Updated weekly

Industry Pulse: this week in global cybersecurity

Every week we review official advisories and guidance from bodies such as CISA, the UK National Cyber Security Centre, CERT-EU, and NIST, along with newly exploited vulnerabilities. We then summarize what changed, why it matters to a global enterprise, and the action a security leader should take. Every item links to its original source so your team can verify it.

Discuss this week's exposure with an advisor Browse assessments and playbooks

Week of September 7, 2026Current briefing

Critical enterprise perimeter infrastructure and core business platforms face widespread exploitation alongside emerging strategic threats to artificial intelligence assets.

This week's advisories highlight severe operational risks spanning corporate network gateways, enterprise resource planning platforms, and proprietary artificial intelligence ecosystems. Security executives must prioritize emergency patching for actively exploited edge management systems and remote access gateways from Cisco, Citrix, and Check Point. In parallel, organizations should implement safeguards against automated model distillation and begin inventorying cryptographic assets for the post-quantum transition.

North AmericaSep 8, 2026
CISA Warns of Industrial-Scale AI Model Distillation Campaigns
CISA released an advisory detailing industrial-scale model distillation campaigns conducted by China-based artificial intelligence entities targeting United States AI firms. The operation involves systematic extraction of proprietary capabilities and intellectual property through structured querying against commercial AI interfaces.
Why it matters: These activities threaten core competitive advantages and proprietary investments in advanced machine learning systems. Corporate leadership must recognize model distillation as a serious intellectual property exfiltration vector that bypasses traditional network defense perimeters.
Recommended action: Security and machine learning engineering teams should audit API access controls, establish query rate limiting, and deploy behavioral anomaly detection across public AI endpoints.
Source: CISA
EMEA
CERT-EU Alerts on Critical Vulnerabilities in Check Point Products
CERT-EU published security advisory 2026-012 warning of critical vulnerabilities discovered across Check Point enterprise solutions. The flaws present severe security risks that could permit unauthorized manipulation of perimeter defense systems.
Why it matters: Security appliances serve as the primary defensive barrier for enterprise networks, making vulnerabilities in these platforms prime targets for threat actors seeking entry. Successful compromise can lead to complete network visibility and subsequent lateral traversal across the corporate environment.
Recommended action: Enterprise network teams should identify all Check Point deployments and apply the latest security updates provided by the vendor immediately.
Source: CERT-EU
EMEA
Critical Weaknesses Reported in SAP Kernel and NetWeaver Message Server
CERT-EU released advisory 2026-011 identifying critical vulnerabilities affecting the SAP Kernel and NetWeaver Message Server. The flaws expose core components of the enterprise resource planning environment to potential compromise.
Why it matters: SAP systems manage mission-critical enterprise workflows including financial ledgering, supply chain logistics, and personnel records. Exploitation of message server infrastructure risks business disruption and regulatory compliance violations.
Recommended action: Organizations should review CERT-EU advisory 2026-011, restrict network access to SAP administrative ports, and patch vulnerable kernel components.
Source: CERT-EU
GlobalSep 9, 2026
CISA Adds Exploited Cisco, Citrix, and Fortinet Flaws to KEV Catalog
CISA cataloged actively exploited vulnerabilities including CVE-2026-20079 in Cisco Secure Firewall Management Center, CVE-2026-19490 in Citrix NetScaler, and CVE-2025-25249 in Fortinet platforms. These flaws permit unauthenticated remote authentication bypass and code execution leading to root access on affected devices.
Why it matters: Internet-facing edge gateways remain the preferred vector for adversaries conducting initial network intrusion. Exploitation of these appliances grants persistent access beneath standard host-based monitoring controls.
Recommended action: Administrators must audit perimeter configurations and patch all impacted Cisco, Citrix, and Fortinet devices ahead of the mandated September 2026 deadlines.
Source: CISA
North AmericaSep 3, 2026
CISA Issues Strategic Call to Action for Post-Quantum Migration
CISA published strategic guidance titled Preparing for the Post-Quantum Era: A Call to Action. The document directs critical infrastructure entities and enterprise organizations to commence proactive planning for post-quantum cryptographic standards.
Why it matters: Quantum computing advances will eventually compromise legacy asymmetric encryption algorithms, placing historical sensitive communications at risk from store-now-decrypt-later attacks. Modernizing cryptographic baselines across complex enterprise software architectures requires multi-year planning and governance.
Recommended action: Security leadership should initiate a formal cryptographic discovery project to document where vulnerable public-key algorithms are deployed across enterprise assets.
Source: CISA

Week of August 31, 2026

Active exploitation across enterprise developer tooling, communications infrastructure, and web components prompted aggressive federal remediation timelines.

