Vulnerabilities

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.

Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.

Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.

MLflow versions prior to 3.15.0 contain a server-side request forgery flaw (CWE-918) in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The webhook URL is validated only for the original request, but delivery follows redirects and re-resolves the hostname without pinning the validated address, letting an attacker redirect server-side requests to internal network services or cloud instance metadata endpoints. Because the endpoint returns response_status and response_body, attackers can read internal service responses and, per public reporting, steal cloud credentials and secrets from metadata services. Any self-hosted MLflow deployment is affected, with internet-exposed servers at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-19, and headlines report active attacks stealing cloud credentials; EPSS puts 30-day exploitation probability at 16.4% (97th percentile).

Do: Upgrade to MLflow 3.15.0 or later immediately, prioritizing any MLflow server reachable from the internet. Until patched, restrict network access to MLflow (especially the /api/2.0/mlflow/webhooks/{id}/test endpoint), place it behind authentication or a reverse proxy, and review webhook logs for unexpected test requests and cloud metadata endpoint access; rotate cloud credentials and secrets if compromise indicators are found. Federal agencies must apply vendor mitigations in accordance with CISA BOD 26-04 guidance or discontinue use if mitigations are unavailable.

CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.

Do: Upgrade to Zimbra Collaboration Suite 10.1.20 or later per vendor instructions; as an interim mitigation, disable SNMP notifications or remove the zimbra-snmp package on hosts that do not need it. Federal operators must satisfy the CISA KEV/BOD 26-04 requirement, and all administrators of internet-facing Zimbra servers should hunt for signs of compromise (unexpected processes or persistence under the zimbra user) since unpatched systems are already being exploited.

CVE-2026-72898 is a critical SQL injection flaw (CWE-89, CVSS 4.0 score of 10) in Metabase, a widely used open-source business intelligence platform. A remote, unauthenticated attacker can send crafted input to the '/reset_password' database endpoint to inject arbitrary SQL into the underlying database. Successful exploitation grants the attacker administrator access to the connected Metabase instance, with confidentiality, integrity, and availability impacts rated high in the CVSS 4.0 vector. Any organization running an affected Metabase instance, particularly one exposed to the internet, is at risk. The flaw is a zero-day being exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11, and carries a 94.2% EPSS probability of exploitation within 30 days (100th percentile).

Do: Upgrade promptly to the fixed Metabase release identified in the vendor's security advisory (no version numbers were provided in the available data), as the flaw is being exploited in the wild and is on CISA's KEV list under BOD 26-04. Until patched, restrict internet access to Metabase and limit reachability of the '/reset_password' endpoint to trusted networks. Hunt for compromise by reviewing access logs for anomalous requests to the reset-password endpoint and checking for unexpected administrator accounts or changed admin credentials.

CVE-2026-65400 is a critical (CVSS 9.8) improper authentication flaw (CWE-287) in Apple macOS's Screen Sharing service, caused by an authentication state-management defect. An attacker who can reach a vulnerable Mac's Screen Sharing service over the network can authenticate without valid credentials, gaining full remote access with high impact to confidentiality, integrity, and availability. All three currently supported macOS branches are affected: Sequoia, Sonoma, and Tahoe, in versions prior to the fixed releases. The flaw is being actively exploited on the internet, with public reporting that attackers use the bypass to deploy Monero cryptominers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18. EPSS estimates a 9.9% probability of exploitation within 30 days (95th percentile).

Do: Upgrade to macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, or macOS Tahoe 26.6.1 (or later) immediately; patching is mandatory for federal agencies under CISA BOD 26-04 given the KEV listing. As an interim mitigation, disable Screen Sharing or restrict it via firewall/VPN so VNC (port 5900) is not reachable from the internet. Review internet-exposed Macs for signs of compromise, especially unexplained Monero miner processes or abnormal CPU usage.

CVE-2026-18577 is an authentication bypass (CWE-288) in N-able's N-central RMM platform caused by an incomplete patch for the earlier vulnerability CVE-2026-18556. Because the original fix can be bypassed via an alternate path or channel, a remote, unauthenticated attacker needs no privileges or user interaction, though the attack requires meeting exploit-specific conditions (high attack complexity, CVSS 4.0: 8.2 High). Successful exploitation lets the attacker bypass authentication and take over N-central accounts, gaining high-impact access to the management console with limited direct effects on downstream services. All N-central versions through 2026.3.1 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-08-03, EPSS estimates a 54.1% chance of exploitation within 30 days (99th percentile), and news reports say attackers kept exploiting it even as N-able shipped successive hotfixes; ransomware use is currently unknown.

Do: Upgrade N-central to a fixed release or hotfix newer than 2026.3.1 following N-able's advisory — the vendor has issued multiple successive hotfixes for this and related N-central flaws, so verify you are on the latest build. Because the flaw is on CISA's KEV, federal and BOD 26-04-bound organizations must apply vendor mitigations promptly or discontinue use of the product if patching is unavailable. Limit internet exposure of N-central portals and review accounts for signs of takeover or unauthorized access.

N-able's N-central RMM platform contains an authentication bypass (CWE-288) in which an alternate path or channel allows requests to skip the normal authentication check. An unauthenticated attacker can trigger it by sending requests through that alternate path without valid credentials, gaining unauthorized access to the N-central management interface; because N-central is remote monitoring and management software run by managed service providers, such access can expose management functions across downstream customer environments. N-able N-central deployments are affected; the available data does not specify affected version ranges or fixed builds. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-04, confirming exploitation in the wild, with a high EPSS of 40.2% (99th percentile), no CVSS score yet, no public PoC, and undetermined ransomware use; related reporting describes a recent string of N-central hotfixes, including fixes for unauthenticated remote code execution.

Do: Apply N-able's hotfix for N-central immediately per the vendor's instructions, since the flaw is in CISA KEV and BOD 26-04 applies (for cloud-hosted N-central, apply mitigations per BOD 26-04 or discontinue use if mitigations are unavailable). Until patched, restrict internet exposure of the N-central server to trusted management networks and review authentication logs for unexpected access, following CISA's forensics triage guidance. Check the vendor advisory for the exact fixed build, as the available data does not list affected or fixed version numbers.

