# Zero-day security incidents · pwn.watch

> Security incidents tagged Zero-day (vendor, product, platform or attack type).

Page: https://pwn.watch/t/zero-day · generated 2026-10-22T18:38:01.102Z

## Status (as of 2026-10-22)
- Incidents: 48 (4 live, 2 live and not fully patched, 45 patched)
- Days without a Zero-day security incident: 0 (2 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-22

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/zero-day.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/zero-day/feed.xml
- This file: https://pwn.watch/t/zero-day/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625) ([json](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json)): critical, live, patched, started 2026-10-22, CVE-2026-114625
- [Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)](https://pwn.watch/i/windows-shell-cve-2026-96951-motw) ([json](https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json)): high, closed, patched, started 2026-10-13, CVE-2026-96951, CVE-2026-108398, CVE-2026-92707
- [Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935) ([json](https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json)): high, live, partial, started 2026-10-01, CVE-2026-104935
- [FortiMail unauthenticated file-write zero-day CVE-2026-104286](https://pwn.watch/i/fortimail-cve-2026-104286) ([json](https://pwn.watch/i/fortimail-cve-2026-104286.json)): critical, live, patched, started 2026-09-30, CVE-2026-104286
- [Apple CoreGraphics zero-day CVE-2026-86950](https://pwn.watch/i/apple-coregraphics-cve-2026-86950) ([json](https://pwn.watch/i/apple-coregraphics-cve-2026-86950.json)): high, closed, patched, started 2026-09-29, CVE-2026-86950
- [Chrome zero-day CVE-2026-87491 (V8 OOB write)](https://pwn.watch/i/chrome-zero-day-cve-2026-87491) ([json](https://pwn.watch/i/chrome-zero-day-cve-2026-87491.json)): high, closed, patched, started 2026-09-09, CVE-2026-87491
- [Chrome zero-day CVE-2026-85046 (V8 type confusion)](https://pwn.watch/i/chrome-zero-day-cve-2026-85046) ([json](https://pwn.watch/i/chrome-zero-day-cve-2026-85046.json)): high, closed, patched, started 2026-09-04, CVE-2026-85046
- [BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)](https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764) ([json](https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764.json)): critical, live, partial, started 2026-08-29, CVE-2026-102764
- [Chrome zero-day CVE-2026-11645 (V8 OOB)](https://pwn.watch/i/chrome-zero-day-cve-2026-11645) ([json](https://pwn.watch/i/chrome-zero-day-cve-2026-11645.json)): high, closed, patched, started 2026-06-01, CVE-2026-11645
- [Chrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)](https://pwn.watch/i/chrome-zero-day-cve-2026-5281-dawn) ([json](https://pwn.watch/i/chrome-zero-day-cve-2026-5281-dawn.json)): high, closed, patched, started 2026-04-01, CVE-2026-5281
- [Chrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)](https://pwn.watch/i/chrome-zero-days-cve-2026-3909-3910) ([json](https://pwn.watch/i/chrome-zero-days-cve-2026-3909-3910.json)): high, closed, patched, started 2026-03-01, CVE-2026-3909, CVE-2026-3910
- [Chrome zero-day CVE-2026-2441 (CSS use-after-free)](https://pwn.watch/i/chrome-zero-day-cve-2026-2441) ([json](https://pwn.watch/i/chrome-zero-day-cve-2026-2441.json)): high, closed, patched, started 2026-02-13, CVE-2026-2441
- [Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive) ([json](https://pwn.watch/i/cisco-sdwan-february-2026-emergency-directive.json)): critical, closed, patched, started 2026-02-01
- [European Commission & Dutch authorities hit via Ivanti EPMM zero-days](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach) ([json](https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json)): critical, closed, patched, started 2026-02-01, CVE-2026-1340
- [UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)](https://pwn.watch/i/singapore-unc3886-telecom-espionage) ([json](https://pwn.watch/i/singapore-unc3886-telecom-espionage.json)): unknown, closed, partial, started 2026-02-01
- [React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js](https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182) ([json](https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json)): critical, closed, patched, started 2025-12-03, CVE-2025-55182
- [Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882) ([json](https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json)): critical, closed, patched, started 2025-09-29, CVE-2025-61882
- [ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770) ([json](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json)): critical, closed, patched, started 2025-07-18, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770
- [CitrixBleed 2: NetScaler memory leak exploited to hijack sessions](https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777) ([json](https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777.json)): critical, closed, patched, started 2025-06-17, CVE-2025-5777
- [SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)](https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324) ([json](https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json)): critical, closed, patched, started 2025-04-24, CVE-2025-31324
- [Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json)): critical, closed, patched, started 2025-01-08, CVE-2025-0282
- [Cleo file transfer zero-days exploited by Clop for data theft](https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956) ([json](https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json)): critical, closed, patched, started 2024-12-03, CVE-2024-50623, CVE-2024-55956
- [Palo Alto PAN-OS management interface auth bypass + privilege escalation](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474) ([json](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json)): critical, closed, patched, started 2024-11-18, CVE-2024-0012, CVE-2024-9474
- [Microsoft November 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039) ([json](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json)): high, closed, patched, started 2024-11-12, CVE-2024-43451, CVE-2024-49039
