{ "generated": "2026-10-04T20:30:38+00:00", "source": "https://threat-intelligence.redeyesecurity.com", "cves": [ { "cve_id": "CVE-2026-104286", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ta419-ai-policy-experts-microsoft-aitm-phishing-2026.html", "post_title": "China-Aligned TA419 Targets U.S. AI Policy Experts With Frameless BitB Microsoft AitM Phishing", "post_published": "2026-10-04", "description": "Proofpoint reports that TA419, a China-aligned espionage group, impersonated an Anthropic employee and a former White House OSTP official to phish U.S. AI policy experts. The kit combines a Frameless browser-in-the-browser page with an adversary-in-the-middle proxy. It captures Microsoft session cookies while the victim", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-104286" ] }, { "cve_id": "CVE-2026-94127", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-94127" ] }, { "cve_id": "CVE-2026-93952", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-93952" ] }, { "cve_id": "CVE-2026-93616", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-93616" ] }, { "cve_id": "CVE-2026-88772", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-88772" ] }, { "cve_id": "CVE-2026-88771", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-88771" ] }, { "cve_id": "CVE-2026-87902", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87902" ] }, { "cve_id": "CVE-2026-85102", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-85102" ] }, { "cve_id": "CVE-2026-76504", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortimail-zero-day-cve-2026-104286-2026.html", "post_title": "FortiMail Zero-Day CVE-2026-104286 Exploited Before Any Patch Ships", "post_published": "2026-10-02", "description": "Attackers are exploiting a CVSS 9.8 FortiMail flaw that lets unauthenticated requests write arbitrary files to the appliance. Every fixed build is still listed as upcoming, so the only protection available now is Fortinet", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76504" ] }, { "cve_id": "CVE-2025-53771", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/warlock-ransomware-sharepoint-toolshell-water-telecom-2026.html", "post_title": "Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom", "post_published": "2026-10-02", "description": "The China-linked Warlock ransomware group, which Symantec tracks as Longlegs, got into a water utility, a telecom provider, a regional government body and a university through ToolShell SharePoint flaws that Microsoft patched in July 2025. In one intrusion the attackers disabled security tools on at least 40 hosts in about two hours and encrypted 33.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-53771" ] }, { "cve_id": "CVE-2025-53770", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/warlock-ransomware-sharepoint-toolshell-water-telecom-2026.html", "post_title": "Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom", "post_published": "2026-10-02", "description": "The China-linked Warlock ransomware group, which Symantec tracks as Longlegs, got into a water utility, a telecom provider, a regional government body and a university through ToolShell SharePoint flaws that Microsoft patched in July 2025. In one intrusion the attackers disabled security tools on at least 40 hosts in about two hours and encrypted 33.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-53770" ] }, { "cve_id": "CVE-2025-49706", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/warlock-ransomware-sharepoint-toolshell-water-telecom-2026.html", "post_title": "Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom", "post_published": "2026-10-02", "description": "The China-linked Warlock ransomware group, which Symantec tracks as Longlegs, got into a water utility, a telecom provider, a regional government body and a university through ToolShell SharePoint flaws that Microsoft patched in July 2025. In one intrusion the attackers disabled security tools on at least 40 hosts in about two hours and encrypted 33.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-49706" ] }, { "cve_id": "CVE-2025-49704", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/warlock-ransomware-sharepoint-toolshell-water-telecom-2026.html", "post_title": "Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom", "post_published": "2026-10-02", "description": "The China-linked Warlock ransomware group, which Symantec tracks as Longlegs, got into a water utility, a telecom provider, a regional government body and a university through ToolShell SharePoint flaws that Microsoft patched in July 2025. In one intrusion the attackers disabled security tools on at least 40 hosts in about two hours and encrypted 33.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-49704" ] }, { "cve_id": "CVE-2025-1055", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/warlock-ransomware-sharepoint-toolshell-water-telecom-2026.html", "post_title": "Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom", "post_published": "2026-10-02", "description": "The China-linked Warlock ransomware group, which Symantec tracks as Longlegs, got into a water utility, a telecom provider, a regional government body and a university through ToolShell SharePoint flaws that Microsoft patched in July 2025. In one intrusion the attackers disabled security tools on at least 40 hosts in about two hours and encrypted 33.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-1055" ] }, { "cve_id": "CVE-2026-48842", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-sd-wan-manager-cve-2026-76504-auth-bypass-2026.html", "post_title": "Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Grants Unauthenticated Admin API Access", "post_published": "2026-09-30", "description": "Attackers are exploiting CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager that lets an unauthenticated remote attacker use the API as the admin user. Cisco has shipped fixed releases across six release trains and says there is no workaround. Managers patched for the May and June SD-WAN flaws are still vulnerable.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-48842" ] }, { "cve_id": "CVE-2026-20262", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-sd-wan-manager-cve-2026-76504-auth-bypass-2026.html", "post_title": "Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Grants Unauthenticated Admin API Access", "post_published": "2026-09-30", "description": "Attackers are exploiting CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager that lets an unauthenticated remote attacker use the API as the admin user. Cisco has shipped fixed releases across six release trains and says there is no workaround. Managers patched for the May and June SD-WAN flaws are still vulnerable.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20262" ] }, { "cve_id": "CVE-2026-20245", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-sd-wan-manager-cve-2026-76504-auth-bypass-2026.html", "post_title": "Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Grants Unauthenticated Admin API Access", "post_published": "2026-09-30", "description": "Attackers are exploiting CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager that lets an unauthenticated remote attacker use the API as the admin user. Cisco has shipped fixed releases across six release trains and says there is no workaround. Managers patched for the May and June SD-WAN flaws are still vulnerable.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20245" ] }, { "cve_id": "CVE-2026-20182", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-sd-wan-manager-cve-2026-76504-auth-bypass-2026.html", "post_title": "Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Grants Unauthenticated Admin API Access", "post_published": "2026-09-30", "description": "Attackers are exploiting CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager that lets an unauthenticated remote attacker use the API as the admin user. Cisco has shipped fixed releases across six release trains and says there is no workaround. Managers patched for the May and June SD-WAN flaws are still vulnerable.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20182" ] }, { "cve_id": "CVE-2013-4786", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/french-tax-dgfip-stolen-passwords-breach-2026.html", "post_title": "Stolen Passwords, No Alarms: How France's Tax Agency Lost Data on 600,000 Taxpayers and Businesses", "post_published": "2026-09-29", "description": "An attacker used several dozen stolen staff passwords to take data from France", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2013-4786" ] }, { "cve_id": "CVE-2026-35273", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/dutch-police-arrest-reformed-hacker-shinyhunters-2026.html", "post_title": "A 'Reformed' Hacker's Arrest, and the ShinyHunters Rampage That Followed", "post_published": "2026-09-28", "description": "Dutch authorities have reportedly detained Pepijn van der Stap, a convicted extortionist who most recently worked as an offensive security lead, in the ShinyHunters investigation. Within days, the group claimed a breach of the FBI", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-35273" ] }, { "cve_id": "CVE-2026-19490", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/citrix-netscaler-two-unpatched-rce-zero-days-2026.html", "post_title": "Two Unpatched Citrix NetScaler RCE Zero-Days Exploited in the Wild: No Patch, No IoCs, No Bulletin", "post_published": "2026-09-27", "description": "watchTowr says two unpatched remote code execution flaws in Citrix NetScaler ADC and Gateway were exploited before any fix existed. Citrix has published nothing, there are no indicators of compromise, and some administrators have already powered their appliances off. Here is what to do before the patch lands.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-19490" ] }, { "cve_id": "CVE-2025-68461", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/roundcube-cve-2026-48842-virtuser-query-sqli-exploited-2026.html", "post_title": "Roundcube CVE-2026-48842: Pre-Auth SQL Injection in virtuser_query Now Exploited", "post_published": "2026-09-25", "description": "The Canadian Centre for Cyber Security says CVE-2026-48842, a pre-authentication SQL injection in Roundcube", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-68461" ] }, { "cve_id": "CVE-2025-49113", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/roundcube-cve-2026-48842-virtuser-query-sqli-exploited-2026.html", "post_title": "Roundcube CVE-2026-48842: Pre-Auth SQL Injection in virtuser_query Now Exploited", "post_published": "2026-09-25", "description": "The Canadian Centre for Cyber Security says CVE-2026-48842, a pre-authentication SQL injection in Roundcube", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-49113" ] }, { "cve_id": "CVE-2025-53521", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/f5-big-ip-apm-oauth-zero-day-cve-2026-94127-2026.html", "post_title": "F5 BIG-IP APM OAuth Servers Under Active Attack: CVE-2026-94127 Gives Unauthenticated RCE", "post_published": "2026-09-23", "description": "Attackers are running code on F5 BIG-IP systems without credentials by sending crafted traffic to virtual servers where APM acts as an OAuth authorization server. F5 rates CVE-2026-94127 at 9.8 out of 10, CISA added it to KEV the same day it was disclosed, and locking down the management interface does not help. Engineering hotfixes exist for the 21.1, 17.5 and 17.1 branches.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-53521" ] }, { "cve_id": "CVE-2026-91843", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/check-point-management-server-zero-day-cve-2026-93616.html", "post_title": "Check Point Management Server Zero-Day: 61 Days From Exploit to Fix", "post_published": "2026-09-22", "description": "Attackers ran unauthenticated code on Check Point Security Management Servers on July 23 using CVE-2026-93616, a 9.8 path traversal bug that Check Point only patched on September 22. A second flaw, CVE-2026-85102, is under active exploitation attempts against Spark firewalls. Version math means servers patched three weeks ago are still exposed.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-91843" ] }, { "cve_id": "CVE-2026-85103", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/check-point-management-server-zero-day-cve-2026-93616.html", "post_title": "Check Point Management Server Zero-Day: 61 Days From Exploit to Fix", "post_published": "2026-09-22", "description": "Attackers ran unauthenticated code on Check Point Security Management Servers on July 23 using CVE-2026-93616, a 9.8 path traversal bug that Check Point only patched on September 22. A second flaw, CVE-2026-85102, is under active exploitation attempts against Spark firewalls. Version math means servers patched three weeks ago are still exposed.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-85103" ] }, { "cve_id": "CVE-2026-76460", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/check-point-management-server-zero-day-cve-2026-93616.html", "post_title": "Check Point Management Server Zero-Day: 61 Days From Exploit to Fix", "post_published": "2026-09-22", "description": "Attackers ran unauthenticated code on Check Point Security Management Servers on July 23 using CVE-2026-93616, a 9.8 path traversal bug that Check Point only patched on September 22. A second flaw, CVE-2026-85102, is under active exploitation attempts against Spark firewalls. Version math means servers patched three weeks ago are still exposed.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76460" ] }, { "cve_id": "CVE-2026-81000", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-81000" ] }, { "cve_id": "CVE-2026-80844", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-80844" ] }, { "cve_id": "CVE-2026-74469", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-74469" ] }, { "cve_id": "CVE-2026-68121", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-68121" ] }, { "cve_id": "CVE-2026-53266", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-53266" ] }, { "cve_id": "CVE-2025-61882", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/shinyhunters-hacks-clop-leak-site-grav-cms-2026.html", "post_title": "ShinyHunters Rooted Clop's Leak Site Through Grav CMS, and Now Wants to Extort the Extortionists", "post_published": "2026-09-20", "description": "On September 19, 2026, ShinyHunters defaced Clop", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-61882" ] }, { "cve_id": "CVE-2025-39964", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-39964" ] }, { "cve_id": "CVE-2025-39682", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-three-linux-kernel-flaws-exploited-2026.html", "post_title": "CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two Days to Patch", "post_published": "2026-09-20", "description": "CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026, with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-39682" ] }, { "cve_id": "CVE-2026-85706", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-85706" ] }, { "cve_id": "CVE-2026-76461", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76461" ] }, { "cve_id": "CVE-2026-76428", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76428" ] }, { "cve_id": "CVE-2026-76424", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76424" ] }, { "cve_id": "CVE-2026-76423", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76423" ] }, { "cve_id": "CVE-2026-76420", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76420" ] }, { "cve_id": "CVE-2026-76413", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76413" ] }, { "cve_id": "CVE-2026-76412", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-76412" ] }, { "cve_id": "CVE-2026-20336", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20336" ] }, { "cve_id": "CVE-2026-20329", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20329" ] }, { "cve_id": "CVE-2026-20326", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20326" ] }, { "cve_id": "CVE-2026-20325", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20325" ] }, { "cve_id": "CVE-2026-20322", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20322" ] }, { "cve_id": "CVE-2026-20306", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20306" ] }, { "cve_id": "CVE-2026-20305", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20305" ] }, { "cve_id": "CVE-2026-20237", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20237" ] }, { "cve_id": "CVE-2026-20234", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20234" ] }, { "cve_id": "CVE-2026-20192", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20192" ] }, { "cve_id": "CVE-2026-20176", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20176" ] }, { "cve_id": "CVE-2026-20130", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-ise-zero-day-cve-2026-76460-auth-bypass-2026.html", "post_title": "Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine", "post_published": "2026-09-18", "description": "Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine that ends in root command execution. CISA added it to the KEV catalog on September 16, 2026 with a September 19 federal deadline. There is no workaround, and Cisco says attackers at this privilege level can erase the evidence.