pwn.watch: CISA KEV incident updates

[critical] BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)

Fri, 23 Oct 2026 01:55:38 GMT

China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).

Status: live · Patch: partial · Fixed in: BT26-05-RS patch for self-hosted RS 24.3.1-26.2.3 (older versions must upgrade first); SaaS auto-patched Oct 9

Latest updates:

2026-10-15/16: Public disclosure / Mandiant blog; CISA KEV Oct 16.
2026-10-08/09: BeyondTrust patches; SaaS auto-fixed.
2026-08-29: Mandiant/GTIG: exploitation of zero-day begins (limited victims).

CVEs: CVE-2026-102764

[critical] FortiMail unauthenticated file-write zero-day CVE-2026-104286

Fri, 23 Oct 2026 01:55:38 GMT

Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).

Status: live · Patch: patched · Fixed in: 8.0.2+, 7.6.7+, 7.4.9+; 7.2.x migrate to 7.4.9+

Latest updates:

2026-10-05: Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA. (source)
2026-10: Fortinet PSIRT FG-IR-26-175 patches and mitigations.
~2026-09-30/10-01: Active exploitation and CISA alerts begin circulating.

CVEs: CVE-2026-104286

[high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Fri, 23 Oct 2026 01:55:38 GMT

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.

Status: live · Patch: partial · Fixed in: 25.1.1.2, 25.1.3.0 / 25.1.3.1, 22.8R2.5

Latest updates:

2026-10-13: Ivanti discloses and patches CVE-2026-104935; Volexity publishes.
2026-10-13/16: CISA KEV listing; federal patching deadline reported as Oct 16.
2026-10-03: Volexity sees UTA0576 chaining for unauth root.

CVEs: CVE-2026-104935

[critical] PHP2Shell: critical unauthenticated RCE in PHP core

Fri, 23 Oct 2026 01:55:38 GMT

Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.

Status: live · Patch: partial · Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35

Latest updates:

2026-10-22: Sansec updates its analysis: mass exploitation now looks less likely than on release day. The public exploits do not work against a default PHP install, and most need a separate local file inclusion bug in the target app. Patching is still advised. (source)
2026-10-22: VulnCheck reports a PHP2Shell exploit that achieves RCE on ASLR-enabled x86-64 servers with PHP's recommended production config (PHP 8.4.26), removing a major barrier to real-world exploitation; available only to its customers. (source)
2026-10-22: Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. (source)

CVEs: CVE-2026-109618, CVE-2026-109619

[critical] Plex2Shell: chained Plex Media Server RCE exploited for miners

Fri, 23 Oct 2026 01:55:38 GMT

Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.

Status: live · Patch: patched · Fixed in: 1.43.3.10861+

Latest updates:

2026-10-21: CISA KEV warning; patch-by Oct 23 for federal agencies.
2026-10-20: CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655). (source)
2026-10-17: Honeypot exploitation (XMRig + proxy) observed.

CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

[high] Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)

Thu, 22 Oct 2026 09:20:00 GMT

Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.

Status: closed · Patch: patched · Fixed in: October 2026 Patch Tuesday cumulative updates (KB packages per SKU)

Latest updates:

2026-10-13: Microsoft ships patches; CISA KEV lists CVE-2026-96951.

CVEs: CVE-2026-96951, CVE-2026-108398, CVE-2026-92707

[high] EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-20: CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23).

CVEs: CVE-2026-106931

[high] Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability

Tue, 20 Oct 2026 00:00:00 GMT

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-20: CISA added CVE-2026-110936 to the KEV catalog (due 2026-11-03).

CVEs: CVE-2026-110936

[high] Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability

Fri, 16 Oct 2026 00:00:00 GMT

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-16: CISA added CVE-2025-61624 to the KEV catalog (due 2026-10-19).

CVEs: CVE-2025-61624

[high] Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Thu, 15 Oct 2026 00:00:00 GMT

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-15: CISA added CVE-2026-21589 to the KEV catalog (due 2026-10-18).

CVEs: CVE-2026-21589

[high] Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-14: CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17).