- [FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)](https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575) ([json](https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575.json)): critical, closed, patched, started 2024-10-23, CVE-2024-47575
- [Microsoft October 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573) ([json](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json)): high, closed, patched, started 2024-10-08, CVE-2024-43572, CVE-2024-43573
- [Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380) ([json](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json)): critical, closed, patched, started 2024-09-10, CVE-2024-8190, CVE-2024-8963, CVE-2024-9379…
- [Microsoft September 2024: 3 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more) ([json](https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more.json)): high, closed, patched, started 2024-09-10, CVE-2024-38014, CVE-2024-38217, CVE-2024-38226
- [Microsoft August 2024: 6 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more) ([json](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json)): high, closed, patched, started 2024-08-13, CVE-2024-38106, CVE-2024-38107, CVE-2024-38178…
- [Microsoft July 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112) ([json](https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112.json)): high, closed, patched, started 2024-07-09, CVE-2024-38080, CVE-2024-38112
- [Microsoft May 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051) ([json](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json)): high, closed, patched, started 2024-05-14, CVE-2024-30040, CVE-2024-30051
- [Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign](https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359) ([json](https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json)): high, closed, patched, started 2024-04-24, CVE-2024-20353, CVE-2024-20359
- [Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)](https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400) ([json](https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400.json)): critical, closed, patched, started 2024-04-12, CVE-2024-3400
- [Microsoft February 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412) ([json](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json)): high, closed, patched, started 2024-02-13, CVE-2024-21351, CVE-2024-21412
- [Ivanti Connect Secure zero-days chained for mass VPN compromise](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json)): critical, closed, patched, started 2024-01-10, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893
- [Citrix Bleed: NetScaler session token leak (CVE-2023-4966)](https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966) ([json](https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json)): critical, closed, patched, started 2023-10-10, CVE-2023-4966
- [Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)](https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515) ([json](https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json)): critical, closed, patched, started 2023-10-04, CVE-2023-22515
- [Cisco IOS XE web UI zero-days: implants on tens of thousands of devices](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198) ([json](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json)): critical, closed, patched, started 2023-09-18, CVE-2023-20198, CVE-2023-20273
- [libwebp heap overflow exploited in the wild (CVE-2023-4863)](https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863) ([json](https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json)): high, closed, patched, started 2023-09-11, CVE-2023-4863
- [BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)](https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061) ([json](https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061.json)): high, closed, patched, started 2023-09-07, CVE-2023-41064, CVE-2023-41061
- [WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)](https://pwn.watch/i/winrar-zero-day-cve-2023-38831) ([json](https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json)): high, closed, patched, started 2023-08-02, CVE-2023-38831
- [Ivanti EPMM zero-days used to breach 12 Norwegian ministries](https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078) ([json](https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json)): critical, closed, patched, started 2023-07-24, CVE-2023-35078, CVE-2023-35081
- [NetScaler ADC/Gateway unauthenticated RCE (CVE-2023-3519)](https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519) ([json](https://pwn.watch/i/citrix-netscaler-rce-cve-2023-3519.json)): critical, closed, patched, started 2023-07-18, CVE-2023-3519
- [Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones](https://pwn.watch/i/operation-triangulation-ios-zero-click-2023) ([json](https://pwn.watch/i/operation-triangulation-ios-zero-click-2023.json)): high, closed, patched, started 2023-06-01, CVE-2023-32434, CVE-2023-32435, CVE-2023-38606
- [MOVEit Transfer zero-day: Cl0p mass data theft](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023) ([json](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json)): critical, closed, patched, started 2023-05-27, CVE-2023-34362, CVE-2023-35036, CVE-2023-35708
- [Barracuda Email Security Gateway zero-day (CVE-2023-2868)](https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868) ([json](https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json)): critical, closed, patched, started 2023-05-18, CVE-2023-2868
- [Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)](https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397) ([json](https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397.json)): critical, closed, patched, started 2023-03-14, CVE-2023-23397
- [Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims](https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669) ([json](https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json)): high, closed, patched, started 2023-02-01, CVE-2023-0669