U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Google Chromium V8 flaw, tracked as CVE-2026-85046 (CVSS score of 8,8), to its Known Exploited Vulnerabilities (KEV) catalog.

This week, Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046, an actively exploited V8 type confusion flaw.

The bug affects Chrome’s JavaScript and WebAssembly engine and could let a remote attacker execute arbitrary code inside the browser sandbox by using a specially crafted HTML page.

“CVE-2026-85046: Type confusion in V8.” reads the advisory. “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”

As usual, Google did not disclose technical details about the attacks exploiting this vulnerability or attribute them to any specific threat actor.

Security researcher Salvatore Gulizia, known as Serotav, reported the flaw on August 4, 2026, and received a $1,000 bug bounty.

“a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arb r/w on the js heap.” wrote Serotav. “The bug was present in both maglev and turbofan.”

CVE-2026-85046 is the sixth actively exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild:

• February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS.
• March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine.
• April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing.
• June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine

Google has updated Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, with the rollout happening over the coming days and weeks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by September 18, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-81578 (CVSS score of 8.8) PaperCut NG/MF Missing Authentication for Critical Function Vulnerability 
• CVE-2026-82078 (CVSS score of 9.4) PaperCut NG/MF Unsafe Reflection Vulnerability 

PaperCut, the print management software running in schools, hospitals, and offices worldwide, recently confirmed that a pre-authentication remote code execution flaw, tracked as CVE-2026-81578, is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install.

“Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress.

“Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.”

The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page.

PaperCut checks the permissions for the page it displays instead of the action it actually performs. The flaw CVE-2026-81578 can let an attacker change the server’s configuration without logging in.

That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server.

The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic.

The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse.

The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise.

“After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb”

PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published.

The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available.

Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level.

The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 14.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2023-49105 ownCloud Improper Authentication Vulnerability
• CVE-2026-53362 Linux Kernel Unspecified Vulnerability
• CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability 

CVE-2023-49105 (CVSS score of 9.8) is an improper-authentication flaw in ownCloud Server’s WebDAV functionality. An unauthenticated attacker who knows a victim’s username can read, alter, or delete that user’s files when no signing key is configured, because the application can accept pre-signed URLs without properly validating that condition. The issue affects ownCloud core versions 10.6.0 through 10.13.0, before version 10.13.1.

Organisations running affected ownCloud instances should treat remediation as urgent, review exposed WebDAV services, and investigate unusual file access, deletion, modification, or downloads.

CVE-2026-53362 (CVSS score of 7.8) is an out-of-bounds memory-write vulnerability in the Linux kernel’s IPv6 networking subsystem. A local attacker who can create UDP sockets could exploit an incorrect parameter-length calculation during fragmented IPv6 packet handling to overwrite kernel memory, potentially causing a system crash, corrupting data, or escalating privileges.access.

Shortly after the Hugging Face incident became public, OpenAI said its models had identified and exploited a zero-day vulnerability in JFrog’s Artifactory package registry manager.

The report also describes a separate incident on July 19. In that case, some AI agents exploited the Linux kernel vulnerability, CVE-2026-53362, to gain higher privileges inside an OpenAI environment.

The agents detected that the Linux kernel on their machine was vulnerable, found a public exploit, modified it to work in their environment, and used it to gain root access to the underlying worker node. This allowed them to escape the Artifactory container and move laterally to other parts of the connected environment.

CVE-2026-66384 (CVSS score of 5.3) is a path-traversal vulnerability in JFrog Artifactory’s Docker cache handling. Under specific remote-repository conditions, an authenticated user can manipulate a file path and write data outside the intended cache directory, potentially affecting other locations on the Artifactory host.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw CVE-2026-66384 by September 10, while the remaining must be addressed by August, 30, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability
• CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
• CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
• CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability
• CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2015-3246 is a race condition in Red Hat libuser that could let an authenticated local user corrupt /etc/passwd to cause denial of service or escalate privileges.

