60
60
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.
watchTowr observed exploitation of MLflow CVE-2026-64849, an unauthenticated SSRF (CVSS 9.3) affecting versions below 3.15.0, within hours of CVE assignment on August 17, 2026, with attackers abusing model-registry webhooks to reach cloud metadata endpoints and exfiltrate credentials and secrets. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 19, 2026, with a September 2 patch deadline for federal civilian agencies. VulnCheck reported scanning of FUXA CVE-2026-25895 (missing authentication plus path traversal, CVSS 9.5, versions through 1.2.9) beginning August 18; about 60 FUXA instances are exposed and no RCE payloads have been dropped yet.
74
[webapps] Nodemailer 9.0.0 - File Read/ SSRF
A public proof-of-concept demonstrates arbitrary file read and SSRF in Nodemailer 9.0.0.
Exploit-DB entry 52654 contains a webapps proof-of-concept for Nodemailer 9.0.0 demonstrating both arbitrary file read and server-side request forgery. Nodemailer is a widely used Node.js email-sending library, so affected deployments could expose local files or internal services. The listing does not include a CVE identifier or evidence of in-the-wild exploitation.
35
[webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF
A public proof-of-concept exploit for an SSRF flaw in Linuxfabrik monitoring_plugins 6.0.0 appeared on Exploit-DB.
Exploit-DB listing 52653 discloses a server-side request forgery (SSRF) vulnerability in Linuxfabrik monitoring_plugins version 6.0.0, classified under web applications. A proof-of-concept exploit is publicly available. No CVE identifier or evidence of in-the-wild exploitation is provided in the listing.
26
[webapps] Apache Gravitino 1.2.1 - SSRF
Exploit-DB publishes a webapps SSRF proof-of-concept exploit targeting Apache Gravitino 1.2.1.
Exploit-DB entry 52641 documents a server-side request forgery (SSRF) exploit against Apache Gravitino version 1.2.1. The entry is categorized under web applications and provides a working proof of concept for the flaw.
25
[webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
Exploit demonstrates arbitrary file read via SSRF in Planyo Online Reservation System 3.0.
Exploit-DB entry 52636 documents an arbitrary file read vulnerability in Planyo Online Reservation System version 3.0, reachable through a server-side request forgery condition. The public PoC shows how the web application can be manipulated to fetch and disclose local files. Sites running the vulnerable version could expose sensitive server files.
25
Recent SSRF Flaw in Ivanti VPN Products Undergoes Mass Exploitation
60
60
60
60
SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
SonicWall says attackers are actively exploiting two chained zero-days in SMA 1000 appliances: CVE-2026-83548, a pre-authentication SSRF rated CVSS 10.0, and CVE-2026-83549, a post-authentication OS command injection (CVSS 7.8) in the Appliance Management Console. Hotfixes are available for SMA 6210, 7210, and 8200v appliances with no workarounds; SonicWall recommends reimaging compromised devices, rotating passwords, and resetting TOTP tokens. NHS England assesses further exploitation as almost certain, following a similar exploited pair in July when CISA added CVE-2026-15409 to its KEV catalog.
78
Network Security Trends: August
60
SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
SonicWall released hotfixes for two zero-day vulnerabilities in its SMA 1000 VPN appliances, with SonicWall PSIRT confirming active exploitation in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated unauthorized operations; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection in the Appliance Management Console enabling arbitrary command execution and RCE. The flaws affect models 6210, 7210 and 8200v running 12.4.3-03453 or earlier and 12.5.0-02835 or earlier, fixed in versions 12.4.3-03526 and 12.5.0-02952. This follows a July Volexity report on threat actor UTA0533 chaining two SMA 1000 zero-days to gain root access and deploy the KNUCKLEBALL Python backdoor.
90
60
60
U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog
60
⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
60
Latest Ivanti Zero Day Exploited By Scores of IPs
60
CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)
CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.
CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. CVE-2026-83548 is a critical (CVSS 10.0) pre-authentication SSRF in the SMA1000 Appliance Work Place interface; CVE-2026-83549 is a high (CVSS 7.8) post-authentication OS command injection leading to RCE in the Appliance Management Console. SMA1000 models 6210, 7210, and 8200v running 12.4.3-03453 or 12.5.0-02835 platform-hotfix and older are affected; fixes ship in 12.4.3-03526 and 12.5.0-02952. Qualys customers can detect vulnerable assets via QID 388624.
82
Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.
A September 1 SonicWall advisory discloses actively exploited zero-days in SMA1000 appliance models 6210, 7210 and 8200v, affecting platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 and older. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface via an unintended alternate access path; CVE-2026-83549 (CVSS 7.8) is post-authentication OS command injection enabling RCE in the Appliance Management Console. SonicWall urges hotfix upgrades, IOC checks with SonicWall support, and re-imaging plus credential and TOTP resets if compromise is found.
78
SonicWall SMA 1000 appliances under attack via zero-day flaws
SonicWall confirms active exploitation of zero-day SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) flaws in SMA 1000 remote access appliances.
SonicWall confirmed attackers are actively exploiting two previously undisclosed vulnerabilities in SMA 1000 SSL VPN appliances, affecting physical and virtual models 6210, 7210, and 8200v but not SMA 100 appliances or SonicWall firewalls. CVE-2026-83548 is a pre-authentication SSRF in the Appliance Work Place interface allowing remote unauthenticated attackers to gain unauthorized access to sensitive functionality, while CVE-2026-83549 is an OS command injection in the Appliance Management Console that can yield remote code execution under specific conditions for authenticated admins. The vendor urged immediate hotfix deployment, IoC review with technical support, and re-imaging or redeployment plus password and TOTP token resets on confirmed compromise. This is the latest in a series of zero-day attacks against SMA 1000 appliances following waves in late 2025 and June-July 2026.
80
U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.
CISA added CVE-2026-64849, a critical unauthenticated server-side request forgery in MLflow, to its Known Exploited Vulnerabilities catalog. The flaw affects MLflow versions before 3.15.0 and allows unauthenticated attackers to reach internal services including cloud metadata endpoints, exposing temporary cloud credentials. watchTowr observed in-the-wild exploitation exfiltrating credentials and secrets, plus widespread scanning of exposed MLflow instances within hours of the CVE's assignment on August 17, 2026. MLflow is an open-source platform for managing the machine learning and AI development lifecycle with over 60 million monthly downloads.
85
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
60
60
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.
85
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.
SonicWall disclosed on September 1, 2026 that CVE-2026-83548, a critical pre-authentication SSRF in the SMA1000 Appliance Work Place interface (CVSS 10.0), and CVE-2026-83549, an authenticated OS command injection in the Appliance Management Console, can be chained for unauthenticated remote code execution. Both vulnerabilities are confirmed exploited in the wild and were added to CISA's Known Exploited Vulnerabilities catalog. Affected SMA1000 models 6210, 7210 and 8200v on versions 12.4.3-03453 and 12.5.0-02835 platform-hotfix or earlier require upgrades to 12.4.3-03526 or 12.5.0-02952 platform-hotfixes.
88
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog on September 2, 2026. The additions cover Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette request smuggling (CVE-2026-48710), Kestra OS command injection (CVE-2026-49869), BerriAI LiteLLM (CVE-2026-59822) and JFrog Artifactory (CVE-2026-82329) authentication flaws, and SonicWall SMA1000 SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) vulnerabilities. Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets.
72
60
60
U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog
60
60
57
CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update
60
CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog
60
September 2025 CVE Landscape
60
U.S. CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
60
Network Attack Trends: February
60
60