New malicious web shell from the Tropic Trooper group is found in the Middle East
60
60
60
42
60
55
55
42
55
Suspected Chinese Group Calypso APT Exploiting Vulnerable Microsoft Exchange Servers
60
47
60
47
60
30
47
42
42
55
60
47
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials
60
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
60
47
Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities
60
60
55
60
55
60
42
30
55
55
55
30
cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root
cPanel disclosed CVE-2026-67401, an authenticated SQL injection in EmailTrack that lets attackers write files and execute code as root.
cPanel disclosed CVE-2026-67401 on September 8, 2026: a SQL injection in the EmailTrack feature that allows authenticated account holders with mail-related permissions to create arbitrary files and execute code with root privileges. Fixes shipped in v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and WP2 channel v11.138.1.9, with all supported versions before those releases affected. Root-level execution poses severe risk to shared hosting providers and multi-tenant servers, as it removes isolation between cPanel accounts, websites, mailboxes, and backups. Researchers Ali Mustafa (rz1027) and abed1526 responsibly reported the flaw.
52
CVE-2026-34908: UniFi OS Auth Bypass Vulnerability
Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.
CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.
55
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
72
Multiple Vulnerabilities Discovered in a SCADA System
Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.
Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.
52