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20130" ] }, { "cve_id": "CVE-2026-87491", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-secure-email-gateway-cve-2026-76461-root-rce-2026.html", "post_title": "Cisco Secure Email Gateway: One Crafted Email Gives Root, and It Is Already Being Exploited", "post_published": "2026-09-16", "description": "CVE-2026-76461 scores 9.8 and turns a single inbound email into unauthenticated root command execution on Cisco Secure Email Gateway. Cisco confirmed in-the-wild exploitation, CISA set a September 17, 2026 federal deadline, and there is no workaround other than upgrading. Here is the hunt command, the fixed builds, and what to do if the grep returns a hit.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] }, { "cve_id": "CVE-2026-82329", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/artifactory-auth-bypass-chain-rust-backdoor-2026.html", "post_title": "Three Artifactory Auth Bypasses Chained: Anonymous Token to Admin in Under Five Minutes", "post_published": "2026-09-14", "description": "Attackers chained CVE-2026-42018 and CVE-2026-42016 against internet-facing JFrog Artifactory between August 15 and September 8, 2026, forging admin tokens, installing malicious Groovy plugins, and dropping a custom Rust backdoor. Wiz and watchTowr found that 49 to 62 percent of internet-reachable Artifactory instances were vulnerable to at least one of the three flaws. CISA added all three to the KEV catalog.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-82329" ] }, { "cve_id": "CVE-2026-42018", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/artifactory-auth-bypass-chain-rust-backdoor-2026.html", "post_title": "Three Artifactory Auth Bypasses Chained: Anonymous Token to Admin in Under Five Minutes", "post_published": "2026-09-14", "description": "Attackers chained CVE-2026-42018 and CVE-2026-42016 against internet-facing JFrog Artifactory between August 15 and September 8, 2026, forging admin tokens, installing malicious Groovy plugins, and dropping a custom Rust backdoor. Wiz and watchTowr found that 49 to 62 percent of internet-reachable Artifactory instances were vulnerable to at least one of the three flaws. CISA added all three to the KEV catalog.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42018" ] }, { "cve_id": "CVE-2026-42016", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/artifactory-auth-bypass-chain-rust-backdoor-2026.html", "post_title": "Three Artifactory Auth Bypasses Chained: Anonymous Token to Admin in Under Five Minutes", "post_published": "2026-09-14", "description": "Attackers chained CVE-2026-42018 and CVE-2026-42016 against internet-facing JFrog Artifactory between August 15 and September 8, 2026, forging admin tokens, installing malicious Groovy plugins, and dropping a custom Rust backdoor. Wiz and watchTowr found that 49 to 62 percent of internet-reachable Artifactory instances were vulnerable to at least one of the three flaws. CISA added all three to the KEV catalog.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42016" ] }, { "cve_id": "CVE-2026-87719", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-85706-preauth-file-read-2026.html", "post_title": "GitLab CVE-2026-85706: A CVSS 10.0 Pre-Auth File Read With a Three Day Patch Window", "post_published": "2026-09-12", "description": "GitLab patched a CVSS 10.0 path traversal in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed servers. watchTowr recorded in-the-wild probes starting at 06:00 UTC on September 11, 2026, hours after disclosure, and CISA added the bug to KEV the same day with a September 14 federal deadline. Fixed in 19.3.2, 19.2.6 and 19.1.8.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87719" ] }, { "cve_id": "CVE-2026-19478", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-85706-preauth-file-read-2026.html", "post_title": "GitLab CVE-2026-85706: A CVSS 10.0 Pre-Auth File Read With a Three Day Patch Window", "post_published": "2026-09-12", "description": "GitLab patched a CVSS 10.0 path traversal in the repository commits API that lets an unauthenticated attacker read arbitrary files from self-managed servers. watchTowr recorded in-the-wild probes starting at 06:00 UTC on September 11, 2026, hours after disclosure, and CISA added the bug to KEV the same day with a September 14 federal deadline. Fixed in 19.3.2, 19.2.6 and 19.1.8.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-19478" ] }, { "cve_id": "CVE-2026-85880", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-85880" ] }, { "cve_id": "CVE-2026-81963", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-81963" ] }, { "cve_id": "CVE-2026-80097", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-80097" ] }, { "cve_id": "CVE-2026-72979", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-72979" ] }, { "cve_id": "CVE-2026-69829", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-69829" ] }, { "cve_id": "CVE-2026-69730", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-69730" ] }, { "cve_id": "CVE-2026-69595", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-69595" ] }, { "cve_id": "CVE-2026-69525", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-69525" ] }, { "cve_id": "CVE-2026-69465", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-69465" ] }, { "cve_id": "CVE-2026-65669", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-65669" ] }, { "cve_id": "CVE-2026-55007", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55007" ] }, { "cve_id": "CVE-2023-21674", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-974-flaws-two-windows-zero-days-2026.html", "post_title": "Microsoft Patches 974 Flaws in One Day, Two Windows Zero-Days Already Exploited", "post_published": "2026-09-11", "description": "September 2026 Patch Tuesday is the largest on record: 974 Microsoft CVEs, 999 counting third-party fixes shipped through the same channel. Two Windows local privilege escalation bugs, CVE-2026-85880 in ALPC and CVE-2026-81963 in the Windows Update Stack, are under active exploitation and now carry a CISA KEV deadline of September 22, 2026. Here is the triage order and the commands to run tonight.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-21674" ] }, { "cve_id": "CVE-2026-87639", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87639" ] }, { "cve_id": "CVE-2026-87628", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87628" ] }, { "cve_id": "CVE-2026-87527", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87527" ] }, { "cve_id": "CVE-2026-87488", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87488" ] }, { "cve_id": "CVE-2026-87464", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87464" ] }, { "cve_id": "CVE-2026-87438", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-87438" ] }, { "cve_id": "CVE-2026-85046", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bluemoon-exploit-kit-chrome-windows-four-apt-groups-2026.html", "post_title": "Four Espionage Groups Adopted the Same Chrome and Windows Exploit Kit in Six Days", "post_published": "2026-09-09", "description": "Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running the same kit by September 3. Two of the three vulnerabilities were patch-gap zero-days, fixed in public Chromium source before they reached stable Chrome.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-85046" ] }, { "cve_id": "CVE-2026-60004", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bluemoon-exploit-kit-chrome-windows-four-apt-groups-2026.html", "post_title": "Four Espionage Groups Adopted the Same Chrome and Windows Exploit Kit in Six Days", "post_published": "2026-09-09", "description": "Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running the same kit by September 3. Two of the three vulnerabilities were patch-gap zero-days, fixed in public Chromium source before they reached stable Chrome.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-60004" ] }, { "cve_id": "CVE-2026-5281", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-5281" ] }, { "cve_id": "CVE-2026-3910", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-3910" ] }, { "cve_id": "CVE-2026-3909", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-3909" ] }, { "cve_id": "CVE-2026-2441", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-2441" ] }, { "cve_id": "CVE-2026-11645", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-v8-zero-day-cve-2026-87491-2026.html", "post_title": "Chrome V8 Zero-Day CVE-2026-87491 Is Being Exploited: Patch to 153.0.8010.36", "post_published": "2026-09-09", "description": "Google shipped fixes for 230 Chrome flaws, including CVE-2026-87491, an out-of-bounds write in the V8 engine that is already under active exploitation. A crafted HTML page gives an attacker code execution inside the renderer sandbox. Safe builds are 153.0.8010.36 and .37, and this is the seventh exploited Chrome zero-day of 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-11645" ] }, { "cve_id": "CVE-2023-49105", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bluemoon-exploit-kit-chrome-windows-four-apt-groups-2026.html", "post_title": "Four Espionage Groups Adopted the Same Chrome and Windows Exploit Kit in Six Days", "post_published": "2026-09-09", "description": "Proofpoint documented BlueMoon, an exploit kit that chains two Google Chrome V8 bugs with a Windows ALPC privilege escalation flaw. APT31 fired it first on August 28, 2026, and three more espionage clusters were running the same kit by September 3. Two of the three vulnerabilities were patch-gap zero-days, fixed in public Chromium source before they reached stable Chrome.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-49105" ] }, { "cve_id": "CVE-2026-75650", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/stylesmuggler-magento-zero-day-cve-2026-75650.html", "post_title": "StyleSmuggler: Magento Zero-Day CVE-2026-75650 Drops a Rust Backdoor and a PHP Web Shell", "post_published": "2026-09-08", "description": "Adobe patched a CVSS 10.0 unauthenticated RCE in Adobe Commerce and Magento Open Source that attackers had been exploiting since September 4, 2026. One managed store was compromised 50 minutes after the first confirmed exploitation. Patching is only half the job: Adobe also requires an encryption key rotation.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] }, { "cve_id": "CVE-2026-72718", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/malicious-git-config-ai-coding-agent-rce-2026.html", "post_title": "Malicious .git Configs Turn Claude Code, Codex, and Cursor Into Attacker Shells", "post_published": "2026-09-03", "description": "Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-72718" ] }, { "cve_id": "CVE-2026-71963", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/malicious-git-config-ai-coding-agent-rce-2026.html", "post_title": "Malicious .git Configs Turn Claude Code, Codex, and Cursor Into Attacker Shells", "post_published": "2026-09-03", "description": "Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-71963" ] }, { "cve_id": "CVE-2026-55607", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/malicious-git-config-ai-coding-agent-rce-2026.html", "post_title": "Malicious .git Configs Turn Claude Code, Codex, and Cursor Into Attacker Shells", "post_published": "2026-09-03", "description": "Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55607" ] }, { "cve_id": "CVE-2026-19592", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/malicious-git-config-ai-coding-agent-rce-2026.html", "post_title": "Malicious .git Configs Turn Claude Code, Codex, and Cursor Into Attacker Shells", "post_published": "2026-09-03", "description": "Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-19592" ] }, { "cve_id": "CVE-2022-24346", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/malicious-git-config-ai-coding-agent-rce-2026.html", "post_title": "Malicious .git Configs Turn Claude Code, Codex, and Cursor Into Attacker Shells", "post_published": "2026-09-03", "description": "Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-24346" ] }, { "cve_id": "CVE-2021-43891", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/malicious-git-config-ai-coding-agent-rce-2026.html", "post_title": "Malicious .git Configs Turn Claude Code, Codex, and Cursor Into Attacker Shells", "post_published": "2026-09-03", "description": "Manifold Security disclosed eight flaws across seven command line AI coding agents where a repository", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-43891" ] }, { "cve_id": "CVE-2026-74820", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/servicenow-cvss-10-graphql-sql-injection-2026.html", "post_title": "Three CVSS 10.0 ServiceNow Flaws: Unauthenticated Code Execution and SQL Injection", "post_published": "2026-08-30", "description": "ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite Data API, broken access control in an image upload processor, and SQL injection through a dynamic ORDER BY clause. Hosted instances are already updated; self-hosted customers have to patch themselves.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-74820" ] }, { "cve_id": "CVE-2026-6876", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/servicenow-cvss-10-graphql-sql-injection-2026.html", "post_title": "Three CVSS 10.0 ServiceNow Flaws: Unauthenticated Code Execution and SQL Injection", "post_published": "2026-08-30", "description": "ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite Data API, broken access control in an image upload processor, and SQL injection through a dynamic ORDER BY clause. Hosted instances are already updated; self-hosted customers have to patch themselves.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6876" ] }, { "cve_id": "CVE-2026-6875", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/servicenow-cvss-10-graphql-sql-injection-2026.html", "post_title": "Three CVSS 10.0 ServiceNow Flaws: Unauthenticated Code Execution and SQL Injection", "post_published": "2026-08-30", "description": "ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite Data API, broken access control in an image upload processor, and SQL injection through a dynamic ORDER BY clause. Hosted instances are already updated; self-hosted customers have to patch themselves.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6875" ] }, { "cve_id": "CVE-2026-18886", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/servicenow-cvss-10-graphql-sql-injection-2026.html", "post_title": "Three CVSS 10.0 ServiceNow Flaws: Unauthenticated Code Execution and SQL Injection", "post_published": "2026-08-30", "description": "ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite Data API, broken access control in an image upload processor, and SQL injection through a dynamic ORDER BY clause. Hosted instances are already updated; self-hosted customers have to patch themselves.