{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T18:38:01.102Z", "tag": { "id": "zero-day", "label": "Zero-day", "isStack": false, "url": "https://pwn.watch/t/zero-day", "feed": "https://pwn.watch/t/zero-day/feed.xml" }, "counts": { "incidents": 48, "live": 4, "notFullyPatched": 2, "patched": 45 }, "incidents": [ { "slug": "arista-velocloud-orchestrator-cve-2026-114625", "title": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks", "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625", "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Arista VeloCloud Orchestrator (VCO) On-Prem", "tags": [ "arista", "velocloud", "sd-wan", "sql-injection", "zero-day", "privilege-escalation" ], "cveIds": [ "CVE-2026-114625" ], "affectedVersions": [ "VCO 5.2.x before 5.2.3.18", "VCO 6.1.x before 6.1.3.10", "VCO 6.4.x before 6.4.2.12" ], "fixedVersions": [ "5.2.3.18", "6.1.3.10", "6.4.2.12" ], "startedAt": "2026-10-22", "closedAt": null, "updatedAt": "2026-10-22T20:32:13+02:00", "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.", "xPost": { "id": "2113331616257077699", "postedAt": "2026-10-22T18:08:16.065Z", "url": "https://x.com/pwnwatch_app/status/2113331616257077699" } }, { "slug": "windows-shell-cve-2026-96951-motw", "title": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw", "json": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows Shell (and related Oct Patch Tuesday components)", "tags": [ "microsoft", "windows", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-96951", "CVE-2026-108398", "CVE-2026-92707" ], "affectedVersions": [ "Supported Windows versions receiving the October 2026 cumulative updates (see Microsoft Security Update Guide)" ], "fixedVersions": [ "October 2026 Patch Tuesday cumulative updates (KB packages per SKU)" ], "startedAt": "2026-10-13", "closedAt": "2026-10-13", "updatedAt": "2026-10-22T11:20:00+02:00", "summary": "Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.", "xPost": null }, { "slug": "ivanti-connect-secure-cve-2026-104935", "title": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935", "json": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "Ivanti Connect Secure (ICS)", "tags": [ "ivanti", "zero-day", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-104935" ], "affectedVersions": [ "25.1.1.1 and prior", "25.1.2.2 and prior", "22.8R2.4 and prior (22.7.x and below unaffected)" ], "fixedVersions": [ "25.1.1.2", "25.1.3.0 / 25.1.3.1", "22.8R2.5" ], "startedAt": "2026-10-01", "closedAt": null, "updatedAt": "2026-10-22T11:20:00+02:00", "summary": "Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.", "xPost": null }, { "slug": "fortimail-cve-2026-104286", "title": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "url": "https://pwn.watch/i/fortimail-cve-2026-104286", "json": "https://pwn.watch/i/fortimail-cve-2026-104286.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiMail", "tags": [ "fortinet", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-104286" ], "affectedVersions": [ "7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, 8.0.0–8.0.1 (migrate/upgrade per Fortinet matrix)" ], "fixedVersions": [ "8.0.2+", "7.6.7+", "7.4.9+; 7.2.x migrate to 7.4.9+" ], "startedAt": "2026-09-30", "closedAt": null, "updatedAt": "2026-10-22T11:18:00+02:00", "summary": "Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).", "xPost": null }, { "slug": "apple-coregraphics-cve-2026-86950", "title": "Apple CoreGraphics zero-day CVE-2026-86950", "url": "https://pwn.watch/i/apple-coregraphics-cve-2026-86950", "json": "https://pwn.watch/i/apple-coregraphics-cve-2026-86950.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apple iOS, iPadOS, macOS (CoreGraphics)", "tags": [ "apple", "ios", "macos", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-86950" ], "affectedVersions": [ "Before iOS/iPadOS 26.7.1 and matching macOS security updates" ], "fixedVersions": [ "iOS/iPadOS 26.7.1", "macOS security updates per Apple HT149226/149228/149229" ], "startedAt": "2026-09-29", "closedAt": "2026-09-29", "updatedAt": "2026-09-29", "summary": "Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.", "xPost": null }, { "slug": "chrome-zero-day-cve-2026-87491", "title": "Chrome zero-day CVE-2026-87491 (V8 OOB write)", "url": "https://pwn.watch/i/chrome-zero-day-cve-2026-87491", "json": "https://pwn.watch/i/chrome-zero-day-cve-2026-87491.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Google Chrome / Chromium V8", "tags": [ "google", "chrome", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-87491" ], "affectedVersions": [ "Before 153.0.8010.36/.37" ], "fixedVersions": [ "153.0.8010.36+", "153.0.8010.37+" ], "startedAt": "2026-09-09", "closedAt": "2026-09-09", "updatedAt": "2026-09-09", "summary": "September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.", "xPost": null }, { "slug": "chrome-zero-day-cve-2026-85046", "title": "Chrome zero-day CVE-2026-85046 (V8 type confusion)", "url": "https://pwn.watch/i/chrome-zero-day-cve-2026-85046", "json": "https://pwn.watch/i/chrome-zero-day-cve-2026-85046.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Google Chrome / Chromium V8", "tags": [ "google", "chrome", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-85046" ], "affectedVersions": [ "Before 152.0.7977.82/.83" ], "fixedVersions": [ "152.0.7977.82+", "152.0.7977.83+" ], "startedAt": "2026-09-04", "closedAt": "2026-09-04", "updatedAt": "2026-09-04", "summary": "September 4 2026 Chrome update patched CVE-2026-85046, a V8 type confusion zero-day Google said was exploited in the wild. Fixed in Chrome 152.0.7977.82/.83. Later added to CISA KEV.", "xPost": null }, { "slug": "beyondtrust-remote-support-cve-2026-102764", "title": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764", "json": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764.json", "status": "live", "severity": "critical", "patchStatus": "partial", "product": "BeyondTrust Remote Support (formerly Bomgar)", "tags": [ "beyondtrust", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-102764" ], "affectedVersions": [ "26.2.3 and earlier; versions older than 24.3.1 must upgrade before applying BT26-05-RS" ], "fixedVersions": [ "BT26-05-RS patch for self-hosted RS 24.3.1-26.2.3 (older versions must upgrade first); SaaS auto-patched Oct 9" ], "startedAt": "2026-08-29", "closedAt": null, "updatedAt": "2026-10-22T20:32:13+02:00", "summary": "China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).", "xPost": null }, { "slug": "chrome-zero-day-cve-2026-11645", "title": "Chrome zero-day CVE-2026-11645 (V8 OOB)", "url": "https://pwn.watch/i/chrome-zero-day-cve-2026-11645", "json": "https://pwn.watch/i/chrome-zero-day-cve-2026-11645.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Google Chrome / Chromium V8", "tags": [ "google", "chrome", "zero-day" ], "cveIds": [ "CVE-2026-11645" ], "affectedVersions": [ "Before 149.0.7827.102 (Win/Linux) / 149.0.7827.103 (Mac)" ], "fixedVersions": [ "149.0.7827.102+", "149.0.7827.103+" ], "startedAt": "2026-06-01", "closedAt": "2026-06-30", "updatedAt": "2026-06-30", "summary": "June 2026 Chrome emergency update patched CVE-2026-11645, an out-of-bounds read/write in V8 exploited in the wild (fifth Chrome zero-day of 2026 at the time). Stable builds 149.0.7827.102/.103.", "xPost": null }, { "slug": "chrome-zero-day-cve-2026-5281-dawn", "title": "Chrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)", "url": "https://pwn.watch/i/chrome-zero-day-cve-2026-5281-dawn", "json": "https://pwn.watch/i/chrome-zero-day-cve-2026-5281-dawn.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Google Chrome / Chromium Dawn", "tags": [ "google", "chrome", "zero-day" ], "cveIds": [ "CVE-2026-5281" ], "affectedVersions": [ "Pre-April 2026 Stable" ], "fixedVersions": [ "April 2026 Chrome Stable" ], "startedAt": "2026-04-01", "closedAt": "2026-04-30", "updatedAt": "2026-04-30", "summary": "April 2026 Chrome patch for CVE-2026-5281, a use-after-free in Dawn (WebGPU), actively exploited in the wild.", "xPost": null }, { "slug": "chrome-zero-days-cve-2026-3909-3910", "title": "Chrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)", "url": "https://pwn.watch/i/chrome-zero-days-cve-2026-3909-3910", "json": "https://pwn.watch/i/chrome-zero-days-cve-2026-3909-3910.