CVE-2015-5287 is a privilege escalation bug in Red Hat Automatic Bug Reporting Tool that could allow local users with certain permissions to gain higher privileges via a symlink attack on a predictable file.

CVE-2019-1068 is a remote code execution flaw in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.

CVE-2021-23758 (CVSS score not specified in the KEV notice) is a deserialization of untrusted data vulnerability in Ajax.NET Professional that could allow for remote code execution via arbitrary .NET classes.

CVE-2022-0995 (CVSS score not specified in the KEV notice) is an out-of-bounds memory write vulnerability in Linux Kernel that could allow a local user to gain privileged access or cause a denial of service on the system.

CVE-2026-8452 (CVSS score not specified in the KEV notice) is an improper restriction of operations within the bounds of a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway that could lead to denial-of-service and has been observed under active exploitation in the wild.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, while the remaining must be addressed by September 9, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gitea flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-60004 (CVSS score of 9,8), to its Known Exploited Vulnerabilities (KEV) catalog.

Gitea is an open-source platform for hosting and managing Git repositories. Think of it as a self-hosted alternative to GitHub or GitLab.

CVE-2026-60004 is a critical remote code execution flaw that allows an attacker with write access to a repository to execute arbitrary shell commands as the Gitea service user.

The flaw affects Gitea versions from 1.17 and was fixed in 1.27.1. The vulnerable diffpatch API can be abused to plant and execute a malicious Git hook. Because Gitea enables open registration by default, an unauthenticated attacker can create an account, create a repository, and exploit the flaw without existing credentials. A reported attack used the vulnerability to deploy a cryptocurrency-miner-like payload after an exposed Gitea instance allowed open registration and anonymous access to its web interface.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by August 28, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-21962 (CVSS score of 10,0), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-21962 is a critical, unauthenticated vulnerability affecting the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS.

An attacker does not need an account or valid credentials. With network access, they can exploit the flaw remotely through HTTP and potentially compromise the affected server. Successful exploitation could allow the attacker to access, modify or delete critical data, potentially gaining broad access to information available through the affected components.

“Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in accessible data,” CISA reports.

The vulnerability also has a scope-change impact, meaning an attacker who exploits it could potentially affect other systems or applications connected to the vulnerable Oracle components.

The flaw affects versions: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0.

In practical terms, this is dangerous because an internet-accessible Oracle WebLogic proxy component could provide an attacker with a path into critical backend systems without requiring authentication.

In March 2026, CloudSEK researchers detected attacks targeting several known flaws in Oracle WebLogic against its honeypot network. Attackers also targeted CVE-2026-21962 along with older WebLogic RCE vulnerabilities, including CVE-2020-14882/14883, CVE-2020-2551 and CVE-2017-10271.

“This report analyzes attack data collected from a high-interaction honeypot simulating a vulnerable Oracle WebLogic Server (v14.1.1.0.0) over a 12-day period (Jan 22 – Feb 3, 2026). The primary focus is the immediate and widespread exploitation of the newly disclosed, critical unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2026-21962 (CVSS: 10.0).” ” reads the report published CloudSEK.

“In addition to CVE-2026-21962, the honeypot captured attacks targeting other persistent, critical WebLogic RCE flaws, including CVE-2020-14882/14883 (Console RCE), CVE-2020-2551 (IIOP RCE), and CVE-2017-10271 (WLS-WSAT RCE). This confirms that threat actors continue to rely on a small set of highly-effective, simple-to-exploit vulnerabilities to compromise WebLogic environments.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by August 27, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Zimbra Collaboration Suite (ZCS) flaw CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog.

CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting the critical vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution and was patched less than a month ago.

“The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the  snmp_notify parameter  and the swatchdog service running (enabled by default).”

The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component.

Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough.

The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations.