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-18886" ] }, { "cve_id": "CVE-2026-18885", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/servicenow-cvss-10-graphql-sql-injection-2026.html", "post_title": "Three CVSS 10.0 ServiceNow Flaws: Unauthenticated Code Execution and SQL Injection", "post_published": "2026-08-30", "description": "ServiceNow patched four AI Platform vulnerabilities on August 27, 2026, three of them rated CVSS 10.0 and reachable by an unauthenticated attacker over the network. The set covers code injection in the GraphQL Composite Data API, broken access control in an image upload processor, and SQL injection through a dynamic ORDER BY clause. Hosted instances are already updated; self-hosted customers have to patch themselves.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-18885" ] }, { "cve_id": "CVE-2026-66384", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/owncloud-cve-2023-49105-philippine-nuclear-exfiltration-2026.html", "post_title": "ownCloud Auth Bypass CVE-2023-49105 Used to Exfiltrate 372 MB of Philippine Nuclear Records", "post_published": "2026-08-28", "description": "A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store with BitLocker keys. A second Philippine target, a naval shipbuilding firm, was hit through a LiteSpeed Cache WordPress flaw. CISA added CVE-2023-49105 to the KEV catalog with a federal patch deadline of August 30, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-66384" ] }, { "cve_id": "CVE-2026-53362", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/owncloud-cve-2023-49105-philippine-nuclear-exfiltration-2026.html", "post_title": "ownCloud Auth Bypass CVE-2023-49105 Used to Exfiltrate 372 MB of Philippine Nuclear Records", "post_published": "2026-08-28", "description": "A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store with BitLocker keys. A second Philippine target, a naval shipbuilding firm, was hit through a LiteSpeed Cache WordPress flaw. CISA added CVE-2023-49105 to the KEV catalog with a federal patch deadline of August 30, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-53362" ] }, { "cve_id": "CVE-2026-21962", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/owncloud-cve-2023-49105-philippine-nuclear-exfiltration-2026.html", "post_title": "ownCloud Auth Bypass CVE-2023-49105 Used to Exfiltrate 372 MB of Philippine Nuclear Records", "post_published": "2026-08-28", "description": "A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store with BitLocker keys. A second Philippine target, a naval shipbuilding firm, was hit through a LiteSpeed Cache WordPress flaw. CISA added CVE-2023-49105 to the KEV catalog with a federal patch deadline of August 30, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-21962" ] }, { "cve_id": "CVE-2026-18963", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/papercut-zero-day-exploited-all-ng-mf-versions-2026.html", "post_title": "PaperCut Zero-Day Under Active Exploitation Hits Every NG and MF Version", "post_published": "2026-08-28", "description": "PaperCut confirmed attackers are exploiting an unpatched flaw affecting all versions of PaperCut NG and MF, with confirmed customer compromises already reported. An emergency patch exists only for v25 and v26, and the vendor is telling everyone else to firewall the Application Server off the internet today. There is no CVE yet, but the IOCs point at a database-layer input bug plus deliberate log deletion.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-18963" ] }, { "cve_id": "CVE-2024-28000", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/owncloud-cve-2023-49105-philippine-nuclear-exfiltration-2026.html", "post_title": "ownCloud Auth Bypass CVE-2023-49105 Used to Exfiltrate 372 MB of Philippine Nuclear Records", "post_published": "2026-08-28", "description": "A Chinese-speaking operator chained a 2023 ownCloud WebDAV authentication bypass into 176 stolen files from a Philippine nuclear research body, including reactor component data, fuel inventories, and a credential store with BitLocker keys. A second Philippine target, a naval shipbuilding firm, was hit through a LiteSpeed Cache WordPress flaw. CISA added CVE-2023-49105 to the KEV catalog with a federal patch deadline of August 30, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-28000" ] }, { "cve_id": "CVE-2023-27350", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/papercut-zero-day-exploited-all-ng-mf-versions-2026.html", "post_title": "PaperCut Zero-Day Under Active Exploitation Hits Every NG and MF Version", "post_published": "2026-08-28", "description": "PaperCut confirmed attackers are exploiting an unpatched flaw affecting all versions of PaperCut NG and MF, with confirmed customer compromises already reported. An emergency patch exists only for v25 and v26, and the vendor is telling everyone else to firewall the Application Server off the internet today. There is no CVE yet, but the IOCs point at a database-layer input bug plus deliberate log deletion.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-27350" ] }, { "cve_id": "CVE-2026-75604", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/nextjs-avif-windows-rce-patches-2026.html", "post_title": "Next.js Ships Two Unauthenticated RCE Fixes: Windows Path Traversal and an AVIF Heap Overflow", "post_published": "2026-08-27", "description": "Vercel patched two critical Next.js bugs on August 25, 2026, both ending in unauthenticated remote code execution. CVE-2026-75604 is a CVSS 9.0 path traversal with no workaround on Windows-hosted servers, and a CVSS 9.5 heap overflow in libheif is reachable through AVIF image optimization. Fixed in Next.js 15.5.24 and 16.3.3.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-75604" ] }, { "cve_id": "CVE-2026-1731", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-1731" ] }, { "cve_id": "CVE-2025-31161", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-31161" ] }, { "cve_id": "CVE-2024-9380", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-9380" ] }, { "cve_id": "CVE-2024-8963", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-8963" ] }, { "cve_id": "CVE-2024-8190", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-8190" ] }, { "cve_id": "CVE-2024-24919", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-24919" ] }, { "cve_id": "CVE-2023-22515", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-22515" ] }, { "cve_id": "CVE-2021-44228", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ] }, { "cve_id": "CVE-2021-26855", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-26855" ] }, { "cve_id": "CVE-2020-5902", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-5902" ] }, { "cve_id": "CVE-2019-19781", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2019-19781" ] }, { "cve_id": "CVE-2019-10068", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2019-10068" ] }, { "cve_id": "CVE-2018-13379", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fbi-disrupts-qtfy-qscan-qtrouter-china-orb-2026.html", "post_title": "FBI Pulls the Plug on QTFY: Eight Years of Chinese Contractor Espionage Hidden Behind Your Routers", "post_published": "2026-08-26", "description": "The DoJ disrupted QScan and QTRouter, two platforms run by QTFY, a Chinese state-sponsored crew employed by a Nanjing company that sells to both the MSS and the PLA. Victims include NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate. The infrastructure existed for one reason: to make intrusions look like they came from somewhere other than China.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2018-13379" ] }, { "cve_id": "CVE-2020-2551", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/oracle-weblogic-cve-2026-21962-exploited-kev-2026.html", "post_title": "Oracle WebLogic Proxy Plug-in Flaw Hits CISA KEV: CVSS 10.0, Unauthenticated, Exploited Since February", "post_published": "2026-08-25", "description": "CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline. Oracle patched it in January 2026, but GreyNoise and CloudSEK have tracked exploitation attempts since February. Unauthenticated attackers with HTTP access can read, create, delete, or modify critical data reachable by the proxy tier.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-2551" ] }, { "cve_id": "CVE-2020-14883", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/oracle-weblogic-cve-2026-21962-exploited-kev-2026.html", "post_title": "Oracle WebLogic Proxy Plug-in Flaw Hits CISA KEV: CVSS 10.0, Unauthenticated, Exploited Since February", "post_published": "2026-08-25", "description": "CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline. Oracle patched it in January 2026, but GreyNoise and CloudSEK have tracked exploitation attempts since February. Unauthenticated attackers with HTTP access can read, create, delete, or modify critical data reachable by the proxy tier.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-14883" ] }, { "cve_id": "CVE-2020-14882", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/oracle-weblogic-cve-2026-21962-exploited-kev-2026.html", "post_title": "Oracle WebLogic Proxy Plug-in Flaw Hits CISA KEV: CVSS 10.0, Unauthenticated, Exploited Since February", "post_published": "2026-08-25", "description": "CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline. Oracle patched it in January 2026, but GreyNoise and CloudSEK have tracked exploitation attempts since February. Unauthenticated attackers with HTTP access can read, create, delete, or modify critical data reachable by the proxy tier.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-14882" ] }, { "cve_id": "CVE-2017-10271", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/oracle-weblogic-cve-2026-21962-exploited-kev-2026.html", "post_title": "Oracle WebLogic Proxy Plug-in Flaw Hits CISA KEV: CVSS 10.0, Unauthenticated, Exploited Since February", "post_published": "2026-08-25", "description": "CISA added CVE-2026-21962, a maximum severity access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, to the Known Exploited Vulnerabilities catalog with a three day federal remediation deadline. Oracle patched it in January 2026, but GreyNoise and CloudSEK have tracked exploitation attempts since February. Unauthenticated attackers with HTTP access can read, create, delete, or modify critical data reachable by the proxy tier.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2017-10271" ] }, { "cve_id": "CVE-2026-69836", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/keycloak-cve-2026-18963-password-reset-account-takeover-2026.html", "post_title": "Keycloak CVE-2026-18963: Unauthenticated Password Reset Hands Over Any Account, Including Admins", "post_published": "2026-08-24", "description": "A CVSS 9.1 state validation bug in Keycloak", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-69836" ] }, { "cve_id": "CVE-2026-61979", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/miniorange-saml-sso-auth-bypass-exploited-2026.html", "post_title": "miniOrange SAML SSO Auth Bypass Chained in Live WordPress Attacks", "post_published": "2026-08-24", "description": "Attackers are chaining CVE-2026-61979 and CVE-2026-15981 in the miniOrange SAML 2.0 Single Sign On plugin for WordPress to forge SAML responses and log in as administrators. Fixes shipped in July, but the vendor advisory covered only the free edition, leaving roughly 30,000 paying customers unaware. Patchstack has confirmed at least one successful admin session hijack and scanning from six IP addresses.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-61979" ] }, { "cve_id": "CVE-2026-15981", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/miniorange-saml-sso-auth-bypass-exploited-2026.html", "post_title": "miniOrange SAML SSO Auth Bypass Chained in Live WordPress Attacks", "post_published": "2026-08-24", "description": "Attackers are chaining CVE-2026-61979 and CVE-2026-15981 in the miniOrange SAML 2.0 Single Sign On plugin for WordPress to forge SAML responses and log in as administrators. Fixes shipped in July, but the vendor advisory covered only the free edition, leaving roughly 30,000 paying customers unaware. Patchstack has confirmed at least one successful admin session hijack and scanning from six IP addresses.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-15981" ] }, { "cve_id": "CVE-2026-15571", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/keycloak-cve-2026-18963-password-reset-account-takeover-2026.html", "post_title": "Keycloak CVE-2026-18963: Unauthenticated Password Reset Hands Over Any Account, Including Admins", "post_published": "2026-08-24", "description": "A CVSS 9.1 state validation bug in Keycloak", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-15571" ] }, { "cve_id": "CVE-2026-73570", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-19478-active-exploitation-2026.html", "post_title": "GitLab CVE-2026-19478 Exploited in the Wild Days After Disclosure", "post_published": "2026-08-22", "description": "A CVSS 9.4 code injection in GitLab", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-73570" ] }, { "cve_id": "CVE-2026-58231", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-19478-active-exploitation-2026.html", "post_title": "GitLab CVE-2026-19478 Exploited in the Wild Days After Disclosure", "post_published": "2026-08-22", "description": "A CVSS 9.4 code injection in GitLab", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-58231" ] }, { "cve_id": "CVE-2019-6693", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortitool-fortios-firmware-config-secret-decryption-2026.html", "post_title": "A Hardcoded FortiOS Key From 2019 Was Still Decrypting Secrets in 7.2.3", "post_published": "2026-08-22", "description": "fortitool, an open-source FortiOS firmware decryption tool, documents that the CVE-2019-6693 hardcoded config-backup key stayed live years longer than believed, and publishes the AES-256 key that replaced it in 7.4. Treat a FortiOS config backup as plaintext.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2019-6693" ] }, { "cve_id": "CVE-2026-68820", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/entra-id-cve-2026-69836-cvss-10-exploited-2026.html", "post_title": "Entra ID RCE at CVSS 10.0 Was Exploited Before Anyone Outside Microsoft Knew It Existed", "post_published": "2026-08-21", "description": "Microsoft confirmed that CVE-2026-69836, a deserialization flaw in Entra ID scoring a perfect 10.0, was exploited in the wild before disclosure. The company says it is fully mitigated and no customer action is required, but it has published no exploitation window, no indicators, and no impact assessment. Here is what defenders can actually do with an advisory that gives them nothing to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-68820" ] }, { "cve_id": "CVE-2026-64849", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/entra-id-cve-2026-69836-cvss-10-exploited-2026.html", "post_title": "Entra ID RCE at CVSS 10.0 Was Exploited Before Anyone Outside Microsoft Knew It Existed", "post_published": "2026-08-21", "description": "Microsoft confirmed that CVE-2026-69836, a deserialization flaw in Entra ID scoring a perfect 10.0, was exploited in the wild before disclosure. The company says it is fully mitigated and no customer action is required, but it has published no exploitation window, no indicators, and no impact assessment. Here is what defenders can actually do with an advisory that gives them nothing to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-64849" ] }, { "cve_id": "CVE-2021-24092", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/defender-btr-sys-boot-driver-abuse-2026.html", "post_title": "Defender's Own BTR.sys Driver Can Delete Your EDR During Boot", "post_published": "2026-08-21", "description": "Check Point Research showed how Microsoft Defender", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-24092" ] }, { "cve_id": "CVE-2025-66376", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/zimbra-snmp-rce-cve-2026-73570-exploited-2026.html", "post_title": "Unauthenticated RCE in Zimbra: CVE-2026-73570 Is Being Exploited Through SMTP", "post_published": "2026-08-20", "description": "CERT Polska confirmed active exploitation of CVE-2026-73570, a CVSS 8.9 command injection flaw that gives unauthenticated attackers code execution on Zimbra Collaboration servers running the optional zimbra-snmp package. The trigger arrives over SMTP, the one port a mail server cannot close. Zimbra fixed it in 10.1.20; anything older with SNMP notifications enabled is a live target.