During the week of August 31, 2026, security authorities identified critical vulnerabilities being actively exploited across core infrastructure, developer platforms, and client software. Enterprise defenders faced compressed mitigation windows for unauthenticated flaws affecting software repositories, workflow orchestrators, and telephony appliances. Technology leaders had to coordinate rapid patching across both backend services and distributed endpoint browsers to mitigate systemic compromise.

GlobalSep 2, 2026
JFrog Artifactory Authentication Flaw
JFrog Artifactory contains an improper authentication vulnerability tracked as CVE-2026-82329. Under default configurations, the flaw allows an unauthenticated attacker with network access to obtain administrative privileges. CISA added the vulnerability on September 2, 2026, with a remediation deadline of September 5, 2026.
Why it matters: Compromise of an enterprise artifact repository represents a direct threat to the software supply chain. Attackers gaining administrative control can tamper with build artifacts, inject malicious code, and compromise downstream production environments.
Recommended action: Security leaders must verify Artifactory configurations and apply the vendor security patch immediately across all environments.
Source: CISA
GlobalSep 2, 2026
Sangoma Switchvox SQL Injection
Sangoma Switchvox contains a SQL injection vulnerability designated as CVE-2026-9586. The issue allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request. This exploitation enables database operations and remote code execution.
Why it matters: Telephony appliances often reside at perimeter interfaces and interface with internal directory systems. Unauthenticated remote code execution on communications infrastructure grants adversaries an immediate initial access foothold within enterprise networks.
Recommended action: Enterprise infrastructure teams must isolate exposed Sangoma Switchvox appliances and deploy available vendor updates without delay.
Source: CISA
GlobalSep 2, 2026
Kestra OSS Command Injection
Kestra OSS contains an OS command injection vulnerability cataloged under CVE-2026-49869. The flaw allows an unauthenticated remote attacker to create and execute arbitrary workflows without valid credentials. The vulnerability was added to the federal catalog on September 2, 2026, with remediation required by September 5, 2026.
Why it matters: Workflow orchestration platforms possess broad execution privileges across cloud environments and internal data pipelines. Unauthorized workflow execution allows threat actors to run arbitrary commands and pivot into connected backend infrastructure.
Recommended action: Security teams should restrict network access to Kestra OSS instances and apply the required remediation patches immediately.
Source: CISA
GlobalSep 4, 2026
Google Chromium V8 Type Confusion
Google Chromium V8 contains a type confusion vulnerability identified as CVE-2026-85046. The flaw allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The issue affects multiple Chromium-based browsers, including Google Chrome, Microsoft Edge, and Opera.
Why it matters: Vulnerabilities in widely adopted browser engines present immediate client-side exposure across the entire enterprise workforce. Because the underlying V8 engine is shared across several major browsers, organizations must address risk across multiple software portfolios simultaneously.
Recommended action: Administrators should mandate and verify the deployment of the latest updates across all Chromium-based browsers deployed on managed endpoints.
Source: CISA

Week of August 24, 2026

Active exploitation across enterprise data infrastructure, development pipelines, and core operating systems dominated the threat landscape.

During the week of August 24, 2026, security advisories confirmed active exploitation targeting critical infrastructure spanning database engines, source control systems, web servers, and kernel networking components. Enterprise leaders had to address severe risks involving unauthenticated data manipulation, remote code execution, and privilege escalation. Immediate remediation was required to secure both edge-facing appliances and foundational backend environments against active compromise.