Below are recommendations by CERT Polska:

“Due to the ongoing campaign exploiting this vulnerability, we recommend:

• verifying Zimbra logs /var/log/zimbra.log for the following entries:

Service status change: <szkodliwy ładunek> changed from stopped to running
Service status change: <szkodliwy ładunek> changed from running to stopped

• verification of files created by user zimbra in the last 30 days in the following directories:

/opt/zimbra/jetty/webapps/
/opt/zimbra/jetty_base/webapps/
/tmp/

If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by August 24, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-72529 (CVSS score of 9.3) TrueConf Server Missing Authentication for Critical Function Vulnerability  
• CVE-2026-72530 (CVSS score of 9.5) TrueConf Server Code Injection Vulnerability

TrueConf Server is an on-premises video conferencing and unified communications platform developed by TrueConf. Organizations can deploy it on their own infrastructure to provide secure video meetings, voice calls, messaging and collaboration without relying entirely on a cloud service.

It is typically used by businesses, government organizations and other institutions that want to keep communications and related data under their own control.

CVE-2026-72529 is a remote code execution vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to execute arbitrary scripts by calling an undocumented function.

The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. An attacker who can reach the vulnerable service could potentially compromise the server and use it as an entry point into the affected network.

CVE-2026-72530 is a sandbox escape vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to break out of an isolated environment and execute arbitrary code on the underlying host.

The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. By sending a specially crafted script, an attacker could escape the restricted environment and gain code execution on the host system, potentially leading to a full server compromise.

In the context of CVE-2026-72529 and CVE-2026-72530, the concern is that vulnerable TrueConf Server installations exposed on TCP port 4307 could provide attackers with a path to execute code on the server.

Vyacheslav Kopeytsev from Kaspersky ICS CERT discovered both vulnerabilities.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2nd.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an MLflow vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2026-64849 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-64849 is a critical server-side request forgery (SSRF) vulnerability in MLflow, a platform for managing machine-learning workflows. The issue affects MLflow versions before 3.15.0 and a remote attacker can exploit the issue without authentication. The vulnerability allows attackers to make requests from an exposed MLflow server to internal services, including cloud metadata endpoints, potentially exposing temporary cloud credentials.

Attackers are actively exploiting CVE-2026-64849 to access cloud metadata services and steal credentials and secrets. Cybersecurity firm watchTowr also observed widespread scanning for exposed MLflow instances just hours after the CVE was assigned on August 17, 2026.

“watchTowr Intel is observing in-the-wild exploitation of a critical unauthenticated Server-Side Request Forgery vulnerability in MLflow (CVE-2026-64849), the open-source platform for managing the machine learning and AI development lifecycle, with over 60 million monthly downloads.” watchTowr said in a post on LinkedIn. “Attackers are exploiting the vulnerability to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets. Within hours of the CVE being assigned, Attacker Eye, our global honeypot network, detected attackers indiscriminately scanning for exposed MLflow systems online, capturing attempts against cloud-hosted instances.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Ray-Project Ray vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2025-62593 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2025-62593 is a critical remote code execution (RCE) vulnerability in Ray, an AI compute engine. Versions before 2.52.0 insufficiently protected the Ray dashboard/API against browser-based attacks. Its defense relied on checking whether the HTTP User-Agent header started with “Mozilla”, but browsers can modify this header.

By combining this weakness with DNS rebinding, an attacker could potentially execute arbitrary code on a developer’s machine simply by getting them to visit a malicious website or view a malicious advertisement while running Ray. The vulnerability affects Firefox and Safari. Ray 2.52.0 fixes the issue.

“This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string “Mozilla” as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified.” reads the advisory. “Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising).”

