migrate unsupported releases to a supported version. Where patching is not feasible, restrict local access to affected systems or disable/remove ABRT if it is not needed. Assess each asset's internet exposure and local user access, and triage per CISA's Forensics Triage Requirements.","aiAffected":[{"vendor":"Red Hat","product":"Automatic Bug Reporting Tool (ABRT)","versions":""}],"aiExposure":"on the order of millions of installations (ABRT is installed by default on RHEL/CentOS/Fedora systems) — ABRT ships as a default component of Red Hat Enterprise Linux and related Fedora/CentOS distributions, so the installed base plausibly exceeds one million systems, though exploitation requires local access and no version range was provided.","aiExposureScale":"mass","aiAt":1789078612632,"updatedAt":1789505839162},{"id":"CVE-2015-3246","publishedAt":null,"modifiedAt":0,"description":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ","cvssScore":null,"cvssVector":null,"cvssVersion":null,"severity":null,"cwes":null,"vendors":["Red Hat"],"products":["Libuser"],"references":null,"epssScore":0.08799,"epssPercentile":0.94888,"epssAt":1789485438053,"kev":true,"kevAddedAt":1787702400000,"kevDueDate":1788912000000,"kevRansomware":"Unknown","kevVendor":"Red Hat","kevProduct":"Libuser","kevName":"Red Hat Libuser Race Condition Vulnerability","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","pocCount":0,"pocUrls":null,"pocFirstSeenAt":null,"firstNewsAt":1787788800000,"cna":null,"ghsaId":null,"ghsaSeverity":null,"ecosystems":null,"aiStatus":"done","aiTitle":"Race Condition in Red Hat libuser Allows Local Privilege Escalation","aiSummary":"CVE-2015-3246 is a race condition in Red Hat's libuser, the user-management library used by utilities that modify system accounts, that can cause corruption of the /etc/passwd file during concurrent account updates. An authenticated local user who triggers the race — typically by racing account-modification operations against one another — can desynchronize or corrupt the passwd file. Successful exploitation yields either a denial-of-service condition on the host or, in the privilege-escalation case, elevated (root-level) access by manipulating entries in /etc/passwd. Any Red Hat system shipping the vulnerable libuser library is affected, with risk concentrated on multi-user servers where untrusted local accounts exist. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, indicating it is being exploited in the wild, and EPSS assigns it an 8.8% probability of exploitation within 30 days (95th percentile); ransomware use is unknown and no public proof-of-concept is cataloged.","aiAdvice":"Update libuser to the fixed packages provided in Red Hat's security advisories across all RHEL/Fedora systems, prioritizing multi-user servers and any asset with untrusted local accounts, in line with CISA BOD 26-04 requirements (apply vendor mitigations or discontinue use of the product where mitigation is unavailable). Because exploitation requires local credentials, review which systems expose local login to non-administrators and check the integrity of /etc/passwd for signs of tampering. Confirm the patched library is active after update and monitor for further KEV-driven deadlines.","aiAffected":[{"vendor":"Red Hat","product":"libuser","versions":"Affected versions not enumerated in the source data; applies to libuser as shipped with Red Hat distributions and remediated via Red Hat security updates"}],"aiExposure":"on the order of millions of Red Hat Enterprise Linux/Fedora installations (libuser ships as a default user-management component) — libuser is a default component of Red Hat Enterprise Linux and Fedora system-account management, so the vulnerable install base is roughly the size of those distributions' installed base (millions of servers and workstations), though…","aiExposureScale":"mass","aiAt":1789078612632,"updatedAt":1789505839162}],"total":45,"page":1,"pageSize":50}