pwn.watch: Zero-day incident updates

[critical] Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks

Thu, 22 Oct 2026 18:32:13 GMT

Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.

Status: live · Patch: patched · Fixed in: 5.2.3.18, 6.1.3.10, 6.4.2.12

Latest updates:

2026-10-22: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected. (source)

CVEs: CVE-2026-114625

[critical] BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)

Thu, 22 Oct 2026 18:32:13 GMT

China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).

Status: live · Patch: partial · Fixed in: BT26-05-RS patch for self-hosted RS 24.3.1-26.2.3 (older versions must upgrade first); SaaS auto-patched Oct 9

Latest updates:

2026-10-15/16: Public disclosure / Mandiant blog; CISA KEV Oct 16.
2026-10-08/09: BeyondTrust patches; SaaS auto-fixed.
2026-08-29: Mandiant/GTIG: exploitation of zero-day begins (limited victims).

CVEs: CVE-2026-102764

[high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Thu, 22 Oct 2026 09:20:00 GMT

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.

Status: live · Patch: partial · Fixed in: 25.1.1.2, 25.1.3.0 / 25.1.3.1, 22.8R2.5

Latest updates:

2026-10-13: Ivanti discloses and patches CVE-2026-104935; Volexity publishes.
2026-10-13/16: CISA KEV listing; federal patching deadline reported as Oct 16.
2026-10-03: Volexity sees UTA0576 chaining for unauth root.

CVEs: CVE-2026-104935

[high] Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)

Thu, 22 Oct 2026 09:20:00 GMT

Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.

Status: closed · Patch: patched · Fixed in: October 2026 Patch Tuesday cumulative updates (KB packages per SKU)

Latest updates:

2026-10-13: Microsoft ships patches; CISA KEV lists CVE-2026-96951.

CVEs: CVE-2026-96951, CVE-2026-108398, CVE-2026-92707

[critical] FortiMail unauthenticated file-write zero-day CVE-2026-104286

Thu, 22 Oct 2026 09:18:00 GMT

Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).

Status: live · Patch: patched · Fixed in: 8.0.2+, 7.6.7+, 7.4.9+; 7.2.x migrate to 7.4.9+

Latest updates:

2026-10-05: Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA. (source)
2026-10: Fortinet PSIRT FG-IR-26-175 patches and mitigations.
~2026-09-30/10-01: Active exploitation and CISA alerts begin circulating.

CVEs: CVE-2026-104286

[high] Apple CoreGraphics zero-day CVE-2026-86950

Tue, 29 Sep 2026 00:00:00 GMT

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.

Status: closed · Patch: patched · Fixed in: iOS/iPadOS 26.7.1, macOS security updates per Apple HT149226/149228/149229

CVEs: CVE-2026-86950

[high] Chrome zero-day CVE-2026-87491 (V8 OOB write)

Wed, 09 Sep 2026 00:00:00 GMT

September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.

Status: closed · Patch: patched · Fixed in: 153.0.8010.36+, 153.0.8010.37+

CVEs: CVE-2026-87491

[high] Chrome zero-day CVE-2026-85046 (V8 type confusion)

Fri, 04 Sep 2026 00:00:00 GMT

September 4 2026 Chrome update patched CVE-2026-85046, a V8 type confusion zero-day Google said was exploited in the wild. Fixed in Chrome 152.0.7977.82/.83. Later added to CISA KEV.

Status: closed · Patch: patched · Fixed in: 152.0.7977.82+, 152.0.7977.83+

CVEs: CVE-2026-85046

[high] Chrome zero-day CVE-2026-11645 (V8 OOB)

Tue, 30 Jun 2026 00:00:00 GMT

June 2026 Chrome emergency update patched CVE-2026-11645, an out-of-bounds read/write in V8 exploited in the wild (fifth Chrome zero-day of 2026 at the time). Stable builds 149.0.7827.102/.103.

Status: closed · Patch: patched · Fixed in: 149.0.7827.102+, 149.0.7827.103+

CVEs: CVE-2026-11645

[high] Chrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)

Thu, 30 Apr 2026 00:00:00 GMT

April 2026 Chrome patch for CVE-2026-5281, a use-after-free in Dawn (WebGPU), actively exploited in the wild.

