Search: “UNC5267”

Cisco warns customers of actively exploited zero-day in email gateways

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 allows unauthenticated root command execution; CISA added it to KEV.

Cisco disclosed CVE-2026-76461, a zero-day in AsyncOS for Cisco Secure Email Gateway that was exploited before disclosure and lets unauthenticated remote attackers execute commands with root privileges on cloud and on-premises instances. CISA promptly added the flaw to its Known Exploited Vulnerabilities catalog, and Cisco has directly contacted cloud customers with indicators of compromise while deploying mitigations. Rapid7 and VulnCheck warn compromised gateways could enable silent email monitoring and internal pivoting from on-premises deployments.

CyberScoop·updated Sep 16, 13:57 UTC · 1d ago·first Sep 15, 15:44 UTC · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

The GNU C Library security advisory update for 2026-09-10

glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.

A new GNU C Library advisory (GLIBC-SA-2026-0016) describes a stack overflow in the nscd service caused by unbounded alloca use. glibc 2.3.4 and newer may crash when a malicious DNS server returns an oversized response, resulting in degraded DNS resolution. Exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. The advisory was posted to oss-security by glibc maintainer Siddhesh Poyarekar.

oss-security·updated Sep 14, 19:54 UTC · 2d ago·first Sep 11, 01:59 UTC · 6d agoVulnerability 2 sources2

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.

Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.

The Hacker News·Sep 8, 13:48 UTC · 9d agoThreat actor in the wild 2 sources2

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News·Sep 1, 06:34 UTC · 16d agoThreat actor in the wild

USN-8776-1: python-cryptography vulnerabilities

Ubuntu patches python-cryptography flaws including a PKCS#7 timing side-channel (CVE-2026-69247) that could allow key recovery.

Ubuntu Security Notice USN-8776-1 fixes multiple vulnerabilities in python-cryptography. CVE-2026-69247 describes distinguishable PKCS#7 decryption outcomes with observable timing differences that a remote attacker could exploit to recover encryption keys; it affects Ubuntu 26.04 LTS. CVE-2023-23931, affecting only Ubuntu 18.04 LTS, involves incorrect handling of objects with immutable buffers during cipher operations, causing corrupted output, and a third issue reported by Jack Lloyd is also addressed.

Ubuntu Security Notices·Sep 16, 20:12 UTC · 17h agoAdvisory 7 sourcesCVE-2023-23931CVE-2026-69247

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 and Microsoft disclose CVE-2026-63520, a SharePoint RCE that chains with CVE-2026-55040 for unauthenticated RCE; patches released.

Rapid7 Labs' zero-day research project on Microsoft SharePoint uncovered two vulnerabilities that, when chained, achieve unauthenticated remote code execution. The second flaw in the chain, CVE-2026-63520, affects all supported versions of Microsoft SharePoint and has been disclosed and fixed. The first chain component, CVE-2026-55040, was disclosed by Rapid7 and Microsoft the previous month.

Rapid7 Blog·Aug 11, 13:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-63520CVE-2026-550401

Cisco security advisory (AV26-876)

Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.

The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.

Canadian Centre for Cyber Security·Sep 3, 13:13 UTC · 14d agoAdvisory

Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)

Help Net Security·Aug 10, 12:26 UTC · Aug 10, 2026Vulnerability in the wildCVE-2026-18577CVE-2026-18556

Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

Cisco warns of a critical authentication bypass in Secure Firewall Management Center that lets unauthenticated attackers execute scripts and obtain root access.

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software allows an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. The flaw stems from an improper system process created at boot time and is triggered via crafted HTTP requests. If the FMC management interface does not have public internet access, the attack surface is limited.

Cisco Security Advisories·Sep 9, 16:00 UTC · 7d agoAdvisory 2 sourcesCVE-2026-20079

CVE-2026-0770: Langflow exec_globals RCE Vulnerability

CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow's exec_globals, endangering exposed deployments.

CVE-2026-0770 is a critical remote code execution vulnerability in Langflow, a popular open-source framework for building language model applications. It allows remote attackers to execute arbitrary code on affected installations without authentication, making internet-exposed deployments particularly dangerous. The flaw resides in the exec_globals component; the available disclosure does not state active exploitation or provide patch details.