“An attacker exploited a code injection vulnerability in Ray AI Compute Engine via a DNS rebinding attack, leading to remote code execution. This allowed the attacker to escalate privileges within the system, move laterally across the network, establish command and control channels, exfiltrate sensitive data, and ultimately disrupt operations.” reads the analysis published by Aviatrix.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 20, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Progress LoadMaster vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2026-8037 (CVSS score of 9.6), to its Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability is an OS Command Injection Remote Code Execution issue that resides in API in Progress ADC Products. An unauthenticated attacker can trigger the flaw to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

In early July, cybersecurity firm eSentire observed exploitation attempts targeting CVE-2026-8037. Activity began June 29, 2026, but the attacks failed and no post-compromise activity was detected. Researchers warned that the public PoC and technical details could lead to increased exploitation.

“Beginning on June 29th, 2026, eSentire’s Threat Response Unit (TRU) identified exploitation attempts targeting the critical Progress Kemp LoadMaster vulnerability CVE-2026-8037. The vulnerability was initially disclosed on June 4th and functional Proof-of-Concept (PoC) exploit code was released on June 29th. CVE-2026-8037 (CVSS: 9.6), is an OS Command Injection Remote Code Execution (RCE) vulnerability which allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance.” eSentire reports.

“As active exploitation attempts have been identified, it is critical that organizations apply the relevant security patches immediately.”

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 10, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a JetBrains TeamCity vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a JetBrains TeamCity vulnerability, tracked as CVE-2026-63077 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.

At the end of July, JetBrains released security updates for TeamCity On-Premises after discovering the critical vulnerability CVE-2026-63077. The flaw could allow unauthenticated attackers to execute arbitrary commands on affected servers. All on-premise versions are impacted, while TeamCity Cloud instances have already been patched. Users are advised to upgrade to versions 2025.11.7 or 2026.1.3.

“A critical security vulnerability has been identified in TeamCity On-Premises and assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-63077.” reads the advisory. “If exploited, this vulnerability may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands.”

The TeamCity vulnerability affects servers exposed via HTTP(S) and can be exploited without authentication through the agent polling protocol. An attacker could bypass authentication and execute arbitrary OS commands with TeamCity server privileges, potentially accessing sensitive data, credentials, configurations, altering server settings, and compromising CI/CD pipelines. JetBrains recommends restricting network access, applying least-privilege configurations, and running TeamCity on dedicated hosts separated from build agents. No active exploitation has been observed at disclosure time.

The company has also released a security patch plugin for organizations unable to immediately upgrade TeamCity to versions 2025.11.7 or 2026.1.3. The plugin fixes only CVE-2026-63077 and can be installed on TeamCity 2017.1 and later. For newer versions, security patches can be managed directly from the administration console.

“The security patch plugin will address only the vulnerability described above (CVE-2026-63077).” continues the advisory.”We always recommend upgrading your server to the latest version to benefit from many other security updates.”

JetBrains recommends protecting internet-facing TeamCity servers by requiring VPN access or adding extra security controls. Exposing login pages or REST APIs can provide attackers with potential entry points to exploit newly disclosed vulnerabilities.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 8, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Langflow, Apache Tomcat, and N-able N-central flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-9198 (CVSS score of 9.8) IBM Langflow Code Injection Vulnerability
• CVE-2026-18556 (CVSS score of 8.2) N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-34486 (CVS score of 7.5) Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

The first issue added to the catalog, tracked as CVE-2026-9198, is a critical issue in IBM Langflow OSS versions 1.0.0–1.10.0 that lets unauthenticated attackers gain superuser access and execute arbitrary code, leading to full remote code execution on default deployments.

The second issue, tracked as CVE-2026-18556, is an authentication bypass flaw in N-able N-central that allows attackers to access affected systems without valid credentials, impacting versions through 2026.1.

The last issue added to the KeV catalog is CVE-2026-34486, a flaw in Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 that can bypass the EncryptInterceptor, exposing sensitive data.

