Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
CVE-2026-73570 (CVSS 8.9) enables unauthenticated command injection and remote code execution in Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled, via crafted SMTP requests. CISA added the flaw to its KEV catalog on August 21, 2026, with a federal patch deadline of August 24. The Shadowserver Foundation counted 267 compromised instances as of August 24, 2026, led by the US (46), Sweden (21), France (20) and Germany (17). Separately, Russia-linked Laundry Bear has weaponized Zimbra stored XSS CVE-2025-66376 against Western government and commercial mail servers since at least July 2025, delivering the ZimReaper payload.
CISA added actively exploited Zimbra flaw CVE-2026-73570 (unauthenticated OS command injection RCE) to its KEV catalog, setting an August 24, 2026 federal patch deadline.
CISA added CVE-2026-73570, an unauthenticated OS command injection flaw in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities catalog after CERT Polska confirmed active exploitation. The flaw lets attackers execute shell commands as the zimbra user via the snmp_notify parameter when the SNMP trap service is enabled and the default swatchdog service is running. Zimbra patched the issue in version 10.1.20 released July 20, 2026, 28 days before exploitation was confirmed. Under BOD 22-01, federal civilian agencies must patch by August 24, 2026.
Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
CVE-2026-73570 is an OS command injection vulnerability (CWE-78) in Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20, caused by improper sanitization of untrusted input during SNMP notification processing. It is triggered when the optional zimbra-snmp package is installed and SNMP notifications are enabled: an unauthenticated attacker sends specially crafted SMTP requests that the flawed notification path turns into execution of arbitrary operating system commands. Successful exploitation runs commands as the Zimbra user, giving attackers control of the mail server's service account with high confidentiality and integrity impact across the host. Only ZCS deployments running the optional SNMP component with notifications enabled are vulnerable; other Zimbra installs are not exposed to this specific flaw. The flaw is under active exploitation: CISA added it to the KEV catalog on 2026-08-21, Poland's CERT has warned of in-the-wild attacks, unpatched Zimbra servers are reported compromised, and two public proof-of-concept exploits exist.
· Synacor Zimbra Collaboration Suite (ZCS) before 10.1.20 (when the optional zimbra-snmp package is installed and SNMP notifications are enabled) KEV PoC ×4large
Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
CVE-2026-86218 is a static code injection flaw (CWE-96) in N-able's N-central on-premises remote monitoring and management (RMM) platform, carrying a maximum CVSS 4.0 score of 10.0. An unauthenticated, remote attacker triggers it by sending crafted network input to the N-central server that is improperly neutralized and persisted into application-managed code, which the server then executes — no privileges (PR:N) or user interaction (UI:N) are required. Successful exploitation yields full server compromise with high impact on confidentiality, integrity, and availability, and because N-central acts as the management hub for downstream customer endpoints, compromise can expose the entire managed estate. Any organization running an affected N-central release (before 2026.3.1.14) — primarily MSPs and corporate IT departments using N-able RMM — is affected. The flaw is confirmed exploited in the wild: N-able patched it as a zero-day, CISA added it to the KEV catalog on 2026-09-08, and it is the fourth N-central hotfix in five weeks, though no public PoC is known and ransomware use is unknown.
· N-able N-central before 2026.3.1.14 KEV PoC ×2large
Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.
· MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC ×2mass
Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service of MikroTik RouterOS: the service accepts a "related" btest connection before the primary session has completed authentication, so an unauthenticated remote client can start an IPv4 UDP bandwidth test. When the test runs with "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer, leaking a small amount of kernel memory, and a separate unchecked, inverted packet-size interval causes an unsigned integer underflow that produces anomalously large fragmented output capable of restarting the RouterOS kernel. An unauthenticated network attacker therefore gains limited information disclosure and, more significantly, a remote denial of service through repeated router crashes, with no credentials or user interaction required (CVSS 4.0: 8.8 High). Any MikroTik device running an unpatched RouterOS version with the bandwidth-test server enabled and reachable from an untrusted network is affected. No public PoC or CISA KEV listing exists for this CVE and EPSS is low (0.4%), but it is part of the batch of RouterOS fixes in MikroTik advisory AV26-887 that attackers have recently chained to hijack routers, so in-the-wild exploitation of the flaw set is reported.
· MikroTik RouterOS (Long-term channel, v6) All versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS (Long-term channel, v7) All versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC mass
Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI
Zimbra Collaboration Suite (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 is vulnerable to stored cross-site scripting through its Classic webmail interface. An attacker sends an HTML e-mail containing a Cascading Style Sheets (CSS) @import directive, and when a recipient opens that message in Classic UI, the injected content executes as script in the victim's browser session. Successful exploitation lets an attacker run arbitrary JavaScript in the Zimbra webmail context, potentially hijacking the session, reading mail, or acting as the user, consistent with the cross-scope impact reflected in the 6.1 CVSS score. Only deployments running the affected ZCS 10/10.1 versions with the Classic UI enabled are exposed; organizations on patched releases or not using Classic UI are not impacted. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-03-18, confirming exploitation in the wild, and recent reporting describes Zimbra flaws being used by Russian-aligned espionage actors against Western and Ukrainian targets.
