60
60
60
60
U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
60
60
60
Critical Ghostscript flaw exploited in the wild. Patch it now!
60
60
60
Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day
Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.
Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.
93
U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.
CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.
82
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
GitLab path traversal CVE-2026-85706 (CVSS 10.0) was actively probed and exploited within 24 hours of disclosure and added to CISA's KEV catalog.
CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API allowing unauthenticated arbitrary file read via a single crafted HTTP request, exposing SSH keys, database credentials, deploy tokens, and CI/CD variables. watchTowr observed in-the-wild probes by September 11, one day after the September 10 disclosure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. Affected versions include CE and EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; the same update also patches insecure deserialization flaw CVE-2026-87719. Defenders should patch or remove public access, hunt logs for POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters, and rotate exposed credentials.
90
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.
Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.
90
UK Council Attack Linked to Mass Exploitation of SonicWall Flaw
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.
90
U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Cisco FMC, Chrome V8, Fortinet and Citrix NetScaler flaws to its KEV catalog, ordering federal patching by September 12.
CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-20079 (CVSS 10.0) is an unauthenticated authentication bypass in Cisco Secure Firewall Management Center's web interface enabling script execution and potential root access. CVE-2026-87491 (CVSS 8.8) is an out-of-bounds write in Chrome's V8 engine — the seventh actively exploited Chrome zero-day of 2026 — fixed in Chrome 153.0.8010.36. CVE-2025-25249 (CVSS 8.1) is a heap-based buffer overflow in FortiOS/FortiSwitchManager's cw_acd daemon being exploited with the PivotC2 RAT, and CVE-2026-19490 (CVSS 9.3) is a NetScaler SAML HTTP-Redirect authentication bypass; federal agencies must patch by September 12, 2026.
84
StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.
Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.
85
Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication
CERT Polska confirms attackers exploit chained MikroTik RouterOS SSH flaws to hijack devices without authentication; patches released in four RouterOS versions.
CERT Polska discovered six RouterOS vulnerabilities and confirmed active attacks chaining CVE-2026-67276 (CVSS 9.2, SSH authentication bypass caused by comparing only RSA key moduli) and CVE-2026-86060 (CVSS 9.2, privilege escalation via crafted usernames), dubbed MikroTrick. A third flaw, CVE-2026-67277 (CVSS 8.8) in the bandwidth-test service, can expose kernel memory or crash devices. Shadowserver counted about 122,500 MikroTik devices with SSH exposed; attackers created a privileged 'ops' account from IP 82.192.72.4, active since September 2. Fixes shipped in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding startup configuration scanning with a 'Flagged' marker for unauthorized changes.
82
Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
MikroTik RouterOS SSH auth-bypass chain MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is actively exploited; patch to 7.24.2/7.23.5/6.49.21.
Attackers are actively exploiting a chain dubbed MikroTrick that combines CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass in RouterOS RSA public key verification, and CVE-2026-86060, an SSH session privilege escalation, giving full admin control of internet-exposed MikroTik devices without the private key. Exploitation began around September 2, 2026, a day before MikroTik's September 3 patches, with confirmed compromises including creation of an 'ops' account; attacks traced to IPs 82.192.72.4 (Leaseweb) and 103.102.31.18. Fixed versions include 7.25beta3, 7.24.2, 7.23.4, 7.23.5 and 6.49.21. Defenders should check logs for failed logins with username '-2' and inspect /system history for ssh:-2@<IP> entries attached to configuration changes.
88
SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
SonicWall released hotfixes for two zero-day vulnerabilities in its SMA 1000 VPN appliances, with SonicWall PSIRT confirming active exploitation in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated unauthorized operations; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection in the Appliance Management Console enabling arbitrary command execution and RCE. The flaws affect models 6210, 7210 and 8200v running 12.4.3-03453 or earlier and 12.5.0-02835 or earlier, fixed in versions 12.4.3-03526 and 12.5.0-02952. This follows a July Volexity report on threat actor UTA0533 chaining two SMA 1000 zero-days to gain root access and deploy the KNUCKLEBALL Python backdoor.