Researchers linked the exploitation of CVE-2026-34486 to a Chinese-speaking threat actor that used an AI-powered autonomous hacking agent based on DeepSeek to identify and exploit internet-facing vulnerabilities. When one attack path failed, the AI independently searched for alternative flaws, while the attackers also carried out manual exploitation of vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo, and IKE VPN systems.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by August 7, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a N-able N-central flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a N-able N-central flaw, tracked as CVE-2026-18577 (CVSS score of 8.2), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-18577 (CVSS 8.2) is an authentication bypass flaw caused by an incomplete fix for a previous vulnerability tracked as CVE-2026-18556. It allows remote attackers to take over accounts and gain administrative access to vulnerable N-able N-central servers. From there, they can use the built-in Take Control feature to move into managed endpoints and establish persistent access.

The company confirmed that a limited number of customers have been identified to be impacted by this, and, for those impacted customers, N‑able support has directly engaged. If you’re a customer who is not running the most recent version of N‑central, we strongly encourage you to upgrade to 2026.3.1.7.

Organizations can check for compromise by looking for a suspicious svchost.exe file in users’ Documents folders, a registered Cloudflared service, or inbound firewall connections from the listed IP addresses:

• 173[.]249[.]252[.]200
• 87[.]249[.]138[.]34
• 37[.]19[.]210[.]32
• 68[.]235[.]46[.]214. 

If any indicators are found, they should immediately contact N-able support and their security team.

Huntress researchers observed attackers exploiting CVE-2026-18577 against multiple organizations, although the activity does not yet appear to be widespread. After gaining access, attackers conducted reconnaissance, targeted domain controllers, enumerated processes, and moved laterally across networks.

“As Huntress continues our investigation and analysis of activity targeting vulnerable N-able N-central environments, we discovered that the four IPs N-able initially flagged as malicious are actually Mullvad or NordVPN VPN exit nodes.” reads the Huntress’s report. “Notably, among the original IPs, we have seen substantial traffic with 87.249.138[.]34 directly attributed to NordVPN, as well as substantial traffic with 37.19.210[.]32 directly attributed to Mullvad VPN. 37.19.210[.]32 has been previously abused for bruteforcing, spam, and other nefarious activity prior to this incident.”

N-able confirmed that a limited number of customers were compromised, highlighting the ongoing abuse of remote monitoring and management (RMM) platforms to gain persistent access.

Huntress warned that more than half (55.6%) of the reachable N-central cloud servers used by its partners and customers remained unpatched against CVE-2026-18577, leaving them exposed to exploitation. The company also noted that N-able added two more malicious IP addresses to its indicators of compromise and said it will continue investigating the attacks and provide updates as new findings emerge.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 6, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Cisco Secure Firewall Management Center (FMC) flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Secure Firewall Management Center (FMC) flaw, tracked as CVE-2026-20316 (CVSS score of 5.3), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-20316 is a static credential vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to authenticate using a built-in low-privileged account and access sensitive information stored on the affected system.

“A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.” reads the advisory. “A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.”

The flaw stems from the presence of hardcoded credentials for a low-privileged user account. Although the account provides limited access, it could be combined with other Cisco Secure FMC Software vulnerabilities to achieve privilege escalation. The attack surface is reduced if the FMC management interface is not exposed to the public internet.

Cisco released the following hot fixes to address this issue:

Cisco Secure FMC Software Release	Hot Fix Name
7.0	Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2	Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4	Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6	Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7	Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0	Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Cisco confirmed active exploitation of the vulnerability in July 2026 and strongly urges customers to upgrade to a fixed software release immediately.

“In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” states the advisory.

Administrators can check for exploitation by running cat /var/log/messages | grep license in expert mode. If the logs contain references to /var/tmp/license.tmp, the device may have been compromised. Cisco advises organizations that suspect exploitation to contact TAC for recovery assistance and immediately rotate all user credentials, cryptographic keys, and certificates, as the vulnerability has been actively exploited.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 1st, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Check Point flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the flaws added to the KeV catalog:

• CVE-2026-16232 (CVSS score of 9.3) Check Point SmartConsole Improper Authentication Vulnerability
• CVE-2026-50522 (CVSS score of 9.8) Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

The first flaw added to the KeV catalog is a critical authentication bypass flaw, tracked as CVE-2026-16232, affecting Security Management and Multi-Domain Management (MDSM).

