CISA adds exploited Ivanti Connect Secure flaws to its KEV catalog
Agencies must fix CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13; UTA0576 chained them with CVE-2026-104935 for root access.
84
- Mentions · 7d93
- Mentions · 30d346
- All mentions764
- First seenAug 11, 2026
- Last mentioned6h ago
Timeline
764 articles · newest firstAttackers chain three Ivanti Connect Secure flaws for unauthenticated root
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV; UTA0576 paired them with CVE-2026-104935, and fixes are in 25.1.1.3 and 22.8R2.6.
84
CISA adds exploited GitLab and Cisco firewall flaws to KEV
Federal agencies must fix unauthenticated GitLab code execution and a Cisco firewall reload bug by November 1, 2026.
84
OWASP co-leads release free RAID-AI ransomware assessment
Users manually rate controls from zero to five; RAID-AI does not connect to systems or verify the answers.
36
TeamViewer before 15.83 lets a host attack the viewer (CVE-2026-111585)
A malicious host can crash the viewer and, on Windows, Remedio showed code execution that is not yet fully remote.
66
Attackers exploit max-severity GitLab flaw CVE-2026-97229
The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.
84
CISA confirms active exploitation of GitLab CVE-2026-97229
Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.
88
CISA adds two exploited Ivanti Connect Secure flaws to KEV
CVE-2026-111357 and CVE-2026-118527 were added after evidence of active exploitation; FCEB agencies must prioritize them under BOD 26-04.
76
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
82
Max-severity GitLab flaw exploited against Alpine Linux
CVE-2026-97229 allows unauthenticated code execution; Alpine rebuilt its instance, and CISA gave agencies three days to patch.
82
CISA says GitLab integer overflow CVE-2026-97229 is exploited
Fixes cover GitLab 19.2.8, 19.3.4, and 19.4.2; federal agencies face a November 1 deadline.
84
CISA adds exploited GitLab RCE and Cisco firewall DoS to KEV
Federal civilian agencies are told to apply fixes for both flaws by November 1, 2026.
82
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
84
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-111357
A local authenticated attacker can escalate privileges; the federal due date is November 2, and ransomware use is unknown.
74
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527
An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.
74
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
74
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
88
Siemens Mendix SAML module allows assertion-replay login bypass
Unauthenticated attackers can replay a valid IdP-initiated SAML response; fixes are V4.2.4 and V3.6.29.
46
CISA adds exploited Ivanti Connect Secure and GitLab flaws to KEV
CVE-2026-111357 is missing authentication in Ivanti Connect Secure; CVE-2026-97229 is an integer overflow in GitLab CE and EE.
82
Hitachi Energy CoreTec flaws allow commands and local root
Authenticated users can inject OS commands, and a local user can reach root through the built-in Linux ESP code.
58
CISA adds exploited GitLab integer overflow CVE-2026-97229 to KEV
FCEB agencies must prioritize the GitLab flaw on exposed assets and check for compromise before patching.
78
Hitachi Energy TRO600 flaws leak files and reach localhost services
An unauthenticated attacker can read configuration and password files; the fixes are 9.1.2.0 and 9.2.2.1.
57
42% of US county election sites still lack .gov domains
Of 2,081 county election sites, 869 are off .gov; about 51% of contact domains lack enforced DMARC.
38
CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV
Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.
68
CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
84
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
84
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
62
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
74
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229
A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.
84
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
88
CISA KEV lists Cisco firewall DoS flaw CVE-2026-76418
Unauthenticated remote attackers can reload ASA and Secure FTD devices; the federal due date is November 1, 2026.
74
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
78
Related CVEs
by mentions- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-10493587%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-7650439%9.8Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-9722927%10.0Unauthenticated RCE in GitLab CE/EE via CI/CD regex
Appears with
- Microsoftvendor · 85
- FBIorganization · 79
- CISAvendor · 67
- Citrixvendor · 59
- Ciscovendor · 55
- Googlevendor · 54
- NetScaler Gatewayproduct · 48
- NetScaler ADCproduct · 47
- watchTowrorganization · 35
- NSAorganization · 34
- Siemensvendor · 32
- Ivantivendor · 30
- Fortinetvendor · 30
- Canadian Centre for Cyber Securityorganization · 29
- Palo Alto Networksvendor · 26
- Microsoftorganization · 24
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.