CVE-2026-59310 is a directory traversal (CWE-22) vulnerability in the Syslog server component of VMware vCenter Server, rated critical at CVSS 9.8. It can be triggered over the network without authentication or user interaction, allowing a malicious actor with network access to vCenter to achieve arbitrary code execution. An attacker who exploits it gains code execution on the vCenter appliance, and reported campaigns show it has been used to establish persistent remote access and, by a suspected China-nexus actor, to deploy Babuk ransomware. Any organization running an affected version of vCenter Server is exposed, especially where the management interface is reachable from the internet; the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18, it was reportedly exploited just five days after disclosure, and EPSS estimates a 45.9% probability of exploitation within 30 days (99th percentile).

Do: Upgrade vCenter Server to the patched release identified in Broadcom's advisory (no specific version ranges are provided in this data) and prioritize any vCenter that is internet-facing, in line with CISA KEV and BOD 26-04 requirements for federal agencies. Until patched, restrict access to the vCenter management interface to trusted networks and verify whether the vCenter Syslog server is enabled. Hunt for compromise indicators, including unexplained remote-access persistence and Babuk ransomware artifacts, given the documented China-nexus exploitation.

Cisco Secure Firewall Management Center (FMC), formerly Firepower Management Center, contains a use of hard-coded password vulnerability (CWE-259) that allows an unauthenticated, remote attacker to log in to an affected system. By authenticating with the built-in hard-coded credentials for a low-privileged account, the attacker can gain access to sensitive data within the impacted systems. Any organization running an affected Cisco FMC deployment is exposed, particularly where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-29, indicating active exploitation in the wild, and related reporting describes active exploitation of FMC vulnerabilities. No CVSS score or public proof-of-concept is yet available, but EPSS assigns a 9.8% probability of exploitation within 30 days (95th percentile).

Do: Upgrade FMC to the fixed release per Cisco's security advisory, as no specific fixed version is provided in this data. Until patched, restrict access to the FMC management interface, audit recent logins against the affected low-privileged accounts, and rotate or remove any hard-coded credentials. Federal agencies must apply mitigations per CISA BOD 26-04 given the KEV listing dated 2026-07-29.

CVE-2026-63077 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in JetBrains TeamCity, caused by deserialization of untrusted data (CWE-502) in the agent polling protocol. An attacker with network access to the TeamCity server, but no credentials of any kind, can send maliciously crafted serialized input to the agent polling endpoint and execute arbitrary code on the server. Successful exploitation yields full server takeover, exposing source code, build logs, stored secrets and credentials, and providing a pivot point into build agents and connected infrastructure; related headlines describe a real breach in which AWS credentials were extracted from an unpatched TeamCity instance. Organizations running TeamCity On-Premises in versions prior to the fixes (2025.11.7 or 2026.1.3, depending on branch) are affected, while the JetBrains-hosted cloud service is not indicated as impacted. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-05, EPSS is 86.5% (100th percentile), and no public PoC is known, meaning defenders cannot rely on public scanners alone and should assume sophisticated attackers are targeting exposed servers.

Do: Upgrade immediately to TeamCity 2025.11.7 or 2026.1.3, whichever branch you run; because the flaw is pre-authentication, also hunt for signs of compromise (unexpected builds or agents, new or modified admin users, altered build configurations, and leaked stored credentials/secrets) per vendor guidance, and restrict internet exposure of the TeamCity server until patched. Federal agencies must apply vendor mitigations or discontinue use per CISA BOD 26-04 and the KEV required action, including the Forensics Triage Requirements.

Check Point SmartConsole, the administrative client used to manage Quantum Security Management and Multi-Domain Security Management, contains an authentication bypass (CWE-287) in its login process that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation is possible when the Management Server IP address is reachable from the internet and the configuration does not restrict Trusted Clients. A successful attacker can modify security policies and security configurations, effectively taking control of firewall management. Any organization running an internet-exposed Check Point management server without Trusted Client restrictions is affected, though Check Point reports exploitation has impacted only a very small number of customers. The flaw was added to CISA's KEV on 2026-07-22, is actively exploited, and press reports indicate public proof-of-concept code has been released.

Do: Apply the fix released in Check Point's advisory for CVE-2026-16232 by updating SmartConsole and the associated Quantum/MDS management software; no fixed version numbers were provided in this data, so confirm them against the vendor bulletin. As an interim mitigation, restrict internet access to the Management Server IP address and configure Trusted Clients so SmartConsole connections are accepted only from known administrator addresses. Review management logs for unexpected logins, unauthenticated token issuance, or unfamiliar administrator sessions, and complete remediation per CISA BOD 26-04 given the KEV listing.

WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label.

Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.

IBM Langflow OSS 1.0.0 through 1.10.0 contains an unauthenticated code-injection flaw (CWE-94) that can be chained into full remote code execution. An attacker with network access first calls /api/v1/auto_login, which mints a SUPERUSER token to any caller without authentication, then calls /api/v1/validate/code, which executes attacker-supplied code via exec() on the Langflow host. Successful exploitation yields full control of the affected deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, network-exploitable with no privileges or user interaction required). Anyone running IBM Langflow OSS 1.0.0-1.10.0 is affected, especially default deployments reachable from untrusted networks. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-04, confirming active exploitation; EPSS estimates a 60.6% probability of exploitation within 30 days (99th percentile), and ransomware use is unknown.

Do: Upgrade IBM Langflow OSS to a release newer than 1.10.0 per IBM's ([email protected]) security advisory, as required under CISA's BOD 26-04 guidance for KEV entries; if mitigations are unavailable, discontinue use of the product per BOD 26-04. Until patched, restrict network access to the /api/v1/auto_login and /api/v1/validate/code endpoints (e.g., firewall rules or reverse-proxy controls) and avoid exposing the instance directly to the internet. Because exploitation is confirmed, review access logs for requests to these endpoints and signs of unauthenticated SUPERUSER token issuance or unexpected code execution.

