ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Shadowserver”

2 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 2
SeverityAllcritical 2high 0medium 0low 0info 0

Cisco email security boxes can be rooted by... an email

Attackers actively exploit critical Cisco Secure Email Gateway flaw CVE-2026-76461, turning a malicious email into unauthenticated root access.

Cisco Secure Email Gateway appliances are being actively exploited via CVE-2026-76461, a CVSS 9.8 AsyncOS flaw requiring no authentication—a crafted email can yield root command execution with no workarounds. Cisco's PSIRT became aware of active exploitation in September; some Secure Email Cloud customers showed indicators of compromise and all cloud devices were upgraded to AsyncOS 16.5.0-780. The bug is in CISA's KEV catalog with federal agencies ordered to remediate by September 17; Shadowserver counted 400+ exposed appliances. Fixes are available in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780, and attackers with root may tamper with logs to hide activity.

The Register · Securityupdated · 14h agofirst · 18h agoExploit / PoC in the wild 15 sourcesCVE-2026-76461CVE-2025-20393

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.

Broadcom patched critical directory traversal flaw CVE-2026-59310 in the vCenter Syslog server on July 29, warning of unauthenticated remote code execution. QUIRSO subsequently found 361 compromised IPs across 47 countries after a suspected APT deployed a reverse SSH tool for persistence and remote access. CISA added the flaw to its KEV catalog with a three-day patch deadline for federal agencies, and over the weekend updated it to flag active abuse by ransomware gangs. Shadowserver tracks over 450 exposed vCenter servers, and CISA has tagged 26 VMware vulnerabilities as exploited in the wild over five years, nine abused by ransomware.

BleepingComputer · 22h agoExploit / PoC in the wildCVE-2026-59310CVE-2025-60710CVE-2025-22225+2 CVEs1