CVEs: CVE-2026-105134, CVE-2026-105133

[high] Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-14: CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17).

CVEs: CVE-2026-76519

[high] Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-14: CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17).

CVEs: CVE-2026-0322

[high] Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Sun, 04 Oct 2026 00:00:00 GMT

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-04: CISA added CVE-2026-88779 to the KEV catalog (due 2026-10-07).

CVEs: CVE-2026-88779

[high] Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Fri, 02 Oct 2026 00:00:00 GMT

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. CISA added CVE-2026-102490, CVE-2026-102489 to the Known Exploited Vulnerabilities catalog on 2026-10-02 based on evidence of active exploitation.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-02: CISA added CVE-2026-102490, CVE-2026-102489 to the KEV catalog (due 2026-10-05).

CVEs: CVE-2026-102490, CVE-2026-102489

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Wed, 30 Sep 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-30: CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).

CVEs: CVE-2026-76504

[high] Apple CoreGraphics zero-day CVE-2026-86950

Tue, 29 Sep 2026 00:00:00 GMT

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.

Status: closed · Patch: patched · Fixed in: iOS/iPadOS 26.7.1, macOS security updates per Apple HT149226/149228/149229

CVEs: CVE-2026-86950

[high] Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability

Fri, 25 Sep 2026 00:00:00 GMT

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-25: CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28).

CVEs: CVE-2026-65660

[high] MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

Fri, 25 Sep 2026 00:00:00 GMT

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the Known Exploited Vulnerabilities catalog on 2026-09-10 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-10: CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the KEV catalog (due 2026-09-13).

CVEs: CVE-2026-86060, CVE-2026-67277, CVE-2026-67279

[high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability

Fri, 25 Sep 2026 00:00:00 GMT

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-25: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).

CVEs: CVE-2026-87902

[high] Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability

Thu, 24 Sep 2026 00:00:00 GMT

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-24: CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27).

CVEs: CVE-2026-71362

[high] Linux Kernel: Linux Kernel Race Condition Vulnerability

Fri, 18 Sep 2026 00:00:00 GMT

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-18: CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21).

CVEs: CVE-2025-39964, CVE-2026-53266, CVE-2025-39682

[high] Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Wed, 16 Sep 2026 00:00:00 GMT

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-16: CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19).

CVEs: CVE-2026-76460

[high] Google Pixel: Google Pixel Improper Authorization Vulnerability

Wed, 16 Sep 2026 00:00:00 GMT

Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-16: CISA added CVE-2026-58704 to the KEV catalog (due 2026-09-19).

CVEs: CVE-2026-58704

[high] Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability

Mon, 14 Sep 2026 00:00:00 GMT

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-14: CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17).

CVEs: CVE-2026-76461

[high] ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Fri, 11 Sep 2026 00:00:00 GMT

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-11: CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).

CVEs: CVE-2026-84869

[high] GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

Fri, 11 Sep 2026 00:00:00 GMT

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-11: CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).

CVEs: CVE-2026-85706

[high] JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability

Fri, 11 Sep 2026 00:00:00 GMT

JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016, CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on 2026-09-11 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-11: CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25).

CVEs: CVE-2026-42016, CVE-2026-42018

[high] Chrome zero-day CVE-2026-87491 (V8 OOB write)

Wed, 09 Sep 2026 00:00:00 GMT

September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.

Status: closed · Patch: patched · Fixed in: 153.0.8010.36+, 153.0.8010.37+

CVEs: CVE-2026-87491

[high] Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using

Wed, 09 Sep 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-09: CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).

CVEs: CVE-2026-20079

[high] Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Wed, 09 Sep 2026 00:00:00 GMT

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-09: CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12).

CVEs: CVE-2026-19490

[high] Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Wed, 09 Sep 2026 00:00:00 GMT

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA KEV on 2026-09-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-09: CISA added CVE-2025-25249 to the KEV catalog (due 2026-09-12).

CVEs: CVE-2025-25249

[high] Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Tue, 08 Sep 2026 00:00:00 GMT

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Added to CISA KEV on 2026-09-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-08: CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11).