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Google Chrome / Chromium", "tags": [ "google", "chrome", "zero-day" ], "cveIds": [ "CVE-2026-3909", "CVE-2026-3910" ], "affectedVersions": [ "Pre-patch March 2026 Stable builds" ], "fixedVersions": [ "March 2026 Chrome Stable updates" ], "startedAt": "2026-03-01", "closedAt": "2026-03-31", "updatedAt": "2026-03-31", "summary": "March 2026 Chrome updates fixed two actively exploited zero-days: CVE-2026-3909 (out-of-bounds write in Skia) and CVE-2026-3910 (inappropriate implementation in V8).", "xPost": null }, { "slug": "chrome-zero-day-cve-2026-2441", "title": "Chrome zero-day CVE-2026-2441 (CSS use-after-free)", "url": "https://pwn.watch/i/chrome-zero-day-cve-2026-2441", "json": "https://pwn.watch/i/chrome-zero-day-cve-2026-2441.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Google Chrome / Chromium", "tags": [ "google", "chrome", "zero-day" ], "cveIds": [ "CVE-2026-2441" ], "affectedVersions": [ "Before Chrome 145.0.7632.75/.76 (Win/Mac) and related Linux builds" ], "fixedVersions": [ "145.0.7632.75+", "144.0.7559.75+ (Linux per reports)" ], "startedAt": "2026-02-13", "closedAt": "2026-02-16", "updatedAt": "2026-02-16", "summary": "First actively exploited Chrome zero-day of 2026. Google patched CVE-2026-2441, a high-severity use-after-free in CSS (CSSFontFeatureValuesMap), in mid-February Chrome 145 updates. Google stated an exploit existed in the wild.", "xPost": null }, { "slug": "cisco-sdwan-february-2026-emergency-directive", "title": "Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)", "url": "https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive", "json": "https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco Catalyst SD-WAN Manager / controllers", "tags": [ "cisco", "sd-wan", "zero-day" ], "cveIds": [], "affectedVersions": [ "See Cisco Security Advisories and CISA emergency directive" ], "fixedVersions": [ "Cisco fixed releases per advisory" ], "startedAt": "2026-02-01", "closedAt": "2026-02-28", "updatedAt": "2026-02-28", "summary": "In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.", "xPost": null }, { "slug": "eu-dutch-ivanti-epmm-zero-day-breach", "title": "European Commission & Dutch authorities hit via Ivanti EPMM zero-days", "url": "https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach", "json": "https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti EPMM deployments (EU institutions)", "tags": [ "ivanti", "zero-day", "data-breach" ], "cveIds": [ "CVE-2026-1340" ], "affectedVersions": [ "Vulnerable EPMM versions prior to Jan/Feb 2026 patches" ], "fixedVersions": [ "Ivanti patched EPMM releases" ], "startedAt": "2026-02-01", "closedAt": "2026-02-28", "updatedAt": "2026-02-28", "summary": "February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.", "xPost": null }, { "slug": "singapore-unc3886-telecom-espionage", "title": "UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)", "url": "https://pwn.watch/i/singapore-unc3886-telecom-espionage", "json": "https://pwn.watch/i/singapore-unc3886-telecom-espionage.json", "status": "closed", "severity": "unknown", "patchStatus": "partial", "product": "Singapore major telecom providers", "tags": [ "zero-day", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-02-01", "closedAt": "2026-02-28", "updatedAt": "2026-02-28", "summary": "In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.", "xPost": null }, { "slug": "react2shell-react-server-components-cve-2025-55182", "title": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182", "json": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "React Server Components (react-server-dom-*), Next.js", "tags": [ "node", "react2shell", "react", "nextjs", "vercel", "rce", "zero-day", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-55182" ], "affectedVersions": [ "React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)", "Next.js App Router releases using affected React (see advisory)" ], "fixedVersions": [ "React 19.0.1", "React 19.1.2", "React 19.2.1", "Next.js: patched release lines per the React/Next.js advisory" ], "startedAt": "2025-12-03", "closedAt": "2025-12-12", "updatedAt": "2025-12-12", "summary": "A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.", "xPost": null }, { "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882", "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882", "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Oracle E-Business Suite", "tags": [ "oracle", "cl0p", "zero-day", "rce", "data-breach", "extortion", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-61882" ], "affectedVersions": [ "Oracle E-Business Suite 12.2.3 to 12.2.14" ], "fixedVersions": [ "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)" ], "startedAt": "2025-09-29", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.", "xPost": null }, { "slug": "toolshell-sharepoint-cve-2025-53770", "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770", "json": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SharePoint Server (on-premises)", "tags": [ "toolshell", "microsoft", "sharepoint", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-49704", "CVE-2025-49706", "CVE-2025-53770" ], "affectedVersions": [ "On-premises SharePoint Server (see Microsoft customer guidance for the exact builds)" ], "fixedVersions": [ "See Microsoft customer guidance for CVE-2025-53770" ], "startedAt": "2025-07-18", "closedAt": "2025-07-22", "updatedAt": "2025-07-22", "summary": "Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.", "xPost": null }, { "slug": "citrixbleed-2-netscaler-cve-2025-5777", "title": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777", "json": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler ADC and Gateway", "tags": [ "citrixbleed", "citrix", "netscaler", "zero-day", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-5777" ], "affectedVersions": [ "See Citrix bulletin" ], "fixedVersions": [ "14.1-43.56", "13.1-58.32", "13.1-FIPS/NDcPP 13.1-37.235" ], "startedAt": "2025-06-17", "closedAt": "2025-07-10", "updatedAt": "2025-07-10", "summary": "An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.", "xPost": null }, { "slug": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "title": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324", "json": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "SAP NetWeaver Visual Composer", "tags": [ "sap", "netweaver", "zero-day", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-31324" ], "affectedVersions": [ "SAP NetWeaver Visual Composer (VCFRAMEWORK); see SAP Security Note" ], "fixedVersions": [ "See SAP Security Note for CVE-2025-31324" ], "startedAt": "2025-04-24", "closedAt": "2025-04-29", "updatedAt": "2025-05-15", "summary": "A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-day-cve-2025-0282", "title": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure, Policy Secure, ZTA Gateways", "tags": [ "ivanti", "vpn", "zero-day", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-0282" ], "affectedVersions": [ "Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)" ], "fixedVersions": [ "Connect Secure 22.7R2.5" ], "startedAt": "2025-01-08", "closedAt": "2025-01-08", "updatedAt": "2025-01-08", "summary": "An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.", "xPost": null }, { "slug": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "title": "Cleo file transfer zero-days exploited by Clop for data theft", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "json": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cleo Multiple Products", "tags": [ "cleo", "zero-day", "cl0p", "file-transfer", "data-breach", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-50623", "CVE-2024-55956" ], "affectedVersions": [ "Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 (Cleo)" ], "fixedVersions": [ "5.8.0.24 (Cleo, for CVE-2024-55956)", "5.8.0.21 (Cleo, for CVE-2024-50623)" ], "startedAt": "2024-12-03", "closedAt": "2024-12-17", "updatedAt": "2024-12-17", "summary": "Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "title": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "json": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "auth-bypass", "firewall", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-0012", "CVE-2024-9474" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-18", "closedAt": "2024-11-18", "updatedAt": "2024-11-18", "summary": "CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-november-2024-43451-49039", "title": "Microsoft