Search: “networking”

63 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 138 Industry 138 Threat actor 119 Vulnerability 111 Malware 89 AI safety & security 84 Research 80 Advisory 69 Policy & legal 54 AI research 52 Tools 51 Data breach 49 Phishing & fraud 40 AI industry 39

SeverityAll critical 81 high 335 medium 253 low 24 info 482

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.

CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-4827

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-81861

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google announced Android 17 will enforce OS-wide Encrypted Client Hello with ECH GREASE, plus Certificate Transparency by default and carrier 2G disablement.

Google announced Android 17 network security protections headlined by OS-wide support for Encrypted Client Hello (ECH), with ECH GREASE enabled by default so connections to non-ECH servers look identical. Google's Jigsaw noted OkHttp has integrated ECH, letting third-party Android apps adopt the standard. The release also enforces Local Network Protection permission prompts, enables Certificate Transparency by default, and lets carriers turn off 2G by default to prevent downgrade attacks, rogue base stations, and SMS blasters. ECH was previously added to Chrome 117 and Firefox 118 at the browser level only.

The Hacker NewsAug 28, 16:20 UTC · 19d agoAdvisory

CareCam CM2507

CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.

CISA advisory ICSA-26-258-08 discloses seven vulnerabilities in CareCam HMT.CM2507 IP cameras running firmware v251211.1507. Issues include missing authentication for network video streaming (CVE-2026-88259, CVSS 3.1 7.5), an empty password on a privileged ONVIF account (CVE-2026-84398), weak legacy hashing of the root password (CVE-2026-85497, CVSS 4.0 9.3 critical), and cleartext storage of Wi-Fi credentials (CVE-2026-81321). Physical-access flaws allow arbitrary code execution from scripts on removable media (CVE-2026-81305) and unauthenticated bootloader access (CVE-2026-85478). The cameras are deployed worldwide in commercial facilities.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-88259 CVE-2026-84398 CVE-2026-84400+4 CVEs

Palo Alto Networks security advisory (AV26-905)

Canada's Cyber Centre relayed Palo Alto Networks advisories covering PAN-OS, Cloud NGFW, Prisma Access, and Prisma Browser vulnerabilities, including PAN-OS CVE-2026-0310 buffer overflow.

The Canadian Centre for Cyber Security issued advisory AV26-905, noting that as of September 10, 2026, multiple Palo Alto Networks products are affected by vulnerabilities. Affected products include Cloud NGFW on AWS and Azure, multiple PAN-OS versions, Prisma Access, and Prisma Browser prior to 151.26.5.170. The advisory references CVE-2026-0310, a PAN-OS buffer overflow via XML processing (PAN-SA-2026-0012), and the September 2026 Chromium monthly vulnerability update. Administrators are encouraged to review the vendor links and apply available updates.

Canadian Centre for Cyber SecuritySep 10, 12:10 UTC · 6d agoAdvisory 3 sources CVE-2026-0310

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-73807 CVE-2026-82567

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

CISA details CVE-2026-61884 (CVSS 9.8) in Tycon Systems TPDIN-Monitor-WEB2: unauthenticated access to power relays when credentials are unset; fixed in 2.4.5.

CISA updated its advisory for Tycon Systems TPDIN-Monitor-WEB2 firmware below 2.4.5, covering two vulnerabilities. CVE-2026-61884 (CVSS 9.8, CWE-306) lets any network attacker reach full device controls, including power relay management and reboots, on units left without configured HTTP credentials. CVE-2026-55985 exposes stored system credentials in cleartext to authenticated dashboard users, enabling compromise of other local systems. No public exploitation has been reported to CISA.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory 2 sources CVE-2026-61884 CVE-2026-55985

Adversary simulation: what you need to know

UK NCSC publishes guidance on adversary simulation, comparing full spectrum and assumed breach approaches across prerequisites, testing, and reporting phases.