· Synacor Zimbra Collaboration Suite (ZCS) 10 10.x before 10.0.18 · Synacor Zimbra Collaboration Suite (ZCS) 10.1 10.1.x before 10.1.13 KEVlarge
SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).
· MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)mass
Unauthenticated Arbitrary File Read in MikroTik RouterOS WebFig (CVE-2026-67281)
RouterOS WebFig's /jsproxy handler contains an unauthenticated file-read flaw: a newly allocated session keeps a stale, uninitialized principal pointer that is later used to authorize file access (CWE-824), combined with a path-traversal issue (CWE-22). An unauthenticated attacker who can reach the web interface first shapes the heap allocator so the uninitialized pointer resolves with sufficient rights, then submits an encrypted URI containing parent-directory components to escape the WebFig file namespace. This lets the attacker read root-owned files on the router, including configuration stores that contain credentials, which could enable further compromise. Only MikroTik RouterOS 7.x before 7.23.4 (Long-term) and 7.24.2 (Stable) is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this flaw is known (EPSS ~0.4%), although recent reporting notes MikroTik patches being chained in router-hijack campaigns generally.
· MikroTik RouterOS (WebFig /jsproxy) 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable); fixed in 7.23.4 and 7.24.2mass
Unauthenticated SSH Session Bypass Enables File Writes in MikroTik RouterOS
CVE-2026-67279 is an authentication-ordering flaw (CWE-841) in the SSH server of MikroTik RouterOS: after a client-requested SSH rekey, the server enters the connection protocol even though user authentication was never attempted. An unauthenticated SSH client can therefore open a session channel and send an exec request, and on affected builds the server dispatches the command without any credentials. This lets the attacker create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data. Any MikroTik device running RouterOS builds older than the fixed releases is affected, although remote exploitation requires the SSH service to be reachable by the attacker. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.4% probability of exploitation in the next 30 days, so no exploitation is currently known.
· MikroTik RouterOS (Long-term branch, v6) prior to 6.49.21 · MikroTik RouterOS (Long-term branch, v7) prior to 7.23.4mass
Access Control Filter Bypass in N-able N-central Exposes Internal APIs
N-able N-central contains a flaw in the access-control filter that protects its internal API (CWE-791, incomplete filtering), allowing requests to bypass the filter and reach internal APIs without authorization. The issue is exploitable over the network with no privileges and no user interaction, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). An attacker gains unauthorized, low-impact access to internal APIs (VC:L); the vector indicates no integrity or availability impact and no evidence of code execution from this flaw. Any organization running an affected N-central release — a remote monitoring and management (RMM) platform operated by managed service providers — is affected, and the fix is available in N-central 2026.3 HF3 and 2026.4. The flaw is not on the CISA KEV list and has no known public PoC or confirmed in-the-wild exploitation, though it was disclosed in the same patching cycle as actively exploited N-central unauthenticated RCE flaws.
· N-able N-central Releases prior to 2026.3 HF3; fixed in 2026.3 HF3 and 2026.4large
X.509 Signature Forgery Enables TLS Impersonation in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x improperly verifies RSA/PKCS#1 v1.5 signatures when validating X.509 certificate chains, accepting malformed signatures (CWE-347, Improper Verification of Cryptographic Signature). Because the RouterOS trust store includes a root CA whose public key uses the small exponent e=3, an attacker who can control or redirect one of the router's outbound TLS connections (for example via a network man-in-the-middle position, DNS hijacking, or a compromised upstream path) can forge an intermediate CA signed with the root's public key, without ever holding its private key, and mint trusted certificates for arbitrary hostnames. This lets the attacker impersonate TLS servers the router connects to, with low confidentiality and integrity impact per the CVSS 4.0 score of 6.3 (medium), which reflects the network vector, no privileges required, but a high attack requirement of holding such a network position. Any deployment running RouterOS 7.x before 7.23.4 (Long-term) or 7.24.2 (Stable) is affected, spanning home/SOHO, enterprise, and ISP/WISP infrastructure; the 6.x branch is not listed as affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and EPSS gives a 0.2% probability of exploitation within 30 days, although related headlines note other MikroTik flaws have recently been chained to hack routers.
· MikroTik RouterOS 7.x before 7.23.4 (Long-term) and before 7.24.2 (Stable); the 6.x branch is not affectedmass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.