GlobalAug 26, 2026
Microsoft SQL Server Remote Code Execution
Microsoft SQL Server contains a remote code execution vulnerability designated as CVE-2019-1068. An attacker can exploit this flaw to execute code directly within the context of the SQL Server Database Engine service account. The vulnerability was added to the known exploited vulnerabilities catalog on August 26, 2026.
Why it matters: Compromising the database engine service account grants threat actors the ability to manipulate mission-critical databases and pivot deeper into enterprise networks. This creates immediate risks of extensive data exfiltration, unauthorized modification of sensitive records, and operational downtime. Organizations must treat database engine execution risks as critical threats to business integrity and regulatory compliance.
Recommended action: Apply the official vendor security updates for all affected Microsoft SQL Server instances immediately.
Source: CISA
GlobalAug 24, 2026
Oracle HTTP Server and WebLogic Proxy Plug-in Access Control
Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in contain an improper access control vulnerability tracked as CVE-2026-21962. This defect allows unauthorized creation, deletion, or modification of critical data. Exploitation can also lead to complete unauthorized access to all data reachable through the server and proxy plug-in.
Why it matters: Because these proxy and server components sit in front of mission-critical middleware, unauthorized data tampering undermines foundational enterprise access controls. Attackers can alter or delete sensitive business information without proper authorization. Failure to address this flaw leaves external and internal application tiers vulnerable to broad data breaches.
Recommended action: Deploy the required security patches for Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in to restore strict access boundaries.
Source: CISA
GlobalAug 25, 2026
Gitea Code Injection
Gitea contains a code injection vulnerability tracked as CVE-2026-60004. An attacker with repository write access can send a malicious patch to the diffpatch API endpoint. This action plants an executable Git hook and allows the execution of arbitrary shell commands as the Gitea service account.
Why it matters: Source code management platforms are central to enterprise software supply chain integrity. Allowing authenticated developers or compromised accounts to run shell commands introduces severe supply chain tampering risks. Such access can lead to the subversion of build pipelines and broader lateral movement across corporate environments.
Recommended action: Update Gitea installations to patched versions and restrict repository write permissions across developer accounts.
Source: CISA
GlobalAug 27, 2026
ownCloud Improper Authentication
ownCloud contains an improper authentication vulnerability identified as CVE-2023-49105. The flaw permits an attacker to access, modify, or delete any file without authentication. Successful exploitation requires knowledge of a victim username where the victim does not have a signing key configured.
Why it matters: Enterprise file sync and sharing platforms host confidential business records, intellectual property, and sensitive employee data. The ability to manipulate or purge files without credentials severely undermines confidentiality and data availability. Such unauthorized access can lead to direct data loss and severe regulatory penalties.
Recommended action: Remediate ownCloud deployments by enforcing signing keys for all user accounts and applying the relevant security fixes.
Source: CISA
GlobalAug 27, 2026
Linux Kernel IPv6 Subsystem Privilege Escalation
The Linux Kernel contains an unspecified vulnerability tracked as CVE-2026-53362. The issue resides in the IPv6 networking subsystem and can allow for local privilege escalation. This vulnerability impacts multiple enterprise operating systems, including Suse, Red Hat, and other Linux distributions.
Why it matters: Operating system kernels provide the core security boundaries for applications, hypervisors, and containerized enterprise workloads. A local privilege escalation flaw enables lower-tier attackers to achieve root-level control over underlying hosts. This undermines container isolation, host integrity, and defense-in-depth controls across hybrid server fleets.
Recommended action: Apply distribution-specific kernel updates across all affected Linux systems and reboot hosts to load the secure kernel.
Source: CISA

Week of August 17, 2026

Active exploitation targeted foundational enterprise infrastructure, messaging platforms, and network authentication mechanisms during the week of August 17, 2026.

CISA added multiple actively exploited vulnerabilities across critical virtualization, collaboration, and network services to its Known Exploited Vulnerabilities catalog. Threat actors demonstrated capabilities to achieve remote code execution and bypass core authentication controls across enterprise operating environments. Organizations must expedite patch validation and remediate exposed endpoints within federal timelines to protect network perimeters.

GlobalAug 18, 2026
Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom VMware vCenter contains a path traversal vulnerability designated as CVE-2026-59310. An attacker with network access to vCenter can exploit this flaw to execute arbitrary code on the affected appliance. CISA added the flaw to its catalog on August 18, 2026, with federal remediation required by August 21, 2026.
Why it matters: Compromise of the vCenter management layer provides unauthorized actors with broad administrative leverage across virtualized infrastructure. The ability to execute arbitrary code at this layer presents critical risks to enterprise hosting environments and operational integrity. Immediate remediation is necessary to prevent lateral movement and unauthorized system control.
Recommended action: Security teams must immediately apply the vendor patch for VMware vCenter to mitigate CVE-2026-59310 and restrict network access to management interfaces.
Source: CISA
GlobalAug 21, 2026
Synacor Zimbra Collaboration Suite OS Command Injection
Synacor Zimbra Collaboration Suite contains an operating system command injection vulnerability tracked under CVE-2026-73570. An unauthenticated attacker can exploit this issue by transmitting specially crafted SMTP requests. Successful exploitation enables the execution of arbitrary operating system commands with Zimbra user permissions.
Why it matters: Because email servers routinely accept traffic from external networks, unauthenticated command injection poses severe exposure to remote perimeter intrusion. Gaining command execution on a messaging platform allows adversaries to compromise message stores and establish access within corporate environments. Organizations face significant confidentiality and data governance risks if mail gateways are compromised.
Recommended action: Administrators should immediately apply vendor-issued updates to Zimbra Collaboration Suite to block command injection attempts via crafted SMTP requests.
Source: CISA
GlobalAug 18, 2026
Microsoft Internet Key Exchange Service Extensions Double Free Vulnerability
A double free vulnerability exists within Microsoft Internet Key Exchange Service Extensions, identified as CVE-2026-33824. The flaw allows remote code execution when targeted by an attacker. CISA cataloged the issue on August 18, 2026, setting a federal remediation due date of August 21, 2026.
Why it matters: Vulnerabilities within core network protocols jeopardize cryptographic tunnel endpoints and boundary defenses. Successful remote code execution at this level can grant attackers a foothold without requiring prior authentication. Such exposures compromise network integrity and bypass perimeter security controls.
Recommended action: Deploy the vendor security update addressing the Microsoft IKE Service Extensions double free vulnerability across all affected hosts.
Source: CISA
GlobalAug 18, 2026
Apple macOS Screen Sharing Improper Authentication Vulnerability
Apple macOS contains an improper authentication vulnerability tracked as CVE-2026-65400. An attacker situated on the network can leverage this flaw to authenticate to Screen Sharing without providing valid credentials. The vulnerability was confirmed as exploited and added to the CISA catalog on August 18, 2026.
Why it matters: Bypassing authentication controls on administrative and desktop tools directly undermines endpoint confidentiality and access control policies. Unauthorized graphical access permits threat actors to view sensitive data and manipulate systems remotely. This flaw increases the risk of lateral movement across internal corporate networks.
Recommended action: Apply the required Apple macOS security updates across all managed devices and disable unneeded Screen Sharing services.
Source: CISA