Sangoma Switchvox SMB Edition 8.3 (build 104997) contains an unauthenticated SQL injection flaw (CWE-89) in its /pa endpoint, where the user-controlled PhoneIP value from XML input is concatenated directly into PostgreSQL queries without sanitization or parameterization. A single crafted request lets a remote, unauthenticated attacker execute arbitrary SQL statements against the backend PostgreSQL database, which can be escalated to remote code execution on the server. Any organization running the affected Switchvox SMB Edition build is exposed, especially appliances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-09-02, and researchers have observed attackers using it without credentials to deploy reverse shells and cryptocurrency miners.

Do: Identify all Switchvox SMB Edition deployments and verify the running build (affected: 8.3, build 104997), then upgrade to the patched release specified in Sangoma's advisory. If patching is delayed, restrict or remove internet exposure of the Switchvox web interface, including the /pa endpoint. Hunt for indicators of compromise such as unexpected reverse shells, new processes, or crypto-miner activity, as active exploitation is confirmed and the flaw is on CISA's KEV catalog, making it subject to BOD 26-04 patching guidance for federal stakeholders.

CVE-2026-15409 is a server-side request forgery (SSRF, CWE-918) in the Appliance Work Place interface of SonicWall SMA1000 series appliances. A remote, unauthenticated attacker can trigger the flaw over the network, causing the appliance to issue requests to attacker-influenced or unintended internal locations. Because the CVSS vector scores scope-changed impacts on confidentiality, integrity, and availability, the SSRF is assessed as capable of reaching sensitive internal services, and reporting indicates it is being used alongside a second SMA1000 zero-day in what may be an exploitation chain. Affected organizations are those running SMA1000 appliances, including SMA 6210, SMA 7210, and SMA 8200v models, which typically act as internet-facing remote-access/VPN gateways. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-07-14, ransomware use is known, and EPSS assigns an 83.7% probability of exploitation within 30 days, though no public PoC is available.

Do: Apply SonicWall's SMA1000 firmware update per the vendor's instructions immediately, prioritizing appliances with the Appliance Work Place interface reachable from the internet. Because the flaw is in CISA's KEV with known ransomware use and may be chained with a second SMA1000 zero-day, hunt for signs of compromise (unexpected outbound or internal requests, anomalous VPN sessions, follow-on ransomware activity) and restrict internet exposure of the interface in the interim. Federal and critical-infrastructure operators must comply with CISA BOD 26-04, including cloud-service guidance, or discontinue use if mitigations are unavailable.

CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthenticated attacker to send maliciously crafted serialized data over the network and execute code on the server, reflected in its 9.8 critical CVSS score with no privileges or user interaction required. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, giving attackers a foothold for follow-on actions such as data theft, lateral movement, or ransomware. Any organization running on-premises SharePoint Server is in scope, particularly deployments reachable from untrusted networks; the required action notes stakeholders must evaluate each asset's internet exposure under CISA BOD 26-04. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-22 and security news headlines describe it as a critical RCE exploited in the wild, with some reports referencing exploitation after a public proof-of-concept release and an authentication bypass. The structured record lists no public PoC as confirmed, but an EPSS of 84.6% (100th percentile) underscores a very high near-term exploitation likelihood.

Do: Apply Microsoft's security updates for SharePoint Server immediately per the vendor advisory, as required under CISA's KEV listing and BOD 26-04, and prioritize any SharePoint deployments that are internet-facing (federal/critical-infrastructure operators must follow BOD 26-04 timelines or discontinue unmitigated use). Until patched, restrict public access to SharePoint endpoints (VPN, firewall rules, or reverse proxy) and review IIS/application logs and running processes for signs of unauthenticated deserialization abuse. Because some reports reference an authentication bypass being chained, also verify authentication paths and monitor for follow-on attacker activity after patching.

Microsoft SharePoint Server contains a missing authentication for critical function vulnerability (CWE-306) that lets an unauthenticated attacker elevate privileges over a network without valid credentials. The flaw is triggered when the affected SharePoint function is accessed remotely without any authentication check, allowing an attacker to gain higher privileges than intended. Successful exploitation could enable an attacker to take elevated actions within the SharePoint environment, potentially leading to further compromise of the server and its data. All organizations running on-premises Microsoft SharePoint Server are potentially affected, though specific versions have not yet been enumerated by Microsoft or CISA. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14, indicating it is being actively exploited, and its EPSS score of 26.6% (98th percentile) reflects a high near-term exploitation risk.

Do: Apply Microsoft's security updates for SharePoint Server as soon as they are available, and check Microsoft's advisory for the specific affected version ranges once published. In the meantime, restrict network access to SharePoint servers, especially for internet-facing instances, and verify whether your environment falls under CISA BOD 26-04 requirements given the KEV listing. Monitor for updated guidance from Microsoft and CISA, as exploitation is confirmed and patching urgency is high.

CVE-2026-56291 is an unauthenticated unrestricted file upload flaw (CWE-434) in the Balbooa Forms extension for Joomla, affecting versions prior to 2.4.1. Because the upload functionality requires no authentication, any remote attacker who can reach a site running the extension can upload arbitrary files, including executable file types, to the web server. Uploaded executable files can subsequently be invoked on the server, resulting in full remote code execution with high impact on confidentiality, integrity, and availability. Any Joomla site running Balbooa Forms below version 2.4.1 is affected, particularly those whose upload functionality is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-10 after reportedly being exploited as a zero-day, and a public proof-of-concept write-up is available.

Do: Upgrade Balbooa Forms to version 2.4.1 or later immediately, as patching is the required action under CISA KEV/BOD 26-04 guidance. If upgrading is not immediately possible, restrict unauthenticated access to the extension's upload functionality at the web server or WAF layer and inspect upload directories for unexpected executable files that would indicate compromise. Review web logs for unauthenticated upload requests from unknown sources and treat any findings as potential RCE incidents.

CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion. It is triggered by crafted file-path input containing directory-traversal sequences that the application fails to constrain, allowing access outside the intended directory; per CISA this can escalate to arbitrary code execution in the context of the current user. Successful exploitation could give an attacker the ability to run code on the ColdFusion host under the ColdFusion service account, a common foothold for further network compromise. All organizations running affected Adobe ColdFusion releases, particularly internet-facing instances, are in scope; the specific affected version ranges have not been detailed in the available data. The flaw is already being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-07 and carries a 42.4% EPSS probability of exploitation within 30 days (99th percentile), though no public PoC is known and ransomware use is unconfirmed.

Do: Inventory all Adobe ColdFusion deployments, prioritizing internet-facing servers, and apply the vendor patch per Adobe's security advisory since the affected version ranges are not yet specified in this data. Federal agencies must patch or apply mitigations in accordance with CISA BOD 26-04 within the KEV deadline or discontinue use if mitigations are unavailable. Until patched, restrict external access to ColdFusion instances and consider WAF/IPS rules blocking directory-traversal sequences in file-path parameters.

Joomlack Page Builder, a page-builder extension for the Joomla CMS from the Joomlack vendor, contains an improper access control flaw (CWE-284) that permits unauthenticated arbitrary file upload to affected sites. An unauthenticated remote attacker can abuse the upload functionality to place attacker-controlled files, typically executable script files, on the web server and then request them to achieve remote code execution. Successful exploitation yields code execution under the web server's privileges, enabling full compromise of the website and potentially the underlying hosting account or server; ransomware use has not been confirmed. Any Joomla deployment with the affected extension installed is potentially exposed, with internet-facing sites at greatest risk, and CISA has not published specific affected version ranges. The flaw was added to the CISA KEV catalog on 2026-07-07, indicating confirmed in-the-wild exploitation, and it carries a high exploitation likelihood (EPSS 30.4%, 98th percentile), although no public proof-of-concept or detailed technical write-up is known.

Do: Inventory Joomla sites for the Joomlack Page Builder extension and apply the vendor's fix as soon as it is released, following the CISA required action and BOD 26-04 guidance; if mitigations are unavailable, remove, disable, or restrict the extension - particularly on internet-exposed or cloud-hosted instances - or discontinue use per BOD 26-04. Until patched, review upload directories for unexpected executable files (e.g., potential webshells) and check access logs for unauthenticated upload requests, and limit direct web access to upload paths where feasible.

Joomlic's iCagenda event-management extension for Joomla contains an unrestricted file-upload flaw (CWE-434) in its file attachment feature, exploitable over the network without authentication or user interaction (CVSS 4.0 score 10.0). Because the extension accepts arbitrary file types, an attacker can upload a malicious PHP file through the attachment feature and have the web server execute it as PHP code. Successful exploitation gives unauthenticated attackers remote code execution on the affected Joomla site, which typically leads to full site or web-server compromise. Any Joomla installation running the iCagenda extension is affected; the available advisory data specifies no affected or fixed version range, so no version numbers can be stated. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-10 (reportedly exploited as a zero-day, with ransomware use currently unknown), public proof-of-concept code is available, and EPSS assigns roughly a 20% probability of exploitation within 30 days.

Do: Joomla administrators running iCagenda should update to the latest release published by Joomlic (no specific fixed version is stated in the available data) and, per the KEV required action, apply vendor mitigations in accordance with CISA BOD 26-04, prioritizing internet-exposed instances. Until patched, restrict or disable the file-attachment upload feature (e.g., prevent PHP execution/uploads in the attachments directory) and review web server logs and upload directories for unexpected .php files indicating prior compromise. Given confirmed in-the-wild exploitation reportedly predating disclosure, assume potential compromise and follow CISA's forensics triage requirements where applicable.

CVE-2026-48908 is an unrestricted upload of files with dangerous types (CWE-434) in the SP Page Builder extension for Joomla developed by JoomShaper/Ollyo. An unauthenticated remote attacker can submit arbitrary files, including PHP files, to the vulnerable upload functionality, and the web server subsequently executes the uploaded PHP. Successful exploitation therefore results in full remote code execution on the hosting server with the privileges of the web service, giving the attacker control over the Joomla site and its data (CVSS 4.0 base score: 10.0, critical). Any Joomla site running SP Page Builder is affected; the available data does not specify affected or fixed version ranges. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07, and EPSS assigns a 14.8% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known.

Do: Upgrade SP Page Builder to the latest release published by Ollyo/JoomShaper and follow the vendor advisory (no specific fixed version is provided in this data); federal agencies must apply mitigations per CISA's BOD 26-04 timelines and the KEV required action. Until patched, restrict or firewall unauthenticated access to SP Page Builder upload endpoints and review web-access logs and upload directories for recently dropped PHP files or webshells, since the flaw is confirmed exploited in the wild.

PTC Windchill and FlexPLM contain an improper input validation flaw (CWE-20) with an associated deserialization of untrusted data weakness (CWE-502) that allows an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request over the network. An attacker who can reach a vulnerable Windchill or FlexPLM server can run arbitrary code on it, potentially gaining a foothold for lateral movement; CISA notes the flaw is being used in ransomware campaigns. All organizations running PTC Windchill or FlexPLM are affected, and the available data does not specify affected version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-25 with known ransomware use, and EPSS assigns a 40.6% probability of exploitation within 30 days (99th percentile). No CVSS score or public proof-of-concept is available yet, but the KEV listing confirms exploitation in the wild.

Do: Apply the fixes in PTC's security advisory for CVE-2026-12569 to both Windchill and FlexPLM as soon as possible, prioritizing internet-facing instances, and comply with the CISA KEV required action under BOD 26-04 (patch within the required window or discontinue use if mitigations are unavailable). Until patched, restrict network exposure of Windchill/FlexPLM servers and hunt for signs of exploitation or ransomware precursor activity; the available data does not list specific patched versions, so defer to PTC's advisory.