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-66376" ] }, { "cve_id": "CVE-2026-65400", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-macos-sharepoint-vcenter-ike-active-exploitation-2026.html", "post_title": "Four CVEs, One Deadline: CISA Flags macOS, SharePoint, vCenter, and IKE Bugs Under Active Attack", "post_published": "2026-08-19", "description": "CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus APT, and at least one Babuk-derived ransomware deployment. Federal agencies have until August 21, 2026 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-65400" ] }, { "cve_id": "CVE-2026-59310", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-macos-sharepoint-vcenter-ike-active-exploitation-2026.html", "post_title": "Four CVEs, One Deadline: CISA Flags macOS, SharePoint, vCenter, and IKE Bugs Under Active Attack", "post_published": "2026-08-19", "description": "CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus APT, and at least one Babuk-derived ransomware deployment. Federal agencies have until August 21, 2026 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-59310" ] }, { "cve_id": "CVE-2026-55040", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-macos-sharepoint-vcenter-ike-active-exploitation-2026.html", "post_title": "Four CVEs, One Deadline: CISA Flags macOS, SharePoint, vCenter, and IKE Bugs Under Active Attack", "post_published": "2026-08-19", "description": "CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus APT, and at least one Babuk-derived ransomware deployment. Federal agencies have until August 21, 2026 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55040" ] }, { "cve_id": "CVE-2026-33824", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-macos-sharepoint-vcenter-ike-active-exploitation-2026.html", "post_title": "Four CVEs, One Deadline: CISA Flags macOS, SharePoint, vCenter, and IKE Bugs Under Active Attack", "post_published": "2026-08-19", "description": "CISA added four vulnerabilities rated 9.1 and higher to the KEV catalog, all confirmed exploited in the wild. The vCenter path traversal flaw alone has been tied to 361 victim IPs in 47 countries, a suspected China-nexus APT, and at least one Babuk-derived ransomware deployment. Federal agencies have until August 21, 2026 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-33824" ] }, { "cve_id": "CVE-2026-25939", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026.html", "post_title": "MLflow SSRF Bug Is Being Exploited to Loot Cloud Metadata Credentials Hours After Disclosure", "post_published": "2026-08-18", "description": "Attackers began scanning for exposed MLflow Tracking Servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and are already pulling cloud credentials out of internal metadata endpoints. A second flaw, CVE-2026-25895 in FUXA SCADA/HMI, is drawing internet-wide scanning against roughly 60 exposed installs. Both are unauthenticated, both rate above CVSS 9, and both sit in infrastructure that security teams rarely inventory.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-25939" ] }, { "cve_id": "CVE-2026-25895", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026.html", "post_title": "MLflow SSRF Bug Is Being Exploited to Loot Cloud Metadata Credentials Hours After Disclosure", "post_published": "2026-08-18", "description": "Attackers began scanning for exposed MLflow Tracking Servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and are already pulling cloud credentials out of internal metadata endpoints. A second flaw, CVE-2026-25895 in FUXA SCADA/HMI, is drawing internet-wide scanning against roughly 60 exposed installs. Both are unauthenticated, both rate above CVSS 9, and both sit in infrastructure that security teams rarely inventory.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-25895" ] }, { "cve_id": "CVE-2023-33831", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/mlflow-ssrf-cve-2026-64849-cloud-credential-theft-2026.html", "post_title": "MLflow SSRF Bug Is Being Exploited to Loot Cloud Metadata Credentials Hours After Disclosure", "post_published": "2026-08-18", "description": "Attackers began scanning for exposed MLflow Tracking Servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and are already pulling cloud credentials out of internal metadata endpoints. A second flaw, CVE-2026-25895 in FUXA SCADA/HMI, is drawing internet-wide scanning against roughly 60 exposed installs. Both are unauthenticated, both rate above CVSS 9, and both sit in infrastructure that security teams rarely inventory.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-33831" ] }, { "cve_id": "CVE-2026-59309", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/china-nexus-vcenter-cve-2026-59310-babuk-ransomware-2026.html", "post_title": "China-Nexus APT Turns vCenter CVE-2026-59310 Into 361 Ransomware Footholds in 47 Countries", "post_published": "2026-08-17", "description": "A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA syslog server to plant cron jobs, deploys a WebSocket backdoor called linuxFile, and ends in Babuk-derived ransomware. Broadcom patched on July 29, 2026, and a second flaw, CVE-2026-59309, is being exploited on the same appliances.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-59309" ] }, { "cve_id": "CVE-2026-20316", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/china-nexus-vcenter-cve-2026-59310-babuk-ransomware-2026.html", "post_title": "China-Nexus APT Turns vCenter CVE-2026-59310 Into 361 Ransomware Footholds in 47 Countries", "post_published": "2026-08-17", "description": "A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA syslog server to plant cron jobs, deploys a WebSocket backdoor called linuxFile, and ends in Babuk-derived ransomware. Broadcom patched on July 29, 2026, and a second flaw, CVE-2026-59309, is being exploited on the same appliances.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20316" ] }, { "cve_id": "CVE-2026-16812", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/china-nexus-vcenter-cve-2026-59310-babuk-ransomware-2026.html", "post_title": "China-Nexus APT Turns vCenter CVE-2026-59310 Into 361 Ransomware Footholds in 47 Countries", "post_published": "2026-08-17", "description": "A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA syslog server to plant cron jobs, deploys a WebSocket backdoor called linuxFile, and ends in Babuk-derived ransomware. Broadcom patched on July 29, 2026, and a second flaw, CVE-2026-59309, is being exploited on the same appliances.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-16812" ] }, { "cve_id": "CVE-2026-16723", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/china-nexus-vcenter-cve-2026-59310-babuk-ransomware-2026.html", "post_title": "China-Nexus APT Turns vCenter CVE-2026-59310 Into 361 Ransomware Footholds in 47 Countries", "post_published": "2026-08-17", "description": "A suspected Chinese-speaking APT began exploiting a CVSS 9.8 directory-traversal flaw in VMware vCenter five days after public disclosure, compromising 361 unique victim IPs across 47 countries. The chain abuses the vCSA syslog server to plant cron jobs, deploys a WebSocket backdoor called linuxFile, and ends in Babuk-derived ransomware. Broadcom patched on July 29, 2026, and a second flaw, CVE-2026-59309, is being exploited on the same appliances.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-16723" ] }, { "cve_id": "CVE-2023-32350", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/polish-chp-plant-private-apn-turbine-shutdown-2026.html", "post_title": "Attackers Shut a Polish CHP Turbine by Pivoting Through a Private Cellular APN", "post_published": "2026-08-11", "description": "CERT Polska disclosed that intruders reached a Polish combined heat and power plant over the distribution operator", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-32350" ] }, { "cve_id": "CVE-2023-32349", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/polish-chp-plant-private-apn-turbine-shutdown-2026.html", "post_title": "Attackers Shut a Polish CHP Turbine by Pivoting Through a Private Cellular APN", "post_published": "2026-08-11", "description": "CERT Polska disclosed that intruders reached a Polish combined heat and power plant over the distribution operator", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-32349" ] }, { "cve_id": "CVE-2026-63077", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/css-webmail-attacks-outlook-gmail-2026.html", "post_title": "CSS in Email Is Now an Exploit Primitive: Six Webmail Clients Broken at Black Hat 2026", "post_published": "2026-08-09", "description": "PortSwigger research presented at Black Hat USA 2026 shows email content escaping its message boundary to hijack the webmail interface itself. Attack chains against Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail captured typed passwords, reconstructed a 12-character login token, and exfiltrated a Slack token through an AI email connector. Public PoCs are live and several bypasses still worked at publication.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-63077" ] }, { "cve_id": "CVE-2026-18577", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/metabase-zero-day-unauthenticated-admin-takeover-2026.html", "post_title": "Metabase Zero-Day Hits CVSS 10.0: Unauthenticated SQL Injection Gives Full Admin", "post_published": "2026-08-08", "description": "Attackers exploited an unauthenticated SQL injection flaw in Metabase as a zero-day, scoring a maximum CVSS 10.0 and handing them administrator access to business intelligence instances. Six release branches are affected, no CVE was assigned, and PC maker Framework has already notified customers of exposed personal data. Metabase published a two-line log pattern that tells you whether you were hit.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-18577" ] }, { "cve_id": "CVE-2023-38646", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/metabase-zero-day-unauthenticated-admin-takeover-2026.html", "post_title": "Metabase Zero-Day Hits CVSS 10.0: Unauthenticated SQL Injection Gives Full Admin", "post_published": "2026-08-08", "description": "Attackers exploited an unauthenticated SQL injection flaw in Metabase as a zero-day, scoring a maximum CVSS 10.0 and handing them administrator access to business intelligence instances. Six release branches are affected, no CVE was assigned, and PC maker Framework has already notified customers of exposed personal data. Metabase published a two-line log pattern that tells you whether you were hit.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-38646" ] }, { "cve_id": "CVE-2026-27912", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/kerberloss-resetnightmare-active-directory-domain-takeover-2026.html", "post_title": "Two Active Directory Bugs Turn Write Access on One Account into Domain Admin", "post_published": "2026-08-06", "description": "KerberLoss hides a duplicate service principal name behind invisible Unicode and breaks Kerberos authentication for any service an attacker picks. ResetNightmare walks a username collision through the Kerberos change-password protocol and comes out the other side as Domain Admin.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-27912" ] }, { "cve_id": "CVE-2026-25177", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/kerberloss-resetnightmare-active-directory-domain-takeover-2026.html", "post_title": "Two Active Directory Bugs Turn Write Access on One Account into Domain Admin", "post_published": "2026-08-06", "description": "KerberLoss hides a duplicate service principal name behind invisible Unicode and breaks Kerberos authentication for any service an attacker picks. ResetNightmare walks a username collision through the Kerberos change-password protocol and comes out the other side as Domain Admin.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-25177" ] }, { "cve_id": "CVE-2021-42282", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/kerberloss-resetnightmare-active-directory-domain-takeover-2026.html", "post_title": "Two Active Directory Bugs Turn Write Access on One Account into Domain Admin", "post_published": "2026-08-06", "description": "KerberLoss hides a duplicate service principal name behind invisible Unicode and breaks Kerberos authentication for any service an attacker picks. ResetNightmare walks a username collision through the Kerberos change-password protocol and comes out the other side as Domain Admin.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-42282" ] }, { "cve_id": "CVE-2017-16740", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/rockwell-plcs-exposed-water-utility-attacks-2026.html", "post_title": "4,407 Rockwell PLCs Sit on the Public Internet, 22 in Cities Hit by Water Utility Attacks", "post_published": "2026-08-06", "description": "Forescout", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2017-16740" ] }, { "cve_id": "CVE-2026-18556", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/n-able-n-central-auth-bypass-cve-2026-18577-exploited-2026.html", "post_title": "N-able N-central Auth Bypass Exploited in the Wild After First Patch Missed an Alternate Path", "post_published": "2026-08-03", "description": "Attackers bypassed authentication on N-able N-central servers, took administrative control, and pivoted through Take Control into managed customer endpoints. N-able", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-18556" ] }, { "cve_id": "CVE-2026-32194", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/adform-trackpoint-script-crypto-clipper-supply-chain-2026.html", "post_title": "Adform's trackpoint-async.js Was Poisoned to Rewrite Crypto Wallet Addresses on Downstream Sites", "post_published": "2026-08-02", "description": "Attackers appended a clipboard-and-DOM hijacking payload to trackpoint-async.js, a tracking script Adform serves from s2.adform[.]net to customer websites. Anyone who copied or typed a Bitcoin, Ethereum, or Tron address on an affected page could have had it silently swapped. Adform detected it on July 27, 2026 and pulled the code, but the file may still be sitting in visitor browser caches.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-32194" ] }, { "cve_id": "CVE-2026-20079", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-fmc-zero-day-cve-2026-20316-static-credentials-2026.html", "post_title": "Cisco Ships Hotfixes for FMC Zero-Day CVE-2026-20316 as CISA Sets August 1 Deadline", "post_published": "2026-07-31", "description": "Cisco confirmed active exploitation of a static-credential flaw in Secure Firewall Management Center that lets unauthenticated attackers log in as a low-privilege user. CISA added CVE-2026-20316 to the KEV catalog on July 29 and gave federal agencies until August 1, 2026 to patch. The bug shares an indicator of compromise with CVE-2026-20079, a CVSS 10.0 auth bypass that yields root.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20079" ] }, { "cve_id": "CVE-2025-68686", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/arista-velocloud-orchestrator-cve-2026-16812-exploited-2026.html", "post_title": "Arista VeloCloud Orchestrator CVE-2026-16812: CVSS 10.0 Command Injection Under Active Attack", "post_published": "2026-07-28", "description": "A maximum-severity OS command injection flaw in on-premises Arista VeloCloud Orchestrator is being exploited in the wild, giving remote attackers privileged access to the orchestrator host. CISA added CVE-2026-16812 to the KEV catalog with a July 30, 2026 federal patch deadline. Because VCO manages the SD-WAN fabric, a compromised orchestrator can reach every VeloCloud Edge device it controls.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] }, { "cve_id": "CVE-2026-54121", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sourtrade-malvertising-browser-assembles-executable-2026.html", "post_title": "SourTrade Malvertising Makes the Victim's Browser Assemble the Malware", "post_published": "2026-07-27", "description": "A malvertising operation called SourTrade delivers no finished binary over the wire. The browser fetches a clean Bun runtime, then byte-copies attacker-supplied PE structures and bytecode into a unique Windows executable per session, defeating simple hash-based detection. It impersonates TradingView, Solana, and Luno across 12 countries and 25 languages to hit retail traders and crypto investors.