November 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039", "json": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-43451", "CVE-2024-49039" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-12", "closedAt": "2024-11-12", "updatedAt": "2024-11-12", "summary": "CVE-2024-43451: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CVE-2024-49039: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Added to the CISA KEV catalog on 2024-11-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "fortinet-fortimanager-fortijump-cve-2024-47575", "title": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)", "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575", "json": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Fortinet FortiManager", "tags": [ "fortinet", "fortimanager", "zero-day", "auth-bypass", "cisa-kev" ], "cveIds": [ "CVE-2024-47575" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-23", "closedAt": "2024-10-23", "updatedAt": "2024-10-23", "summary": "Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-23.", "xPost": null }, { "slug": "microsoft-zero-days-october-2024-43572-43573", "title": "Microsoft October 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573", "json": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-43572", "CVE-2024-43573" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-08", "closedAt": "2024-10-08", "updatedAt": "2024-10-08", "summary": "CVE-2024-43572: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CVE-2024-43573: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Added to the CISA KEV catalog on 2024-10-08.", "xPost": null }, { "slug": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "title": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "json": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA)", "tags": [ "ivanti", "ivanti-csa", "zero-day", "sql-injection", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-8190", "CVE-2024-8963", "CVE-2024-9379", "CVE-2024-9380" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-10-09", "updatedAt": "2024-10-11", "summary": "Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.", "xPost": null }, { "slug": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "title": "Microsoft September 2024: 3 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more", "json": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Publisher, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day" ], "cveIds": [ "CVE-2024-38014", "CVE-2024-38217", "CVE-2024-38226" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-09-10", "updatedAt": "2024-09-10", "summary": "CVE-2024-38014: Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. CVE-2024-38217: Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. CVE-2024-38226: Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. Added to the CISA KEV catalog on 2024-09-10.", "xPost": null }, { "slug": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "title": "Microsoft August 2024: 6 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more", "json": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Project, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-38106", "CVE-2024-38107", "CVE-2024-38178", "CVE-2024-38189", "CVE-2024-38193", "CVE-2024-38213" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-13", "closedAt": "2024-08-13", "updatedAt": "2024-08-13", "summary": "CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.", "xPost": null }, { "slug": "microsoft-zero-days-july-2024-38080-38112", "title": "Microsoft July 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112", "json": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day" ], "cveIds": [ "CVE-2024-38080", "CVE-2024-38112" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-09", "closedAt": "2024-07-09", "updatedAt": "2024-07-09", "summary": "CVE-2024-38080: Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CVE-2024-38112: Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. Added to the CISA KEV catalog on 2024-07-09.", "xPost": null }, { "slug": "microsoft-zero-days-may-2024-30040-30051", "title": "Microsoft May 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051", "json": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft DWM Core Library, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-30040", "CVE-2024-30051" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-14", "closedAt": "2024-05-14", "updatedAt": "2024-05-14", "summary": "CVE-2024-30040: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CVE-2024-30051: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-05-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "title": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign", "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "json": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "tags": [ "cisco", "cisco-asa", "cisco-ftd", "zero-day", "espionage", "firewall", "cisa-kev" ], "cveIds": [ "CVE-2024-20353", "CVE-2024-20359" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-04-24", "closedAt": "2024-04-24", "updatedAt": "2024-04-24", "summary": "Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.", "xPost": null }, { "slug": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "title": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "json": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Palo Alto Networks PAN-OS", "tags": [ "palo-alto", "pan-os", "zero-day", "rce", "vpn", "firewall", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-3400" ], "affectedVersions": [ "PAN-OS 10.2, 11.0 and 11.1 with GlobalProtect (exact hotfix ranges in the Palo Alto advisory)" ], "fixedVersions": [ "Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3" ], "startedAt": "2024-04-12", "closedAt": "2024-04-12", "updatedAt": "2024-04-12", "summary": "A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-february-2024-21351-21412", "title": "Microsoft February 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412", "json": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-21351", "CVE-2024-21412" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-02-13", "updatedAt": "2024-02-13", "summary": "CVE-2024-21351: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CVE-2024-21412: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Added to the CISA KEV catalog on 2024-02-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "title": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "json": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons", "tags": [ "ivanti", "ivanti-connect-secure", "vpn", "zero-day", "auth-bypass", "rce", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-46805", "CVE-2024-21887", "CVE-2024-21893" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-10", "closedAt": "2024-01-31", "updatedAt": "2024-01-31", "summary": "Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "citrix-bleed-netscaler-cve-2023-4966", "title": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966", "json": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler ADC and NetScaler Gateway", "tags": [ "citrix", "netscaler", "zero-day", "session-hijacking", "lockbit", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-4966" ], "affectedVersions": [ "NetScaler ADC and Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (NVD); exact builds: see vendor advisory" ], "fixedVersions": [ "14.1-8.50", "13.1-49.15", "13.0-92.19", "FIPS/NDcPP builds: see vendor advisory" ], "startedAt": "2023-10-10", "closedAt": "2023-11-21", "updatedAt": "2023-12-18", "summary": "A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).", "xPost": null }, { "slug": "atlassian-confluence-admin-creation-cve-2023-22515", "title": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515", "json": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Atlassian Confluence Data Center and Server", "tags": [ "java", "atlassian", "confluence", "zero-day", "auth-bypass", "china", "cisa-kev" ], "cveIds": [ "CVE-2023-22515" ], "affectedVersions": [ "8.0.0 to 8.5.1 (Atlassian advisory)" ], "fixedVersions": [ "8.3.3", "8.4.3", "8.5.2 (LTS)" ], "startedAt": "2023-10-04", "closedAt": "2023-10-16", "updatedAt": "2023-10-16", "summary": "A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.", "xPost": null }, { "slug": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "title": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198", "json": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Cisco IOS XE Software (web UI)", "tags": [ "cisco", "ios-xe", "zero-day", "auth-bypass", "rce", "cisa-kev" ], "cveIds": [ "CVE-2023-20198", "CVE-2023-20273" ], "affectedVersions": [ "IOS XE with the HTTP/HTTPS server (web UI) enabled; see vendor advisory" ], "fixedVersions": [ "17.9.4a", "17.6.6a", "17.3.8a", "16.12.10a (Catalyst 3650/3850 only)" ], "startedAt": "2023-09-18", "closedAt": "2023-10-23", "updatedAt": "2023-10-23", "summary": "Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.", "xPost": null }, { "slug": "libwebp-heap-overflow-cve-2023-4863", "title": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863", "json": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "libwebp (Google Chrome and everything that bundles libwebp)", "tags": [ "node", "python", "libwebp", "google", "chrome", "electron", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-4863" ], "affectedVersions": [ "Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)" ], "fixedVersions": [ "Chrome 116.0.5845.187", "libwebp 1.3.2", "Bundling apps/libraries: see each vendor's advisory" ], "startedAt": "2023-09-11", "closedAt": "2023-09-13", "updatedAt": "2023-09-13", "summary": "A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.", "xPost": null }, { "slug": "apple-blastpass-cve-2023-41064-41061", "title": "BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)", "url": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061", "json": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apple iOS, iPadOS, macOS and watchOS", "tags": [ "apple", "ios", "macos", "nso-group", "pegasus", "spyware", "zero-click", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-41064", "CVE-2023-41061" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "iOS 16.6.1 and iPadOS 16.6.1", "iOS 15.7.9 and iPadOS 15.7.9", "macOS Ventura 13.5.2", "macOS Monterey 12.6.9", "macOS Big Sur 11.7.10", "watchOS 9.6.2" ], "startedAt": "2023-09-07", "closedAt": "2023-09-11", "updatedAt": "2023-09-11", "summary": "Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.", "xPost": null }, { "slug": "winrar-zero-day-cve-2023-38831", "title": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831", "json": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "RARLAB WinRAR", "tags": [ "winrar", "rarlab", "windows", "zero-day", "rce", "cisa-kev" ], "cveIds": [ "CVE-2023-38831" ], "affectedVersions": [ "Before 6.23 (NVD)" ], "fixedVersions": [ "6.23" ], "startedAt": "2023-08-02", "closedAt": "2023-10-18", "updatedAt": "2023-10-18", "summary": "WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.", "xPost": null }, { "slug": "ivanti-epmm-norway-government-cve-2023-35078", "title": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078", "json": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Ivanti Endpoint Manager Mobile (EPMM / MobileIron Core)", "tags": [ "ivanti", "epmm", "mobileiron", "zero-day", "auth-bypass", "norway", "cisa-kev" ], "cveIds": [ "CVE-2023-35078", "CVE-2023-35081" ], "affectedVersions": [ "CVE-2023-35078: see vendor advisory", "CVE-2023-35081: 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2 (NVD)" ], "fixedVersions": [ "CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD)", "CVE-2023-35078: see vendor advisory" ], "startedAt": "2023-07-24", "closedAt": "2023-08-15", "updatedAt": "2023-08-15", "summary": "APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).", "xPost": null }, { "slug": "citrix-netscaler-rce-cve-2023-3519", "title": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519", "json": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Citrix NetScaler ADC and NetScaler Gateway", "tags": [ "citrix", "netscaler", "zero-day", "rce", "webshell", "cisa-kev" ], "cveIds": [ "CVE-2023-3519" ], "affectedVersions": [ "NetScaler ADC and Gateway configured as a Gateway or AAA virtual server; exact builds: see vendor advisory" ], "fixedVersions": [ "13.1-49.13", "13.0-91.13", "FIPS/NDcPP builds: see vendor advisory" ], "startedAt": "2023-07-18", "closedAt": "2023-07-20", "updatedAt": "2023-07-20", "summary": "An unauthenticated code injection in NetScaler ADC and Gateway was exploited as a zero-day to plant webshells, including on a US critical infrastructure organisation in June 2023. Citrix patched it on July 18, 2023.", "xPost": null }, { "slug": "operation-triangulation-ios-zero-click-2023", "title": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones", "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023", "json": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apple iOS (and other Apple OSes sharing the bugs)", "tags": [ "apple", "ios", "kaspersky", "spyware", "zero-click", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-32434", "CVE-2023-32435", "CVE-2023-38606" ], "affectedVersions": [ "Exploited against iOS versions before iOS 15.7 / 15.7.1 (NVD)" ], "fixedVersions": [ "CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD)", "CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD)", "CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)" ], "startedAt": "2023-06-01", "closedAt": "2023-12-27", "updatedAt": "2023-12-27", "summary": "Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.", "xPost": null }, { "slug": "moveit-transfer-cl0p-mass-exploitation-2023", "title": "MOVEit Transfer zero-day: Cl0p mass data theft", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023", "json": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Progress MOVEit Transfer", "tags": [ "progress", "moveit", "cl0p", "zero-day", "sql-injection", "data-breach", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-34362", "CVE-2023-35036", "CVE-2023-35708" ], "affectedVersions": [ "CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)", "CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)", "CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)" ], "fixedVersions": [ "2021.0.8 (13.0.8)", "2021.1.6 (13.1.6)", "2022.0.6 (14.0.6)", "2022.1.7 (14.1.7)", "2023.0.3 (15.0.3)", "Older branches: see vendor advisory" ], "startedAt": "2023-05-27", "closedAt": "2023-06-16", "updatedAt": "2023-06-16", "summary": "Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.", "xPost": null }, { "slug": "barracuda-esg-zero-day-cve-2023-2868", "title": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868", "json": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Barracuda Email Security Gateway (appliance)", "tags": [ "barracuda", "email-security", "zero-day", "rce", "china", "cisa-kev" ], "cveIds": [ "CVE-2023-2868" ], "affectedVersions": [ "5.1.3.001 to 9.2.0.006 (appliance form factor only) (NVD)" ], "fixedVersions": [ "See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)" ], "startedAt": "2023-05-18", "closedAt": "2023-06-15", "updatedAt": "2023-06-15", "summary": "A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.", "xPost": null }, { "slug": "microsoft-outlook-ntlm-leak-cve-2023-23397", "title": "Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)", "url": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397", "json": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Outlook for Windows", "tags": [ "microsoft", "outlook", "ntlm", "apt28", "zero-click", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-23397" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "See vendor advisory (March 2023 security updates)" ], "startedAt": "2023-03-14", "closedAt": "2023-03-24", "updatedAt": "2023-03-24", "summary": "A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.", "xPost": null }, { "slug": "goanywhere-mft-cl0p-cve-2023-0669", "title": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669", "json": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Fortra GoAnywhere MFT", "tags": [ "fortra", "goanywhere", "cl0p", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-0669" ], "affectedVersions": [ "Before 7.1.2 (NVD)" ], "fixedVersions": [ "7.1.2" ], "startedAt": "2023-02-01", "closedAt": "2023-02-10", "updatedAt": "2023-02-10", "summary": "A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.", "xPost": null } ], "posts": [ { "authorName": "Dark Web Informer", "handle": "DarkWebInformer", "avatarUrl": "https://pbs.twimg.com/profile_images/2109088203504287744/BJcETLaO_bigger.jpg", "text": "🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited\n\nArista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.