Web discovery (articles for new exploits & KEV entries)·Aug 24, 09:57 UTC · 24d agoVulnerabilityCVE-2026-0770

GNU security advisory (AV26-923)

Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.

The Canadian Centre for Cyber Security issued advisory AV26-923 on September 15, 2026, covering CVE-2026-91752, a stack overflow vulnerability in GNU libextractor versions prior to 1.15 triggered via OLE2 file parsing. The Cyber Centre encourages users and administrators to review the provided links and apply necessary updates as they become available.

Canadian Centre for Cyber Security·updated Sep 16, 23:13 UTC · 14h ago·first Sep 15, 15:10 UTC · 1d agoAdvisory 2 sourcesCVE-2026-91752

ZDI-26-564: NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

ZDI discloses CVE-2026-24232, a CVSS 7.8 deserialization RCE in NVIDIA Transformers4Rec's load_model_trainer_states_from_checkpoint function.

The Zero Day Initiative published ZDI-26-564, a deserialization of untrusted data vulnerability in NVIDIA Transformers4Rec. Remote code execution is possible, but exploitation requires user interaction such as visiting a malicious page or opening a malicious file. The flaw is tracked as CVE-2026-24232 with a CVSS score of 7.8.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026AdvisoryCVE-2026-24232

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)

Cisco Talos confirms nation-state (Sandworm) and ransomware (Qilin) actors actively exploit CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center.

CVE-2026-20079 is a critical unauthenticated authentication bypass in the FMC web interface allowing root-level script and command execution via crafted HTTP requests; CVE-2026-20316 stems from static hard-coded credentials enabling unauthenticated logins. Cisco Talos detailed three intrusion clusters: web shell and JAR deployment for credential theft, a Sandworm-attributed reverse shell and credential-harvesting implant, and a suspected Qilin ransomware operator chain. Cisco urges immediate hotfixes ahead of a comprehensive hardening release the week of September 16, or taking the FMC management interface offline.

Help Net Security·Sep 10, 11:22 UTC · 7d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316

Cisco FMC CVE-2026-20079 Actively Exploited

Cisco confirms active exploitation of CVE-2026-20079, a maximum-severity authentication bypass in Secure Firewall Management Center.

Cisco has confirmed that CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), is being actively exploited in the wild. The vulnerability carries a maximum CVSS severity, and defenders are urged to treat it as an urgent patch priority. FMC centrally manages Cisco Secure Firewall deployments, so exposure across enterprise environments is likely.

SOCRadar·Sep 10, 12:28 UTC · 7d agoExploit / PoC in the wildCVE-2026-20079

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project Zero·Sep 8, 07:00 UTC · 9d agoResearch2

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 published technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint.

Rapid7 released an analysis covering CVE-2026-63520, a remote code execution flaw affecting Microsoft SharePoint. SharePoint is widely deployed in enterprise environments, making exposed, unpatched servers a likely target for exploitation. Defenders should consult the Rapid7 write-up for exposure checks and patch guidance. The available text does not confirm active exploitation at this time.

Rapid7 Blog·Aug 24, 16:18 UTC · 23d agoVulnerabilityCVE-2026-635201

USN-8737-2: GNU C Library vulnerabilities

Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.

USN-8737-2 provides the Ubuntu 24.04 LTS counterpart to fixes released in USN-8737-1 for GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in strfmon when handling right-justification padding, potentially allowing denial of service or arbitrary code execution on Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in tdelete that could also result in denial of service or code execution.

Ubuntu Security Notices·Sep 10, 11:25 UTC · 7d agoAdvisoryCVE-2026-19499CVE-2026-195421

Commvault security advisory (AV26-895)

Canada's Cyber Centre advisory AV26-895 warns Commvault Cloud builds before 11.36.123/11.40.72/11.44.20/11.46.20 are affected by a Command Center API authentication bypass.

The Canadian Centre for Cyber Security alerted users that Commvault Cloud versions 11.36, 11.40, 11.44 and 11.46, prior to fixed builds 11.36.123, 11.40.72, 11.44.20 and 11.46.20, are affected by issue CV_2026_07_1, a Command Center API authentication bypass. Administrators are encouraged to review the linked vendor advisories and apply the available updates.

Canadian Centre for Cyber Security·Sep 8, 18:11 UTC · 8d agoAdvisory

Jenkins security advisory (AV26-877)

Canada's Cyber Centre relayed a Jenkins advisory (AV26-877) covering core and numerous plugin vulnerabilities fixed in 2.568.3/2.580.