Week of August 10, 2026

Active exploitation of vulnerabilities in network firewalls, operating system drivers, and analytics platforms demanded rapid enterprise remediation.

During the week of August 10, 2026, security leaders faced targeted threats across perimeter infrastructure, internal endpoints, and corporate reporting platforms. The newly cataloged vulnerabilities include unauthenticated remote denial of service on firewall appliances, local privilege escalation in core operating system drivers, and full administrative takeover through business intelligence software. Addressing these active threats requires immediate patch deployment and continuous validation of boundary and internal controls.

GlobalAug 11, 2026
Cisco Secure Firewall ASA and FTD Heap Inspection Vulnerability
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense appliances contain a heap inspection vulnerability. An unauthenticated remote attacker can exploit this flaw to cause the device to reload unexpectedly. This behavior results in a sustained denial of service condition on affected firewalls.
Why it matters: Unscheduled reloads of boundary security devices interrupt critical traffic flows and degrade enterprise perimeter defenses. Such disruptions undermine availability commitments and can expose corporate networks during failover states. Maintaining resilient firewall infrastructure is essential for overall enterprise operational governance.
Recommended action: Apply the appropriate vendor updates to all affected Cisco ASA and FTD appliances immediately to mitigate denial of service risks.
Source: CISA
GlobalAug 11, 2026
Metabase Application SQL Injection Vulnerability
Metabase contains a SQL injection vulnerability that permits an unauthenticated remote attacker to execute arbitrary SQL commands within the application database. Exploitation allows the attacker to achieve administrator-level access to the affected instance. From this position, the attacker can alter configurations, steal stored database credentials, and read or export sensitive enterprise data.
Why it matters: Full administrative compromise of business intelligence software exposes linked data warehouses and backend databases to complete exfiltration. Credential theft from this centralized platform broadens the blast radius across interconnected corporate data stores. This poses immediate governance, compliance, and confidentiality risks for organizations managing sensitive records.
Recommended action: Restrict exposure of Metabase interfaces and apply the official vendor security fix to prevent unauthorized access and data loss.
Source: CISA
GlobalAug 11, 2026
Microsoft Windows Ancillary Function Driver Privilege Escalation
A use-after-free vulnerability exists in the Microsoft Windows Ancillary Function Driver for WinSock. The flaw allows an authorized attacker with local access to trigger memory corruption within the driver. Successful exploitation permits the attacker to elevate privileges directly on the targeted host.
Why it matters: Local privilege escalation flaws provide threat actors with the system rights necessary to circumvent security telemetry and establish deeper host persistence. Once administrative access is achieved, attackers can move laterally or deploy further malicious payloads across the enterprise. Timely remediation of endpoint driver vulnerabilities is vital to sustaining effective defense in depth.
Recommended action: Ensure the latest Microsoft Windows security updates are distributed and installed across all affected workstations and server fleets.
Source: CISA

Week of August 3, 2026

Active exploitation targeted enterprise infrastructure and developer tooling through critical unauthenticated execution and authentication bypass flaws.

