60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Week in review: Attackers exploiting VMware RCE, Microsoft fixes actively exploited zero-day
60
60
60
60
60
60
RunC Flaws Enable Container Escapes, Granting Attackers Host Access
60
60
60
60
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
GitLab path traversal CVE-2026-85706 (CVSS 10.0) was actively probed and exploited within 24 hours of disclosure and added to CISA's KEV catalog.
CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API allowing unauthenticated arbitrary file read via a single crafted HTTP request, exposing SSH keys, database credentials, deploy tokens, and CI/CD variables. watchTowr observed in-the-wild probes by September 11, one day after the September 10 disclosure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. Affected versions include CE and EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; the same update also patches insecure deserialization flaw CVE-2026-87719. Defenders should patch or remove public access, hunt logs for POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters, and rotate exposed credentials.
90
60
60
60
60
60
SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch
A maximum-severity (CVSS 10.0) unauthenticated RCE flaw in SAP Commerce Cloud, CVE-2026-58231, is under active exploitation days after patching.
CVE-2026-58231, rated 10.0 on CVSS, stems from insufficient authorization checks and input validation in SAP Commerce Cloud, enabling unauthenticated arbitrary code execution. Defused Cyber's honeypots detected exploitation attempts three days after the patch, and KEVIntel independently confirmed two attempts on August 14 from a US IP address. Onapsis urges customers to patch and rebuild, with an IP Filter Set offered as a temporary workaround. No actor attribution yet, though prior SAP NetWeaver flaw CVE-2025-31324 was exploited by China-nexus and criminal groups.
80