Vulnerabilities

Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.

Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.

CVE-2026-72898 is a critical SQL injection flaw (CWE-89, CVSS 4.0 score of 10) in Metabase, a widely used open-source business intelligence platform. A remote, unauthenticated attacker can send crafted input to the '/reset_password' database endpoint to inject arbitrary SQL into the underlying database. Successful exploitation grants the attacker administrator access to the connected Metabase instance, with confidentiality, integrity, and availability impacts rated high in the CVSS 4.0 vector. Any organization running an affected Metabase instance, particularly one exposed to the internet, is at risk. The flaw is a zero-day being exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11, and carries a 94.2% EPSS probability of exploitation within 30 days (100th percentile).

Do: Upgrade promptly to the fixed Metabase release identified in the vendor's security advisory (no version numbers were provided in the available data), as the flaw is being exploited in the wild and is on CISA's KEV list under BOD 26-04. Until patched, restrict internet access to Metabase and limit reachability of the '/reset_password' endpoint to trusted networks. Hunt for compromise by reviewing access logs for anomalous requests to the reset-password endpoint and checking for unexpected administrator accounts or changed admin credentials.

CVE-2026-18577 is an authentication bypass (CWE-288) in N-able's N-central RMM platform caused by an incomplete patch for the earlier vulnerability CVE-2026-18556. Because the original fix can be bypassed via an alternate path or channel, a remote, unauthenticated attacker needs no privileges or user interaction, though the attack requires meeting exploit-specific conditions (high attack complexity, CVSS 4.0: 8.2 High). Successful exploitation lets the attacker bypass authentication and take over N-central accounts, gaining high-impact access to the management console with limited direct effects on downstream services. All N-central versions through 2026.3.1 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-08-03, EPSS estimates a 54.1% chance of exploitation within 30 days (99th percentile), and news reports say attackers kept exploiting it even as N-able shipped successive hotfixes; ransomware use is currently unknown.

Do: Upgrade N-central to a fixed release or hotfix newer than 2026.3.1 following N-able's advisory — the vendor has issued multiple successive hotfixes for this and related N-central flaws, so verify you are on the latest build. Because the flaw is on CISA's KEV, federal and BOD 26-04-bound organizations must apply vendor mitigations promptly or discontinue use of the product if patching is unavailable. Limit internet exposure of N-central portals and review accounts for signs of takeover or unauthorized access.

CVE-2026-63077 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in JetBrains TeamCity, caused by deserialization of untrusted data (CWE-502) in the agent polling protocol. An attacker with network access to the TeamCity server, but no credentials of any kind, can send maliciously crafted serialized input to the agent polling endpoint and execute arbitrary code on the server. Successful exploitation yields full server takeover, exposing source code, build logs, stored secrets and credentials, and providing a pivot point into build agents and connected infrastructure; related headlines describe a real breach in which AWS credentials were extracted from an unpatched TeamCity instance. Organizations running TeamCity On-Premises in versions prior to the fixes (2025.11.7 or 2026.1.3, depending on branch) are affected, while the JetBrains-hosted cloud service is not indicated as impacted. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-05, EPSS is 86.5% (100th percentile), and no public PoC is known, meaning defenders cannot rely on public scanners alone and should assume sophisticated attackers are targeting exposed servers.

Do: Upgrade immediately to TeamCity 2025.11.7 or 2026.1.3, whichever branch you run; because the flaw is pre-authentication, also hunt for signs of compromise (unexpected builds or agents, new or modified admin users, altered build configurations, and leaked stored credentials/secrets) per vendor guidance, and restrict internet exposure of the TeamCity server until patched. Federal agencies must apply vendor mitigations or discontinue use per CISA BOD 26-04 and the KEV required action, including the Forensics Triage Requirements.

