60
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross
60
New Mirai Variant Targeting Network Security Devices
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
Unit 42 observed attacks exploiting VisualDoor (SonicWall SSL-VPN), CVE-2020-25506 (D-Link DNS-320), CVE-2020-26919 (Netgear ProSAFE Plus), and other flaws, with infrastructure rotating across at least three IP addresses between February 16 and March 13, 2021. Payloads were updated hours after CVE-2021-27561 and CVE-2021-27562 (Yealink Device Management, unauthenticated root RCE) and later added CVE-2021-22502 (Micro Focus Operation Bridge Reporter) and CVE-2019-19356 (Netis WF2419). Successful exploitation invokes wget to fetch shell scripts that download Mirai binaries compiled for multiple architectures and brute-forcers, and attacks were still ongoing when reported.
75
60
CISA Urges Software Makers to Eliminate OS Command Injection Flaws
60
Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self
60
60
60
60
60
CISA Warns of Zimbra OS Command Injection Vulnerability Active Exploitation (CVE-2026-73570)
CISA added actively exploited Zimbra OS command injection flaw CVE-2026-73570 to its KEV catalog, urging users to patch by August 24, 2026.
CISA warned that Zimbra vulnerability CVE-2026-73570 is being actively exploited in the wild and added it to its Known Exploited Vulnerabilities Catalog. The OS command injection flaw resides in the SNMP monitoring component and is exploitable when SNMP notifications are enabled. Users, including US federal agencies subject to BOD deadlines, were urged to apply fixes before the August 24, 2026 deadline. Qualys ThreatPROTECT published tracking coverage of the KEV addition.
78
60
60
Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation
60
60
Critical Flaw in Cisco IP Phone Series Exposes Users to Command Injection Attack
60
60
Vulnerability Spotlight: OS command injection, directory traversal and other vulnerabilities found in Siretta Quartz
60
60
Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass
60
60
Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability
60
60
60
Vulnerability Spotlight: Command injection vulnerabilities in Robustel cellular router
60
60
Cisco fixes root privilege, command injection vulnerabilities in Cisco SD-WAN solution
60
60
60
U.S. CISA adds Microsoft Windows, Zyxel device flaws to its Known Exploited Vulnerabilities catalog
60
60
SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
SonicWall says attackers are actively exploiting two chained zero-days in SMA 1000 appliances: CVE-2026-83548, a pre-authentication SSRF rated CVSS 10.0, and CVE-2026-83549, a post-authentication OS command injection (CVSS 7.8) in the Appliance Management Console. Hotfixes are available for SMA 6210, 7210, and 8200v appliances with no workarounds; SonicWall recommends reimaging compromised devices, rotating passwords, and resetting TOTP tokens. NHS England assesses further exploitation as almost certain, following a similar exploited pair in July when CISA added CVE-2026-15409 to its KEV catalog.
78
60
60
US CISA added 17 flaws to its Known Exploited Vulnerabilities Catalog
60
Progress Software fixed multiple high
60
60
60
60
60