CVE-2026-20262 is a directory/path traversal vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager, the central management component of Cisco's enterprise SD-WAN solution. An authenticated, remote attacker can supply crafted input containing traversal sequences that escape the intended directory, allowing the attacker to create a new file or overwrite any file on the affected system's filesystem. Overwriting arbitrary files can enable configuration tampering, persistence, or privilege escalation on the management appliance depending on which file is targeted. Any organization running Cisco Catalyst SD-WAN Manager is affected, with greatest risk where the management interface is reachable by broad user populations or from the internet. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-15, indicating exploitation in the wild; no public proof-of-concept is known, ransomware association is unknown, CVSS is not yet scored, and EPSS assigns a 28.2% probability of exploitation within 30 days (98th percentile).

Do: Apply the fixed release per Cisco's advisory (specific fixed versions are not provided in this data set, so consult Cisco's security notice) and follow CISA's KEV required action, including BOD 26-04 timelines for federal agencies and cloud service use. Until patched, restrict access to the SD-WAN Manager management interface to trusted management networks, enforce strong authentication, and audit the filesystem for unexpectedly created or recently modified files that could indicate exploitation. Evaluate each instance's internet exposure and prioritize internet-reachable management appliances for immediate remediation.

CVE-2026-48558 is an authentication bypass (CWE-347, improper verification of cryptographic signature) in the SimpleHelp remote access/support platform's OpenID Connect (OIDC) login flow, where submitted identity tokens are accepted without verifying their signature. It is triggered when OIDC authentication is configured: a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims and obtain a fully authenticated technician session, and in some configurations this also bypasses multi-factor authentication. Related reporting describes a path from this bypass to remote code execution. Only SimpleHelp deployments using OIDC-based (e.g., SSO) authentication are affected; deployments relying on local SimpleHelp accounts are not described as affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-29, confirming exploitation in the wild, with a 30% EPSS probability of exploitation within 30 days and no public proof-of-concept known.

Do: Update SimpleHelp to the latest release per vendor instructions, prioritizing any internet-facing server (CISA KEV listing means federal agencies must act under BOD 26-04). Until patched, restrict access to the SimpleHelp web login to trusted management networks (VPN/firewall) or temporarily switch from OIDC to local-account authentication with MFA. Verify whether OIDC is enabled on each instance and review technician login logs for sessions created with unusual or unexpected identity claims.

CVE-2026-35273 is a missing-authentication flaw (CWE-306) in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported releases 8.61 and 8.62. An unauthenticated attacker with network access over HTTP can reach the vulnerable component with no credentials and no user interaction, and successful attacks result in full takeover of the PeopleTools environment — reported in the wild as remote code execution followed by data theft. Organizations running PeopleSoft — including universities, government agencies and large enterprises — are affected, and the ShinyHunters group has already used the flaw against unpatched universities, with Nissan disclosing an employee-data breach linked to it. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-12 with ransomware use noted, and EPSS assigns a 95.5% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but exploitation is confirmed in the wild, having been used as a zero-day before patching.

Do: Apply the PeopleTools security fixes for releases 8.61 and 8.62 per Oracle's advisory instructions immediately, prioritizing internet-facing instances to meet CISA KEV/BOD 26-04 timelines; where patching is not yet possible, restrict HTTP access to the PeopleSoft tier from untrusted networks. Review web and application logs on 8.61/8.62 environments for signs of unauthenticated access to the Updates Environment Management component, given confirmed ShinyHunters exploitation and ransomware use. Organizations unable to mitigate internet exposure should follow BOD 26-04 guidance for cloud services or consider discontinuing use of the exposed product.

CVE-2026-20253 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the PostgreSQL sidecar service endpoint of Splunk Enterprise, which lacks authentication controls. Any unauthenticated user who can reach the endpoint over the network can invoke file operations without credentials, creating or truncating arbitrary files on the host; public research (watchTowr) and news coverage describe this leading to pre-authentication remote code execution. The flaw affects Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, while versions 9.4 and earlier are not affected. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-18, media reports indicate it is under active attack, and EPSS assigns a 96.9% probability of exploitation within 30 days.

Do: Upgrade to Splunk Enterprise 10.2.4 (10.2 track) or 10.0.7 (10 track) or later; Splunk Enterprise 9.4 and earlier are unaffected. If you cannot upgrade immediately, disable the PostgreSQL sidecar service per vendor guidance and ensure the endpoint is not reachable from untrusted networks. As a KEV entry, federal agencies must apply vendor mitigations in line with BOD 26-04 by the CISA deadline; audit whether the PostgreSQL sidecar service is enabled and whether it is exposed to the internet.

CVE-2026-25089 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox caused by improper neutralization of special elements in OS commands, allowing an unauthenticated attacker to execute unauthorized commands by sending specifically crafted HTTP requests to the product. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 score of 9.8), meaning any reachable instance — hardware/VM appliance, FortiSandbox Cloud, or FortiSandbox PaaS — is exposed to system-level command execution. Successful exploitation carries high impact to confidentiality, integrity, and availability on the sandbox itself and can serve as a foothold into the surrounding network. Organizations running FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, or 4.2 (all versions), as well as FortiSandbox Cloud 5.0.4–5.0.5 and FortiSandbox PaaS 5.0.4–5.0.5, are affected. The vulnerability is being actively exploited in the wild: CISA added it to the KEV catalog on 2026-07-16, EPSS assigns a 76.1% probability of exploitation within 30 days (100th percentile), and news coverage describes FortiSandbox bugs under active attack, though no public proof-of-concept is known.

Do: Upgrade FortiSandbox to a release beyond the affected ranges — newer than 5.0.5, 4.4.8, and 4.2 — and update FortiSandbox Cloud and PaaS beyond 5.0.5, following Fortinet's PSIRT advisory for the exact fixed versions (not specified in this data). Until patched, restrict the FortiSandbox management interface from direct internet exposure and review appliance logs for signs of command-injection exploitation. Organizations subject to CISA's KEV requirements must apply vendor mitigations per BOD 26-04 timelines or discontinue cloud use of the product if mitigations are unavailable.