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-54121" ] }, { "cve_id": "CVE-2026-32191", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bing-images-svg-command-injection-cve-2026-32194-2026-07.html", "post_title": "Bing SVG Flaws Gave RCE as SYSTEM on Microsoft's Image Servers", "post_published": "2026-07-26", "description": "XBOW found two unauthenticated command-injection bugs in Bing", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-32191" ] }, { "cve_id": "CVE-2016-3714", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bing-images-svg-command-injection-cve-2026-32194-2026-07.html", "post_title": "Bing SVG Flaws Gave RCE as SYSTEM on Microsoft's Image Servers", "post_published": "2026-07-26", "description": "XBOW found two unauthenticated command-injection bugs in Bing", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2016-3714" ] }, { "cve_id": "CVE-2026-16232", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fastjson-1x-rce-cve-2026-16723-no-patch-2026.html", "post_title": "Fastjson 1.x Zero-Day (CVE-2026-16723): Unauthenticated RCE With No Patch Available", "post_published": "2026-07-25", "description": "A critical Fastjson 1.x flaw lets a single unauthenticated JSON request execute code inside Spring Boot fat-JAR applications, and Alibaba has no fixed 1.x release. The chain works without AutoType and without a classpath gadget, and security firms report in-the-wild exploit activity against US financial, healthcare, and retail targets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-16232" ] }, { "cve_id": "CVE-2026-50522", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/certighost-cve-2026-54121-ad-cs-domain-controller-impersonation-2026.html", "post_title": "Certighost: A Low-Privileged AD User Can Forge a Domain Controller (CVE-2026-54121)", "post_published": "2026-07-24", "description": "Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50522" ] }, { "cve_id": "CVE-2026-42533", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/certighost-cve-2026-54121-ad-cs-domain-controller-impersonation-2026.html", "post_title": "Certighost: A Low-Privileged AD User Can Forge a Domain Controller (CVE-2026-54121)", "post_published": "2026-07-24", "description": "Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42533" ] }, { "cve_id": "CVE-2026-20896", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/certighost-cve-2026-54121-ad-cs-domain-controller-impersonation-2026.html", "post_title": "Certighost: A Low-Privileged AD User Can Forge a Domain Controller (CVE-2026-54121)", "post_published": "2026-07-24", "description": "Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20896" ] }, { "cve_id": "CVE-2022-26923", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/certighost-cve-2026-54121-ad-cs-domain-controller-impersonation-2026.html", "post_title": "Certighost: A Low-Privileged AD User Can Forge a Domain Controller (CVE-2026-54121)", "post_published": "2026-07-24", "description": "Certighost (CVE-2026-54121) is a CVSS 8.8 flaw in Active Directory Certificate Services that lets any low-privileged domain user obtain a certificate for a domain controller", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-26923" ] }, { "cve_id": "CVE-2026-62145", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/check-point-smartconsole-auth-bypass-cve-2026-16232.html", "post_title": "Check Point Patches Actively Exploited SmartConsole Auth Bypass Granting Full Admin Access", "post_published": "2026-07-23", "description": "Check Point has patched CVE-2026-16232, a CVSS 9.3 authentication bypass in the SmartConsole login flow that lets unauthenticated attackers mint admin tokens on internet-exposed Management Servers. Exploitation is confirmed in the wild, CISA has added it to the KEV catalog, and two additional management-plane flaws shipped in the same fix. Federal agencies have until July 25 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-62145" ] }, { "cve_id": "CVE-2026-62144", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/check-point-smartconsole-auth-bypass-cve-2026-16232.html", "post_title": "Check Point Patches Actively Exploited SmartConsole Auth Bypass Granting Full Admin Access", "post_published": "2026-07-23", "description": "Check Point has patched CVE-2026-16232, a CVSS 9.3 authentication bypass in the SmartConsole login flow that lets unauthenticated attackers mint admin tokens on internet-exposed Management Servers. Exploitation is confirmed in the wild, CISA has added it to the KEV catalog, and two additional management-plane flaws shipped in the same fix. Federal agencies have until July 25 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-62144" ] }, { "cve_id": "CVE-2026-63030", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/servicenow-ai-platform-cve-2026-6875-active-exploitation-2026.html", "post_title": "CVE-2026-6875: ServiceNow AI Platform Sandbox Escape Under Active Exploitation", "post_published": "2026-07-22", "description": "Attackers are exploiting CVE-2026-6875, a CVSS 9.5 sandbox escape in the ServiceNow AI Platform that gives unauthenticated remote code execution and full instance compromise. Patches shipped in June; Defused Cyber caught in-the-wild exploitation matching the public PoC in July. Self-hosted customers who have not patched are the primary exposure.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-63030" ] }, { "cve_id": "CVE-2026-58644", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharepoint-cve-2026-50522-active-exploitation-machine-keys-2026.html", "post_title": "SharePoint CVE-2026-50522 Exploited in the Wild: Attackers Stealing Machine Keys in a Single Request", "post_published": "2026-07-21", "description": "A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone leaves them with persistent access. This is the third SharePoint bug from Microsoft", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-58644" ] }, { "cve_id": "CVE-2026-56164", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharepoint-cve-2026-50522-active-exploitation-machine-keys-2026.html", "post_title": "SharePoint CVE-2026-50522 Exploited in the Wild: Attackers Stealing Machine Keys in a Single Request", "post_published": "2026-07-21", "description": "A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone leaves them with persistent access. This is the third SharePoint bug from Microsoft", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-56164" ] }, { "cve_id": "CVE-2026-45659", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharepoint-cve-2026-50522-active-exploitation-machine-keys-2026.html", "post_title": "SharePoint CVE-2026-50522 Exploited in the Wild: Attackers Stealing Machine Keys in a Single Request", "post_published": "2026-07-21", "description": "A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone leaves them with persistent access. This is the third SharePoint bug from Microsoft", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-45659" ] }, { "cve_id": "CVE-2026-32201", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharepoint-cve-2026-50522-active-exploitation-machine-keys-2026.html", "post_title": "SharePoint CVE-2026-50522 Exploited in the Wild: Attackers Stealing Machine Keys in a Single Request", "post_published": "2026-07-21", "description": "A CVSS 9.8 deserialization flaw in on-premises SharePoint Server is under active exploitation following a public PoC release. Attackers are pulling IIS machine keys with a single HTTP request, which means patching alone leaves them with persistent access. This is the third SharePoint bug from Microsoft", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-32201" ] }, { "cve_id": "CVE-2021-39275", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/russian-intelligence-ip-camera-espionage-nato-2026.html", "post_title": "Russian Intelligence Is Hijacking IP Cameras to Track NATO Military Logistics", "post_published": "2026-07-20", "description": "Dutch intelligence services AIVD and MIVD say at least one Russian service is systematically hijacking internet-exposed IP cameras across NATO states and Ukraine to watch weapons shipments and troop movements. In Ukraine, camera access has been used to target personnel. Entry requires no zero-days: default passwords and stale firmware are enough.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-39275" ] }, { "cve_id": "CVE-2016-7407", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/russian-intelligence-ip-camera-espionage-nato-2026.html", "post_title": "Russian Intelligence Is Hijacking IP Cameras to Track NATO Military Logistics", "post_published": "2026-07-20", "description": "Dutch intelligence services AIVD and MIVD say at least one Russian service is systematically hijacking internet-exposed IP cameras across NATO states and Ukraine to watch weapons shipments and troop movements. In Ukraine, camera access has been used to target personnel. Entry requires no zero-days: default passwords and stale firmware are enough.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2016-7407" ] }, { "cve_id": "CVE-2026-60137", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/wp2shell-wordpress-core-preauth-rce-cve-2026-63030.html", "post_title": "WP2Shell: Pre-Auth RCE in WordPress Core (CVE-2026-63030) Puts Sites One Request From a Shell", "post_published": "2026-07-18", "description": "CVE-2026-63030,", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-60137" ] }, { "cve_id": "CVE-2026-34183", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/openssl-hollowbyte-silent-fix-2026.html", "post_title": "HollowByte: 11 Bytes Freeze OpenSSL Server Memory, and There's No CVE to Find", "post_published": "2026-07-18", "description": "Okta", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-34183" ] }, { "cve_id": "CVE-2025-66199", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/openssl-hollowbyte-silent-fix-2026.html", "post_title": "HollowByte: 11 Bytes Freeze OpenSSL Server Memory, and There's No CVE to Find", "post_published": "2026-07-18", "description": "Okta", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-66199" ] }, { "cve_id": "CVE-2026-57092", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-record-622-cve-patch-tuesday-july-2026.html", "post_title": "Microsoft's 622-CVE Patch Tuesday: Two Zero-Days in SharePoint and AD FS Are Already Being Exploited", "post_published": "2026-07-17", "description": "Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident responders. Neither is on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-57092" ] }, { "cve_id": "CVE-2026-56155", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-record-622-cve-patch-tuesday-july-2026.html", "post_title": "Microsoft's 622-CVE Patch Tuesday: Two Zero-Days in SharePoint and AD FS Are Already Being Exploited", "post_published": "2026-07-17", "description": "Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident responders. Neither is on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-56155" ] }, { "cve_id": "CVE-2026-55008", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-record-622-cve-patch-tuesday-july-2026.html", "post_title": "Microsoft's 622-CVE Patch Tuesday: Two Zero-Days in SharePoint and AD FS Are Already Being Exploited", "post_published": "2026-07-17", "description": "Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident responders. Neither is on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55008" ] }, { "cve_id": "CVE-2026-54118", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-record-622-cve-patch-tuesday-july-2026.html", "post_title": "Microsoft's 622-CVE Patch Tuesday: Two Zero-Days in SharePoint and AD FS Are Already Being Exploited", "post_published": "2026-07-17", "description": "Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident responders. Neither is on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-54118" ] }, { "cve_id": "CVE-2026-54117", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-record-622-cve-patch-tuesday-july-2026.html", "post_title": "Microsoft's 622-CVE Patch Tuesday: Two Zero-Days in SharePoint and AD FS Are Already Being Exploited", "post_published": "2026-07-17", "description": "Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident responders. Neither is on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-54117" ] }, { "cve_id": "CVE-2026-50661", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-record-622-cve-patch-tuesday-july-2026.html", "post_title": "Microsoft's 622-CVE Patch Tuesday: Two Zero-Days in SharePoint and AD FS Are Already Being Exploited", "post_published": "2026-07-17", "description": "Microsoft shipped 622 CVEs in July 2026, more than triple the previous record, and two of them are under active attack: an unauthenticated SharePoint privilege escalation and an AD FS elevation flaw found by incident responders. Neither is on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50661" ] }, { "cve_id": "CVE-2026-9256", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/nginx-cve-2026-42533-map-regex-heap-overflow-2026.html", "post_title": "Sixteen Researchers Found the Same NGINX Bug. CVE-2026-42533 Is What AI-Assisted Discovery Looks Like.", "post_published": "2026-07-15", "description": "F5 patched a critical NGINX heap overflow in the map/regex path (CVE-2026-42533, CVSS 9.2) and credited about sixteen researchers who each found it independently. That is what open-source review looks like now AI lowered the barrier. The bug, who is exposed, and how Caver detects exploitation.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-9256" ] }, { "cve_id": "CVE-2026-42945", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/nginx-cve-2026-42533-map-regex-heap-overflow-2026.html", "post_title": "Sixteen Researchers Found the Same NGINX Bug. CVE-2026-42533 Is What AI-Assisted Discovery Looks Like.", "post_published": "2026-07-15", "description": "F5 patched a critical NGINX heap overflow in the map/regex path (CVE-2026-42533, CVSS 9.2) and credited about sixteen researchers who each found it independently. That is what open-source review looks like now AI lowered the barrier. The bug, who is exposed, and how Caver detects exploitation.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42945" ] }, { "cve_id": "CVE-2026-15410", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sonicwall-sma-1000-zero-days-exploited-2026.html", "post_title": "Two SonicWall SMA 1000 Zero-Days Under Active Attack, One Rated CVSS 10.0", "post_published": "2026-07-15", "description": "SonicWall confirmed active exploitation of two zero-days in SMA 1000 series appliances, including a CVSS 10.0 unauthenticated SSRF and a post-auth code injection flaw that yields admin-level command execution. CISA added both to the KEV catalog with a July 17, 2026 federal patch deadline. Patched builds are available now, but confirmed-compromised appliances must be re-imaged.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-15410" ] }, { "cve_id": "CVE-2026-15409", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sonicwall-sma-1000-zero-days-exploited-2026.html", "post_title": "Two SonicWall SMA 1000 Zero-Days Under Active Attack, One Rated CVSS 10.0", "post_published": "2026-07-15", "description": "SonicWall confirmed active exploitation of two zero-days in SMA 1000 series appliances, including a CVSS 10.0 unauthenticated SSRF and a post-auth code injection flaw that yields admin-level command execution. CISA added both to the KEV catalog with a July 17, 2026 federal patch deadline. Patched builds are available now, but confirmed-compromised appliances must be re-imaged.