NCSC guidance describes two adversary simulation approaches: full spectrum, starting outside the network with an end-to-end attack, and assumed breach, starting from an internal foothold. The preferred methodology spans three phases - prerequisites (scoping, passive reconnaissance, preparation), testing (active reconnaissance, initial access, internal phase, cleanup), and reporting. The document distinguishes adversary simulation from penetration testing and stresses customer-defined objectives and minimal information sharing.

NCSC UKupdated 09:09 UTC · 6m agofirst 08:29 UTC · 46m agoAdvisory 2 sources

Oracle Critical Security Patch Update, September 2026 Review

Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.

Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.

Qualys ThreatPROTECTSep 16, 14:15 UTC · 19h agoAdvisory CVE-2026-83154 CVE-2026-83196 CVE-2026-83197+10 CVEs

CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks

CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.

CISA, the NSA, and cyber agencies from Australia, Canada, the UK, and New Zealand released joint guidance on September 15 covering 17 techniques attackers use to compromise Active Directory, including AD CS, Certificate Services, and Federation Services attacks. Named techniques include Kerberoasting, AS-REP roasting, password spraying, DCSync, NTDS.dit dumping, Golden and Silver Tickets, Golden SAML, and Skeleton Key. Recommendations include minimizing SPN accounts, enforcing AES encryption, disabling NTLM, account lockout thresholds of five attempts, phishing-resistant MFA, and Tier 0 prioritization. The guide also lists Windows event IDs 4769, 4768, 4625, 4771, and 2889 for detecting Kerberoasting and password spraying on domain controllers.

GBHackersSep 16, 06:04 UTC · 1d agoAdvisory

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2024-42384 CVE-2024-42385 CVE-2024-42386+11 CVEs

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Ubuntu released USN-8748-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across networking, file system, and crypto subsystems.

Ubuntu issued security notice USN-8748-1 fixing several Linux kernel vulnerabilities affecting the NVIDIA Tegra memory controller driver, hardware crypto device drivers, and network drivers, among others. Affected subsystems include GFS2, OCFS2, and SMB file systems, B.A.T.M.A.N. meshing, Ceph, Netfilter, Open vSwitch, IPv4/IPv6, RxRPC, SCTP, and TIPC. An attacker could potentially exploit these flaws to compromise the system.

Ubuntu Security NoticesSep 10, 15:32 UTC · 6d agoAdvisory CVE-2026-52914 CVE-2026-52931 CVE-2026-52955+8 CVEs

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-38059 CVE-2026-38057 CVE-2026-38056+1 CVEs

Slovakia Warns of Cyber Risks in Road Speed Cameras

Slovakia's NBÚ warns that speed camera systems from SODASUS, Simicon and NEROline pose cyber risks including undocumented remote access.

Slovakia's National Security Authority (NBÚ) warned of a significant cyber threat tied to several road speed camera products: NERO R-ONE units sold by Cyprus-based SODASUS, and Cordon-series cameras made by Russia's Simicon and sold by Croatia's NEROline. A security analysis requested by the Interior Ministry found weak protections, mismatches between documented and actual communication settings and software versions, unclear hardware/software provenance, and pre-configured remote-access mechanisms outside operator control. NBÚ warned that compromised cameras could expose vehicle and licence-plate data, tamper with records, or serve as a foothold into public-sector networks lacking segmentation. The Interior Ministry reportedly removed the units from its pilot deployment and asked the supplier to replace them with equipment meeting Slovak and EU security requirements.

Security AffairsAug 24, 08:54 UTC · 24d agoAdvisory

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-68953 CVE-2026-66890 CVE-2026-68070+3 CVEs

Siemens Mendix SAML

Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).

CISA republished Siemens advisory SSA-887643 for CVE-2026-80465 (CVSS 8.7) in the Mendix SAML module, affecting Mendix 10/11-compatible versions before 4.2.3 and Mendix 9.24-compatible versions before 3.6.27. The module improperly validates SAML response signatures (CWE-347), letting unauthenticated remote attackers hijack an account in specific SSO configurations. Mendix has released fixed versions and recommends updating.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-80465

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-58113

CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production

CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.

Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.

CSO OnlineSep 8, 17:16 UTC · 8d agoAdvisory in the wild

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-78225 CVE-2026-81855

NextGen Healthcare Mirth Connect

CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.

CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.

CISA Advisoriesupdated Sep 11, 13:08 UTC · 5d agofirst Sep 10, 12:00 UTC · 6d agoAdvisory 2 sources CVE-2026-82583 CVE-2026-78224 CVE-2026-82578

AVEVA Pipeline Integrity Monitor

CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.

CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-81821 CVE-2026-81822 CVE-2026-81823+1 CVEs

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-87020

Dell security advisory (AV26-886)

Canada's Cyber Centre flags September 2026 Dell vulnerabilities across iDRAC9/iDRAC10, OpenManage, PowerEdge, Avamar, NetWorker VE, PowerProtect, IDPA and PowerScale OneFS.

Canadian Centre for Cyber Security advisory AV26-886 lists Dell vulnerabilities across iDRAC9, iDRAC10, OpenManage Network Integration, PowerEdge servers, the OpenManage Python SDK, Avamar, NetWorker Virtual Edition, PowerProtect DP Series, IDPA and PowerScale OneFS. Fixed versions include iDRAC9 7.30.10.50, iDRAC10 1.30.30.50 and OpenManage Network Integration 3.10. No CVE identifiers or exploitation status are provided; administrators are urged to apply the vendor updates.

Canadian Centre for Cyber SecuritySep 8, 14:07 UTC · 8d agoAdvisory

CareCam Pro IP Cameras

CISA advisory details hard-coded bootloader credential CVE-2026-85083 in ANJIA AJL33PC0801 CareCam Pro cameras, allowing physical-access firmware compromise.

CISA ICS advisory ICSA-26-251-01 describes CVE-2026-85083, a hard-coded credential (CWE-798) used for bootloader authentication in the ANJIA AJL33PC0801 CareCam Pro IP camera. An attacker with physical access could gain privileged bootloader access and modify firmware and configuration, potentially fully compromising the device. The flaw scores 6.8 on CVSS 3.1 (7.0 on CVSS 4.0), is not remotely exploitable, and no public exploitation has been reported. Affected firmware is linux_linux_202008261138_svn13796 with U-Boot 2010.06; the vendor is headquartered in China with worldwide deployments.

CISA AdvisoriesSep 8, 12:00 UTC · 8d agoAdvisory CVE-2026-85083

USN-8729-1: Linux kernel vulnerabilities

Ubuntu issued USN-8729-1 fixing Linux kernel vulnerabilities across ARM, Bluetooth, GPU, SCSI, SMB, and Azure MANA subsystems.

Ubuntu released USN-8729-1 addressing several security issues discovered in the Linux kernel that could allow an attacker to compromise the system. Fixes span ARM32/ARM64/PowerPC architectures, Bluetooth, GPU, InfiniBand, and network drivers, plus the Microsoft Azure Network Adapter (MANA) driver. The update also corrects flaws in the SCSI and SPI subsystems, SMB and NTFS3 file systems, EFI core, and file systems infrastructure.

Ubuntu Security NoticesSep 7, 09:08 UTC · 10d agoAdvisory 6 sources

IXON VPN Client

CISA warns CVE-2026-75925 (CVSS 9.6) in IXON VPN Client <1.4.7 lets attackers inject config directives for root/SYSTEM remote code execution.

IXON's CRLF injection flaw (CVE-2026-75925, CWE-93) in VPN Client before 1.4.7 lets the unauthenticated local configuration service inject additional directives into a file consumed by a privileged subprocess. Injected configuration persists across client and OS restarts, enabling code execution as root or SYSTEM while the VPN connection keeps functioning normally. Deployments span energy, manufacturing, water, and IT sectors; no public exploitation has been reported to CISA.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-75925

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-78012

Inductive Automation Ignition

CISA reports a permissions flaw (CVE-2026-77393, CVSS 8.8) in Inductive Automation Ignition <=8.1.53 letting authenticated users create projects; fixed in 8.1.54.