During the week of August 3, 2026, CISA cataloged confirmed active exploitation impacting core infrastructure components, continuous integration systems, and artificial intelligence frameworks. Organizations faced heightened risk from unauthenticated access vectors that allow threat actors to execute arbitrary commands or bypass access controls entirely. Security leaders were required to enforce immediate patching cycles to mitigate exposure across edge appliances and internal developer environments.

GlobalAug 7, 2026
Progress LoadMaster Command Injection
Progress LoadMaster contains a command injection vulnerability tracked as CVE-2026-8037. The flaw allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. CISA added this vulnerability to the catalog on August 7, 2026, establishing a federal remediation due date of August 10, 2026.
Why it matters: Because load balancers sit at key network junctions, unauthenticated command execution presents an immediate risk of network perimeter compromise. Threat actors gaining command-level access can pivot deeper into internal enterprise segments and intercept organizational traffic. Governance teams must recognize that perimeter appliance vulnerabilities require emergency mitigation protocols due to rapid exploitation windows.
Recommended action: Apply the vendor security updates immediately to all Progress LoadMaster appliances to prevent unauthorized command execution.
Source: CISA
GlobalAug 5, 2026
JetBrains TeamCity Untrusted Deserialization
JetBrains TeamCity contains a deserialization of untrusted data vulnerability identified as CVE-2026-63077. The flaw could allow unauthenticated remote code execution via the agent polling protocol. It was added to the CISA catalog on August 5, 2026, with federal remediation required by August 8, 2026.
Why it matters: Build and continuous integration servers possess privileged access to corporate source code, intellectual property, and deployment pipelines. Remote code execution on these platforms allows attackers to tamper with software supply chains and escalate privileges across multiple environments. Compromise of continuous integration infrastructure poses direct operational and regulatory risks to enterprise software integrity.
Recommended action: Immediately patch JetBrains TeamCity servers to resolve untrusted deserialization vulnerabilities within the agent polling protocol.
Source: CISA
GlobalAug 3, 2026
N-able N-central Authentication Bypass
N-able N-central contains an authentication bypass vulnerability using an alternate path or channel, tracked as CVE-2026-18577. This vulnerability is the result of an incomplete patch for CVE-2026-18556 and allows authentication bypass and account takeover in N-central. CISA cataloged the vulnerability on August 3, 2026, setting a federal remediation due date of August 6, 2026.
Why it matters: Remote monitoring and management platforms retain elevated administrative privileges across broad client and corporate endpoints. An authentication bypass leading to account takeover enables malicious actors to leverage trusted management tooling for widespread lateral movement. Governance oversight must account for failed or incomplete upstream fixes, which leave high-privilege systems vulnerable despite prior remediation efforts.
Recommended action: Verify and apply the updated vendor fix for CVE-2026-18577 across all N-central instances to remediate the authentication bypass.
Source: CISA
GlobalAug 4, 2026
IBM Langflow Code Injection
IBM Langflow contains a code injection vulnerability tracked as CVE-2026-9198. The flaw allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. CISA designated the vulnerability as actively exploited on August 4, 2026, mandating federal remediation by August 7, 2026.
Why it matters: Emerging artificial intelligence tooling is frequently integrated directly with enterprise data sources and internal application programming interfaces. Default deployments vulnerable to unauthenticated code execution offer adversaries an easy foothold into experimental and production artificial intelligence infrastructure. Organizations face serious governance risks if rapidly adopted machine learning components bypass traditional vulnerability management controls.
Recommended action: Update default IBM Langflow deployments to a secured version immediately to eliminate unauthenticated code execution risks.
Source: CISA

Week of July 27, 2026

Active exploitation targeted enterprise network management appliances and orchestrators during the final week of July 2026.

The addition of three confirmed vulnerabilities to the CISA Known Exploited Vulnerabilities catalog highlighted sustained adversary attention on perimeter and network control systems. Organizations running management solutions from Cisco, Arista, and Fortinet faced threats ranging from credential abuse to command execution. Security leaders needed to verify appliance isolation and adhere to expedited federal remediation timelines.