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-15409" ] }, { "cve_id": "CVE-2018-0171", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fsb-center-16-static-tundra-cisco-smart-install-advisory-2026.html", "post_title": "FSB Center 16 Is Still Looting Cisco Routers With a 2018 Bug: Inside the 11-Nation Advisory", "post_published": "2026-07-13", "description": "NSA, FBI, CISA and 15 partner agencies across eight allied nations published joint guidance on Russian FSB Center 16 hackers, tracked as Berserk Bear and Static Tundra, who have been harvesting configs from internet-exposed network devices since at least November 2021. The primary entry point is CVE-2018-0171, an eight-year-old Cisco Smart Install flaw, plus routers still running SNMP with default community strings. Energy, communications, healthcare, financial services, defense and state/local government are named targets.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2018-0171" ] }, { "cve_id": "CVE-2026-55116", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55116" ] }, { "cve_id": "CVE-2026-55115", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55115" ] }, { "cve_id": "CVE-2026-54402", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-54402" ] }, { "cve_id": "CVE-2026-54400", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-54400" ] }, { "cve_id": "CVE-2026-50748", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50748" ] }, { "cve_id": "CVE-2026-50747", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50747" ] }, { "cve_id": "CVE-2026-50746", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50746" ] }, { "cve_id": "CVE-2026-34910", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-34910" ] }, { "cve_id": "CVE-2026-34909", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-34909" ] }, { "cve_id": "CVE-2026-34908", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ubiquiti-unifi-critical-flaws-2026.html", "post_title": "Ubiquiti Patches Seven Critical UniFi Flaws, Including a Perfect 10.0 Command Injection", "post_published": "2026-07-10", "description": "Ubiquiti shipped fixes for seven critical vulnerabilities spanning UniFi Connect, Talk, Access, Protect, and UniFi OS, topped by a CVSS 10.0 command injection. With prior UniFi OS bugs already on CISA", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-34908" ] }, { "cve_id": "CVE-2023-24489", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/progress-sharefile-storage-zone-controller-shutdown-2026.html", "post_title": "Progress Orders Emergency Shutdown of ShareFile Storage Zone Controllers Over Unnamed Threat", "post_published": "2026-07-10", "description": "Progress Software has told every ShareFile customer running a self-hosted Storage Zone Controller to power the servers down over a", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-24489" ] }, { "cve_id": "CVE-2026-43499", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/github-verified-commit-hash-malleability-2026.html", "post_title": "GitHub 'Verified' Commits Can Be Cloned Into New Hashes Without the Signing Key", "post_published": "2026-07-09", "description": "New research shows anyone can take a signed Git commit and mint a second copy with identical files, author, and a valid signature, but a different hash, and GitHub still stamps it Verified. Hash-based blocklists, dedup, and provenance systems inherit the flaw. Three attack routes cover every signature scheme GitHub verifies, and no forge has shipped a fix.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-43499" ] }, { "cve_id": "CVE-2026-56290", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-56290" ] }, { "cve_id": "CVE-2026-55255", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-55255" ] }, { "cve_id": "CVE-2026-53166", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ghostlock-cve-2026-43499-linux-root-container-escape-2026.html", "post_title": "GhostLock: 15-Year-Old Linux Kernel Flaw Gives Any Local User Root in 5 Seconds", "post_published": "2026-07-08", "description": "GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-53166" ] }, { "cve_id": "CVE-2026-5027", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-5027" ] }, { "cve_id": "CVE-2026-48908", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-48908" ] }, { "cve_id": "CVE-2026-48282", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-48282" ] }, { "cve_id": "CVE-2026-46242", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ghostlock-cve-2026-43499-linux-root-container-escape-2026.html", "post_title": "GhostLock: 15-Year-Old Linux Kernel Flaw Gives Any Local User Root in 5 Seconds", "post_published": "2026-07-08", "description": "GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-46242" ] }, { "cve_id": "CVE-2026-33017", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-33017" ] }, { "cve_id": "CVE-2026-31431", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ghostlock-cve-2026-43499-linux-root-container-escape-2026.html", "post_title": "GhostLock: 15-Year-Old Linux Kernel Flaw Gives Any Local User Root in 5 Seconds", "post_published": "2026-07-08", "description": "GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-31431" ] }, { "cve_id": "CVE-2026-21445", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-21445" ] }, { "cve_id": "CVE-2026-10702", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ghostlock-cve-2026-43499-linux-root-container-escape-2026.html", "post_title": "GhostLock: 15-Year-Old Linux Kernel Flaw Gives Any Local User Root in 5 Seconds", "post_published": "2026-07-08", "description": "GhostLock (CVE-2026-43499) is a use-after-free in Linux futex priority-inheritance code that has shipped by default in nearly every distro since 2011. Nebula Security", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-10702" ] }, { "cve_id": "CVE-2026-0770", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-0770" ] }, { "cve_id": "CVE-2025-34291", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-34291" ] }, { "cve_id": "CVE-2025-3248", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisa-kev-adobe-joomla-langflow-exploited-2026.html", "post_title": "CISA Flags Four Actively Exploited Flaws: ColdFusion, Joomla Page Builders, and Langflow Under Attack", "post_published": "2026-07-08", "description": "CISA added four actively exploited vulnerabilities to its KEV catalog, three of them scored CVSS 10.0, spanning Adobe ColdFusion, two Joomla page builders, and the Langflow AI platform. One ColdFusion flaw was hit within hours of disclosure; a Joomla flaw was exploited as a zero-day to plant Super User accounts. FCEB agencies must patch by July 10, 2026.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-3248" ] }, { "cve_id": "CVE-2026-40141", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/beyondtrust-auth-bypass-rs-pra-2026.html", "post_title": "BeyondTrust Patches Two 9.2-Rated Auth Bypass Flaws in Remote Support and PRA", "post_published": "2026-07-07", "description": "BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with elevated privileges. A third bug (8.7) enables denial-of-service and a fourth (8.5) lets low-privilege users reach data beyond their scope. Given the repeated in-the-wild exploitation of prior RS/PRA CVEs, upgrading to RS/PRA 25.3.3 is urgent.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-40141" ] }, { "cve_id": "CVE-2026-40140", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/beyondtrust-auth-bypass-rs-pra-2026.html", "post_title": "BeyondTrust Patches Two 9.2-Rated Auth Bypass Flaws in Remote Support and PRA", "post_published": "2026-07-07", "description": "BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with elevated privileges. A third bug (8.7) enables denial-of-service and a fourth (8.5) lets low-privilege users reach data beyond their scope. Given the repeated in-the-wild exploitation of prior RS/PRA CVEs, upgrading to RS/PRA 25.3.3 is urgent.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-40140" ] }, { "cve_id": "CVE-2026-40139", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/beyondtrust-auth-bypass-rs-pra-2026.html", "post_title": "BeyondTrust Patches Two 9.2-Rated Auth Bypass Flaws in Remote Support and PRA", "post_published": "2026-07-07", "description": "BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with elevated privileges. A third bug (8.7) enables denial-of-service and a fourth (8.5) lets low-privilege users reach data beyond their scope. Given the repeated in-the-wild exploitation of prior RS/PRA CVEs, upgrading to RS/PRA 25.3.3 is urgent.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-40139" ] }, { "cve_id": "CVE-2026-40138", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/beyondtrust-auth-bypass-rs-pra-2026.html", "post_title": "BeyondTrust Patches Two 9.2-Rated Auth Bypass Flaws in Remote Support and PRA", "post_published": "2026-07-07", "description": "BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with elevated privileges. A third bug (8.7) enables denial-of-service and a fourth (8.5) lets low-privilege users reach data beyond their scope. Given the repeated in-the-wild exploitation of prior RS/PRA CVEs, upgrading to RS/PRA 25.3.3 is urgent.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-40138" ] }, { "cve_id": "CVE-2024-12356", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/beyondtrust-auth-bypass-rs-pra-2026.html", "post_title": "BeyondTrust Patches Two 9.2-Rated Auth Bypass Flaws in Remote Support and PRA", "post_published": "2026-07-07", "description": "BeyondTrust shipped fixes for four vulnerabilities in Remote Support and Privileged Remote Access, including two pre-auth bypass flaws rated CVSS 9.2 that let unauthenticated attackers seize appliance accounts with elevated privileges. A third bug (8.7) enables denial-of-service and a fourth (8.5) lets low-privilege users reach data beyond their scope. Given the repeated in-the-wild exploitation of prior RS/PRA CVEs, upgrading to RS/PRA 25.3.3 is urgent.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-12356" ] }, { "cve_id": "CVE-2026-53359", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/januscape-kvm-guest-to-host-escape-cve-2026-53359-2026.html", "post_title": "16-Year-Old Linux KVM Bug 'Januscape' Lets a Guest VM Take Down the Host on Intel and AMD", "post_published": "2026-07-06", "description": "A use-after-free in Linux KVM", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-53359" ] }, { "cve_id": "CVE-2026-46316", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/januscape-kvm-guest-to-host-escape-cve-2026-53359-2026.html", "post_title": "16-Year-Old Linux KVM Bug 'Januscape' Lets a Guest VM Take Down the Host on Intel and AMD", "post_published": "2026-07-06", "description": "A use-after-free in Linux KVM", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-46316" ] }, { "cve_id": "CVE-2026-46113", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/januscape-kvm-guest-to-host-escape-cve-2026-53359-2026.html", "post_title": "16-Year-Old Linux KVM Bug 'Januscape' Lets a Guest VM Take Down the Host on Intel and AMD", "post_published": "2026-07-06", "description": "A use-after-free in Linux KVM", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-46113" ] }, { "cve_id": "CVE-2026-43500", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/januscape-kvm-guest-to-host-escape-cve-2026-53359-2026.html", "post_title": "16-Year-Old Linux KVM Bug 'Januscape' Lets a Guest VM Take Down the Host on Intel and AMD", "post_published": "2026-07-06", "description": "A use-after-free in Linux KVM", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-43500" ] }, { "cve_id": "CVE-2026-43284", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/januscape-kvm-guest-to-host-escape-cve-2026-53359-2026.html", "post_title": "16-Year-Old Linux KVM Bug 'Januscape' Lets a Guest VM Take Down the Host on Intel and AMD", "post_published": "2026-07-06", "description": "A use-after-free in Linux KVM", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-43284" ] }, { "cve_id": "CVE-2026-48558", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bad-epoll-cve-2026-46242-linux-kernel-root-2026.html", "post_title": "Bad Epoll (CVE-2026-46242): Unprivileged-to-Root Linux Kernel Bug Hits Servers, Desktops, and Android", "post_published": "2026-07-05", "description": "A use-after-free race in the Linux epoll subsystem lets any local user reach root roughly 99% of the time, works from inside the Chrome renderer sandbox, and reaches Android. Kernels built on 6.4 or newer are affected until patched. There is no workaround because epoll cannot be disabled.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-48558" ] }, { "cve_id": "CVE-2026-43074", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/bad-epoll-cve-2026-46242-linux-kernel-root-2026.html", "post_title": "Bad Epoll (CVE-2026-46242): Unprivileged-to-Root Linux Kernel Bug Hits Servers, Desktops, and Android", "post_published": "2026-07-05", "description": "A use-after-free race in the Linux epoll subsystem lets any local user reach root roughly 99% of the time, works from inside the Chrome renderer sandbox, and reaches Android. Kernels built on 6.4 or newer are affected until patched. There is no workaround because epoll cannot be disabled.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-43074" ] }, { "cve_id": "CVE-2026-6688", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6688" ] }, { "cve_id": "CVE-2026-6687", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6687" ] }, { "cve_id": "CVE-2026-6686", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6686" ] }, { "cve_id": "CVE-2026-6685", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6685" ] }, { "cve_id": "CVE-2026-6684", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6684" ] }, { "cve_id": "CVE-2026-6683", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6683" ] }, { "cve_id": "CVE-2026-6682", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fatfs-unpatched-flaws-embedded-devices-2026.html", "post_title": "Seven Unpatched FatFs Flaws Put Millions of Embedded Devices One USB Away From a Jailbreak", "post_published": "2026-07-04", "description": "runZero disclosed seven vulnerabilities in FatFs, a FAT/exFAT filesystem library bundled into firmware across security cameras, drones, industrial controllers, and crypto wallets. Three carry a 7.6 CVSS and enable code execution, only one is fixed upstream, and the lone maintainer never responded. Public proof-of-concept exploit code is already out.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-6682" ] }, { "cve_id": "CVE-2025-9491", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/armored-likho-busysnake-stealer-power-sector-2026.html", "post_title": "Armored Likho Hits Government and Power Sector with BusySnake Stealer", "post_published": "2026-07-03", "description": "A newly documented threat actor, Armored Likho, is hitting government agencies and electric power operators across Russia, Brazil, and Kazakhstan with a Python-based stealer called BusySnake. The campaign blends espionage with financial theft and weaponizes CVE-2025-9491, a Windows LNK flaw patched only in November 2025.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-9491" ] }, { "cve_id": "CVE-2025-11371", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharepoint-rce-cve-2026-45659-cisa-kev-active-exploitation-2026.html", "post_title": "SharePoint RCE CVE-2026-45659 Hits CISA KEV as Attackers Exploit It in the Wild", "post_published": "2026-07-02", "description": "CISA added Microsoft SharePoint Server flaw CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The deserialization bug lets any authenticated user with Site Member permissions run code remotely. Federal agencies have until July 4, 2026 to patch.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-11371" ] }, { "cve_id": "CVE-2021-29441", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/jadepuffer-ai-agent-langflow-ransomware-2026.html", "post_title": "JADEPUFFER: An AI Agent Just Ran a Ransomware Attack End to End", "post_published": "2026-07-02", "description": "Sysdig says an AI agent executed a full ransomware operation with no human at the keyboard: exploiting a patched Langflow RCE, harvesting credentials, pivoting to a production MySQL/Nacos server, and encrypting 1,342 configurations. The encryption key was printed once and never saved, so paying gets victims nothing.