90
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Attackers actively exploit two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML WordPress plugin, forging SAML responses to become admin.
CVE-2026-61979 is a SAML algorithm confusion flaw that lets attackers sign forged assertions using the identity provider's RSA public key as an HMAC secret; CVE-2026-15981 stems from PHP treating openssl_verify()'s -1 error return as true, allowing a crafted signature that triggers an OpenSSL error to validate. Both bugs independently let unauthenticated attackers obtain WordPress administrator sessions and both are confirmed exploited in the wild. DigitalOcean discovered the exploitation via a network anomaly after public vulnerability databases covered only the Free edition (fixed in 5.4.5), leaving seven independently versioned paid editions appearing patched. Attackers are scanning SSO endpoints from six IPs in Belgium, Nigeria, the US and Germany, and paid-edition fixes require manual uploads across version lines.
78
U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited CVE-2026-21962, a CVSS 10.0 unauthenticated flaw in Oracle HTTP Server and WebLogic Proxy Plug-in, to KEV with an August 27 deadline.
CISA added CVE-2026-21962 (CVSS 10.0), an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by August 27, 2026. The unauthenticated flaw allows remote attackers with network access to create, delete, or modify critical data, potentially gain broad access, and cause a scope change to other systems; affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CloudSEK honeypot data from January-February 2026 showed widespread exploitation of the flaw alongside older WebLogic RCEs including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271.
85
GitLab Warns of Active Exploitation of Critical GraphQL Flaw
GitLab emergency-patches actively exploited flaw CVE-2026-19478 (CVSS 9.4), letting unauthenticated attackers modify or delete public projects on self-managed servers.
GitLab emergency-patched CVE-2026-19478 (CVSS 9.4) on August 17 after WatchTowr researchers warned of active exploitation. The flaw lets unauthenticated attackers remotely modify or delete public projects and user data through a GraphQL directive, affecting only self-managed installations. Fixes ship in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11; the 18.2-18.10 branches receive no patch and must upgrade. Until patching, defenders should restrict unauthenticated access to /api/graphql, disable public repositories, and hunt for @gl_introduced in logs.
78
NSA, CISA, FBI, DOE, and EPA Warn of Active AI
Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.
NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.
88
SAP Commerce Cloud CVE-2026
Attackers actively exploit unauthenticated RCE CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud days after patch release.
CVE-2026-58231, a maximum-severity flaw in SAP Commerce Cloud (CVSS 10.0), allows unauthenticated attackers to abuse a default authentication client and bypass insufficient validation, achieving arbitrary code execution and compromise of internal components. Defused Cyber researchers observed exploitation attempts against honeypots only three days after SAP released the patch. The flaw had no public PoC and was not previously known to be exploited. The attackers are unknown, though past critical SAP flaws have been exploited by China-linked groups UNC5221 and UNC5174 and ransomware gangs.
86
macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.
CVE-2026-65400 (CVSS 9.8) is an authentication state-management flaw in macOS's built-in Screen Sharing that lets network attackers authenticate without valid credentials. The Dutch NCSC confirmed active exploitation against systems with port 5900 exposed to the internet; in every documented case attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the bug in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. A related researcher scan found roughly 40,000 exposed Screen Sharing hosts, and security firm Calif built working exploits for related flaws in about four hours using an AI coding agent.
80
Adobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public Disclosure
Attackers began exploiting critical Adobe Commerce flaw CVE-2026-71362 (CVSS 9.1) for unauthenticated customer account takeover shortly after patch release.
Sansec blocked the first exploitation attempts of CVE-2026-71362 immediately after Adobe published its advisory. The flaw lets unauthenticated attackers switch a customer session to another customer account, hijacking accounts and accessing private data without credentials, admin privileges or user interaction. It affects Adobe Commerce, Commerce B2B and Magento Open Source versions through the July 2026 patches, and Adobe issued isolated patch files APSB26-92 fixing seven vulnerabilities, including stored cross-site scripting and authorization issues.
74
60
60
60
60
60
60
60
60
60
60
60
60
U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its Known Exploited Vulnerabilities catalog
60