Ivanti Sentry (formerly MobileIron Sentry) contains an OS command injection flaw (CWE-78) that lets a remote, unauthenticated attacker execute operating-system commands with root privileges on the appliance. Exploitation succeeds when the Sentry appliance is in an unmanaged state with its endpoints externally reachable; deployments that enforce mTLS with EPMM or restrict HTTPS access through Ivanti Neurons for MDM keep the interfaces inaccessible to external actors. A successful attacker gains root-level remote code execution, giving full control of the gateway that fronts an organization's mobile device management (MDM) infrastructure. Organizations running unmanaged, internet-exposed Ivanti/MobileIron Sentry appliances are affected. The flaw is being exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-11 (formal CVSS scoring is still pending), EPSS puts the 30-day exploitation probability at 99.9%, no public proof-of-concept is known, and ransomware use is undetermined.

Do: Inventory all Ivanti/MobileIron Sentry appliances and determine whether they are unmanaged with externally reachable endpoints; apply Ivanti's mitigations in line with CISA KEV and BOD 26-04 timelines, and where a patch is not yet in place, restrict access by enabling mTLS with EPMM or limiting HTTPS access through Ivanti Neurons for MDM. Monitor Ivanti's advisories for fixed versions and review exposed appliances for signs of compromise.

Check Point has disclosed CVE-2026-50751, a critical (CVSS 9.3) improper authentication flaw (CWE-287) in the certificate validation logic for Remote Access and Mobile Access VPN when the deprecated IKEv1 key exchange is used. An unauthenticated remote attacker can exploit this logic flow weakness during IKEv1 negotiation to bypass user authentication entirely. Successful exploitation lets the attacker establish a remote access VPN connection without a valid user password, gaining access to the organization's internal network resources (high confidentiality impact per the CVSS score). Any organization running a Check Point Security Gateway on Gaia OS or Gaia Embedded with IKEv1-based Remote Access/Mobile Access configured is affected; specific affected and fixed versions are in Check Point's advisory. The flaw is being exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 with known ransomware use and an EPSS of 83.8% — and it was disclosed alongside other critical Check Point VPN certificate flaws per recent headlines.

Do: Upgrade affected Security Gateways to the fixed releases identified in Check Point's advisory (version numbers are not specified in the source data), prioritizing internet-facing VPN gateways; as an interim mitigation, move Remote Access/Mobile Access clients to IKEv2 or disable IKEv1. Review VPN authentication logs for sessions established without valid credentials, given known in-the-wild and ransomware exploitation. Federal agencies must apply mitigations per BOD 22-01, and defenders should beware of fake 'public PoC' repositories spreading malware (ChocoPoC RAT), since no legitimate public PoC is known.

CVE-2026-48907 is an improper access control flaw (CWE-284) in the Joomla Content Editor (JCE) extension from Widget Factory Limited that allows unauthenticated users to create new editor profiles. Because these profiles can confer file-upload privileges, an attacker can reach the editor's upload functionality without logging in, upload malicious PHP files, and have the web server execute them, resulting in unauthenticated remote code execution with high impact on system confidentiality, integrity, and availability (CVSS 4.0 score of 10). Any Joomla site running the affected JCE extension is exposed, with internet-facing sites most at risk. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-16, confirming in-the-wild exploitation, and EPSS assigns a 78.1% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but CISA and Australian authorities have warned of active CMS exploitation targeting this flaw.

Do: Apply the latest JCE update per Widget Factory Limited's vendor instructions, in line with CISA BOD 26-04 requirements (federal agencies must patch or discontinue use of the product if mitigations are unavailable). Until patched, verify whether unauthenticated users can create editor profiles in your JCE configuration, restrict access to the extension, and inspect webroots and logs for unexpected PHP file uploads. Given confirmed active exploitation and a very high EPSS score, prioritize internet-facing Joomla sites immediately.

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) contains an improper encoding or escaping of output flaw (CWE-116) in its handling of user-supplied files. An attacker who already has authenticated access to the system can trigger it by supplying a crafted file, because the file's contents are not properly escaped before being processed. Successful exploitation yields arbitrary command execution with root privileges, giving the attacker full control of the SD-WAN management platform. Organizations running Cisco Catalyst SD-WAN Manager/vManage to manage their SD-WAN fabric are affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-09, indicating active exploitation, though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Apply the fixed release per Cisco's security advisory (specific fixed versions are not included in the available data), and prioritize this patch given the KEV listing. Because the flaw requires authenticated local access, restrict management-plane access to trusted administrators and networks, review privileged accounts on the manager, and audit the system for unexpected processes or changes. Federal agencies must follow the KEV required action under BOD 22-01 (mitigate per vendor instructions or discontinue use).

SolarWinds Serv-U, an FTP and managed-file-transfer server, contains an uncontrolled resource consumption flaw (CWE-400) that allows an unauthenticated remote attacker to exhaust the service's resources. It is triggered by sending specially crafted POST requests with the Content-Encoding: deflate header, which crashes the Serv-U service. An attacker gains denial of service — file transfer operations stop until the service is restarted — and the available data indicates no remote code execution or data exposure. Any organization running Serv-U, typically enterprises using it as an internal or internet-facing file transfer endpoint, is affected; the available advisories do not specify affected version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-05, signaling exploitation in the wild, and EPSS estimates a 40% probability of exploitation within 30 days (99th percentile), though CVSS scoring is pending and no public proof-of-concept is known.

Do: Inventory all Serv-U deployments and apply SolarWinds' mitigation per vendor instructions, or discontinue use of the product if mitigations are unavailable, as required by the KEV listing (federal agencies must follow BOD 22-01 timelines). As an interim mitigation, block or normalize POST requests carrying the Content-Encoding: deflate header at a WAF or reverse proxy and restrict Serv-U's internet exposure. Monitor the Serv-U service for crashes, since successful exploitation takes it down until it is restarted.