The Canadian Centre for Cyber Security published advisory AV26-877 for the Jenkins security advisory dated September 2, 2026. Affected products include Jenkins releases other than 2.568.3 and 2.580, plus plugins such as GitLab, LDAP, Microsoft Entra ID, SAML, Script Security, Pipeline Build Step, and others. Administrators are encouraged to review the linked advisory and apply necessary updates.

Canadian Centre for Cyber Security·Sep 3, 13:54 UTC · 14d agoAdvisory

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

CVE-2026-19490 is a critical unauthenticated authentication bypass in Citrix NetScaler ADC and Gateway, remotely exploitable without user interaction.

An advisory published August 19, 2026 describes CVE-2026-19490, a critical authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw carries a CVSS v4.0 base score of 9.3 and is remotely exploitable by unauthenticated attackers over the network without user interaction or elevated privileges. NetScaler ADC and Gateway are widely deployed enterprise products positioned at or near the network perimeter, providing load balancing, SSL/TLS offloading, and secure remote access. The text does not state whether exploitation has been observed in the wild.

Rapid7 Blog·Aug 19, 16:46 UTC · 28d agoVulnerabilityCVE-2026-194901

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber Security·Sep 15, 14:29 UTC · 1d agoAdvisoryCVE-2026-13293CVE-2026-19290

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks

Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.

Cisco confirmed in August 2026 that CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center, is being actively exploited, allowing remote attackers to execute scripts and commands as root via crafted HTTP requests to the web interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch by September 12, 2026. Shared IOCs, identical hot fixes, and a July 23 log entry suggest CVE-2026-20079 was used alongside the separately exploited static-credential flaw CVE-2026-20316 in the same attacks. Cisco released patches and cloud fixes, warns hot fixes do not remediate already-compromised devices, and says there are no workarounds.

BleepingComputer·Sep 9, 21:40 UTC · 7d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316

CVE-2026-52307: Stored XSS in 1CMS v5.6

CVE-2026-52307: authenticated stored XSS in 1CMS (ClassCMS) v5.6 Column Management lets attackers inject scripts via the title field.

ClassCMS 1CMS v5.6 contains an authenticated stored cross-site scripting vulnerability, CVE-2026-52307, in the Column Management component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field. No CVSS score, patch information, or exploitation evidence was provided in the disclosure.

Full Disclosure·Sep 8, 17:24 UTC · 8d agoVulnerabilityCVE-2026-52307

AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489

Canadian Cyber Centre alerts on Citrix NetScaler ADC/Gateway flaws CVE-2026-19490 (authentication bypass) and CVE-2026-19489 (buffer overflow), urging emergency patching.

The Canadian Centre for Cyber Security issued alert AL26-019 covering two Citrix NetScaler vulnerabilities disclosed in a vendor advisory on August 19, 2026. CVE-2026-19490 (CWE-288) allows a remote unauthenticated attacker to bypass authentication on appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. CVE-2026-19489 (CWE-120) is a classic buffer overflow that may cause memory overflow, unpredictable behavior, or denial-of-service conditions. Affected appliances are vulnerable when configured as a SAML IdP; fixed versions include 14.1-73.32, 13.1-63.21, and 13.1-37.277 for FIPS.

Canadian Centre for Cyber Security·Sep 4, 19:00 UTC · 12d agoAdvisory 3 sourcesCVE-2026-19490CVE-2026-19489

Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.

Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.

Canadian Centre for Cyber Security·Sep 8, 19:03 UTC · 8d agoAdvisory in the wildCVE-2026-81963CVE-2026-858802

Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

The Hacker News·Aug 6, 16:41 UTC · Aug 6, 2026Exploit / PoC in the wildCVE-2026-20316CVE-2026-20079

Cisco security advisory (AV26-197) – Update 3

CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.

The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.

Canadian Centre for Cyber Security·Sep 9, 20:04 UTC · 7d agoExploit / PoC in the wildCVE-2026-20131CVE-2026-20079

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security·Sep 13, 08:00 UTC · 4d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 Blog·Sep 8, 11:01 UTC · 9d agoVulnerabilityCVE-2026-86206CVE-2026-86207CVE-2026-18577