CVEs: CVE-2026-75650

[high] Microsoft Windows: Microsoft Windows Link Following Vulnerability

Tue, 08 Sep 2026 00:00:00 GMT

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CISA added CVE-2026-81963, CVE-2026-85880 to the Known Exploited Vulnerabilities catalog on 2026-09-08 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-08: CISA added CVE-2026-81963, CVE-2026-85880 to the KEV catalog (due 2026-09-22).

CVEs: CVE-2026-81963, CVE-2026-85880

[high] N-able N-central: N-able N-central Static Code Injection Vulnerability

Tue, 08 Sep 2026 00:00:00 GMT

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Added to CISA KEV on 2026-09-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-08: CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11).

CVEs: CVE-2026-86218

[high] Chrome zero-day CVE-2026-85046 (V8 type confusion)

Fri, 04 Sep 2026 00:00:00 GMT

September 4 2026 Chrome update patched CVE-2026-85046, a V8 type confusion zero-day Google said was exploited in the wild. Fixed in Chrome 152.0.7977.82/.83. Later added to CISA KEV.

Status: closed · Patch: patched · Fixed in: 152.0.7977.82+, 152.0.7977.83+

CVEs: CVE-2026-85046

[high] BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-08: CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).

CVEs: CVE-2026-42271, CVE-2026-48710

[high] BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).

CVEs: CVE-2026-59822

[high] JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05).

CVEs: CVE-2026-82329

[high] Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-49869 to the KEV catalog (due 2026-09-05).

CVEs: CVE-2026-49869

[high] Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05).

CVEs: CVE-2026-9586

[high] SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA added CVE-2026-83548, CVE-2026-83549 to the Known Exploited Vulnerabilities catalog on 2026-09-02 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-83548, CVE-2026-83549 to the KEV catalog (due 2026-09-05).

CVEs: CVE-2026-83548, CVE-2026-83549

[high] JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Thu, 27 Aug 2026 00:00:00 GMT

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Added to CISA KEV on 2026-08-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-27: CISA added CVE-2026-66384 to the KEV catalog (due 2026-09-10).

CVEs: CVE-2026-66384

[high] Linux Kernel: Linux Kernel Unspecified Vulnerability

Thu, 27 Aug 2026 00:00:00 GMT

Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. Added to CISA KEV on 2026-08-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-27: CISA added CVE-2026-53362 to the KEV catalog (due 2026-08-30).

CVEs: CVE-2026-53362

[high] Gitea Gitea: Gitea Code Injection Vulnerability

Tue, 25 Aug 2026 00:00:00 GMT

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-25: CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28).

CVEs: CVE-2026-60004

[high] Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Mon, 24 Aug 2026 00:00:00 GMT

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-24: CISA added CVE-2026-21962 to the KEV catalog (due 2026-08-27).

CVEs: CVE-2026-21962

[high] Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Fri, 21 Aug 2026 00:00:00 GMT

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-21: CISA added CVE-2026-73570 to the KEV catalog (due 2026-08-24).

CVEs: CVE-2026-73570

[high] TrueConf Server: TrueConf Server Code Injection Vulnerability

Thu, 20 Aug 2026 00:00:00 GMT

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. CISA added CVE-2026-72530, CVE-2026-72529 to the Known Exploited Vulnerabilities catalog on 2026-08-20 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-20: CISA added CVE-2026-72530, CVE-2026-72529 to the KEV catalog (due 2026-09-03).

CVEs: CVE-2026-72530, CVE-2026-72529

[high] MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability

Wed, 19 Aug 2026 00:00:00 GMT

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-19: CISA added CVE-2026-64849 to the KEV catalog (due 2026-09-02).

CVEs: CVE-2026-64849

[high] Apple macOS: Apple macOS Improper Authentication Vulnerability

Tue, 18 Aug 2026 00:00:00 GMT

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Added to CISA KEV on 2026-08-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-18: CISA added CVE-2026-65400 to the KEV catalog (due 2026-08-21).

CVEs: CVE-2026-65400