GlobalJul 27, 2026
Arista VeloCloud Orchestrator On-Prem Command Injection
Arista VeloCloud Orchestrator On-Prem contains an operating system command injection vulnerability. This defect allows a remote attacker to access privileged internal functionality and impact the host appliance. Exploitation compromises the confidentiality, integrity, and availability of the orchestrator and all managed data.
Why it matters: Central orchestration hosts represent critical single points of failure across enterprise wide-area networks. A compromise at this layer jeopardizes configurations and network traffic governance across connected endpoints. With a remediation deadline of July 30, 2026, unaddressed deployments posed acute operational and compliance exposure.
Recommended action: Security teams should update all on-premises Arista VeloCloud Orchestrator instances immediately and isolate management interfaces from public access.
Source: CISA
GlobalJul 29, 2026
Cisco Secure Firewall Management Center Hard-Coded Password Vulnerability
Cisco Secure Firewall Management Center, formerly known as Firepower Management Center, contains a use of hard-coded password vulnerability. The flaw enables an unauthenticated, remote attacker to log in to an affected appliance using a low-privileged account. Through this access, the attacker can view sensitive information residing within the impacted systems.
Why it matters: Hard-coded credentials remove technical barriers for initial access, allowing remote adversaries to harvest configuration and policy data directly from the management console. Exposure of firewall policies significantly degrades perimeter defenses and exposes internal architecture. Organizations faced an accelerated federal directive to remediate affected systems by August 1, 2026.
Recommended action: Apply the appropriate vendor updates to Cisco Secure Firewall Management Center devices and restrict management console access to secure administrative subnets.
Source: CISA
GlobalJul 27, 2026
Fortinet FortiOS Patch Bypass and Information Exposure
Fortinet FortiOS contains a vulnerability that exposes sensitive information to an unauthorized actor. By sending crafted HTTP requests, an unauthenticated remote attacker can bypass a patch designed to prevent a symbolic link persistence mechanism seen in post-exploit incidents. Exploiting this issue requires that an attacker has already compromised the device at the filesystem level using another vulnerability.
Why it matters: This vulnerability undermines persistence mitigations, allowing previously established attackers to maintain footholds on firewall hardware. Incomplete remediation of earlier compromises leaves critical security gateways exposed to recurring unauthorized access. Governance teams required full verification of underlying filesystem integrity prior to the August 10, 2026 deadline.
Recommended action: Deploy the latest FortiOS firmware updates and conduct filesystem integrity inspections on perimeter units to identify lingering unauthorized access.
Source: CISA

Week of July 20, 2026

Active exploitation targeted enterprise management consoles, collaboration servers, and web platforms through critical authentication and code execution vulnerabilities.

During the week of July 20, 2026, the Cybersecurity and Infrastructure Security Agency added multiple critical vulnerabilities to its Known Exploited Vulnerabilities catalog. The listings revealed active exploitation against foundational software including Check Point SmartConsole, Microsoft SharePoint, WordPress Core, and Langflow. Enterprise security leaders must prioritize rapid patching against these flaws, which permit unauthenticated remote code execution and full administrative compromise.

GlobalJul 22, 2026
Check Point SmartConsole Authentication Bypass
Check Point SmartConsole contains an improper authentication vulnerability tracked as CVE-2026-16232, added to the catalog on July 22, 2026. The vulnerability allows an unauthenticated remote attacker to obtain an application login token. Attackers can then leverage this token to authenticate with full administrative privileges.
Why it matters: Administrative compromise of security management consoles exposes network control infrastructure to hostile manipulation. Unauthorized attackers gaining full privileges can disable protections and alter firewall policies across the enterprise. The severity is reflected in the accelerated federal remediation deadline of July 25, 2026.
Recommended action: Isolate exposed management interfaces and apply the required vendor updates to Check Point SmartConsole immediately.
Source: CISA
GlobalJul 22, 2026
Microsoft SharePoint Untrusted Data Deserialization
Microsoft SharePoint contains a deserialization of untrusted data vulnerability identified as CVE-2026-50522, added by CISA on July 22, 2026. The security flaw allows an unauthorized attacker to execute arbitrary code over a network connection. CISA set a federal remediation deadline of July 25, 2026.
Why it matters: SharePoint servers host critical enterprise documents, internal collaboration services, and identity integration mechanisms. Remote code execution by an unauthorized attacker can lead to total platform takeover and lateral network movement. Failure to secure these environments risks severe enterprise data exposure.
Recommended action: Deploy the official Microsoft security update to all affected SharePoint instances to block network code execution.
Source: CISA
GlobalJul 21, 2026
WordPress Core Interpretation Conflict and Chained Remote Code Execution
WordPress Core contains an interpretation conflict vulnerability designated as CVE-2026-63030, cataloged on July 21, 2026. The vulnerability enables attackers to perform SQL injection and achieve remote code execution. It can be chained with CVE-2026-60137 to grant an unauthenticated attacker remote code execution on default installations.
Why it matters: The chaining of these vulnerabilities permits adversaries to compromise default installations without requiring prior credentials. Because the attack vector takes advantage of plugins or themes passing untrusted input, web properties face systemic exposure. Organizations maintaining public web infrastructure face imminent risk of host compromise.
Recommended action: Upgrade WordPress Core to the latest secured version to remediate the vulnerability before the July 24, 2026 federal deadline.
Source: CISA
GlobalJul 21, 2026
Langflow Untrusted Control Sphere Code Execution
Langflow contains a vulnerability involving the inclusion of functionality from an untrusted control sphere, tracked as CVE-2026-0770 and cataloged on July 21, 2026. The flaw allows remote attackers to execute arbitrary code on affected installations. CISA established a remediation due date of July 24, 2026.
Why it matters: Allowing remote attackers to run arbitrary code undermines host security and the integrity of application workloads. Threat actors can exploit these flaws to compromise developer environments and access integrated systems. The rapid federal timeline underscores the urgent operational danger posed by active exploitation.
Recommended action: Identify all active Langflow installations and apply the official vendor patch to prevent unauthorized code execution.
Source: CISA