Status: closed · Patch: patched · Fixed in: April 2026 Chrome Stable

CVEs: CVE-2026-5281

[high] Chrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)

Tue, 31 Mar 2026 00:00:00 GMT

March 2026 Chrome updates fixed two actively exploited zero-days: CVE-2026-3909 (out-of-bounds write in Skia) and CVE-2026-3910 (inappropriate implementation in V8).

Status: closed · Patch: patched · Fixed in: March 2026 Chrome Stable updates

CVEs: CVE-2026-3909, CVE-2026-3910

[critical] Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)

Sat, 28 Feb 2026 00:00:00 GMT

In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.

Status: closed · Patch: patched · Fixed in: Cisco fixed releases per advisory

[critical] European Commission & Dutch authorities hit via Ivanti EPMM zero-days

Sat, 28 Feb 2026 00:00:00 GMT

February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.

Status: closed · Patch: patched · Fixed in: Ivanti patched EPMM releases

CVEs: CVE-2026-1340

[unknown] UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)

Sat, 28 Feb 2026 00:00:00 GMT

In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.

Status: closed · Patch: partial

[high] Chrome zero-day CVE-2026-2441 (CSS use-after-free)

Mon, 16 Feb 2026 00:00:00 GMT

First actively exploited Chrome zero-day of 2026. Google patched CVE-2026-2441, a high-severity use-after-free in CSS (CSSFontFeatureValuesMap), in mid-February Chrome 145 updates. Google stated an exploit existed in the wild.

Status: closed · Patch: patched · Fixed in: 145.0.7632.75+, 144.0.7559.75+ (Linux per reports)

CVEs: CVE-2026-2441

[critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js

Fri, 12 Dec 2025 00:00:00 GMT

A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.

Status: closed · Patch: patched · Fixed in: React 19.0.1, React 19.1.2, React 19.2.1, Next.js: patched release lines per the React/Next.js advisory

Latest updates:

2025-12-12: Unit 42 updates its threat brief on ongoing exploitation (source)
2025-12-05: CISA adds CVE-2025-55182 to KEV
2025-12-03: React discloses a critical vulnerability in React Server Components and ships fixes (source)

CVEs: CVE-2025-55182

[critical] Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)

Mon, 20 Oct 2025 00:00:00 GMT

Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.

Status: closed · Patch: patched · Fixed in: Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)

Latest updates:

2025-10-20: CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV (source)
2025-10-06: CISA adds CVE-2025-61882 to KEV
2025-10-04: Oracle publishes a Security Alert for CVE-2025-61882 (source)

CVEs: CVE-2025-61882

[critical] ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)

Tue, 22 Jul 2025 00:00:00 GMT

Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.

Status: closed · Patch: patched · Fixed in: See Microsoft customer guidance for CVE-2025-53770

Latest updates:

2025-07-22: Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603 (source)
2025-07-22: CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV
2025-07-20: CISA adds CVE-2025-53770 to KEV and publishes guidance (source)

CVEs: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770

[critical] CitrixBleed 2: NetScaler memory leak exploited to hijack sessions

Thu, 10 Jul 2025 00:00:00 GMT

An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.

Status: closed · Patch: patched · Fixed in: 14.1-43.56, 13.1-58.32, 13.1-FIPS/NDcPP 13.1-37.235

Latest updates:

2025-07-10: CISA adds CVE-2025-5777 to KEV
2025-07-04: watchTowr publishes technical analysis; public PoCs follow (source)
2025-06-26: ReliaQuest reports likely targeted exploitation (source)

CVEs: CVE-2025-5777

[critical] SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)

Thu, 15 May 2025 00:00:00 GMT

A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.

Status: closed · Patch: patched · Fixed in: See SAP Security Note for CVE-2025-31324

Latest updates:

2025-05-15: CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV
2025-04-29: CISA adds CVE-2025-31324 to KEV
2025-04-24: SAP releases an emergency fix; ReliaQuest publishes its findings (source)

CVEs: CVE-2025-31324

[critical] Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)

Wed, 08 Jan 2025 00:00:00 GMT

An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.