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-29441" ] }, { "cve_id": "CVE-2026-8037", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/kemp-loadmaster-cve-2026-8037-active-exploitation-2026.html", "post_title": "Kemp LoadMaster Pre-Auth RCE Under Active Attack: Patch CVE-2026-8037 Now", "post_published": "2026-07-01", "description": "Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-8037" ] }, { "cve_id": "CVE-2026-46817", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/kemp-loadmaster-cve-2026-8037-active-exploitation-2026.html", "post_title": "Kemp LoadMaster Pre-Auth RCE Under Active Attack: Patch CVE-2026-8037 Now", "post_published": "2026-07-01", "description": "Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-46817" ] }, { "cve_id": "CVE-2024-1212", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/kemp-loadmaster-cve-2026-8037-active-exploitation-2026.html", "post_title": "Kemp LoadMaster Pre-Auth RCE Under Active Attack: Patch CVE-2026-8037 Now", "post_published": "2026-07-01", "description": "Attackers began probing Progress Kemp LoadMaster load balancers on June 29, 2026, targeting a CVSS 9.6 pre-auth command injection flaw. A public PoC and watchTowr", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-1212" ] }, { "cve_id": "CVE-2026-20127", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-catalyst-sd-wan-zero-day-cve-2026-20245-root-access-2026.html", "post_title": "Cisco SD-WAN Zero-Day CVE-2026-20245 Gave Attackers Root Inside a Telecom Fabric", "post_published": "2026-06-28", "description": "An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malicious CSV upload, a hidden", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20127" ] }, { "cve_id": "CVE-2026-12569", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-catalyst-sd-wan-zero-day-cve-2026-20245-root-access-2026.html", "post_title": "Cisco SD-WAN Zero-Day CVE-2026-20245 Gave Attackers Root Inside a Telecom Fabric", "post_published": "2026-06-28", "description": "An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malicious CSV upload, a hidden", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-12569" ] }, { "cve_id": "CVE-2025-67038", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/cisco-catalyst-sd-wan-zero-day-cve-2026-20245-root-access-2026.html", "post_title": "Cisco SD-WAN Zero-Day CVE-2026-20245 Gave Attackers Root Inside a Telecom Fabric", "post_published": "2026-06-28", "description": "An unknown actor exploited Cisco Catalyst SD-WAN as a zero-day for at least two months before disclosure, escalating a compromised admin account to full root on a communications service provider. Mandiant traced a malicious CSV upload, a hidden", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-67038" ] }, { "cve_id": "CVE-2026-20253", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-20253" ] }, { "cve_id": "CVE-2025-55182", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-55182" ] }, { "cve_id": "CVE-2024-36401", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-36401" ] }, { "cve_id": "CVE-2024-21762", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-21762" ] }, { "cve_id": "CVE-2023-46747", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-46747" ] }, { "cve_id": "CVE-2023-32315", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-32315" ] }, { "cve_id": "CVE-2023-20198", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-20198" ] }, { "cve_id": "CVE-2022-41082", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-41082" ] }, { "cve_id": "CVE-2022-40684", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-40684" ] }, { "cve_id": "CVE-2022-27925", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-27925" ] }, { "cve_id": "CVE-2021-36260", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-36260" ] }, { "cve_id": "CVE-2021-27076", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-27076" ] }, { "cve_id": "CVE-2016-4437", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/sharkloader-strikeshaker-cobalt-strike-2026.html", "post_title": "SharkLoader Smuggles Cobalt Strike Through 13 Known-Exploited CVEs", "post_published": "2026-06-27", "description": "Kaspersky", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2016-4437" ] }, { "cve_id": "CVE-2026-24061", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/convoc2-teams-relay-c2-commodity-threat-2026.html", "post_title": "Backdoor.Turn Got the Headlines. convoC2 Is the Version Anyone Can Run", "post_published": "2026-06-25", "description": "The DPRK", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-24061" ] }, { "cve_id": "CVE-2026-47729", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fake-ai-skill-passed-scanners-26000-agents-2026.html", "post_title": "Fake AI Agent Skill Slipped Past Every Scanner and Reached 26,000 Agents", "post_published": "2026-06-23", "description": "A security firm planted a malicious AI agent skill that passed Cisco", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-47729" ] }, { "cve_id": "CVE-2026-50012", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/squidbleed-squid-proxy-heap-overread-cve-2026-47729-2026.html", "post_title": "Squidbleed: A 1997 Squid Proxy Bug Leaks Other Users' Cleartext HTTP Requests", "post_published": "2026-06-22", "description": "A 29-year-old heap over-read in the Squid web proxy, dubbed Squidbleed (CVE-2026-47729), lets any permitted proxy user leak another user", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50012" ] }, { "cve_id": "CVE-2026-23111", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/usbliter8-apple-a12-a13-securerom-exploit-2026.html", "post_title": "usbliter8: Unpatchable SecureROM Exploit Breaks Apple A12 and A13 Boot Chain", "post_published": "2026-06-21", "description": "Paradigm Shift researchers published a working exploit, usbliter8, that achieves arbitrary code execution inside the SecureROM of Apple A12 and A13 chips. Burned into silicon at manufacture, the flaw cannot be patched by any software update. It requires physical access and DFU mode, completes in under two seconds, and affects iPhone XS through iPhone 11, several iPads, and Apple Watch Series 4 and 5.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-23111" ] }, { "cve_id": "CVE-2025-24472", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortibleed-fortigate-credential-campaign-2026.html", "post_title": "FortiBleed Isn't a Campaign: It's an Eight-Year Fortinet Audit Result. 86,644 Firewalls Failed", "post_published": "2026-06-20", "description": "FortiBleed isn", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-24472" ] }, { "cve_id": "CVE-2024-55591", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortibleed-fortigate-credential-campaign-2026.html", "post_title": "FortiBleed Isn't a Campaign: It's an Eight-Year Fortinet Audit Result. 86,644 Firewalls Failed", "post_published": "2026-06-20", "description": "FortiBleed isn", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-55591" ] }, { "cve_id": "CVE-2020-12812", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortibleed-fortigate-credential-campaign-2026.html", "post_title": "FortiBleed Isn't a Campaign: It's an Eight-Year Fortinet Audit Result. 86,644 Firewalls Failed", "post_published": "2026-06-20", "description": "FortiBleed isn", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-12812" ] }, { "cve_id": "CVE-2018-13382", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/fortibleed-fortigate-credential-campaign-2026.html", "post_title": "FortiBleed Isn't a Campaign: It's an Eight-Year Fortinet Audit Result. 86,644 Firewalls Failed", "post_published": "2026-06-20", "description": "FortiBleed isn", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2018-13382" ] }, { "cve_id": "CVE-2026-26030", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/autojack-autogen-studio-mcp-rce-2026.html", "post_title": "AutoJack: One Web Page Turns a Local AI Agent Into Host Code Execution", "post_published": "2026-06-19", "description": "Microsoft researchers detailed AutoJack, an exploit chain that lets a single attacker-controlled web page reach a privileged local service through an AI browsing agent and run arbitrary commands on the host. The flaw lives in AutoGen Studio", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-26030" ] }, { "cve_id": "CVE-2026-25592", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/autojack-autogen-studio-mcp-rce-2026.html", "post_title": "AutoJack: One Web Page Turns a Local AI Agent Into Host Code Execution", "post_published": "2026-06-19", "description": "Microsoft researchers detailed AutoJack, an exploit chain that lets a single attacker-controlled web page reach a privileged local service through an AI browsing agent and run arbitrary commands on the host. The flaw lives in AutoGen Studio", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-25592" ] }, { "cve_id": "CVE-2026-2473", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vertex-ai-pickle-in-the-middle-bucket-squatting-2026.html", "post_title": "Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads With Nothing but a Project ID", "post_published": "2026-06-19", "description": "A flaw in Google Cloud", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-2473" ] }, { "cve_id": "CVE-2026-47102", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/litellm-vulnerability-chain-ai-gateway-takeover-2026.html", "post_title": "LiteLLM Vulnerability Chain Enables Full AI Gateway Takeover from Default Account", "post_published": "2026-06-15", "description": "Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the proxy.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-47102" ] }, { "cve_id": "CVE-2026-47101", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/litellm-vulnerability-chain-ai-gateway-takeover-2026.html", "post_title": "LiteLLM Vulnerability Chain Enables Full AI Gateway Takeover from Default Account", "post_published": "2026-06-15", "description": "Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the proxy.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-47101" ] }, { "cve_id": "CVE-2026-42271", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/litellm-vulnerability-chain-ai-gateway-takeover-2026.html", "post_title": "LiteLLM Vulnerability Chain Enables Full AI Gateway Takeover from Default Account", "post_published": "2026-06-15", "description": "Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the proxy.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42271" ] }, { "cve_id": "CVE-2026-40217", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/litellm-vulnerability-chain-ai-gateway-takeover-2026.html", "post_title": "LiteLLM Vulnerability Chain Enables Full AI Gateway Takeover from Default Account", "post_published": "2026-06-15", "description": "Three chained vulnerabilities in LiteLLM let low-privilege users escalate to admin and execute code on AI gateway servers. Critical-severity chain exposes all provider keys, credentials, and prompts flowing through the proxy.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-40217" ] }, { "cve_id": "CVE-2024-20399", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/velvet-ant-linux-pam-openssh-backdoor-2026.html", "post_title": "China-Linked Velvet Ant Backdoored Linux PAM and OpenSSH for Nine Years", "post_published": "2026-06-14", "description": "Chinese APT group Velvet Ant compromised the Linux login layer itself, backdooring PAM modules and OpenSSH binaries on air-gapped networks since 2016. Sygnia researchers found nine variants recording credentials where ordinary defenses cannot reach.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-20399" ] }, { "cve_id": "CVE-2026-39987", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/self-replicating-ai-worm-local-models-2026.html", "post_title": "Self-Replicating AI Worm Operates Entirely on Local Models, Bypasses Vendor Controls", "post_published": "2026-06-09", "description": "University of Toronto researchers built a proof-of-concept AI worm that uses local open-weight LLMs to autonomously reason through networks, generate runtime exploits, and self-replicate, compromising 62% of test hosts without touching commercial AI services or human input.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-39987" ] }, { "cve_id": "CVE-2026-50752", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/checkpoint-ikev1-vpn-authentication-bypass-qilin-2026.html", "post_title": "Check Point IKEv1 VPN Authentication Bypass Exploited by Qilin Ransomware Affiliate", "post_published": "2026-06-08", "description": "CVE-2026-50751, a critical logic flaw in Check Point VPN certificate validation, allows unauthenticated attackers to bypass passwords in IKEv1 configurations. Exploitation tied to Qilin ransomware began May 7, targeting dozens of organizations globally.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50752" ] }, { "cve_id": "CVE-2026-50751", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/checkpoint-ikev1-vpn-authentication-bypass-qilin-2026.html", "post_title": "Check Point IKEv1 VPN Authentication Bypass Exploited by Qilin Ransomware Affiliate", "post_published": "2026-06-08", "description": "CVE-2026-50751, a critical logic flaw in Check Point VPN certificate validation, allows unauthenticated attackers to bypass passwords in IKEv1 configurations. Exploitation tied to Qilin ransomware began May 7, targeting dozens of organizations globally.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-50751" ] }, { "cve_id": "CVE-2026-39218", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ai-agent-ffmpeg-zero-days-chrome-429-patches-2026.html", "post_title": "AI Agent Finds 21 Zero-Days in FFmpeg for $1,000 as Chrome Ships Record 429 Patches", "post_published": "2026-06-06", "description": "A security startup", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-39218" ] }, { "cve_id": "CVE-2026-39210", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ai-agent-ffmpeg-zero-days-chrome-429-patches-2026.html", "post_title": "AI Agent Finds 21 Zero-Days in FFmpeg for $1,000 as Chrome Ships Record 429 Patches", "post_published": "2026-06-06", "description": "A security startup", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-39210" ] }, { "cve_id": "CVE-2026-10881", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ai-agent-ffmpeg-zero-days-chrome-429-patches-2026.html", "post_title": "AI Agent Finds 21 Zero-Days in FFmpeg for $1,000 as Chrome Ships Record 429 Patches", "post_published": "2026-06-06", "description": "A security startup", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-10881" ] }, { "cve_id": "CVE-2026-42832", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-365-android-debug-flag-token-theft-2026.html", "post_title": "Debug Flag Left Enabled in Microsoft 365 Android Apps Exposed Account Tokens to Any App", "post_published": "2026-06-04", "description": "A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interaction. Microsoft patched the flaw affecting billions of app downloads after Enclave Security disclosed it.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42832" ] }, { "cve_id": "CVE-2026-41102", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-365-android-debug-flag-token-theft-2026.html", "post_title": "Debug Flag Left Enabled in Microsoft 365 Android Apps Exposed Account Tokens to Any App", "post_published": "2026-06-04", "description": "A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interaction. Microsoft patched the flaw affecting billions of app downloads after Enclave Security disclosed it.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-41102" ] }, { "cve_id": "CVE-2026-41101", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-365-android-debug-flag-token-theft-2026.html", "post_title": "Debug Flag Left Enabled in Microsoft 365 Android Apps Exposed Account Tokens to Any App", "post_published": "2026-06-04", "description": "A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interaction. Microsoft patched the flaw affecting billions of app downloads after Enclave Security disclosed it.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-41101" ] }, { "cve_id": "CVE-2026-41100", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-365-android-debug-flag-token-theft-2026.html", "post_title": "Debug Flag Left Enabled in Microsoft 365 Android Apps Exposed Account Tokens to Any App", "post_published": "2026-06-04", "description": "A single line of debug code left in production builds of six Microsoft 365 Android apps disabled authentication checks, allowing any app on the device to steal user account tokens without password prompts or user interaction. Microsoft patched the flaw affecting billions of app downloads after Enclave Security disclosed it.