The vulnerability, which is under active exploitation, allows unauthenticated remote attackers to obtain a SmartConsole login token and gain full administrative access.

“An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration. Check Point is aware that this vulnerability is being exploited, impacting a very small number of customers.” reads the advisory. “Successful remote exploit requires internet access to the Management Server IP address and no restrictions on Trusted Clients (GUI clients).”

Successful exploitation requires the Management Server to be accessible from the internet and Trusted Clients (GUI client) access restrictions to be disabled.

Check Point said it is aware of a limited number of customers targeted through CVE-2026-16232 and has already notified the affected organizations. The following attacker IP addresses have been identified as indicators of compromise (IoCs):

• 151.241.99[.]207
• 151.241.99[.]233
• 158.62.198[.]182
• 192.142.10[.]99
• 139.28.37[.]250
• 194.213.18[.]137

The flaw impacts the following products and versions:

• Products: Security Management Server, Multi-Domain Security Management Server (MDS)
• Product Versions: R77.30, R80, R80.10, R80.20, R80.30, R81 R81.10, R81.20, R82, R82.10

The second issue added to the catalog is a critical Microsoft SharePoint vulnerability, tracked as CVE-2026-50522, that is being actively exploited following the release of a public proof-of-concept (PoC) code, according to watchTowr researchers.

Patched in Microsoft’s July 2026 Patch Tuesday, the deserialization flaw allows authenticated attackers with Site Owner privileges to execute arbitrary code remotely on vulnerable SharePoint servers.

CVE-2026-50522 and CVE-2026-58644 are a matched pair of SharePoint remote code execution bugs; both can be triggered without authentication or user interaction, and stemming from the deserialization of untrusted data. CVE-2026-50522 was demonstrated live at Pwn2Own Berlin, meaning a working exploit was handed to Microsoft. Despite that, the advisory lists exploit maturity as unknown.

Organizations should apply the available security updates immediately.

watchTowr observed active exploitation of CVE-2026-50522 targeting on-premises Microsoft SharePoint servers shortly after public exploit code was released. Attackers are using the flaw to steal SharePoint machine keys in a single request, enabling persistent access even after patching. Security experts warn that organizations should not only apply Microsoft’s updates but also rotate machine keys and other potentially exposed credentials to prevent long-term compromise.

“On July 20th, watchTowr identified proof-of-concept exploit code for this vulnerability. Within hours, our global honeypot network, Attacker Eye, captured exploitation attempts using this PoC that successfully compromised target systems.” watchTowr wrote on LinkedIn. “Attackers are pulling SharePoint machine keys via a single request. Patching is not enough, defenders should rotate credentials on any assets that may have been exposed.”

Cybersecurity firm Defused Cyber also spotted threat actors exploiting CVE-2026-50522 to deliver a .NET deserialization payload through a SharePoint sign-in endpoint. The observed attacks require no authentication, consistent with the vulnerability’s unauthenticated remote code execution profile.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these flaws by July 25, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the flaws added to the KeV catalog:

• CVE-2021-27137 (CVSS score of 8.1) DD-WRT Stack-Based Buffer Overflow Vulnerability
• CVE-2026-0770 (CVSS score of 9.8) Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability  
• CVE-2026-63030 (CVSS score of 9.8) WordPress Core Interpretation Conflict Vulnerability  
• CVE-2026-60137 (CVSS score of 5.9) WordPress Core SQL Injection Vulnerability

The first issue added to the catalog is CVE-2021-27137, a buffer overflow vulnerability affecting DD-WRT before version 45724. The flaw exists in the UPnP handling functionality (ssdp.c) due to an unsafe strcpy operation in the ssdp_msearch function. An unauthenticated remote attacker could exploit the issue by sending a specially crafted M-SEARCH request to trigger a buffer overflow and potentially execute arbitrary code. Exploitation requires UPnP to be enabled, as it is disabled by default and typically limited to internal interfaces.

