Search: “net-rds”

NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected

Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.

The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.

Cyber Security News·updated 17:14 UTC · 1h ago·first Sep 14, 05:11 UTC · 2d agoVulnerability 10 sourcesCVE-2026-85102CVE-2026-85103

Cisco security advisory (AV26-921)

Canadian Cyber Centre warns actively exploited Cisco Secure Email Gateway SQL injection CVE-2026-76461 was added to CISA's KEV database.

The Canadian Centre for Cyber Security advisory AV26-921 (September 14, 2026) covers a SQL injection vulnerability in Cisco Secure Email Gateway (AsyncOS) and Secure Email and Web Manager. Affected versions include AsyncOS/Secure Email Gateway prior to 15.5.5-014, 16.0.4-302, and 16.5.0-780, and Secure Email and Web Manager prior to 15.5.5-006 and 16.5.0-429. Cisco stated CVE-2026-76461 is being actively exploited, and CISA added it to the Known Exploited Vulnerabilities database the same day. Users and administrators are urged to apply updates as they become available.

Canadian Centre for Cyber Security·updated 13:57 UTC · 4h ago·first Sep 14, 19:23 UTC · 1d agoAdvisory in the wild 17 sourcesCVE-2026-76461

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA Advisories·Sep 3, 12:00 UTC · 13d agoAdvisoryCVE-2026-78012

Critical NetScaler Vulnerability Exploited in Attacks

CISA added critical Citrix NetScaler flaw CVE-2026-19490 (CVSS 9.3) to its KEV catalog after confirming exploitation of gateway and AAA virtual servers in the wild.

CISA warned that threat actors are exploiting CVE-2026-19490, a critical-severity flaw (CVSS 9.3) affecting NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix patched the bug on August 19, and Rapid7 warned it is remotely exploitable without authentication. Sensor data from Previdian shows exploitation ongoing since at least September 3, one day after a public exploit appeared on GitHub, with matching requests observed from three IPs across three countries. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies three days to patch under BOD 26-04.

SecurityWeek·updated Sep 10, 18:57 UTC · 5d ago·first Sep 10, 12:20 UTC · 6d agoExploit / PoC in the wild 5 sourcesCVE-2026-194902· 2 reads

CISA Warns of N-able N-central RCE Vulnerability Exploited in the Wild

CISA added CVE-2026-86218, a CVSS 10.0 unauthenticated RCE in N-able N-central RMM, to its KEV catalog; on-premises admins must patch to 2026.3.1.14.

CISA added CVE-2026-86218, a CVSS 10.0 static code injection (CWE-96) enabling unauthenticated RCE in N-able N-central, to the Known Exploited Vulnerabilities catalog on September 8, 2026. The flaw affects all on-premises builds before 2026.3.1.14 across the 2025.4 through 2026.3 release lines; N-able shipped Hotfix 4 for 2026.3 on September 5-6, 2026. Huntress research indicates at least one customer's N-central instance was compromised on September 4, and federal civilian agencies must mitigate by September 11 under BOD 26-04. Hosted environments were patched server-side, but a compromised RMM server can serve as a single point of entry into entire MSP client bases.

Cyber Security News·Sep 9, 13:31 UTC · 7d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-862071

[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.

Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.

Exploit-DB·Aug 25, 00:00 UTC · 22d agoExploit / PoCCVE-2026-421671

USN-8730-2: Linux kernel (Azure) vulnerability

Ubuntu fixes a Linux kernel (Azure) vulnerability in the IPv6 networking and Netfilter subsystems.

Ubuntu security notice USN-8730-2 corrects a security issue in the Linux kernel Azure flavor affecting the IPv6 networking and Netfilter subsystems. An attacker could possibly use the flaw to compromise the system.

Ubuntu Security Notices·Sep 15, 09:41 UTC · 1d agoAdvisory 2 sources

U.S. CISA adds a N-able N-central flaw to its Known Exploited Vulnerabilities catalog

Security Affairs·Aug 4, 11:02 UTC · Aug 4, 2026Exploit / PoC in the wildCVE-2026-18577CVE-2026-18556

GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends

GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.

Two flaws in the open-source GeoNetwork catalog chain into unauthenticated RCE: a missing authorization check on the formatter upload endpoint (CVE-2026-63219, CVSS 8.6) and an unsafe Saxon XSLT processor configuration allowing Java execution (CVE-2026-58400, CVSS 9.1). Fixes shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with details published August 31. Ethiack fingerprinted 121 internet-exposed vulnerable deployments across 39 countries, 89% tied to government or military agencies. No exploitation in the wild or KEV listing was reported at disclosure.

