Cyber Threat Radar & Zero-Days

UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from UnrealIRCd.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from BroadWorks.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Webtop Media Transcoder.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Office.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from GPUStack.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Media Server.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from PHP.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from SonicOS SSLVPN.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Brotli.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Multiple Products.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from WordPress Core.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Kernel.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Secure Firewall ASA Software and Cisco Secure FTD Software.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Connect Secure.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Connect Secure.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Community Edition and Enterprise Edition.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from VMware ESX.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Commerce and Magento.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from PHP.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Media Server.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Collabora Online – Built-in CODE Server.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from VeloCloud Orchestrator.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Media Server.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Media Server.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from SiteGuard Server Edition.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from AhsayCBS.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Secure Email Gateway.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Multiple Products.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Remote Support.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Multiple Products.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from AhsayCBS.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Connect Secure.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from BIND.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Strapi.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. This vulnerability has been officially cataloged in the CISA Known Exploited Vulnerabilities (KEV) database due to active in-the-wild exploitation by threat actors. Organizations are advised to remediate immediately.

• ✓Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• ✓Enforce CISA BOD compliance guidelines and verify perimeter access controls.
• ✓Monitor SIEM logs for anomalous outbound network connections from Struts.
• ✓Isolate public-facing management interfaces behind VPN with FIDO2 multi-factor authentication.

Logical authorization flaws in REST and GraphQL microservices allow authenticated users to view or alter data records belonging to other tenants simply by replacing object identifiers in request parameters.

• ✓Implement server-side user ownership validation on every data access query
• ✓Use unpredictable GUIDs/UUIDs instead of sequential numeric IDs
• ✓Deploy automated API security gateways with contextual authorization filters

Automated cloud reconnaissance scripts target misconfigured IAM policies that permit PassRole, AttachUserPolicy, or CreateAccessKey actions, allowing lateral movement from development sandboxes into production cloud assets.

• ✓Enforce strict Principle of Least Privilege (PoLP) with automated IAM linting
• ✓Enable continuous CloudTrail and GuardDuty anomaly detection
• ✓Implement AWS SCPs (Service Control Policies) restricting privilege changes

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-3785. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

Internal network assessments demonstrate that adversaries with initial access leverage unconstrained delegation and weak Service Principal Name (SPN) passwords to extract service ticket hashes offline for brute-forcing.

• ✓Disable legacy NTLM and SMBv1 protocols across all subnets
• ✓Enforce AES-256 encryption on all Active Directory service accounts
• ✓Deploy honey tokens to detect unauthorized SPN enumeration requests

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-3230. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-7023. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-2217. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-4829. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-5275. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-5494. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

MNA Tech Academy Threat Intel monitors active scanning and exploitation targeting CVE-2026-7174. Security teams must review internal firewall and proxy access logs for unauthorized outbound connections. Fresh practical defenses and IOC detection rules have been updated in our practical SOC labs.

• ✓Deploy latest emergency vendor patch
• ✓Audit incoming perimeter network telemetry for anomalous signatures
• ✓Enforce zero-trust architecture with certificate-based authentication
• ✓Contact MNA Tech SOC team for immediate incident triage and isolation

A flaw in the eBPF verifier allows local unprivileged accounts to craft ring-buffer memory corruptions. Once executed, the exploit manipulates task credentials to acquire root (UID 0), allowing container escapes in shared Kubernetes cloud clusters.

• ✓Apply updated distro kernel packages immediately
• ✓Disable unprivileged eBPF via sysctl: kernel.unprivileged_bpf_disabled=1
• ✓Enforce SELinux / AppArmor confinement on shared multi-tenant hosts
• ✓Deploy runtime threat detection agents to detect anomalous kernel rings

An attacker took over the maintainer account of an established open-source string manipulation library through session hijacking. A minor version update contained minified, obfuscated JavaScript designed to inspect environment variables (.env files) during application build steps and transmit AWS access secrets to a command-and-control server in Eastern Europe.

• ✓Lock dependencies with strict hash verification in package-lock.json
• ✓Utilize private package proxies with malware scanning filters
• ✓Mandate automated Software Bill of Materials (SBOM) audits in CI pipelines
• ✓Rotate all production AWS and database credentials exposed during builds

Security researchers at MNA Tech analyzed an emerging threat vector targeting autonomous LLM agents that execute external system shell commands. By sending crafted text files or support emails containing indirect prompt injection payloads, attackers deceive the underlying model into invoking arbitrary OS-level subprocesses, extracting cloud API keys from container memory.

• ✓Sanitize external LLM context retrieved from untrusted RAG databases
• ✓Restrict AI agent tool-calling permissions to sandboxed Docker microVMs
• ✓Implement strict token validation and human-in-the-loop for file operations
• ✓Audit prompt injection filters using automated red teaming scripts

A high-impact Broken Object Level Authorization (BOLA) and IDOR vulnerability was uncovered in third-party instant payment routing middleware. Attackers manipulate client-side JSON request parameters to substitute target bank account IDs without session re-authentication. The vulnerability allowed automated credential-stuffing bots to query balances and trigger micro-debit requests.

• ✓Enforce cryptographic object-level authorization (BOLA/IDOR protection)
• ✓Deploy AI-driven rate limiting on transactional endpoints
• ✓Adopt CERT-In mandated security audits for mobile financial applications
• ✓Implement strict mutual TLS (mTLS) for microservice API gateways

Threat actors are actively leveraging an unauthenticated path traversal and buffer overflow in the web management daemon of widely deployed enterprise SSL VPN appliances. Successful exploitation allows arbitrary shell command execution with root privileges, bypassing session authentication entirely. Once access is established, attackers deploy Cobalt Strike beacons, perform active Active Directory reconnaissance, and stage double-extortion ransomware payloads.

• ✓Apply vendor emergency hotfix immediately
• ✓Disable remote management WAN interfaces
• ✓Enforce hardware FIDO2 MFA across all VPN endpoints
• ✓Isolate internal DMZ from production core switches

A critical remote code execution vulnerability discovered in Apache Log4j affecting millions of servers worldwide. Immediate patching required.

• ✓Apply vendor patches
• ✓Review access logs
• ✓Implement MFA

Technical analysis of the latest ransomware attack targeting major infrastructure. Indicators of compromise and remediation steps provided.

• ✓Apply vendor patches
• ✓Review access logs
• ✓Implement MFA