The second issue added to the catalog is CVE-2026-0770, a critical remote code execution vulnerability affecting Langflow. The flaw exists in the handling of the exec_globals parameter in the validate endpoint, where the application improperly loads functionality from an untrusted control sphere. An unauthenticated remote attacker can exploit the vulnerability to execute arbitrary code with root privileges on affected systems.

Regarding WordPress issues added to the catalog, public proof-of-concept exploits are now available for the critical wp2shell vulnerabilities affecting WordPress Core. The flaws, tracked as CVE-2026-63030 and CVE-2026-60137, can be chained to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x.

CVE-2026-63030 is a REST API batch-route confusion bug introduced in WordPress 6.9. CVE-2026-60137 is a high-severity SQL injection flaw in the author__not_in parameter of WP_Query, affecting.

“The 7.0.2 security release addresses one critical and one high severity security issue.” reads the WordPress announcement.

“Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.”

Cybersecurity researchers at Searchlight Cyber discovered the flaws that can allow remote attackers to compromise vulnerable sites without valid credentials, making immediate patching essential.

“Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core. The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.” reads the advisory. “It is estimated that over 500 million websites use WordPress.”

Researchers withheld technical details to give organizations time to patch, but released an online tool to help administrators check whether their WordPress instances are vulnerable.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these flaws by July 24, 2026, except for CVE-2026-60137, which must be fixed by August 4.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities (KEV) catalog.

• CVE-2026-25089 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability  
• CVE-2026-39808 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability  
• CVE-2026-58644 (CVSS score of 9.8) Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

This week, Microsoft’s July 2026 Patch Tuesday addressed the SharePoint remote code execution bug CVE-2026-58644, which can be triggered without authentication or user interaction. The flaw stems from the deserialization of untrusted data.

“Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.” reads the advisory. “In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server.”

Microsoft confirmed it is aware of active exploitation of this vulnerability.

The second issue added to the KeV catalog is an OS command injection flaw, tracked as CVE-2026-25089, in FortiSandbox products. The vulnerability could allow remote, unauthenticated attackers to send specially crafted HTTP requests and execute arbitrary commands on affected devices. Adham El Karn of Fortinet Product Security team discovered the vulnerability.

The last issue added to the catalog, tracked as CVE-2026-39808, is an OS command injection flaw.

“An Improper Neutralization of Special Elements used in an OS Command (‘OS command injection’) vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.” reads the advisory.

Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of this vulnerability within a 24-hour window.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to urgently fix these flaws by July 19, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The flaws added to the catalog are:

• CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
• CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability
• CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
• CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

This week, SonicWall confirmed the active exploitation of two zero-day vulnerabilities affecting Secure Mobile Access (SMA) 1000 appliances. The vulnerabilities were internally discovered and reported by Adam Babis of the company’s PSIRT.

The company investigated multiple incidents indicating these vulnerabilities are being actively exploited in the wild.

The first vulnerability, tracked as CVE-2026-15409 (CVSS score of 10.0), is a Server-side request forgery (SSRF) issue that a remote unauthenticated attacker could exploit to potentially cause the appliance to make requests to an unintended location.

“A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.” reads the advisory.

The second vulnerability, tracked as CVE-2026-15410 (CVSS score of 7.2), is a post-authentication code injection flaw in the Appliance Management Console (AMC) that a remote authenticated attacker could exploit to execute arbitrary operating system commands as administrator under certain conditions.

“Post-authentication improper control of generation of code (‘Code Injection’) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.” continues the advisory. “SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory.”

Regarding the other two issues added to the KEV catalog this month, Microsoft’s July 2026 Patch Tuesday security updates fixed a record 621 CVEs, including two that are being actively exploited as zero-days.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to urgently fix the vulnerabilities by July 17, 2026, except CVE-2026-56155, which must be addressed by July 28, 2026

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)