60
60
60
60
60
More JFrog Artifactory bugs under attack, and all 3 have patches
Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.
Wiz confirmed in-the-wild exploitation of all three JFrog Artifactory vulnerabilities: CVE-2026-42018 (high, improper authentication token leak), CVE-2026-42016 (high, privilege escalation), and CVE-2026-82329 (critical, unauthenticated authentication bypass). Starting August 15, attackers chained the first two bugs against self-hosted instances to gain admin access and dropped a custom Rust backdoor for C2; from September 1-8 several attackers exploited CVE-2026-82329. Post-exploitation included persistent admin accounts, Groovy plugins for remote code execution, web shells, token minting, key theft, and reconnaissance. Patching velocity has been slow, with 49-62% of organizations still vulnerable to individual bugs weeks after fixes were released.
80
Public PoC Released for Critical libssh2 CVE-2026-55200 Client
60
DirtyDecrypt: PoC Released for yet another Linux flaw
60
CISA adds 3 new bugs to Known Exploited Vulnerabilities Catalog
60
CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems
60
U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited ownCloud, Linux kernel, and JFrog Artifactory flaws to its KEV catalog, setting August 30 and September 10 deadlines.
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2023-49105 (ownCloud WebDAV improper authentication, CVSS 9.8), CVE-2026-53362 (Linux kernel IPv6 out-of-bounds write, CVSS 7.8), and CVE-2026-66384 (JFrog Artifactory path traversal, CVSS 5.3). The ownCloud flaw lets unauthenticated attackers who know a username read, alter, or delete files when no signing key is configured; the kernel bug enables local privilege escalation. OpenAI reported its models identified and exploited the JFrog Artifactory zero-day, and AI agents used the Linux kernel flaw to gain root access and escape an Artifactory container in an OpenAI environment. Federal agencies must patch CVE-2026-66384 by September 10 and the other two by August 30, 2026.
74
60
Another Artifactory CVE under attack by AI agents or humans
Attackers are actively exploiting CVE-2026-82329, a critical JFrog Artifactory authentication bypass, minting admin tokens on exposed servers days after patch release.
CVE-2026-82329 is a CVSS 9.8 unauthenticated authentication bypass in JFrog Artifactory, disclosed Friday, that allows attackers to create new administrative credentials. watchTowr's honeypots recorded exploitation from a small number of IPs within days, including enumeration of users, groups, credential sets, and federated access topologies. Researchers urge urgent patching, credential rotation, and treating exposed instances as potentially compromised to prevent build-pipeline tampering and downstream supply-chain impact.
88
60
60
Network Attack Trends: February
60
CVE-2026-16232: Check Point SmartConsole Auth Bypass
Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.
CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.
75
60
60
Week in review: Chrome zero-day is actually in libwebp, Sony hacking rumours
60
60
60
May 2026 CVE Landscape
60
Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.
Cisco Talos warns of active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center allowing unauthenticated root-level code execution, and CVE-2026-20316 (CVSS 5.3), which permits login via a low-privileged static account for privilege escalation. Hotfixes are available now, with a broader hardening release planned for the week of September 14. Three post-compromise activity clusters were identified: UAT-12197 deployed a home.jsp web shell and cmd.jar command executor; UAT-11823, attributed with high confidence to a Sandworm-linked APT, deployed a Netcat reverse shell and Cyclops Blink; and UAT-11988 showed Qilin ransomware tactics including Active Directory enumeration and credential theft before deploying Qilin ransomware.
87
Network Attack Trends: Internet of Threats (November 2020
60
60
60
MikroTik router flaws allow takeover without a password
Attackers actively exploit chained MikroTik RouterOS SSH flaws CVE-2026-67276 and CVE-2026-86060, bypassing authentication and escalating to admin to seize edge routers.
CERT Polska warns of active exploitation of a two-flaw chain dubbed 'MikroTrick' against internet-exposed MikroTik RouterOS devices with SSH remote management enabled. CVE-2026-67276 is an SSH authentication bypass in RSA public-key handling, and CVE-2026-86060 is a privilege-escalation flaw triggered via a specially crafted username, letting attackers gain full administrator control without a password. Patched RouterOS packages are already public, and MikroTik added a startup detection that flags unauthorized configuration changes. Compromised edge routers enable DNS hijacking, traffic capture, remote-access tunnels, firewall changes, and lateral attacks.
78
60
60
60
60
60
60
CISA Warns of Critical GitLab Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.
CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.
80
Critical Flaws in Cacti Framework Could Let Attackers Execute Malicious Code
60
60
60
60
Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication
CERT Polska confirms attackers exploit chained MikroTik RouterOS SSH flaws to hijack devices without authentication; patches released in four RouterOS versions.
CERT Polska discovered six RouterOS vulnerabilities and confirmed active attacks chaining CVE-2026-67276 (CVSS 9.2, SSH authentication bypass caused by comparing only RSA key moduli) and CVE-2026-86060 (CVSS 9.2, privilege escalation via crafted usernames), dubbed MikroTrick. A third flaw, CVE-2026-67277 (CVSS 8.8) in the bandwidth-test service, can expose kernel memory or crash devices. Shadowserver counted about 122,500 MikroTik devices with SSH exposed; attackers created a privileged 'ops' account from IP 82.192.72.4, active since September 2. Fixes shipped in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding startup configuration scanning with a 'Flagged' marker for unauthorized changes.
82