The Hacker News·Sep 2, 09:18 UTC · 14d agoVulnerabilityCVE-2026-63219CVE-2026-58400CVE-2024-36401+1 CVEs

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security·Aug 24, 04:21 UTC · 23d agoTools1

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth RCE in N-able N-central, to KEV after N-able confirmed in-the-wild exploitation; patch by September 11.

CISA added CVE-2026-86218, a maximum-severity static code injection flaw enabling pre-authentication remote code execution in N-able N-central, to its Known Exploited Vulnerabilities catalog with a September 11, 2026 deadline for federal agencies. The flaw is fixed in N-central 2026.3 Hotfix 4 (released September 5), and N-able told customers it has been observed being exploited in the wild. Separately, Huntress is investigating the compromise of a fully patched customer N-central environment on September 4 and cannot yet confirm which flaw was used, while Rapid7-disclosed CVE-2026-86206 and CVE-2026-86207 can be chained by an unauthenticated attacker to create a rogue System Administrator account.

The Hacker News·Sep 9, 04:27 UTC · 7d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207

VU#874418: RDK-B WebUI contains multiple vulnerabilities

CERT/CC warns RDK-B WebUI rdkb-2025q4-kirkstone contains multiple flaws enabling network attackers to bypass authentication, cause DoS, or potentially execute code.

VU#874418 describes multiple vulnerabilities in the RDK-B WebUI version rdkb-2025q4-kirkstone, the open-source Reference Design Kit for Broadband used in broadband gateways and networking devices. Issues include memory corruption, improper authentication, race conditions, and insufficient input validation. A network-adjacent attacker could bypass authentication, obtain administrative access, cause denial-of-service, or corrupt underlying processes, with potential arbitrary code execution under certain conditions.

CERT/CC Vulnerability Notes·Aug 19, 19:28 UTC · 27d agoVulnerability

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

Huntress·Sep 6, 11:00 UTC · 10d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

ZDI-26-564: NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

ZDI discloses CVE-2026-24232, a CVSS 7.8 deserialization RCE in NVIDIA Transformers4Rec's load_model_trainer_states_from_checkpoint function.

The Zero Day Initiative published ZDI-26-564, a deserialization of untrusted data vulnerability in NVIDIA Transformers4Rec. Remote code execution is possible, but exploitation requires user interaction such as visiting a malicious page or opening a malicious file. The flaw is tracked as CVE-2026-24232 with a CVSS score of 7.8.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026AdvisoryCVE-2026-24232

New infosec products of the week: August 21, 2026

Weekly product roundup covering NETSCOUT outbound DDoS mitigation, F5 AI Gateway enhancements, Intezer Workflows, and Tufin TOS 5.3.

NETSCOUT extended Adaptive DDoS Protection to automatically mitigate outbound attack traffic for service providers. F5 enhanced its AI Gateway and integrated it into the F5 AI Security Platform for unified AI access governance. Intezer launched Workflows, native automation and response inside its platform without a separate SOAR, and Tufin released Orchestration Suite 5.3 with AI-powered Segmentation Intelligence for multi-vendor environments.

Help Net Security·Aug 21, 00:00 UTC · 26d agoTools

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Citrix patched a critical authentication bypass, CVE-2026-19490, in NetScaler Gateway and NetScaler ADC, urging customers to upgrade immediately.

Citrix has patched two flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is a critical authentication bypass (CVSS v4.0 9.3) that works when the appliance is configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy Gateway or AAA virtual server, with additional conditions depending on firmware and SAML configuration. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that can cause denial of service when SIP ALG is enabled on LSN setups. Rapid7 had not observed exploitation as of August 19, 2026, but urged emergency patching; a signature-based mitigation is available via NetScaler Console.

Help Net Security·Aug 21, 00:00 UTC · 26d agoVulnerabilityCVE-2026-19490CVE-2026-19489

USN-8742-1: Netty vulnerability

Ubuntu issues USN-8742-1 fixing a Netty DNS cache poisoning flaw caused by improper NS record bailiwick validation.