Status: closed · Patch: patched · Fixed in: Connect Secure 22.7R2.5

Latest updates:

2025-01-08: Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5 (source)
2025-01-08: Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware (source)
2025-01-08: CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions (source)

CVEs: CVE-2025-0282

[critical] Cleo file transfer zero-days exploited by Clop for data theft

Tue, 17 Dec 2024 00:00:00 GMT

Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: 5.8.0.24 (Cleo, for CVE-2024-55956), 5.8.0.21 (Cleo, for CVE-2024-50623)

Latest updates:

2024-12-17: CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07) (source)
2024-12-16: Clop claims responsibility for the Cleo data-theft attacks (source)
2024-12-14: Cleo advisory: patch 5.8.0.24 for CVE-2024-55956 (source)

CVEs: CVE-2024-50623, CVE-2024-55956

[critical] Palo Alto PAN-OS management interface auth bypass + privilege escalation

Mon, 18 Nov 2024 00:00:00 GMT

CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-18: CVE-2024-0012 published (source)
2024-11-18: CVE-2024-9474 published (source)
2024-11-18: CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09) (source)

CVEs: CVE-2024-0012, CVE-2024-9474

[high] Microsoft November 2024: 2 actively exploited zero-days

Tue, 12 Nov 2024 00:00:00 GMT

CVE-2024-43451: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CVE-2024-49039: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Added to the CISA KEV catalog on 2024-11-12. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-12: CVE-2024-43451 published (source)
2024-11-12: CVE-2024-49039 published (source)
2024-11-12: CISA added CVE-2024-43451 to the KEV catalog (federal deadline 2024-12-03) (source)

CVEs: CVE-2024-43451, CVE-2024-49039

[critical] FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)

Wed, 23 Oct 2024 00:00:00 GMT

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-23: CVE-2024-47575 published (source)
2024-10-23: CISA added CVE-2024-47575 to the KEV catalog (federal deadline 2024-11-13) (source)

CVEs: CVE-2024-47575

[critical] Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor

Fri, 11 Oct 2024 00:00:00 GMT

Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-11: FortiGuard Labs details the zero-day chain used against Ivanti CSA (source)
2024-10-09: CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30) (source)
2024-10-09: CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30) (source)

CVEs: CVE-2024-8190, CVE-2024-8963, CVE-2024-9379, CVE-2024-9380

[high] Microsoft October 2024: 2 actively exploited zero-days

Tue, 08 Oct 2024 00:00:00 GMT

CVE-2024-43572: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CVE-2024-43573: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Added to the CISA KEV catalog on 2024-10-08.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-08: CVE-2024-43572 published (source)
2024-10-08: CVE-2024-43573 published (source)
2024-10-08: CISA added CVE-2024-43572 to the KEV catalog (federal deadline 2024-10-29) (source)

CVEs: CVE-2024-43572, CVE-2024-43573

[high] Microsoft September 2024: 3 actively exploited zero-days

Tue, 10 Sep 2024 00:00:00 GMT

CVE-2024-38014: Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. CVE-2024-38217: Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. CVE-2024-38226: Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. Added to the CISA KEV catalog on 2024-09-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-10: CVE-2024-38014 published (source)
2024-09-10: CVE-2024-38217 published (source)
2024-09-10: CVE-2024-38226 published (source)

CVEs: CVE-2024-38014, CVE-2024-38217, CVE-2024-38226

[high] Microsoft August 2024: 6 actively exploited zero-days

Tue, 13 Aug 2024 00:00:00 GMT

CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-13: CVE-2024-38106 published (source)
2024-08-13: CVE-2024-38107 published (source)
2024-08-13: CVE-2024-38178 published (source)

CVEs: CVE-2024-38106, CVE-2024-38107, CVE-2024-38178, CVE-2024-38189, CVE-2024-38193, CVE-2024-38213

[high] Microsoft July 2024: 2 actively exploited zero-days

Tue, 09 Jul 2024 00:00:00 GMT

CVE-2024-38080: Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CVE-2024-38112: Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. Added to the CISA KEV catalog on 2024-07-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-07-09: CVE-2024-38080 published (source)
2024-07-09: CVE-2024-38112 published (source)
2024-07-09: CISA added CVE-2024-38080 to the KEV catalog (federal deadline 2024-07-30) (source)