Progress Kemp LoadMaster, the application delivery controller/load balancer sold by Progress Software (formerly Kemp), contains an unauthenticated OS command injection flaw (CWE-77) in its API: unsanitized input sent to multiple command endpoints allows arbitrary operating-system commands to be executed on the appliance. Because the affected endpoints require no authentication, any remote attacker with network access to the appliance's API or management interface can trigger the bug directly; public research by WatchTowr describes it as a pre-authentication RCE chain (involving uninitialized memory/quote handling) that can yield root-level command execution. Successful exploitation gives an attacker full control of the appliance, consistent with the Critical 9.8 CVSS 3.1 score (network-exploitable, no privileges or user interaction, high impact on confidentiality, integrity and availability). Organizations running Progress Kemp LoadMaster appliances are affected, especially those where the management or API interface is reachable from the internet. Exploitation is confirmed and ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-07 after 792 reported exploit attempts, and EPSS assigns a 99.6% probability of exploitation within 30 days.

Do: Upgrade LoadMaster to the fixed release identified in Progress's security advisory (fixed version numbers are not specified in this data). Until patched, restrict the LoadMaster API/management interface to trusted networks or VPN access, and review appliance logs for signs of unexpected command execution given confirmed in-the-wild exploitation. Because the flaw is on CISA's KEV catalog, US federal agencies must apply mitigations per BOD 26-04 by the required deadline — or discontinue use of the product if mitigations are unavailable — and evaluate each asset's internet exposure.

An unauthenticated server-side request forgery (SSRF) flaw exists in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), caused by improper input validation of specific HTTP requests. An attacker triggers it by sending a crafted HTTP request to the device's WebDialer service, which must be enabled for exploitation (it is disabled by default). Successful exploitation lets the attacker write files to the underlying operating system, which can later be used to elevate privileges to root — the reason Cisco assigned a Critical Security Impact Rating despite the 8.6 (High) CVSS base score. Organizations running affected Unified CM or Unified CM SME deployments, particularly those with WebDialer enabled and reachable from untrusted networks, are exposed. The flaw is being exploited in the wild: public exploit references appeared in mid-June 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-25, with EPSS indicating an ~88% probability of exploitation within 30 days.

Do: Upgrade affected Unified CM and Unified CM SME deployments to the fixed release cited in Cisco's advisory (specific version not provided in this dataset), prioritizing internet-exposed systems per CISA BOD 26-04 requirements. Confirm whether the WebDialer service is enabled and disable it if unused, or restrict network access to it. Check device logs for crafted HTTP requests hitting WebDialer endpoints and unexpected file writes on the underlying OS that could indicate prior exploitation.

Oracle E-Business Suite contains a critical improper privilege management flaw (CVE-2026-46817) in the File Transmission component of Oracle Payments, affecting versions 12.2.3 through 12.2.15. The flaw is easily exploitable: an unauthenticated attacker with network access over HTTP can trigger it, with no credentials or user interaction required. Successful exploitation results in takeover of Oracle Payments, with high confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Organizations running the affected E-Business Suite releases — especially those exposing the Payments/File Transmission interface to untrusted networks — are in scope. The issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-15, researchers have observed exploitation in the wild, and EPSS assigns a 13% probability of exploitation within 30 days (96th percentile).

Do: Apply the remediation provided in Oracle's security advisory for CVE-2026-46817 to all Oracle E-Business Suite 12.2.3–12.2.15 environments running Oracle Payments, and in the meantime restrict HTTP/network access to the File Transmission component. Because the flaw is being actively exploited, review EBS/Payments access logs for unauthenticated requests and anomalous file-transmission activity to check for compromise. Federal agencies must apply mitigations in line with CISA BOD 26-04 timelines or discontinue use of the product if mitigations are unavailable.

Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days.

Do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions.

Mirasvit Full Page Cache Warmer, a storefront performance extension for Magento, contains a PHP deserialization flaw (CWE-502) that permits unauthenticated remote code execution. The flaw is triggered simply by sending the store a request carrying a crafted serialized PHP object in the 'CacheWarmer' cookie; when the application unserializes that untrusted value, attacker-controlled object injection executes code in the context of the web server. Successful exploitation yields arbitrary code execution on the storefront host, useful for webshell deployment, data theft, or lateral movement, and it requires no credentials or special privileges. Any site running the extension is affected; no public proof-of-concept is known, but CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-03, confirming exploitation in the wild (ransomware use unknown), and EPSS assigns a 27.5% 30-day exploitation probability (98th percentile).

Do: Apply Mirasvit's remediation guidance and upgrade the Full Page Cache Warmer extension as soon as the vendor publishes a fixed release; the KEV listing (2026-06-03) makes patching or mitigation mandatory for U.S. federal agencies under BOD 22-01. Until patched, hunt for exploitation by reviewing web access logs for anomalous or oversized 'CacheWarmer' cookie values containing serialized PHP objects (e.g., 'O:'-prefixed payloads) and for indicators of post-exploitation on Magento web servers. If no fix is available yet and the store is internet-facing, consider temporarily disabling the extension or restricting the CacheWarmer cookie handling as an interim mitigation.

CVE-2026-45659 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Microsoft SharePoint Server in which an authorized (authenticated, low-privilege) attacker can submit crafted serialized data over the network, with no user interaction required, to execute code on the server. Successful exploitation carries high impact on confidentiality, integrity, and availability within the SharePoint service context, giving attackers a foothold for follow-on activity, and CISA notes that ransomware use is known. Organizations running on-premises Microsoft SharePoint Server are affected; the source data lists no specific version ranges, and the CPE scope (sharepoint server) points to the on-premises product rather than the Microsoft-managed SharePoint Online service. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-01 after active exploitation, and its EPSS score of 76.1% (100th percentile) indicates a high probability of near-term exploitation. The CVE record lists no public proof-of-concept, though related reporting describes exploitation activity following a public PoC release for a SharePoint authentication bypass.