Ubuntu Security Notice USN-8742-1 addresses a vulnerability in the Netty framework in which NS records are incorrectly validated for bailiwick. An attacker could potentially exploit this to facilitate DNS cache poisoning attacks. Updated packages are available for supported Ubuntu releases.

Ubuntu Security Notices·updated 11:33 UTC · 6h ago·first Sep 10, 09:01 UTC · 6d agoAdvisory 12 sources

CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability

N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw (CWE-96 static code injection) in N-able N-central servers, scored 10.0 CVSS 4.0 by N-able and 9.8 CVSS 3.1 by NIST. N-able fixed it in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, and has already patched hosted NCOD environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026, citing evidence of active exploitation, though researchers have not attributed every reported N-central compromise to this flaw. Horizon3 released a NodeZero Rapid Response test to validate exposure and recommends log review for prior compromise.

Horizon3.ai·updated 17:13 UTC · 1h ago·first 16:06 UTC · 2h agoExploit / PoC in the wild 19 sourcesCVE-2026-862181

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CR·Sep 9, 07:03 UTC · 7d agoResearch

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

Study of NVD data finds ReDoS vulnerabilities growing more prevalent and more likely to be exploited, while five detection tools disagree substantially.

The study compares five publicly available ReDoS detection tools and one regex correction tool across three datasets. An empirical analysis of all ReDoS vulnerabilities reported to the NVD finds they are becoming more prevalent and are much more likely to be exploited than non-ReDoS weaknesses. The detection tools exhibited substantial disagreement on whether a given regex is vulnerable.

arXiv cs.CR·Sep 9, 15:09 UTC · 7d agoResearch

2026-007: Critical Vulnerability in Windows Netlogon

Actively exploited CVSS 9.8 Windows Netlogon flaw lets unauthenticated attackers execute code with SYSTEM privileges on domain controllers.

Microsoft's May 2026 advisory describes CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon (CVSS 9.8) that allows unauthenticated remote code execution with SYSTEM privileges on domain controllers via specially crafted packets. The Centre for Cybersecurity Belgium reports the flaw is currently being exploited by threat actors. All Windows Server versions from 2012 through 2025 acting as domain controllers are affected and require the May updates.

CERT-EU Advisories·Sep 8, 15:13 UTC · 8d agoExploit / PoC in the wildCVE-2026-410891

U.S. CISA adds Langflow, Apache Tomcat, and N-able N-central flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Aug 5, 15:25 UTC · Aug 5, 2026Exploit / PoC in the wildCVE-2026-9198CVE-2026-18556CVE-2026-34486

WebPros security advisory (AV26-908)

Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.

The Canadian Centre for Cyber Security published advisory AV26-908 covering vulnerabilities in WebPros products, including cPanel & WHM and ConfigServer Security & Firewall (CSF). Affected cPanel builds include versions prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP2 11.138.1.9, while CSF versions 14.00-16.29 (CVE-2026-65638) and 2.15-16.29 (CVE-2026-65639) are also affected. CVE-2026-67401 describes SQL injection in cPanel's EmailTrack functionality. Users and administrators are encouraged to review the advisories and apply available updates.

Canadian Centre for Cyber Security·updated Sep 11, 11:28 UTC · 5d ago·first Sep 10, 17:38 UTC · 6d agoAdvisory 3 sourcesCVE-2026-65638CVE-2026-65639CVE-2026-67401

ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

NVIDIA TensorRT improper array index validation in ONNX parsing (CVE-2026-24238, CVSS 7.8) enables remote code execution.

ZDI-26-592 addresses improper validation of array index in NVIDIA TensorRT's ONNX file parsing, tracked as CVE-2026-24238 with CVSS 7.8. Exploitation permits remote code execution on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoAdvisoryCVE-2026-24238

WebPros security advisory (AV26-861)

Canada's Cyber Centre relayed a cPanel advisory for CVE-2026-65643, a domain parking vulnerability fixed in multiple cPanel/WHM releases; admins should update.

Canada's Cyber Centre issued advisory AV26-861 relaying cPanel's disclosure of CVE-2026-65643, a vulnerability in cPanel's Domain Parking functionality. Affected cPanel & WebHost Manager (WHM) builds include all releases prior to 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and WP2 11.138.1.7. Administrators are urged to review vendor guidance and apply updates. No exploitation details were provided in the advisory.

Canadian Centre for Cyber Security·Aug 28, 15:10 UTC · 19d agoAdvisoryCVE-2026-65643