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw (CWE-95) in the vB5_Template_Runtime::runMaths() method of the template runtime, where an insufficiently restrictive regex filter fails to block phpfuck-style encoding of PHP payloads using permitted characters. An unauthenticated attacker triggers the flaw by sending crafted input in the pagenav[pagenumber] parameter to the unauthenticated ajax/render template route, causing attacker-controlled PHP code to be evaluated on the server. Successful exploitation yields arbitrary remote code execution in the context of the web application, with network-reachable high impact on confidentiality, integrity, and availability (CVSS 4.0 score 9.3, critical). Every installation running an affected vBulletin 5.x or 6.x release is exposed, since the vulnerable route requires no authentication. Exploitation has not yet been added to CISA KEV, but related coverage indicates a public exploit has been released, and the EPSS score of 70.8% (99th percentile) suggests a high likelihood of exploitation within the next 30 days.

Do: Upgrade all vBulletin 5.x and 6.x deployments to a vendor-patched release beyond 5.7.5 and 6.2.1 per the official vBulletin security advisory. Where immediate patching is not possible, restrict access to the ajax/render route and deploy WAF rules to flag or block suspicious phpfuck-style encoded input in the pagenav[pagenumber] parameter, and review access logs for exploitation attempts.

Check Point SmartConsole, the administrative client used to manage Quantum Security Management and Multi-Domain Security Management, contains an authentication bypass (CWE-287) in its login process that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation is possible when the Management Server IP address is reachable from the internet and the configuration does not restrict Trusted Clients. A successful attacker can modify security policies and security configurations, effectively taking control of firewall management. Any organization running an internet-exposed Check Point management server without Trusted Client restrictions is affected, though Check Point reports exploitation has impacted only a very small number of customers. The flaw was added to CISA's KEV on 2026-07-22, is actively exploited, and press reports indicate public proof-of-concept code has been released.

Do: Apply the fix released in Check Point's advisory for CVE-2026-16232 by updating SmartConsole and the associated Quantum/MDS management software; no fixed version numbers were provided in this data, so confirm them against the vendor bulletin. As an interim mitigation, restrict internet access to the Management Server IP address and configure Trusted Clients so SmartConsole connections are accepted only from known administrator addresses. Review management logs for unexpected logins, unauthenticated token issuance, or unfamiliar administrator sessions, and complete remediation per CISA BOD 26-04 given the KEV listing.

WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label.

Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.

IBM Langflow OSS 1.0.0 through 1.10.0 contains an unauthenticated code-injection flaw (CWE-94) that can be chained into full remote code execution. An attacker with network access first calls /api/v1/auto_login, which mints a SUPERUSER token to any caller without authentication, then calls /api/v1/validate/code, which executes attacker-supplied code via exec() on the Langflow host. Successful exploitation yields full control of the affected deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, network-exploitable with no privileges or user interaction required). Anyone running IBM Langflow OSS 1.0.0-1.10.0 is affected, especially default deployments reachable from untrusted networks. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-04, confirming active exploitation; EPSS estimates a 60.6% probability of exploitation within 30 days (99th percentile), and ransomware use is unknown.

Do: Upgrade IBM Langflow OSS to a release newer than 1.10.0 per IBM's ([email protected]) security advisory, as required under CISA's BOD 26-04 guidance for KEV entries; if mitigations are unavailable, discontinue use of the product per BOD 26-04. Until patched, restrict network access to the /api/v1/auto_login and /api/v1/validate/code endpoints (e.g., firewall rules or reverse-proxy controls) and avoid exposing the instance directly to the internet. Because exploitation is confirmed, review access logs for requests to these endpoints and signs of unauthenticated SUPERUSER token issuance or unexpected code execution.

CVE-2026-15409 is a server-side request forgery (SSRF, CWE-918) in the Appliance Work Place interface of SonicWall SMA1000 series appliances. A remote, unauthenticated attacker can trigger the flaw over the network, causing the appliance to issue requests to attacker-influenced or unintended internal locations. Because the CVSS vector scores scope-changed impacts on confidentiality, integrity, and availability, the SSRF is assessed as capable of reaching sensitive internal services, and reporting indicates it is being used alongside a second SMA1000 zero-day in what may be an exploitation chain. Affected organizations are those running SMA1000 appliances, including SMA 6210, SMA 7210, and SMA 8200v models, which typically act as internet-facing remote-access/VPN gateways. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-07-14, ransomware use is known, and EPSS assigns an 83.7% probability of exploitation within 30 days, though no public PoC is available.