\n⠀\nThe SQL injection flaw allows any authenticated user, including someone https://t.co/YmvPfvAwhb", "date": "2026-10-22T15:33:25.000Z", "url": "https://x.com/DarkWebInformer/status/2113292650828726321", "media": [], "incident": "arista-velocloud-orchestrator-cve-2026-114625" }, { "authorName": "bvcyberguardian", "handle": "bvcyberguardian", "avatarUrl": "https://pbs.twimg.com/profile_images/2072419215970082816/V3aI9G5b_bigger.jpg", "text": "🔴 Patch Windows right now.\n\nCVE-2026-96951 — a \"Mark of the Web\" bypass — is being actively exploited in the wild. A malicious ZIP or ISO can run code on your machine without triggering security warnings.\n\nStart → Settings → Windows Update → Check for updates.\n\nDon't postpone", "date": "2026-10-19T13:07:34.000Z", "url": "https://x.com/bvcyberguardian/status/2112168782596833559", "media": [], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "!Manan", "handle": "0xManan", "avatarUrl": "https://pbs.twimg.com/profile_images/2020588315171500032/jbdIlDMp_bigger.jpg", "text": "welcome.cgi → root.\n\nIvanti Connect Secure CVE-2026-104935. Zero-day. ITW. KEV.\n\nUTA0576 chain (Volexity):\n• public welcome.cgi + X-DSCGI-PATH → hit protected wu.cgi unauth\n• zip-upload race → execute the Perl before delete\n• dsinvoked + in-memory lib patch → root\n• ICT", "date": "2026-10-19T09:10:30.000Z", "url": "https://x.com/0xManan/status/2112109121621373036", "media": [], "incident": "ivanti-connect-secure-cve-2026-104935" }, { "authorName": "Novacybersecurity Inc. & Associates", "handle": "thenovacyberXBT", "avatarUrl": "https://pbs.twimg.com/profile_images/2109756295289131008/LyqgwmUQ_bigger.jpg", "text": "Patch fast, stay safe. Attackers exploit known flaws within days, like this month's Windows Shell zero-day (CVE-2026-96951) and the Linux \"PwnEscape\" bug (CVE-2026-99999).\nUpdate Windows and Linux today, turn on auto-updates, and use MFA.\n#CyberSecurity #PatchManagement #InfoSec https://t.co/WYVnDmsENU", "date": "2026-10-18T11:30:36.000Z", "url": "https://x.com/thenovacyberXBT/status/2111781993109495979", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HU6OgPJbAAAo_t6.jpg" } ], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "InfraSecurity Services", "handle": "infrasecserv", "avatarUrl": "https://pbs.twimg.com/profile_images/2033955264173338626/ClYbz4n0_bigger.png", "text": "October Patch Tuesday: 1,408 CVEs, 72 critical. Zero-day CVE-2026-96951 (Windows Shell Mark of the Web bypass) is exploited, CISA deadline Oct 16. SharePoint CVE-2026-65660 is also exploited, yet Microsoft's guide still says No. #PatchTuesday #InfoSec", "date": "2026-10-18T08:03:54.000Z", "url": "https://x.com/infrasecserv/status/2111729974159827024", "media": [], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "Autumn Good", "handle": "autumn_good_35", "avatarUrl": "https://pbs.twimg.com/profile_images/753613417236172800/eRXIGCi1_bigger.jpg", "text": "『GTIG attributes the zero-day exploitation of CVE-2026-102764 and the subsequent deployment of SAWFLY and BARECLAW to the suspected PRC-nexus espionage actor ARMORY CASTLE (formerly tracked as UNC5221).』\n\nARMORY CASTLE Exploits BeyondTrust\nhttps://t.co/dMDDmTEMqA", "date": "2026-10-16T07:17:29.000Z", "url": "https://x.com/autumn_good_35/status/2110993518932181444", "media": [], "incident": "beyondtrust-remote-support-cve-2026-102764" }, { "authorName": "Dark Web Intelligence", "handle": "DailyDarkWeb", "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg", "text": "🚨 CRITICAL: BEYONDTRUST REMOTE SUPPORT CVE-2026-102764 EXPLOITED AS ZERO-DAY BY PRC-NEXUS ARMORY CASTLE\n\nBeyondTrust disclosed BT26-05 (CVE-2026-102764, CVSS 9.3) on Oct 15, 2026: a critical unauthenticated file-operations flaw in Remote Support (formerly Bomgar) that can lead https://t.co/9PDO5pA0gA", "date": "2026-10-15T22:11:04.000Z", "url": "https://x.com/DailyDarkWeb/status/2110856005198213489", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HUtEWINWYAAGWP2.jpg" } ], "incident": "beyondtrust-remote-support-cve-2026-102764" }, { "authorName": "John", "handle": "Big_Bad_W0lf_", "avatarUrl": "https://pbs.twimg.com/profile_images/1268550997716144131/YqtdRZ2z_bigger.jpg", "text": "Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221). \n\nhttps://t.co/v1fGotYhM8", "date": "2026-10-15T21:27:37.000Z", "url": "https://x.com/Big_Bad_W0lf_/status/2110845070975119585", "media": [], "incident": "beyondtrust-remote-support-cve-2026-102764" }, { "authorName": "Dark Web Intelligence", "handle": "DailyDarkWeb", "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg", "text": "🚨 IVANTI CONNECT SECURE ZERO-DAY CHAIN EXPLOITED TO STEAL CREDENTIALS (CVE-2026-104935)\n\nIvanti disclosed a new Connect Secure (ICS) VPN flaw on Oct 13, 2026 and says it is aware of limited exploitation in the wild. CISA added it to the KEV catalog the same day. Volexity https://t.co/o24PhxS5jy", "date": "2026-10-13T18:01:14.000Z", "url": "https://x.com/DailyDarkWeb/status/2110068357949247657", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HUh3_CObIAAt9bY.jpg" } ], "incident": "ivanti-connect-secure-cve-2026-104935" }, { "authorName": "Daily CyberSecurity", "handle": "Daily_CyberSec", "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg", "text": "UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.\n\n#Ivanti #ZeroDay #CVE2026104935 #UTA0576 #Volexity #VPN #ActiveDirectory #Cybersecurity\nhttps://t.co/Yb0bCtOh60", "date": "2026-10-13T16:19:58.000Z", "url": "https://x.com/Daily_CyberSec/status/2110042871994651025", "media": [], "incident": "ivanti-connect-secure-cve-2026-104935" }, { "authorName": "Bunker", "handle": "BunkerITx", "avatarUrl": "https://pbs.twimg.com/profile_images/2101396047402610688/uprGaFdb_bigger.jpg", "text": "🚨 Fortinet FortiMail: CVE-2026-104286 (CVSS 9.8) is actively exploited.\n\nUnauthenticated attackers can write arbitrary files, potentially leading to code execution.\n\nYour email security gateway needs security. Ironic.\n\n#Cybersecurity\n\nhttps://t.co/ldmxkOOdHO https://t.co/0AYMecEQPs", "date": "2026-10-11T12:21:11.000Z", "url": "https://x.com/BunkerITx/status/2109258005313466616", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HUWW-aFXgAANCTg.jpg" } ], "incident": "fortimail-cve-2026-104286" }, { "authorName": "jark after dark", "handle": "jarkafterdark", "avatarUrl": "https://pbs.twimg.com/profile_images/2082021037404037120/UgUODE6b_bigger.jpg", "text": "fortinet is warning about a critical fortimail zero-day, cve-2026-104286, already under active exploitation. cisa has flagged it too.\n\nhttps://t.co/8phX4oRY7S\n\nit is an unauthenticated arbitrary file write, rated 9.8, triggered by a crafted http or https request.", "date": "2026-10-11T02:30:07.000Z", "url": "https://x.com/jarkafterdark/status/2109109259552116797", "media": [], "incident": "fortimail-cve-2026-104286" }, { "authorName": "CiberPlaneta", "handle": "CiberPlanetaOrg", "avatarUrl": "https://pbs.twimg.com/profile_images/2026768320549003264/1cg_XTJx_bigger.png", "text": "🛡️ CVE-2026-104286: escritura arbitraria de archivos en Fortinet FortiMail\nCISA confirma explotación activa de CVE-2026-104286, una falla crítica de FortiMail que permite escritura arbitraria de archivos sin autenticación.\nhttps://t.co/V275SQHfFe\n\n#ciberplaneta #vulnerabilidades", "date": "2026-10-01T20:58:07.000Z", "url": "https://x.com/CiberPlanetaOrg/status/2105764216950898840", "media": [], "incident": "fortimail-cve-2026-104286" } ], "changes": [ { "incident": "arista-velocloud-orchestrator-cve-2026-114625", "incidentTitle": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/", "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625" }, { "incident": "beyondtrust-remote-support-cve-2026-102764", "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-15/16", "title": "Public disclosure / Mandiant blog; CISA KEV Oct 16.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764" }, { "incident": "windows-shell-cve-2026-96951-motw", "incidentTitle": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-13", "title": "Microsoft ships patches; CISA KEV lists CVE-2026-96951.