CISA republished Inductive Automation's advisory for CVE-2026-77393, an incorrect default permissions issue (CWE-276) in Ignition 8.1.53 and earlier. The Gateway "Create Project Role(s)" setting shipped blank, allowing any authenticated user who can execute gateway scripts to create projects. Ignition 8.1.54 restricts project creation to Designer sessions and the 8.3 series is unaffected. CISA notes no known public exploitation of this vulnerability.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-77393

Rockwell Automation 1756-ENBT Module

Rockwell's 1756-ENBT ControlLogix EtherNet/IP bridge (all versions) is vulnerable to DoS via crafted CIP packets, crashing the module until manual restart.

CISA republished Rockwell Automation's advisory for CVE-2025-10478, a CWE-754 flaw affecting all versions of the 1756-ENBT ControlLogix EtherNet/IP bridge, scored CVSS 7.5. A crafted CIP packet can crash the module, and the device requires a restart to recover. Affected critical infrastructure sectors include critical manufacturing, food and agriculture, transportation systems, and water. No public exploitation has been reported; CISA recommends minimizing network exposure.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory 3 sources CVE-2025-10478

HPE security advisory (AV26-873)

Canada's Cyber Centre relays HPE advisories covering multiple vulnerabilities in Aruba AOS-CX switches and Fabric Composer, urging updates.

The Canadian Centre for Cyber Security issued advisory AV26-873 noting multiple vulnerabilities in HPE Aruba Networking AOS-CX and Fabric Composer. Affected versions span AOS-CX releases through branches 10.10, 10.13, 10.16, 10.17, and 10.18, and Fabric Composer through 7.3.3. Administrators are urged to review HPE bulletins HPESBNW05133 and HPESBNW05134 and apply available updates.

Canadian Centre for Cyber SecuritySep 2, 13:38 UTC · 14d agoAdvisory

CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' a 22-page guide marking the agency's first guidance on decoys such as honeypots and honeytokens. Acting executive director Chris Butera described decoys as a low-cost, high-fidelity way to detect adversaries already inside networks, complementing zero-trust and assume-compromise approaches. The guidance covers decoy principles, definitions, deployment scenarios, and is aimed especially at resource-constrained critical infrastructure sectors.

CyberScoopSep 16, 20:22 UTC · 12h agoAdvisory

HPE security advisory (AV26-928)

Canada's Cyber Centre relayed an HPE advisory covering multiple vulnerabilities in EdgeConnect SD-WAN Gateways and Orchestrator, urging prompt updates.

On September 16, 2026, the Canadian Centre for Cyber Security published advisory AV26-928 noting that as of September 15, 2026, HPE is affected by multiple vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways and Orchestrator across multiple versions, per HPE bulletin HPESBNW05135 rev.1. The Cyber Centre encourages users and administrators to review the linked HPE security bulletins and apply available updates. No exploitation details or CVE identifiers are provided in the advisory text.

Canadian Centre for Cyber SecuritySep 16, 18:35 UTC · 14h agoAdvisory 2 sources

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities

Cisco patched ACL Object Group Search bypass flaws in ASA and FTD firewall software that let unauthenticated attackers reach protected networks.

Cisco disclosed multiple vulnerabilities in the ACL Object Group Search implementation of Secure Firewall ASA and FTD Software, caused by a logic error in populating group access control policies. An unauthenticated remote attacker could send traffic that should be blocked through the device, bypassing configured access controls. Cisco has released software updates; no exploitation is mentioned.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 17h agoAdvisory 9 sources

USN-8761-1: Linux kernel (Azure) vulnerabilities

Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.

Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.

Ubuntu Security NoticesSep 15, 09:42 UTC · 1d agoAdvisory 2 sources

USN-8758-1: dracut vulnerability

Ubuntu patches dracut CVE-2026-15816, where a rogue adjacent-network DHCP server can inject root-executed commands during boot-failure handling.