Do: Apply SonicWall's SMA1000 firmware update per the vendor's instructions immediately, prioritizing appliances with the Appliance Work Place interface reachable from the internet. Because the flaw is in CISA's KEV with known ransomware use and may be chained with a second SMA1000 zero-day, hunt for signs of compromise (unexpected outbound or internal requests, anomalous VPN sessions, follow-on ransomware activity) and restrict internet exposure of the interface in the interim. Federal and critical-infrastructure operators must comply with CISA BOD 26-04, including cloud-service guidance, or discontinue use if mitigations are unavailable.

CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthenticated attacker to send maliciously crafted serialized data over the network and execute code on the server, reflected in its 9.8 critical CVSS score with no privileges or user interaction required. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, giving attackers a foothold for follow-on actions such as data theft, lateral movement, or ransomware. Any organization running on-premises SharePoint Server is in scope, particularly deployments reachable from untrusted networks; the required action notes stakeholders must evaluate each asset's internet exposure under CISA BOD 26-04. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-22 and security news headlines describe it as a critical RCE exploited in the wild, with some reports referencing exploitation after a public proof-of-concept release and an authentication bypass. The structured record lists no public PoC as confirmed, but an EPSS of 84.6% (100th percentile) underscores a very high near-term exploitation likelihood.

Do: Apply Microsoft's security updates for SharePoint Server immediately per the vendor advisory, as required under CISA's KEV listing and BOD 26-04, and prioritize any SharePoint deployments that are internet-facing (federal/critical-infrastructure operators must follow BOD 26-04 timelines or discontinue unmitigated use). Until patched, restrict public access to SharePoint endpoints (VPN, firewall rules, or reverse proxy) and review IIS/application logs and running processes for signs of unauthenticated deserialization abuse. Because some reports reference an authentication bypass being chained, also verify authentication paths and monitor for follow-on attacker activity after patching.

ServiceNow has patched a critical, unauthenticated remote code execution vulnerability (CWE-94, code injection) in the ServiceNow AI platform that is reachable over the network without credentials or user interaction, though exploitation requires certain circumstances to be met (CVSS 4.0 attack complexity is high). A remote attacker who successfully triggers the flaw can execute code within the ServiceNow platform, with potentially high impact on the confidentiality, integrity, and availability of the instance and its data. Both ServiceNow-hosted (SaaS) instances and self-hosted customer and partner deployments are affected; hosted instances were fixed via a centrally deployed security update, while self-hosted customers and partners must apply the provided security updates or patched family releases themselves. ServiceNow's advisory states it was not initially aware of exploitation, but subsequent security reporting indicates this pre-auth RCE has been exploited in the wild. There is no known public proof-of-concept and the flaw is not yet in CISA's KEV catalog, but EPSS assigns a 77.6% probability of exploitation within 30 days.

Do: Self-hosted customers and partners should immediately apply the released security updates or upgrade to the patched family releases, as specific affected version numbers were not disclosed. Hosted customers should verify with ServiceNow that their instance received the centrally deployed update and confirm their current patch level. Given reports of in-the-wild exploitation, review instance logs for signs of unauthenticated code execution and restrict external access to instances where feasible.

CVE-2026-48558 is an authentication bypass (CWE-347, improper verification of cryptographic signature) in the SimpleHelp remote access/support platform's OpenID Connect (OIDC) login flow, where submitted identity tokens are accepted without verifying their signature. It is triggered when OIDC authentication is configured: a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims and obtain a fully authenticated technician session, and in some configurations this also bypasses multi-factor authentication. Related reporting describes a path from this bypass to remote code execution. Only SimpleHelp deployments using OIDC-based (e.g., SSO) authentication are affected; deployments relying on local SimpleHelp accounts are not described as affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-29, confirming exploitation in the wild, with a 30% EPSS probability of exploitation within 30 days and no public proof-of-concept known.

Do: Update SimpleHelp to the latest release per vendor instructions, prioritizing any internet-facing server (CISA KEV listing means federal agencies must act under BOD 26-04). Until patched, restrict access to the SimpleHelp web login to trusted management networks (VPN/firewall) or temporarily switch from OIDC to local-account authentication with MFA. Verify whether OIDC is enabled on each instance and review technician login logs for sessions created with unusual or unexpected identity claims.