Week of July 13, 2026

CISA added ten actively exploited vulnerabilities across critical enterprise infrastructure including collaboration platforms, security appliances, and enterprise business suites during the week of July 13, 2026.

Threat actors demonstrated active exploitation of critical weaknesses spanning Microsoft SharePoint, Fortinet FortiSandbox appliances, Oracle E-Business Suite, and SonicWall gateway products. The compressed federal remediation deadlines of three days for multiple vulnerabilities reflected high operational risk from remote unauthenticated attack vectors. Enterprise security leaders were required to prioritize emergency patching across perimeter security tooling and core internal application platforms.

GlobalJul 16, 2026
Microsoft SharePoint Remote Code Execution and Privilege Escalation
CISA added CVE-2026-58644 and CVE-2026-56164 affecting Microsoft SharePoint to the Known Exploited Vulnerabilities catalog. CVE-2026-58644 is a deserialization of untrusted data flaw allowing an unauthorized attacker to execute code over a network. CVE-2026-56164 involves missing authentication for a critical function, permitting an unauthorized attacker to elevate privileges remotely.
Why it matters: SharePoint environments frequently house sensitive enterprise communications, files, and authentication integrations. Network-based exploitation without valid credentials allows adversaries to establish initial footholds and move laterally across corporate directories. The federal remediation deadlines required mitigation within three days of listing, underscoring immediate threat levels.
Recommended action: Enterprise security teams must immediately apply the vendor-issued security updates to all on-premises SharePoint installations and verify that external-facing instances are restricted.
Source: CISA
GlobalJul 16, 2026
Fortinet FortiSandbox Remote OS Command Injection
CISA cataloged CVE-2026-25089 and CVE-2026-39808 affecting Fortinet FortiSandbox on July 16, 2026. These OS command injection flaws allow unauthenticated attackers to execute unauthorized commands or code via specifically crafted HTTP requests. The vulnerabilities impact FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS architectures.
Why it matters: FortiSandbox instances sit in trusted positions designed to analyze suspicious network traffic and file artifacts. Subversion of security inspection appliances grants attackers full control over security telemetry and potential access into isolated inspection zones. The unauthenticated nature of these exploits poses critical perimeter exposure risk.
Recommended action: Security administrators must apply vendor patches immediately to FortiSandbox on-premises appliances and review cloud-managed instances to ensure current firmware deployment.
Source: CISA
GlobalJul 15, 2026
Oracle E-Business Suite Oracle Payments Takeover
CVE-2026-46817 is an improper privilege management vulnerability in Oracle E-Business Suite added to the catalog on July 15, 2026. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks lead directly to the total takeover of the Oracle Payments component.
Why it matters: Oracle Payments processes financial transactions and handles sensitive enterprise banking and merchant details. Compromise of this component directly imperils financial data integrity and creates severe regulatory and compliance liabilities. Because the exploit requires only unauthenticated HTTP access, publicly exposed instances face acute compromise danger.
Recommended action: Organizations operating Oracle E-Business Suite must isolate HTTP interfaces from untrusted networks and apply the official vendor patch before the remediation cutoff.
Source: CISA
GlobalJul 14, 2026
SonicWall SMA1000 Appliances SSRF and Code Injection
CISA cataloged CVE-2026-15409 and CVE-2026-15410 impacting SonicWall SMA1000 appliances on July 14, 2026. CVE-2026-15409 allows a remote unauthenticated attacker to cause the appliance to make requests to unintended locations via server-side request forgery. CVE-2026-15410 enables an authenticated remote attacker with administrator privileges to execute arbitrary OS commands under specific conditions.
Why it matters: Secure Mobile Access appliances manage remote access directly into internal corporate networks. Exploiting server-side request forgery enables attackers to probe internal network zones and bypass perimeter access barriers. Combining request redirection with command execution pathways threatens complete boundary device takeover.
Recommended action: Network administrators must immediately deploy the necessary firmware updates from SonicWall and audit management interface logs for unauthorized requests.
Source: CISA

Week of July 6, 2026

Active exploitation of web component file upload flaws and application access controls drove urgent remediation mandates.