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "Ivanti discloses and patches CVE-2026-104935; Volexity publishes.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-13/16", "title": "CISA KEV listing; federal patching deadline reported as Oct 16.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "beyondtrust-remote-support-cve-2026-102764", "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-08/09", "title": "BeyondTrust patches; SaaS auto-fixed.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764" }, { "incident": "fortimail-cve-2026-104286", "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-05", "title": "Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA.", "body": null, "sourceUrl": "https://www.fortiguard.com/psirt/FG-IR-26-175", "url": "https://pwn.watch/i/fortimail-cve-2026-104286" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-03", "title": "Volexity sees UTA0576 chaining for unauth root.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-03", "title": "Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root.", "body": null, "sourceUrl": "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/", "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "ivanti-connect-secure-cve-2026-104935", "incidentTitle": "Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-01", "title": "Defused reports first signs of exploitation.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935" }, { "incident": "fortimail-cve-2026-104286", "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10", "title": "Fortinet PSIRT FG-IR-26-175 patches and mitigations.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortimail-cve-2026-104286" }, { "incident": "fortimail-cve-2026-104286", "incidentTitle": "FortiMail unauthenticated file-write zero-day CVE-2026-104286", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "~2026-09-30/10-01", "title": "Active exploitation and CISA alerts begin circulating.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/fortimail-cve-2026-104286" }, { "incident": "beyondtrust-remote-support-cve-2026-102764", "incidentTitle": "BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-08-29", "title": "Mandiant/GTIG: exploitation of zero-day begins (limited victims).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-12", "title": "Unit 42 updates its threat brief on ongoing exploitation", "body": null, "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-05", "title": "CISA adds CVE-2025-55182 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "React discloses a critical vulnerability in React Server Components and ships fixes", "body": null, "sourceUrl": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "react2shell-react-server-components-cve-2025-55182", "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-12-03", "title": "AWS sees China-nexus groups exploiting it within hours", "body": "Including Earth Lamia and Jackpot Panda.", "sourceUrl": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/", "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA adds CVE-2025-61882 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-04", "title": "Oracle publishes a Security Alert for CVE-2025-61882", "body": null, "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "Cl0p-branded extortion emails start arriving at executives", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603", "body": "Storm-2603 deployed Warlock ransomware.", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-20", "title": "CISA adds CVE-2025-53770 to KEV and publishes guidance", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-19", "title": "Microsoft publishes customer guidance for CVE-2025-53770", "body": "Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.", "sourceUrl": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-18", "title": "Eye Security observes large-scale exploitation of on-prem SharePoint servers", "body": "Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).", "sourceUrl": "https://research.eye.security/sharepoint-under-siege/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-10", "title": "CISA adds CVE-2025-5777 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-04", "title": "watchTowr publishes technical analysis; public PoCs follow", "body": null, "sourceUrl": "https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-26", "title": "ReliaQuest reports likely targeted exploitation", "body": null, "sourceUrl": "https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-23", "title": "GreyNoise observes exploitation starting", "body": null, "sourceUrl": "https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc", "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "citrixbleed-2-netscaler-cve-2025-5777", "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-06-17", "title": "Citrix discloses CVE-2025-5777 and releases fixes", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-15", "title": "CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-29", "title": "CISA adds CVE-2025-31324 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "sap-netweaver-visual-composer-zero-day-cve-2025-31324", "incidentTitle": "SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-24", "title": "SAP releases an emergency fix; ReliaQuest publishes its findings", "body": null, "sourceUrl": "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/", "url": "https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-connect-secure-flaw-used-in-zero-day-attacks/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "ivanti-connect-secure-zero-day-cve-2025-0282", "incidentTitle": "Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-01-08", "title": "CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions", "body": null, "sourceUrl": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-17", "title": "CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "Clop claims responsibility for the Cleo data-theft attacks", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-14", "title": "Cleo advisory: patch 5.8.0.24 for CVE-2024-55956", "body": null, "sourceUrl": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-13", "title": "CVE-2024-55956 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-13", "title": "CISA added CVE-2024-50623 to the KEV catalog (federal deadline 2025-01-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-09", "title": "Huntress warns that fully patched 5.8.0.21 systems are still exploitable", "body": null, "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-03", "title": "Earliest exploitation Huntress observed against Cleo servers", "body": null, "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-0012 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-0012", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CVE-2024-9474 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474", "incidentTitle": "Palo Alto PAN-OS management interface auth bypass + privilege escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-18", "title": "CISA added CVE-2024-9474 to the KEV catalog (federal deadline 2024-12-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-43451 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43451", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-49039 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49039", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-43451 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-49039 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-27", "title": "CVE-2024-50623 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "fortinet-fortimanager-fortijump-cve-2024-47575", "incidentTitle": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-23", "title": "CVE-2024-47575 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-47575", "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575" }, { "incident": "fortinet-fortimanager-fortijump-cve-2024-47575", "incidentTitle": "FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-23", "title": "CISA added CVE-2024-47575 to the KEV catalog (federal deadline 2024-11-13)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-11", "title": "FortiGuard Labs details the zero-day chain used against Ivanti CSA", "body": null, "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-09", "title": "CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43572 