60
45
CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog
60
60
60
60
60
60
60
2026-005: High Vulnerability in the Linux Kernel ("Copy Fail")
Linux kernel flaw CVE-2026-31431 ('Copy Fail', CVSS 7.8) allows unprivileged users to gain root via AF_ALG; a public PoC is out and most distros remain unpatched.
Disclosed on 29 April 2026, CVE-2026-31431 is a local privilege escalation in the Linux kernel's algif_aead module (AF_ALG crypto API), CVSS 7.8, stemming from a 2017 in-place optimisation. By chaining an AF_ALG socket operation with splice(), an unprivileged user can write 4 bytes into an arbitrary page-cache page, e.g. corrupting a setuid binary like /usr/bin/su to obtain a root shell. It affects virtually all kernels built since 2017, including Ubuntu 20.04-24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16; the mainline fix landed 1 April 2026 but no vendor packages were available as of 30 April. CERT-EU recommends the interim mitigation (disable algif_aead) and blocking AF_ALG via seccomp, prioritising Kubernetes nodes and CI/CD runners.
68
60
60
60
45
60
Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019
Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.
CVE-2019-19781, a CVSS 9.8 directory traversal vulnerability, affects all supported versions of Citrix ADC and Citrix Gateway. Unit 42 captured multiple exploitation attempts in the wild and identified scanning activity from roughly 700 Shodan-exposed hosts. The flaw stems from improper pathname handling in Apache, allowing unauthenticated attackers to read sensitive files like smb.conf or achieve remote code execution via crafted XML. Palo Alto Networks released Threat Prevention signatures 57497 and 57570 on January 7, 2020, while Citrix published advisories CTX267027 and CTX267679 with responder policy mitigations pending a late-January patch.
82
Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
60
ToolShell Exploit: Critical SharePoint Zero
60
2026-004: Critical Vulnerability in SharePoint Exploited
CVE-2026-20963 (CVSS 9.8), an unauthenticated RCE in on-prem SharePoint, was added to CISA's KEV on 18 March 2026 and is actively exploited.
CERT-EU warns about CVE-2026-20963, a CVSS 9.8 unauthenticated remote code execution flaw in SharePoint caused by deserialisation of untrusted data, affecting SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. Microsoft raised the CVSS score on 17 March 2026 and the flaw entered CISA's Known Exploited Vulnerabilities catalogue on 18 March 2026. Three additional SharePoint RCE flaws (CVE-2026-26106, CVE-2026-26113, CVE-2026-26114) were fixed in the March 2026 release. CERT-EU urges immediate patching of internet-facing servers plus AMSI Full Mode, EDR deployment, ASP.NET machine key rotation, and compromise assessments.
90
60
57
60
45
60
45
60
60
60
60
60
Back-to-back N-able bugs send admins on a patching spree
CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.
N-able disclosed CVE-2026-86218 on September 6, a pre-authentication remote code execution flaw with CVSS 10.0 in its N-central RMM platform, and both N-able and Huntress report it is being exploited in the wild. It follows Huntress's disclosure of an exploit chain combining CVE-2026-86206 and CVE-2026-86207 that bypasses access controls to create unauthorized administrative accounts, investigated after a September 4 compromise of a fully patched customer environment. N-able has applied mitigations to all hosted N-central instances; on-premises customers must upgrade to Hotfix 4 (build 2026.3.1.14) immediately.
88
60
60
60
60
60
60
60
60
60