CVE-2026-20253 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the PostgreSQL sidecar service endpoint of Splunk Enterprise, which lacks authentication controls. Any unauthenticated user who can reach the endpoint over the network can invoke file operations without credentials, creating or truncating arbitrary files on the host; public research (watchTowr) and news coverage describe this leading to pre-authentication remote code execution. The flaw affects Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, while versions 9.4 and earlier are not affected. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-18, media reports indicate it is under active attack, and EPSS assigns a 96.9% probability of exploitation within 30 days.

Do: Upgrade to Splunk Enterprise 10.2.4 (10.2 track) or 10.0.7 (10 track) or later; Splunk Enterprise 9.4 and earlier are unaffected. If you cannot upgrade immediately, disable the PostgreSQL sidecar service per vendor guidance and ensure the endpoint is not reachable from untrusted networks. As a KEV entry, federal agencies must apply vendor mitigations in line with BOD 26-04 by the CISA deadline; audit whether the PostgreSQL sidecar service is enabled and whether it is exposed to the internet.

CVE-2026-25089 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox caused by improper neutralization of special elements in OS commands, allowing an unauthenticated attacker to execute unauthorized commands by sending specifically crafted HTTP requests to the product. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 score of 9.8), meaning any reachable instance — hardware/VM appliance, FortiSandbox Cloud, or FortiSandbox PaaS — is exposed to system-level command execution. Successful exploitation carries high impact to confidentiality, integrity, and availability on the sandbox itself and can serve as a foothold into the surrounding network. Organizations running FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, or 4.2 (all versions), as well as FortiSandbox Cloud 5.0.4–5.0.5 and FortiSandbox PaaS 5.0.4–5.0.5, are affected. The vulnerability is being actively exploited in the wild: CISA added it to the KEV catalog on 2026-07-16, EPSS assigns a 76.1% probability of exploitation within 30 days (100th percentile), and news coverage describes FortiSandbox bugs under active attack, though no public proof-of-concept is known.

Do: Upgrade FortiSandbox to a release beyond the affected ranges — newer than 5.0.5, 4.4.8, and 4.2 — and update FortiSandbox Cloud and PaaS beyond 5.0.5, following Fortinet's PSIRT advisory for the exact fixed versions (not specified in this data). Until patched, restrict the FortiSandbox management interface from direct internet exposure and review appliance logs for signs of command-injection exploitation. Organizations subject to CISA's KEV requirements must apply vendor mitigations per BOD 26-04 timelines or discontinue cloud use of the product if mitigations are unavailable.

Progress Kemp LoadMaster, the application delivery controller/load balancer sold by Progress Software (formerly Kemp), contains an unauthenticated OS command injection flaw (CWE-77) in its API: unsanitized input sent to multiple command endpoints allows arbitrary operating-system commands to be executed on the appliance. Because the affected endpoints require no authentication, any remote attacker with network access to the appliance's API or management interface can trigger the bug directly; public research by WatchTowr describes it as a pre-authentication RCE chain (involving uninitialized memory/quote handling) that can yield root-level command execution. Successful exploitation gives an attacker full control of the appliance, consistent with the Critical 9.8 CVSS 3.1 score (network-exploitable, no privileges or user interaction, high impact on confidentiality, integrity and availability). Organizations running Progress Kemp LoadMaster appliances are affected, especially those where the management or API interface is reachable from the internet. Exploitation is confirmed and ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-07 after 792 reported exploit attempts, and EPSS assigns a 99.6% probability of exploitation within 30 days.

Do: Upgrade LoadMaster to the fixed release identified in Progress's security advisory (fixed version numbers are not specified in this data). Until patched, restrict the LoadMaster API/management interface to trusted networks or VPN access, and review appliance logs for signs of unexpected command execution given confirmed in-the-wild exploitation. Because the flaw is on CISA's KEV catalog, US federal agencies must apply mitigations per BOD 26-04 by the required deadline — or discontinue use of the product if mitigations are unavailable — and evaluate each asset's internet exposure.