Do: Apply Microsoft's current security updates for SharePoint Server following vendor instructions, prioritizing internet-facing servers, and comply with CISA BOD 26-04, which requires applying mitigations per vendor guidance (including the cited Forensics Triage Requirements) or discontinuing use of the product if mitigations are unavailable. Because in-the-wild exploitation and ransomware use are confirmed, triage exposed servers for compromise: review IIS/SharePoint logs for unexpected authenticated requests, look for webshells or newly modified files in SharePoint web roots, and check for unusual child processes spawned by the SharePoint application pool. Given related reporting on an authentication-bypass PoC, also verify that any related SharePoint authentication-bypass patches are…

CVE-2026-34910 is an improper input validation flaw (CWE-20) in Ubiquiti UniFi OS that allows command injection on affected gateways and network video recorders. A malicious actor with network access to the device can send crafted, unvalidated input that triggers arbitrary command execution, with no privileges or user interaction required (CVSS 3.1 base score 10.0, network vector, scope changed). Successful exploitation grants full control of the device — high confidentiality, integrity, and availability impact — and can serve as a foothold into the attached network. Affected products span the UniFi gateway and recording line: UniFi OS Server, Cloud Gateway Industrial, Dream Machine/Pro/Special Edition/Pro Max, Enterprise Fortress Gateway, Dream Wall, Dream Router and Dream Router 7, UniFi Express 7, and the UniFi Network Video Recorder. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-23, public reporting describes in-the-wild exploitation being used to build a Mirai botnet, and EPSS estimates an 87.5% chance of exploitation within 30 days.

Do: Upgrade all listed UniFi OS devices to the fixed firmware in Ubiquiti's June 2026 security advisory (consult the vendor advisory for exact fixed versions per product), and per CISA BOD 26-04 patch within the required window or discontinue use of affected cloud-reachable assets. Restrict device management interfaces (UniFi Network UI, SSH, API) to trusted networks and audit internet-facing gateways for signs of compromise, including Mirai botnet traffic or unexpected outbound connections.

CVE-2026-34926 is a directory traversal vulnerability (CWE-23) in the on-premise edition of the Trend Micro Apex One endpoint management server. A pre-authenticated local attacker — someone with access to the Apex One server who has already obtained administrative credentials through some other method — can use the traversal to modify a key table on the server, injecting malicious code that the server then deploys to its managed agents. This gives the attacker a delivery channel to run malicious code on the agents managed by the exploited server (CVSS scope changed), which is why the 6.7 CVSS score reflects a local, high-complexity, high-privilege attack path with high confidentiality impact. Only on-premise Apex One deployments are exploitable; the cloud/SaaS edition is not affected by this flaw. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-21 (EPSS 12.7%, 96th percentile), though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Apply Trend Micro's fix for the Apex One on-premise server per the vendor security advisory (exact fixed versions are not stated in the available data — check the bulletin), or, for US federal agencies, satisfy the BOD 22-01/KEV required action of applying vendor mitigations or discontinuing use if mitigations are unavailable. Because exploitation requires administrative credentials obtained by some other method, review privileged accounts on Apex One servers for compromise, check the server's key table for unauthorized modifications, and look for unexpected or anomalous code distributed to managed agents. Ransomware use is unconfirmed but plausible; restrict local and administrative access to the server and monitor agent activity until patched.

CVE-2026-48172 is a critical privilege-escalation flaw (CWE-266, incorrect privilege assignment) in the LiteSpeed User-End cPanel plugin before 2.4.5, stemming from mishandling of the plugin's Redis enable/disable feature. It is exploitable over the network without authentication or user interaction (CVSS 4.0: AV:N/AC:L/PR:N/UI:N), and exploitation leaves traces of requests to the cPanel API's redisAble function in cPanel logs. An attacker who exploits it can elevate privileges to possibly root on the hosting server, meaning a single attacker could take control of every account and site hosted on that server. At risk are hosting providers and organizations running cPanel/WHM with the LiteSpeed cPanel plugin (and the related WHM plugin), a common premium web-server setup on multi-tenant shared-hosting platforms. The flaw was exploited in the wild in May 2026, was added to CISA's KEV catalog on 2026-05-26, and carries an EPSS of 18.9% (97th percentile); no public PoC is known.

Do: Upgrade the LiteSpeed User-End cPanel plugin to at least version 2.4.7 (versions before 2.4.5 are affected; 2.4.7 is the recommended minimum). Hunt for exploitation by running grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash: no output means you were not hit, while hits should be validated (confirm the listed IPs are legitimate, block any that are not, and review system logs for actions taken by those IPs). Because this is a CISA KEV entry (added 2026-05-26), apply the vendor fix per BOD 22-01 timelines or discontinue use of the product if mitigations are unavailable.

CVE-2026-9082 is a critical SQL injection flaw (CWE-89) in Drupal core caused by improper neutralization of special elements used in SQL commands, allowing user-controlled input to alter the queries the application executes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) shows it is remotely exploitable over the network without authentication, special privileges, or user interaction. A successful attacker gains high-impact access to the database (read, modify, or disrupt data), and news reports indicate PostgreSQL-backed sites may additionally be exposed to remote code execution. It affects Drupal core from version 8.9.0 onward across all current major lines, with fixes in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10, meaning essentially all unpatched modern Drupal deployments are at risk. The flaw is confirmed under active attack: CISA added it to the KEV catalog on 2026-05-22 and headlines report it is already being exploited in the wild, while EPSS assigns an 87.9% 30-day exploitation probability (100th percentile); no public proof-of-concept is known yet.

Do: Upgrade Drupal core immediately to the patched release for your branch: 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10, or a later release as applicable, since the flaw is being actively exploited and carries an 87.9% EPSS. Prioritize internet-facing sites and deployments using a PostgreSQL database, which reports say can be pushed to remote code execution, and review web and database logs for signs of exploitation. Under the CISA KEV listing (added 2026-05-22), U.S. federal agencies must apply vendor mitigations per applicable BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.