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43572", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43573 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43573", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43572 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43573 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-9379 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9379", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-9380 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-9380", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-19", "title": "CVE-2024-8963 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8963", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-19", "title": "CISA added CVE-2024-8963 to the KEV catalog (federal deadline 2024-10-10)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-13", "title": "CISA added CVE-2024-8190 to the KEV catalog (federal deadline 2024-10-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-8190 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-8190", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380", "incidentTitle": "Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "Ivanti publishes the advisory for CVE-2024-8190", "body": null, "sourceUrl": "https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa", "url": "https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38014 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38014", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38217 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38217", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38226 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38226", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38014 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38217 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38226 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38106 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38106", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38107 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38107", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38178 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38178", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38189 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38189", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38193 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38193", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38213 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38213", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38106 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38107 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38178 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38189 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38193 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38213 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38080 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38080", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38112 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38112", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-38080 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-38112 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30040 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30040", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30051 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30051", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30040 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30051 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-24", "title": "CVE-2024-20353 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20353", "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359" }, { "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-24", "title": "CVE-2024-20359 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20359", "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359" }, { "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-24", "title": "CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359" }, { "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-24", "title": "CISA added CVE-2024-20359 to the KEV catalog (federal deadline 2024-05-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359" }, { "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359", "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-24", "title": "Cisco Talos discloses the ArcaneDoor campaign; Cisco ships fixes", "body": null, "sourceUrl": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/", "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "CVE-2024-3400 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400", "incidentTitle": "Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-04-12", "title": "Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details", "body": null, "sourceUrl": "https://security.paloaltonetworks.com/CVE-2024-3400", "url": "https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21351 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21351", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21412 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21412", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21351 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21412 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CVE-2024-21893 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21893", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-31", "title": "CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-19", "title": "CISA issues Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2023-46805 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-46805", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-12", "title": "CVE-2024-21887 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21887", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2023-46805 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2024-21887 to the KEV catalog (federal deadline 2024-01-22)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893", "incidentTitle": "Ivanti Connect Secure zero-days chained for mass VPN compromise", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "Volexity discloses active exploitation of two Ivanti Connect Secure zero-days", "body": null, "sourceUrl": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/", "url": "https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893" }, { "incident": "operation-triangulation-ios-zero-click-2023", "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-12-27", "title": "At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606", "body": null, "sourceUrl": "https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/", "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-12-18", "title": "Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers", "body": null, "sourceUrl": "https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-11-21", "title": "CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-23", "title": "Citrix issues additional mitigation guidance", "body": null, "sourceUrl": "https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-23", "title": "CISA adds CVE-2023-20273 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-22", "title": "First fixed release, 17.9.4a, published", "body": null, "sourceUrl": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-20", "title": "Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "CISA adds CVE-2023-4966 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-18", "title": "Google TAG: government-backed actors exploiting the WinRAR bug", "body": null, "sourceUrl": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-17", "title": "Mandiant reports zero-day exploitation since late August 2023 and session hijacking that survives patching", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "Cisco advisory and Talos write-up on active exploitation; CISA adds CVE-2023-20198 to KEV", "body": null, "sourceUrl": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "citrix-bleed-netscaler-cve-2023-4966", "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-10", "title": "Citrix publishes