60
60
60
60
60
60
60
57
50
New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender
Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.
The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.
65
SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit
Attackers are actively exploiting critical SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) days after Rapid7 released a public PoC.
CVE-2026-55040 is a critical authentication bypass (CVSS 9.1) in SharePoint Server Subscription Edition that lets unauthenticated attackers forge JWT tokens and impersonate any user, including administrators. Microsoft patched it in July 2026 Patch Tuesday, but Rapid7 published a technical write-up and Python PoC on GitHub on August 12, and Defused quickly observed attackers running the PoC against SharePoint honeypots. KEVIntel recorded 12 exploitation attempts since July 19, with eight occurring on August 12-13 from IP addresses in Hong Kong, Japan, the Netherlands, Taiwan and the U.S. Admin-level SharePoint access exposes documents and data modification and can serve as a foothold into broader Microsoft 365 infrastructure; unpatched instances should apply the July update immediately.
78
60
60
60
Hackers target Windows users exploiting a Zero
60
60
60
60
60
60
50
2026-002: Multiple Vulnerabilities in Cisco Products
Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.
On 25 February 2026 Cisco released advisories for multiple flaws in Catalyst SD-WAN Controller and SD-WAN Manager, potentially granting administrative access to attackers. CVE-2026-20127 (CVSS 10.0) is an authentication bypass in the Controller's peering authentication mechanism, exploited in the wild since 2023, allowing unauthenticated admin access via NETCONF, rogue device injection, and persistent access. SD-WAN Manager flaws include CVE-2026-20129 (9.8, unauthenticated API auth bypass to netadmin), CVE-2026-20126 (7.8, local privesc to root), CVE-2026-20133 (7.5, info disclosure), CVE-2026-20122 (7.1, arbitrary file overwrite), and CVE-2026-20128 (5.5, DCA info disclosure). CERT-EU recommends patching, capturing forensic evidence, IOC hunting, and restricting management-plane internet exposure.
78
60
60
60
60
57
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
50
60
60
60
60
60
60
60
50
Apple macOS Screen Sharing Flaw Exploited on Internet
Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.
NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.
82
60
50