Ubuntu security notice USN-8758-1 fixes CVE-2026-15816 in dracut, where messages written by the die() function to the emergency hook directory are not properly shell-quoted. An attacker on an adjacent network controlling a rogue DHCP server could exploit this to inject commands executing as root during boot-failure handling. Users should apply the patched dracut package.

Ubuntu Security NoticesSep 14, 20:28 UTC · 2d agoAdvisory CVE-2026-15816

USN-8754-1: Freeciv vulnerability

Ubuntu patches Freeciv stack overflow where remote attackers crash clients or servers using crafted network packets.

USN-8754-1 fixes a Freeciv vulnerability where certain network packets trigger a stack overflow. A remote attacker could use this to crash Freeciv clients or servers, resulting in denial of service. Ubuntu released updated packages.

Ubuntu Security NoticesSep 14, 12:40 UTC · 2d agoAdvisory1

September 2026 Patch Tuesday forecast: All we need is more time

September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.

This Patch Tuesday forecast column notes August 2026 Patch Tuesday was the second largest ever with 398 resolved CVEs, yet only one was confirmed actively exploited. SharePoint flaws CVE-2026-55040 and CVE-2026-63520 are being chained for authentication bypass and remote code execution in active attacks against unpatched servers. Microsoft Defender's ShieldBreak elevation of privilege flaw (CVE-2026-69414) is publicly disclosed with PoC code and a fix is expected, while Chrome CVE-2026-85046 was reported exploited in the wild. Several products, including Windows 11 24H2 Home/Pro and Exchange Server 2016/2019 ESU, reach end of support in October 2026.

Help Net SecuritySep 9, 09:05 UTC · 8d agoAdvisory in the wildCVE-2026-55040 CVE-2026-63520 CVE-2026-62911+5 CVEs2

ZDI-26-632: WatchGuard FireWare OS epm connect Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 8.8 unauthenticated stack-based buffer overflow in WatchGuard FireWare OS epm connect enabling network-adjacent remote code execution.

ZDI published advisory ZDI-26-632 for a stack-based buffer overflow in the epm connect component of WatchGuard FireWare OS. Network-adjacent attackers can execute arbitrary code without authentication. ZDI assigned CVSS 8.8 and the issue is tracked as CVE-2026-13086.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 8d agoAdvisory CVE-2026-13086

SonicWall security advisory (AV26-884)

Canada's Cyber Centre issued advisory AV26-884 warning that SonicWall Network Security Manager On-Prem 4.3.0 and earlier are affected by multiple vulnerabilities.

The Canadian Centre for Cyber Security published advisory AV26-884 on September 4, 2026, flagging SonicWall Network Security Manager (NSM) On-Prem across VMware, Hyper-V, Azure, and KVM deployments, versions 4.3.0 and earlier, as affected by multiple vulnerabilities. The advisory does not list CVE identifiers, exploit details, or in-the-wild exploitation. Administrators are encouraged to review the referenced links and apply updates as they become available.

Canadian Centre for Cyber SecuritySep 8, 14:01 UTC · 8d agoAdvisory

Ubiquiti security advisory (AV26-850)

Canada's Cyber Centre reports critical vulnerabilities across Ubiquiti UniFi products including UniFi OS Server, Network, Protect, and Access; updates required.

The Canadian Centre for Cyber Security (AV26-850) reports critical vulnerabilities affecting numerous Ubiquiti products, including UniFi OS Server (<=5.1.21), UniFi Network Application (<=10.4.57), UniFi Protect Application (<=7.1.87), and UniFi Access Application (<=4.3.3). Other affected products include UniFi Connect, UID Enterprise Agent, UniFi Talk, UniFi Protect AI Key, Connect Display Cast Pro, and Enterprise Audio/Video Bridge. Administrators should update affected applications and devices; the advisory lists no CVE ids or exploitation details.

Canadian Centre for Cyber SecurityAug 26, 17:11 UTC · 21d agoAdvisory