bulletin CTX579459 and fixed builds", "body": null, "sourceUrl": "https://support.citrix.com/external/article/CTX579459/netscaler-adc-and-netscaler-gateway-secu.html", "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-05", "title": "CISA adds CVE-2023-22515 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "atlassian-confluence-admin-creation-cve-2023-22515", "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "Atlassian discloses the zero-day after customer reports and ships fixes", "body": null, "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html", "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515" }, { "incident": "cisco-ios-xe-web-ui-implants-cve-2023-20198", "incidentTitle": "Cisco IOS XE web UI zero-days: implants on tens of thousands of devices", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "Earliest malicious activity found by Cisco Talos", "body": null, "sourceUrl": "https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/", "url": "https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198" }, { "incident": "libwebp-heap-overflow-cve-2023-4863", "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-13", "title": "CISA adds CVE-2023-4863 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863" }, { "incident": "libwebp-heap-overflow-cve-2023-4863", "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-11", "title": "Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild", "body": null, "sourceUrl": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html", "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863" }, { "incident": "apple-blastpass-cve-2023-41064-41061", "incidentTitle": "BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-11", "title": "CISA adds both CVEs to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061" }, { "incident": "apple-blastpass-cve-2023-41064-41061", "incidentTitle": "BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-07", "title": "Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates", "body": null, "sourceUrl": "https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/", "url": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-24", "title": "CISA adds CVE-2023-38831 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-23", "title": "Group-IB: zero-day exploited since April 2023 against traders", "body": null, "sourceUrl": "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-08-15", "title": "Norway shuts down the old ministry e-mail solution and rolls out a new one", "body": null, "sourceUrl": "https://www.regjeringen.no/en/whats-new/shutdown-of-e-mail-solution-following-cyberattack/id2991023/", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "winrar-zero-day-cve-2023-38831", "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-02", "title": "WinRAR 6.23 released with the fix", "body": null, "sourceUrl": "https://www.rarlab.com/rarnew.htm", "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-08-01", "title": "CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-28", "title": "Ivanti patches the second bug, CVE-2023-35081", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-25", "title": "CISA adds CVE-2023-35078 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-24", "title": "Norway: cyber-attack on the ICT platform used by 12 ministries through a zero-day in a supplier's software", "body": null, "sourceUrl": "https://www.regjeringen.no/en/whats-new/ministries-hit-by-cyber-attacks/id2990098/", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "operation-triangulation-ios-zero-click-2023", "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-24", "title": "Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-38606", "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023" }, { "incident": "ivanti-epmm-norway-government-cve-2023-35078", "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-23", "title": "Ivanti patches CVE-2023-35078", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a", "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078" }, { "incident": "citrix-netscaler-rce-cve-2023-3519", "incidentTitle": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-20", "title": "CISA advisory AA23-201A: webshell dropped on a critical infrastructure organisation's NetScaler in June 2023", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a", "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519" }, { "incident": "citrix-netscaler-rce-cve-2023-3519", "incidentTitle": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-19", "title": "CISA adds CVE-2023-3519 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519" }, { "incident": "citrix-netscaler-rce-cve-2023-3519", "incidentTitle": "NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-18", "title": "Citrix publishes CTX561482 and fixed builds; exploits seen on unmitigated appliances", "body": null, "sourceUrl": "https://support.citrix.com/external/article/CTX561482/citrix-adc-and-citrix-gateway-security-b.html", "url": "https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519" }, { "incident": "operation-triangulation-ios-zero-click-2023", "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-21", "title": "Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-32434", "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-16", "title": "Third round of fixes for CVE-2023-35708 after a public proof of concept", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35708", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-15", "title": "Mandiant attributes the campaign to China-nexus UNC4841", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-09", "title": "Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35036", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-07", "title": "CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-06", "title": "Barracuda tells customers to replace compromised appliances immediately, regardless of patch level", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-02", "title": "CISA adds CVE-2023-34362 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "operation-triangulation-ios-zero-click-2023", "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-01", "title": "Kaspersky discloses Operation Triangulation", "body": null, "sourceUrl": "https://securelist.com/operation-triangulation/109842/", "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-31", "title": "Progress discloses the critical MOVEit Transfer vulnerability and ships patches", "body": null, "sourceUrl": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-30", "title": "Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-27", "title": "Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-26", "title": "CISA adds CVE-2023-2868 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-20", "title": "Security patch pushed to all ESG appliances worldwide", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "barracuda-esg-zero-day-cve-2023-2868", "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-18", "title": "Barracuda notices anomalous traffic from ESG appliances", "body": null, "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability", "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868" }, { "incident": "microsoft-outlook-ntlm-leak-cve-2023-23397", "incidentTitle": "Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-24", "title": "Microsoft publishes investigation guidance for CVE-2023-23397", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/", "url": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397" }, { "incident": "microsoft-outlook-ntlm-leak-cve-2023-23397", "incidentTitle": "Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-14", "title": "Patch Tuesday fix; CISA adds CVE-2023-23397 to KEV", "body": null, "sourceUrl": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397", "url": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-10", "title": "CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-07", "title": "Emergency patch: GoAnywhere MFT 7.1.2", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" }, { "incident": "goanywhere-mft-cl0p-cve-2023-0669", "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-01", "title": "Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/", "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669" } ] }