CVEs: CVE-2024-38080, CVE-2024-38112

[high] Microsoft May 2024: 2 actively exploited zero-days

Tue, 14 May 2024 00:00:00 GMT

CVE-2024-30040: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CVE-2024-30051: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-05-14. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-14: CVE-2024-30040 published (source)
2024-05-14: CVE-2024-30051 published (source)
2024-05-14: CISA added CVE-2024-30040 to the KEV catalog (federal deadline 2024-06-04) (source)

CVEs: CVE-2024-30040, CVE-2024-30051

[high] Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign

Wed, 24 Apr 2024 00:00:00 GMT

Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-04-24: CVE-2024-20353 published (source)
2024-04-24: CVE-2024-20359 published (source)
2024-04-24: CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01) (source)

CVEs: CVE-2024-20353, CVE-2024-20359

[critical] Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)

Fri, 12 Apr 2024 00:00:00 GMT

A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3

Latest updates:

2024-04-12: CVE-2024-3400 published (source)
2024-04-12: CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19) (source)
2024-04-12: Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details (source)

CVEs: CVE-2024-3400

[high] Microsoft February 2024: 2 actively exploited zero-days

Tue, 13 Feb 2024 00:00:00 GMT

CVE-2024-21351: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CVE-2024-21412: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Added to the CISA KEV catalog on 2024-02-13. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-02-13: CVE-2024-21351 published (source)
2024-02-13: CVE-2024-21412 published (source)
2024-02-13: CISA added CVE-2024-21351 to the KEV catalog (federal deadline 2024-03-05) (source)

CVEs: CVE-2024-21351, CVE-2024-21412

[critical] Ivanti Connect Secure zero-days chained for mass VPN compromise

Wed, 31 Jan 2024 00:00:00 GMT

Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-31: CVE-2024-21893 published (source)
2024-01-31: CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02) (source)
2024-01-31: CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02 (source)

CVEs: CVE-2023-46805, CVE-2024-21887, CVE-2024-21893

[high] Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones

Wed, 27 Dec 2023 00:00:00 GMT

Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.

Status: closed · Patch: patched · Fixed in: CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD), CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD), CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)

Latest updates:

2023-12-27: At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606 (source)
2023-07-24: Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26 (source)
2023-06-21: Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23 (source)

CVEs: CVE-2023-32434, CVE-2023-32435, CVE-2023-38606

[critical] Citrix Bleed: NetScaler session token leak (CVE-2023-4966)

Mon, 18 Dec 2023 00:00:00 GMT

A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).

Status: closed · Patch: patched · Fixed in: 14.1-8.50, 13.1-49.15, 13.0-92.19, FIPS/NDcPP builds: see vendor advisory

Latest updates:

2023-12-18: Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers (source)
2023-11-21: CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A) (source)
2023-10-23: Citrix issues additional mitigation guidance (source)

CVEs: CVE-2023-4966

[critical] Cisco IOS XE web UI zero-days: implants on tens of thousands of devices

Mon, 23 Oct 2023 00:00:00 GMT

Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.

Status: closed · Patch: patched · Fixed in: 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a (Catalyst 3650/3850 only)

Latest updates:

2023-10-23: CISA adds CVE-2023-20273 to the KEV catalog
2023-10-22: First fixed release, 17.9.4a, published (source)
2023-10-20: Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root

CVEs: CVE-2023-20198, CVE-2023-20273

[high] WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)

Wed, 18 Oct 2023 00:00:00 GMT

WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.

Status: closed · Patch: patched · Fixed in: 6.23

Latest updates:

2023-10-18: Google TAG: government-backed actors exploiting the WinRAR bug (source)
2023-08-24: CISA adds CVE-2023-38831 to the KEV catalog
2023-08-23: Group-IB: zero-day exploited since April 2023 against traders (source)

CVEs: CVE-2023-38831

[critical] Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)

Mon, 16 Oct 2023 00:00:00 GMT

A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.

Status: closed · Patch: patched · Fixed in: 8.3.3, 8.4.3, 8.5.2 (LTS)

Latest updates:

2023-10-16: CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation (source)
2023-10-05: CISA adds CVE-2023-22515 to the KEV catalog
2023-10-04: Atlassian discloses the zero-day after customer reports and ships fixes (source)

CVEs: CVE-2023-22515

[high] libwebp heap overflow exploited in the wild (CVE-2023-4863)

Wed, 13 Sep 2023 00:00:00 GMT

A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.