An unauthenticated server-side request forgery (SSRF) flaw exists in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), caused by improper input validation of specific HTTP requests. An attacker triggers it by sending a crafted HTTP request to the device's WebDialer service, which must be enabled for exploitation (it is disabled by default). Successful exploitation lets the attacker write files to the underlying operating system, which can later be used to elevate privileges to root — the reason Cisco assigned a Critical Security Impact Rating despite the 8.6 (High) CVSS base score. Organizations running affected Unified CM or Unified CM SME deployments, particularly those with WebDialer enabled and reachable from untrusted networks, are exposed. The flaw is being exploited in the wild: public exploit references appeared in mid-June 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-25, with EPSS indicating an ~88% probability of exploitation within 30 days.

Do: Upgrade affected Unified CM and Unified CM SME deployments to the fixed release cited in Cisco's advisory (specific version not provided in this dataset), prioritizing internet-exposed systems per CISA BOD 26-04 requirements. Confirm whether the WebDialer service is enabled and disable it if unused, or restrict network access to it. Check device logs for crafted HTTP requests hitting WebDialer endpoints and unexpected file writes on the underlying OS that could indicate prior exploitation.

CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft SharePoint Server in which an authorized (authenticated, low-privilege) attacker can submit crafted serialized data over the network, with no user interaction required, to execute code on the server. Successful exploitation carries high impact on confidentiality, integrity, and availability within the SharePoint service context, giving attackers a foothold for follow-on activity, and CISA notes that ransomware use is known. Organizations running on-premises Microsoft SharePoint Server are affected; the source data lists no specific version ranges, and the CPE scope (sharepoint server) points to the on-premises product rather than the Microsoft-managed SharePoint Online service. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-01 after active exploitation, and its EPSS score of 76.1% (100th percentile) indicates a high probability of near-term exploitation. The CVE record lists no public proof-of-concept, though related reporting describes exploitation activity following a public PoC release for a SharePoint authentication bypass.

Do: Apply Microsoft's current security updates for SharePoint Server following vendor instructions, prioritizing internet-facing servers, and comply with CISA BOD 26-04, which requires applying mitigations per vendor guidance (including the cited Forensics Triage Requirements) or discontinuing use of the product if mitigations are unavailable. Because in-the-wild exploitation and ransomware use are confirmed, triage exposed servers for compromise: review IIS/SharePoint logs for unexpected authenticated requests, look for webshells or newly modified files in SharePoint web roots, and check for unusual child processes spawned by the SharePoint application pool. Given related reporting on an authentication-bypass PoC, also verify that any related SharePoint authentication-bypass patches are…

CVE-2026-34910 is an improper input validation flaw (CWE-20) in Ubiquiti UniFi OS that allows command injection on affected gateways and network video recorders. A malicious actor with network access to the device can send crafted, unvalidated input that triggers arbitrary command execution, with no privileges or user interaction required (CVSS 3.1 base score 10.0, network vector, scope changed). Successful exploitation grants full control of the device — high confidentiality, integrity, and availability impact — and can serve as a foothold into the attached network. Affected products span the UniFi gateway and recording line: UniFi OS Server, Cloud Gateway Industrial, Dream Machine/Pro/Special Edition/Pro Max, Enterprise Fortress Gateway, Dream Wall, Dream Router and Dream Router 7, UniFi Express 7, and the UniFi Network Video Recorder. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, public reporting describes in-the-wild exploitation being used to build a Mirai botnet, and EPSS estimates an 87.5% chance of exploitation within 30 days.

Do: Upgrade all listed UniFi OS devices to the fixed firmware in Ubiquiti's June 2026 security advisory (consult the vendor advisory for exact fixed versions per product), and per CISA BOD 26-04 patch within the required window or discontinue use of affected cloud-reachable assets. Restrict device management interfaces (UniFi Network UI, SSH, API) to trusted networks and audit internet-facing gateways for signs of compromise, including Mirai botnet traffic or unexpected outbound connections.

