60
CVE-2019-1068: A remote code execution vulnerability exists in ...
CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.
CVE-2019-1068 (CVSS 8.8, CWE-20) is an improper input validation flaw allowing unauthenticated RCE in Microsoft SQL Server 2014 SP2/SP3, 2016, and 2017 on 32-bit and x64 builds. Exploitation requires low complexity and low privileges with no user interaction, and CISA formally added it to the KEV catalog on August 26, 2026. The CVE was originally published on July 15, 2019 and carries an EPSS score of 52.8%. Administrators must inventory affected SQL Server assets and apply vendor patches on an accelerated timeline.
72
60
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability
CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.
CVE-2026-9586 (CVSS 4.0: 9.3) is an unauthenticated SQL injection in the /pa endpoint of Sangoma Switchvox SMB Edition, where the unsanitized PhoneIP value in XML phone notification requests reaches the PostgreSQL database. Horizon3 demonstrated escalation to OS command execution, and honeypots run with Defused Cyber observed exploitation attempts on August 30, 2026, using PostgreSQL commands with nc and curl. Fixed in Switchvox 8.4.0.2 released July 14, 2026; one attacker IP (176.65.148.184) was documented.
64
New Mirai Variant Targeting Network Security Devices
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
Unit 42 observed attacks exploiting VisualDoor (SonicWall SSL-VPN), CVE-2020-25506 (D-Link DNS-320), CVE-2020-26919 (Netgear ProSAFE Plus), and other flaws, with infrastructure rotating across at least three IP addresses between February 16 and March 13, 2021. Payloads were updated hours after CVE-2021-27561 and CVE-2021-27562 (Yealink Device Management, unauthenticated root RCE) and later added CVE-2021-22502 (Micro Focus Operation Bridge Reporter) and CVE-2019-19356 (Netis WF2419). Successful exploitation invokes wget to fetch shell scripts that download Mirai binaries compiled for multiple architectures and brute-forcers, and attacks were still ongoing when reported.
75
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.
85
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.
80
[webapps] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
Exploit-DB publishes unauthenticated remote code execution exploit for Orkes Conductor 3.30.2 workflow orchestration platform.
A public exploit demonstrates unauthenticated remote code execution in Orkes Conductor version 3.30.2. The flaw allows arbitrary code execution on exposed Conductor instances without any authentication. Organizations running the workflow orchestration platform should patch or restrict exposure immediately.
48
U.S. CISA adds Microsoft Windows, Apache HugeGraph-Server, Oracle JDeveloper, Oracle WebLogic Server, and Microsoft SQL Server bugs to its Known Exploited Vulnerabilities catalog
60
Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 internet-facing Gitea servers are exposed to active exploitation of CVE-2026-60004, an authenticated code injection flaw enabling arbitrary code execution.
Attackers are targeting CVE-2026-60004, a code injection vulnerability in Gitea that lets authenticated attackers execute arbitrary code. The flaw was reported by Salesforce security researcher Shai Rod. Roughly 8,300 Gitea instances are estimated vulnerable, so administrators should patch promptly and check for compromise.
72
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
82
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CERT Polska and CISA report active exploitation of Zimbra RCE CVE-2026-73570, with 267 instances compromised per Shadowserver.
CVE-2026-73570 (CVSS 8.9) enables unauthenticated command injection and remote code execution in Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled, via crafted SMTP requests. CISA added the flaw to its KEV catalog on August 21, 2026, with a federal patch deadline of August 24. The Shadowserver Foundation counted 267 compromised instances as of August 24, 2026, led by the US (46), Sweden (21), France (20) and Germany (17). Separately, Russia-linked Laundry Bear has weaponized Zimbra stored XSS CVE-2025-66376 against Western government and commercial mail servers since at least July 2025, delivering the ZimReaper payload.
75
Langflow Remote Code Execution Vulnerability Exploited in Attacks (CVE-2026-0768)
Critical CVSS 9.8 RCE CVE-2026-0768 in Langflow is under active exploitation, with attackers probing for credentials and secrets.
CVE-2026-0768, a critical (CVSS 9.8) remote code execution flaw in Langflow's code validator, lets attackers execute Python code with root privileges via the validate endpoint's code parameter. VulnCheck honeypots in the UK detected Russian-origin exploitation performing reconnaissance and credential harvesting, querying environment variables like LANGFLOW_SUPERUSER and AWS keys and reading Langflow's secret key. Versions before 1.4.2 are affected; no vendor advisory or public PoC was available at reporting time.
65
60
60
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Threat actors exploit Fortinet heap-based buffer overflow CVE-2025-25249 to deploy PivotC2 RAT, infecting 178 devices and exfiltrating data from US targets.
SOCRadar reports exploitation of an unauthenticated remote code execution vulnerability, CVE-2025-25249 (CVSS 7.4), patched in January in FortiOS and FortiSwitchManager. Attackers scanned over 30,000 IP addresses, infected 178 devices with PivotC2 RAT, and at least two intrusions resulted in data exfiltration, primarily targeting US entities. SOCRadar attributes attacks to a likely Russian-speaking cybercrime actor and suggests the RAT was AI-assisted, in use since July 2026. CISA added the CVE to the KEV catalog with a three-day BOD 26-04 patch deadline for federal agencies.
82
Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch
PaperCut pre-auth RCE CVE-2026-81578 actively exploited; 47% of tracked installs unpatched and exposed to remote code execution.
Huntress confirmed active exploitation of a pre-authentication RCE flaw in PaperCut (CVE-2026-81578), chainable with CVE-2026-82078 to achieve SYSTEM-level code execution via PaperCut's Application Server. Observed attacks focused on short reconnaissance (whoami, ver, tasklist) with no persistence, but a malicious Java class dropping into the installation directory leaves the jdbc:derby:memory:pwn breadcrumb. Roughly 47% of ~2,500 tracked installations run version 23 or earlier with no patch yet available.
74
60
57
[remote] PraisonAI praisonaiagents 1.6.77 - Remote Code Execution
Public RCE exploit targets PraisonAI praisonaiagents 1.6.77, an open-source multi-agent AI framework.
Exploit-DB entry 52639 publishes a remote code execution exploit against praisonaiagents 1.6.77, the agent library from PraisonAI used for building LLM-powered multi-agent applications. The PoC demonstrates how attackers could achieve arbitrary code execution on deployments running the vulnerable version. This continues a pattern of serious flaws surfacing in rapidly developed AI agent frameworks.
45
60
Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.
Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.
78
60
CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.
65
60
57
57
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.
60
60
57
Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.
82
60
60
CISA adds recently disclosed Apple flaws to its Known Exploited Vulnerabilities catalog
60
60
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.
75
Hackers Target Langflow in CVE-2026
Threat actors are actively exploiting CVE-2026-0768, an unauthenticated Python RCE in Langflow, hunting OpenAI, AWS, and SSH credentials.
Attackers began exploiting CVE-2026-0768 (CVSS 9.8), an unauthenticated remote code execution flaw in the code validator of the Langflow AI low-code platform, affecting all versions up to 1.4.2. VulnCheck observed 50+ Canary detections on the first day of exploitation, with attackers checking Langflow, OpenAI, and AWS keys in environment variables, reading the secret key, and looking for SSH access and shell history; most traffic originates from Russia and targeted UK-based canaries. The flaw was reported via ZDI by Trend Research in July 2025 and disclosed in January 2026; six other Langflow CVEs were added to VulnCheck's KEV list this year.
72
60