Status: closed · Patch: patched · Fixed in: Chrome 116.0.5845.187, libwebp 1.3.2, Bundling apps/libraries: see each vendor's advisory

Latest updates:

2023-09-13: CISA adds CVE-2023-4863 to the KEV catalog
2023-09-11: Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild (source)

CVEs: CVE-2023-4863

[high] BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

Mon, 11 Sep 2023 00:00:00 GMT

Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

Status: closed · Patch: patched · Fixed in: iOS 16.6.1 and iPadOS 16.6.1, iOS 15.7.9 and iPadOS 15.7.9, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, watchOS 9.6.2

Latest updates:

2023-09-11: CISA adds both CVEs to the KEV catalog
2023-09-07: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates (source)

CVEs: CVE-2023-41064, CVE-2023-41061

[critical] Ivanti EPMM zero-days used to breach 12 Norwegian ministries

Tue, 15 Aug 2023 00:00:00 GMT

APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).

Status: closed · Patch: patched · Fixed in: CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD), CVE-2023-35078: see vendor advisory

Latest updates:

2023-08-15: Norway shuts down the old ministry e-mail solution and rolls out a new one (source)
2023-08-01: CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023 (source)
2023-07-28: Ivanti patches the second bug, CVE-2023-35081

CVEs: CVE-2023-35078, CVE-2023-35081

[critical] NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)

Thu, 20 Jul 2023 00:00:00 GMT

An unauthenticated code injection in NetScaler ADC and Gateway was exploited as a zero-day to plant webshells, including on a US critical infrastructure organisation in June 2023. Citrix patched it on July 18, 2023.

Status: closed · Patch: patched · Fixed in: 13.1-49.13, 13.0-91.13, FIPS/NDcPP builds: see vendor advisory

Latest updates:

2023-07-20: CISA advisory AA23-201A: webshell dropped on a critical infrastructure organisation's NetScaler in June 2023 (source)
2023-07-19: CISA adds CVE-2023-3519 to the KEV catalog
2023-07-18: Citrix publishes CTX561482 and fixed builds; exploits seen on unmitigated appliances (source)

CVEs: CVE-2023-3519

[critical] MOVEit Transfer zero-day: Cl0p mass data theft

Fri, 16 Jun 2023 00:00:00 GMT

Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.

Status: closed · Patch: patched · Fixed in: 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), Older branches: see vendor advisory

Latest updates:

2023-06-16: Third round of fixes for CVE-2023-35708 after a public proof of concept (source)
2023-06-09: Progress fixes more SQL injection bugs found during code review (CVE-2023-35036) (source)
2023-06-07: CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505) (source)

CVEs: CVE-2023-34362, CVE-2023-35036, CVE-2023-35708

[critical] Barracuda Email Security Gateway zero-day (CVE-2023-2868)

Thu, 15 Jun 2023 00:00:00 GMT

A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.

Status: closed · Patch: patched · Fixed in: See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)

Latest updates:

2023-06-15: Mandiant attributes the campaign to China-nexus UNC4841 (source)
2023-06-06: Barracuda tells customers to replace compromised appliances immediately, regardless of patch level (source)
2023-05-30: Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware (source)

CVEs: CVE-2023-2868

[critical] Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)

Fri, 24 Mar 2023 00:00:00 GMT

A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.

Status: closed · Patch: patched · Fixed in: See vendor advisory (March 2023 security updates)

Latest updates:

2023-03-24: Microsoft publishes investigation guidance for CVE-2023-23397 (source)
2023-03-14: Patch Tuesday fix; CISA adds CVE-2023-23397 to KEV (source)

CVEs: CVE-2023-23397

[high] Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims

Fri, 10 Feb 2023 00:00:00 GMT

A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.

Status: closed · Patch: patched · Fixed in: 7.1.2

Latest updates:

2023-02-10: CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations (source)
2023-02-07: Emergency patch: GoAnywhere MFT 7.1.2 (source)
2023-02-01: Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console (source)

CVEs: CVE-2023-0669