A double-free memory-corruption flaw (CWE-415) in the Microsoft Windows Internet Key Exchange (IKE) service extension allows a remote, unauthenticated attacker to trigger the bug with crafted network traffic, with no privileges or user interaction required. Successful exploitation yields remote code execution with full system impact, reflected in the critical 9.8 CVSS score (high confidentiality, integrity, and availability). The vulnerable IKE component is present in Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016, 2019, and 2022 (including 23H2), which ship it as a built-in feature. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-18, and security reporting confirms it is being actively exploited in the wild, though ransomware use is not yet confirmed. No public proof-of-concept is known, but the high EPSS score (72.7%, 99th percentile) signals a very strong likelihood of imminent or ongoing exploitation.

Do: Apply Microsoft's security updates for CVE-2026-33824 to all affected Windows 10, Windows 11, and Windows Server releases, prioritizing internet-exposed systems where IKE/VPN is reachable (UDP 500/4500), per BOD 26-04 requirements. Organizations unable to patch promptly should restrict or discontinue use of exposed IKE/VPN services on affected hosts until updated. Triage VPN endpoints and remote-access servers for crashes or suspicious IKE traffic given confirmed in-the-wild exploitation.

CVE-2026-39808 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox versions 4.4.0 through 4.4.8, caused by improper neutralization of special elements passed to OS commands. The vulnerability is network-reachable, requires no privileges or user interaction (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), though CISA's description does not specify the exact entry point that a remote unauthenticated attacker abuses to trigger it. Successful exploitation lets the attacker execute unauthorized code or commands on the appliance, with high impact to confidentiality, integrity, and availability. Any organization running FortiSandbox 4.4.0-4.4.8 is affected; these sandboxing appliances are typically deployed as add-ons to enterprise FortiGate security estates. The flaw was added to CISA's KEV on 2026-07-16, and press coverage describes critical FortiSandbox bugs coming under active attack, so in-the-wild exploitation should be assumed.

Do: Upgrade all FortiSandbox appliances out of the affected 4.4.0-4.4.8 range to a fixed release per Fortinet's advisory, prioritizing internet-exposed units and complying with the CISA KEV required action (added 2026-07-16) and BOD 26-04 guidance. Until patched, restrict network access to the appliance's management and analysis interfaces and triage for signs of command execution such as unexpected processes or outbound connections. Confirm the specific fixed 4.4.x build in Fortinet's PSIRT advisory before scheduling upgrades.

CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat in which the EncryptInterceptor, the component that encrypts Tomcat cluster communication, can be bypassed in a fail-open manner; the flaw was introduced as a regression by the fix for CVE-2026-29146. It affects Tomcat 11.0.20, 10.1.53 and 9.0.116, and is triggered when cluster communication is expected to be encrypted: an attacker positioned on the network path between cluster nodes receives inter-node traffic in cleartext. By reading that unencrypted traffic, the attacker can obtain sensitive data such as session payloads, potentially enabling session theft and authentication bypass as indicated by related reporting. Only deployments running the affected point releases with the EncryptInterceptor in use are impacted, including Tomcat shipped in Red Hat JBoss Web Server and Red Hat Enterprise Linux channels. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-04, EPSS places 30-day exploitation probability at 98.6%, though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Upgrade Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117, and apply the corresponding Red Hat JBoss Web Server / Enterprise Linux updates when published. Audit Tomcat cluster configurations for EncryptInterceptor usage, and until patched restrict or encrypt the network segment carrying inter-node cluster traffic. Because the flaw is in CISA's KEV catalog, federal agencies must patch per BOD 26-04 timelines and should review cluster nodes for signs of session data interception.

CVE-2026-20079 is an authentication bypass (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, caused by an improper system process created at boot time. An unauthenticated, remote attacker can exploit it by sending crafted HTTP requests to the FMC web interface, which allows the execution of script files and commands on the device. A successful exploit grants the attacker root access to the underlying operating system, giving full control of the management platform (CVSS 3.1: 10.0, network-exploitable, no privileges or user interaction required, scope changed). The flaw affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management deployments. Cisco has confirmed the vulnerability is being exploited in active attacks, it carries a 35.9% EPSS score (98th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.