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-41100" ] }, { "cve_id": "CVE-2026-21509", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gamaredon-winrar-exploit-ukraine-2026.html", "post_title": "Gamaredon Exploits WinRAR Vulnerability to Deploy GammaWorm and GammaSteel Against Ukraine", "post_published": "2026-06-02", "description": "Russian FSB-linked threat group Gamaredon weaponizes CVE-2025-8088 WinRAR vulnerability to deliver modular malware framework targeting Ukrainian organizations. Attack chain deploys GammaPhish HTML applications, GammaWorm propagation tools, and GammaSteel data theft modules.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-21509" ] }, { "cve_id": "CVE-2026-0257", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gamaredon-winrar-exploit-ukraine-2026.html", "post_title": "Gamaredon Exploits WinRAR Vulnerability to Deploy GammaWorm and GammaSteel Against Ukraine", "post_published": "2026-06-02", "description": "Russian FSB-linked threat group Gamaredon weaponizes CVE-2025-8088 WinRAR vulnerability to deliver modular malware framework targeting Ukrainian organizations. Attack chain deploys GammaPhish HTML applications, GammaWorm propagation tools, and GammaSteel data theft modules.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-0257" ] }, { "cve_id": "CVE-2025-8088", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/gamaredon-winrar-exploit-ukraine-2026.html", "post_title": "Gamaredon Exploits WinRAR Vulnerability to Deploy GammaWorm and GammaSteel Against Ukraine", "post_published": "2026-06-02", "description": "Russian FSB-linked threat group Gamaredon weaponizes CVE-2025-8088 WinRAR vulnerability to deliver modular malware framework targeting Ukrainian organizations. Attack chain deploys GammaPhish HTML applications, GammaWorm propagation tools, and GammaSteel data theft modules.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-8088" ] }, { "cve_id": "CVE-2026-35616", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/pan-os-globalprotect-cve-2026-0257-active-exploitation-2026.html", "post_title": "PAN-OS GlobalProtect Authentication Bypass CVE-2026-0257 Under Active Exploitation", "post_published": "2026-05-31", "description": "Palo Alto Networks CVE-2026-0257 authentication bypass vulnerability is being actively exploited in the wild, allowing attackers to establish unauthorized VPN connections. Rapid7 confirms successful exploitation across numerous customers dating back to May 17, with threat actors gaining internal network access.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-35616" ] }, { "cve_id": "CVE-2026-5194", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/claude-mythos-ai-discovers-10000-vulnerabilities-2026.html", "post_title": "Anthropic's Claude Mythos AI Discovers 10,000 Critical Vulnerabilities in One Month", "post_published": "2026-05-23", "description": "Anthropic", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-5194" ] }, { "cve_id": "CVE-2026-28517", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/nginx-cve-2026-42945-active-exploitation-2026.html", "post_title": "NGINX CVE-2026-42945 Under Active Exploitation: 18-Year-Old Flaw Triggers Worker Crashes and RCE", "post_published": "2026-05-19", "description": "Critical heap buffer overflow in NGINX versions 0.6.27 through 1.30.0 is being actively exploited in the wild. The vulnerability, introduced in 2008, allows unauthenticated attackers to crash worker processes or achieve remote code execution on systems without ASLR protection.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-28517" ] }, { "cve_id": "CVE-2026-28516", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/nginx-cve-2026-42945-active-exploitation-2026.html", "post_title": "NGINX CVE-2026-42945 Under Active Exploitation: 18-Year-Old Flaw Triggers Worker Crashes and RCE", "post_published": "2026-05-19", "description": "Critical heap buffer overflow in NGINX versions 0.6.27 through 1.30.0 is being actively exploited in the wild. The vulnerability, introduced in 2008, allows unauthenticated attackers to crash worker processes or achieve remote code execution on systems without ASLR protection.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-28516" ] }, { "cve_id": "CVE-2026-28515", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/nginx-cve-2026-42945-active-exploitation-2026.html", "post_title": "NGINX CVE-2026-42945 Under Active Exploitation: 18-Year-Old Flaw Triggers Worker Crashes and RCE", "post_published": "2026-05-19", "description": "Critical heap buffer overflow in NGINX versions 0.6.27 through 1.30.0 is being actively exploited in the wild. The vulnerability, introduced in 2008, allows unauthenticated attackers to crash worker processes or achieve remote code execution on systems without ASLR protection.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-28515" ] }, { "cve_id": "CVE-2021-34527", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/windows-miniplasma-zero-day-system-access-2026.html", "post_title": "Windows MiniPlasma Zero-Day Grants SYSTEM Access, PoC Published", "post_published": "2026-05-18", "description": "A newly disclosed Windows zero-day vulnerability dubbed MiniPlasma allows unprivileged users to escalate to SYSTEM-level access through a flaw in the Print Spooler service. Proof-of-concept code is now publicly available with no patch currently deployed.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-34527" ] }, { "cve_id": "CVE-2026-44338", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/praisonai-auth-bypass-exploited-4-hours-2026.html", "post_title": "PraisonAI Authentication Bypass Exploited Within 4 Hours of Disclosure", "post_published": "2026-05-17", "description": "CVE-2026-44338, a critical authentication bypass in PraisonAI", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-44338" ] }, { "cve_id": "CVE-2026-33825", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/yellowkey-greenplasma-zero-days-bitlocker-ctfmon-2026.html", "post_title": "YellowKey and GreenPlasma Zero-Days Target BitLocker Encryption and Windows Privilege Escalation", "post_published": "2026-05-15", "description": "Anonymous researcher Chaotic Eclipse disclosed two critical Windows zero-days: YellowKey enables BitLocker bypass through Windows Recovery Environment in minutes, while GreenPlasma allows SYSTEM-level privilege escalation via CTFMON. Both vulnerabilities remain unpatched as tensions escalate with Microsoft.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-33825" ] }, { "cve_id": "CVE-2025-48804", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/yellowkey-greenplasma-zero-days-bitlocker-ctfmon-2026.html", "post_title": "YellowKey and GreenPlasma Zero-Days Target BitLocker Encryption and Windows Privilege Escalation", "post_published": "2026-05-15", "description": "Anonymous researcher Chaotic Eclipse disclosed two critical Windows zero-days: YellowKey enables BitLocker bypass through Windows Recovery Environment in minutes, while GreenPlasma allows SYSTEM-level privilege escalation via CTFMON. Both vulnerabilities remain unpatched as tensions escalate with Microsoft.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-48804" ] }, { "cve_id": "CVE-2026-45321", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/mini-shai-hulud-worm-slsa-attested-supply-chain-attack-2026.html", "post_title": "Mini Shai-Hulud Worm Deploys SLSA-Attested Malware Across Major Package Ecosystems", "post_published": "2026-05-13", "description": "TeamPCP threat actors compromised 42 TanStack packages and infiltrated npm/PyPI repositories from Mistral AI, UiPath, OpenSearch, and Guardrails AI using GitHub Actions OIDC token hijacking. The worm produces validly attested malicious packages and includes a destructive wiper component targeting developers who revoke compromised tokens.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-45321" ] }, { "cve_id": "CVE-2026-7482", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ollama-memory-leak-code-execution-vulnerabilities-2026.html", "post_title": "Critical Ollama Vulnerabilities Expose 300,000+ Servers to Memory Leaks and Persistent Code Execution", "post_published": "2026-05-10", "description": "A critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama enables unauthenticated attackers to exfiltrate entire process memory from over 300,000 servers. Two additional unpatched Windows vulnerabilities allow persistent code execution through the update mechanism.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-7482" ] }, { "cve_id": "CVE-2026-44009", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-44009" ] }, { "cve_id": "CVE-2026-44008", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-44008" ] }, { "cve_id": "CVE-2026-44007", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-44007" ] }, { "cve_id": "CVE-2026-44006", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-44006" ] }, { "cve_id": "CVE-2026-44005", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-44005" ] }, { "cve_id": "CVE-2026-43999", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-43999" ] }, { "cve_id": "CVE-2026-43997", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-43997" ] }, { "cve_id": "CVE-2026-42249", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ollama-memory-leak-code-execution-vulnerabilities-2026.html", "post_title": "Critical Ollama Vulnerabilities Expose 300,000+ Servers to Memory Leaks and Persistent Code Execution", "post_published": "2026-05-10", "description": "A critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama enables unauthenticated attackers to exfiltrate entire process memory from over 300,000 servers. Two additional unpatched Windows vulnerabilities allow persistent code execution through the update mechanism.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42249" ] }, { "cve_id": "CVE-2026-42248", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/ollama-memory-leak-code-execution-vulnerabilities-2026.html", "post_title": "Critical Ollama Vulnerabilities Expose 300,000+ Servers to Memory Leaks and Persistent Code Execution", "post_published": "2026-05-10", "description": "A critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama enables unauthenticated attackers to exfiltrate entire process memory from over 300,000 servers. Two additional unpatched Windows vulnerabilities allow persistent code execution through the update mechanism.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-42248" ] }, { "cve_id": "CVE-2026-26956", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-26956" ] }, { "cve_id": "CVE-2026-26332", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-26332" ] }, { "cve_id": "CVE-2026-24781", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-24781" ] }, { "cve_id": "CVE-2026-24120", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-24120" ] }, { "cve_id": "CVE-2026-24118", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-24118" ] }, { "cve_id": "CVE-2026-22709", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-22709" ] }, { "cve_id": "CVE-2023-37466", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/vm2-nodejs-sandbox-escape-vulnerabilities-2026.html", "post_title": "Twelve Critical Vulnerabilities in vm2 Node.js Library Enable Complete Sandbox Escape", "post_published": "2026-05-10", "description": "Twelve critical vulnerabilities in the widely-used vm2 Node.js sandbox library allow attackers to escape isolation and execute arbitrary code on host systems. Three vulnerabilities scored perfect 10.0 CVSS ratings, affecting all versions through 3.11.1.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-37466" ] }, { "cve_id": "CVE-2026-41940", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/pcpjack-worm-exploits-5-cves-credential-theft-2026.html", "post_title": "PCPJack Worm Exploits 5 CVEs to Steal Credentials and Hijack TeamPCP Infrastructure", "post_published": "2026-05-07", "description": "New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services to harvest credentials from cloud, container, and financial platforms.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-41940" ] }, { "cve_id": "CVE-2026-1357", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/pcpjack-worm-exploits-5-cves-credential-theft-2026.html", "post_title": "PCPJack Worm Exploits 5 CVEs to Steal Credentials and Hijack TeamPCP Infrastructure", "post_published": "2026-05-07", "description": "New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services to harvest credentials from cloud, container, and financial platforms.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-1357" ] }, { "cve_id": "CVE-2025-9501", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/pcpjack-worm-exploits-5-cves-credential-theft-2026.html", "post_title": "PCPJack Worm Exploits 5 CVEs to Steal Credentials and Hijack TeamPCP Infrastructure", "post_published": "2026-05-07", "description": "New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services to harvest credentials from cloud, container, and financial platforms.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-9501" ] }, { "cve_id": "CVE-2025-48703", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/pcpjack-worm-exploits-5-cves-credential-theft-2026.html", "post_title": "PCPJack Worm Exploits 5 CVEs to Steal Credentials and Hijack TeamPCP Infrastructure", "post_published": "2026-05-07", "description": "New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services to harvest credentials from cloud, container, and financial platforms.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-48703" ] }, { "cve_id": "CVE-2025-29927", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/pcpjack-worm-exploits-5-cves-credential-theft-2026.html", "post_title": "PCPJack Worm Exploits 5 CVEs to Steal Credentials and Hijack TeamPCP Infrastructure", "post_published": "2026-05-07", "description": "New credential theft framework PCPJack exploits five CVEs to spread worm-like across cloud environments while deliberately removing TeamPCP artifacts. The campaign targets Docker, Kubernetes, and multiple cloud services to harvest credentials from cloud, container, and financial platforms.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2025-29927" ] }, { "cve_id": "CVE-2026-33827", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-april-patch-tuesday-wormable-2026.html", "post_title": "April Patch Tuesday: 163 Vulnerabilities, a Wormable TCP/IP RCE, and Two Already-Exploited Flaws", "post_published": "2026-05-05", "description": "Microsoft", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-33827" ] }, { "cve_id": "CVE-2026-32202", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/microsoft-april-patch-tuesday-wormable-2026.html", "post_title": "April Patch Tuesday: 163 Vulnerabilities, a Wormable TCP/IP RCE, and Two Already-Exploited Flaws", "post_published": "2026-05-05", "description": "Microsoft", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-32202" ] }, { "cve_id": "CVE-2026-0625", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/chrome-zero-day-webgpu-cve-2026-5281.html", "post_title": "Chrome Zero-Day CVE-2026-5281: Active Exploitation of a WebGPU Use-After-Free", "post_published": "2026-05-05", "description": "A use-after-free in Chrome", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-0625" ] }, { "cve_id": "CVE-2023-50224", "post_url": "https://threat-intelligence.redeyesecurity.com/blog/apt28-router-dns-hijacking-2026.html", "post_title": "Russia's APT28 Is Hijacking Your Router to Steal Microsoft 365 Credentials", "post_published": "2026-05-05", "description": "GRU-affiliated APT28 exploited unpatched TP-Link routers to perform DNS hijacking against NATO members and Ukraine, capturing M365 credentials via adversary-in-the-middle infrastructure.", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-50224" ] } ] }