Do: Upgrade FMC (and SCC Firewall Management tenants) to the fixed release specified in Cisco's advisory, prioritizing internet-exposed or externally reachable management interfaces; CISA KEV action applies to federal agencies under BOD 26-04. Until patching, restrict FMC web interface access to trusted management networks and VPNs and check devices for signs of exploitation such as unexpected script execution, unfamiliar processes, or root-level changes. Triage per CISA's Forensics Triage Requirements if compromise is suspected.

CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, an open-source visual builder for LLM and AI agent workflows. The flaw, categorized as CWE-829 (inclusion of functionality from an untrusted control sphere), resides in how the exec_globals parameter supplied to the validate endpoint is handled, allowing code or resources from an untrusted control sphere to be included and executed. A remote attacker with no credentials can send a crafted request to that endpoint and execute arbitrary code in the context of root on the affected installation. Any deployment of an affected Langflow version is exposed, with internet-facing self-hosted or containerized instances at greatest risk. The issue was disclosed through Trend Micro's Zero Day Initiative (ZDI-CAN-27325) and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, confirming active in-the-wild exploitation; no public proof-of-concept is known.

Do: Apply the vendor's patched Langflow release and any prescribed mitigations per CISA guidance; because exploitation requires no authentication and executes as root, prioritize internet-exposed instances immediately (EPSS is high at 63.4%). Per BOD 26-04, if mitigations or updates are unavailable for a given deployment, discontinue use of the product. Review access logs for unexpected unauthenticated requests to the validate endpoint containing crafted exec_globals parameters, and restrict network exposure of Langflow instances until patched.

Ajax.NET Professional (distributed as the ajaxpro.2 package) is vulnerable to insecure deserialization (CWE-502): it deserializes arbitrary .NET classes supplied by the client without validating which types may be instantiated. Because AjaxPro exposes HTTP endpoints for browser-to-server AJAX calls, a remote, unauthenticated attacker can send a crafted serialized payload to any reachable AjaxPro endpoint and abuse .NET deserialization gadget chains to execute code on the server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 9.8, network vector, no privileges or user interaction required). Any application running any version of ajaxpro.2 / Ajax.NET Professional is affected; the provided data specifies no fixed version, so defenders must rely on vendor guidance for patched releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, carries an EPSS 30-day exploitation probability of 83.6%, has public PoC code available, and Talos Intelligence reporting links it to the Chinese-speaking threat actor UAT-10147, which deploys the SPECTRE malware with an EDR bypass and a Linux rootkit in post-compromise operations.

Do: Inventory your ASP.NET estate for AjaxPro usage (web.config references, AjaxPro HTTP handlers) and prioritize any internet-facing instance for remediation. Upgrade ajaxpro.2 to the latest vendor release per vendor instructions — the provided data specifies no fixed version — or, if patching is not immediately possible, restrict or block access to AjaxPro endpoints from the internet. Because the flaw is on CISA's KEV under BOD 26-04, apply mitigations within the required timeline and hunt exposed servers for post-compromise tooling, as Talos reports UAT-10147 deploying SPECTRE with an EDR bypass and a Linux rootkit.

CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server caused by improper handling of the processing of internal functions (CWE-20, improper input validation). An attacker who can reach SQL Server over the network with low-privileged credentials can trigger the flawed code path and execute arbitrary code, gaining high confidentiality, integrity, and availability impact on the database host. Any organization running affected Microsoft SQL Server versions — including SQL Server 2016 and SQL Server 2017 — is affected. The flaw carries a high EPSS score (52.8% probability of exploitation within 30 days, 99th percentile) and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, with headlines reporting it being exploited in active attacks. No public proof-of-concept is known, but the in-the-wild exploitation documented by CISA makes patching urgent; the fix shipped in Microsoft's July 2019 Patch Tuesday security updates.

Do: Apply Microsoft's July 2019 security updates (cumulative updates) for SQL Server 2016 and SQL Server 2017 as directed in the vendor advisory, and inventory all SQL Server instances — especially those reachable on TCP 1433 from the internet — prioritizing exposed or low-privilege-accessible instances. Given the KEV listing, CISA's BOD 26-04 requires patching per vendor instructions (or discontinuing use if mitigation is unavailable) on a prioritized timeline; restrict network access to SQL Server and confirm no unexpected low-privileged accounts or unusual process activity on database hosts as a triage check.