During the week of July 6, 2026, federal advisories confirmed the active weaponization of unrestricted file upload flaws across web building extensions alongside critical vulnerabilities in enterprise platforms. Adversaries routinely leveraged unauthenticated entry points to upload executable code directly to target web servers. Security leaders needed to prioritize internet-facing web application patching, enforce strict file upload controls, and restrict access to internal orchestration tools.

GlobalJul 7, 2026
Adobe ColdFusion Path Traversal Vulnerability
Adobe ColdFusion contains a path traversal vulnerability identified as CVE-2026-48282. This weakness allows an attacker to achieve arbitrary code execution within the context of the current running user. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on July 7, 2026, establishing a federal remediation deadline of July 10, 2026.
Why it matters: Enterprise deployments of Adobe ColdFusion frequently support critical enterprise web services and integrate with internal databases. Arbitrary code execution provides threat actors an immediate foothold to compromise the underlying server and pursue lateral movement. Leaving these environments unpatched risks widespread infrastructure compromise and data exposure.
Recommended action: Apply the official vendor security update for Adobe ColdFusion across all production and development hosts. Restrict administrative endpoints to trusted internal networks.
Source: CISA
GlobalJul 7, 2026
Langflow Flow Execution Authorization Bypass
Langflow contains an authorization bypass through a user-controlled key vulnerability designated as CVE-2026-55255. The flaw allows an authenticated attacker to execute any flow belonging to another user simply by providing the victim's flow ID in the request. The vulnerability was listed in the CISA catalog on July 7, 2026, with remediation required by July 10, 2026.
Why it matters: AI orchestration and pipeline tools store sensitive workflow logic, operational tokens, and access to enterprise datasets. Inadequate cross-tenant authorization permits unauthorized users to trigger workflows and manipulate sensitive operational processes. The failure of access boundaries inside internal tooling jeopardizes enterprise data integrity and model governance.
Recommended action: Upgrade Langflow deployments to the latest patched version to enforce strict authorization controls on flow IDs. Review system logs for unauthorized requests attempting to invoke foreign flow identifiers.
Source: CISA
GlobalJul 10, 2026
Balbooa Forms Unauthenticated Remote Code Execution
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability tracked as CVE-2026-56291. The flaw enables an unauthenticated attacker to upload arbitrary files to the host system. This arbitrary upload mechanism permits executable files to be placed on the server, resulting in full remote code execution.
Why it matters: Public-facing web forms must accept external user input, making unauthenticated upload flaws highly susceptible to automated exploitation. Attackers obtaining full remote code execution can install persistent web shells and compromise the host operating system. This compromises the integrity of web properties and exposes connected internal segments.
Recommended action: Update Balbooa Forms to the vendor-provided patched version immediately. Scan web server directories for unrecognized executable files and unauthorized uploads.
Source: CISA
GlobalJul 7, 2026
JoomShaper SP Page Builder Arbitrary File Upload
JoomShaper SP Page Builder is affected by an unrestricted upload of file with dangerous type vulnerability identified as CVE-2026-48908. Unauthenticated attackers can exploit the component to upload arbitrary files to the target environment. This flaw ultimately results in the upload and execution of arbitrary PHP code on the hosting server.
Why it matters: Content management extensions that allow unauthenticated script execution represent a primary vector for site defacement and perimeter compromise. Remote attackers can leverage PHP execution to read sensitive configuration files and establish external command-and-control channels. Rapid federal cataloging highlights that adversaries actively seek out exposed extensions for initial access.
Recommended action: Install the required security update for JoomShaper SP Page Builder across all managed sites. Implement web application firewall rules to block unauthorized file upload attempts targeting builder endpoints.
Source: CISA

Week of June 29, 2026

Active exploitation targeted authentication flaws in remote administration software and deserialization vulnerabilities in enterprise collaboration platforms.

During the week of June 29, 2026, cybersecurity authorities cataloged active exploitation affecting remote access tooling and core collaboration infrastructure. Attackers leveraged an authentication bypass in SimpleHelp to forge technician sessions and exploited untrusted data deserialization in Microsoft SharePoint Server to achieve network code execution. Enterprise security leaders needed to audit identity verification configurations and accelerate deployment of critical patches to protect enterprise endpoints and internal networks.

GlobalJun 29, 2026
SimpleHelp Authentication Bypass Vulnerability
SimpleHelp contains an authentication bypass vulnerability within its OpenID Connect (OIDC) authentication flow where identity tokens submitted during login are accepted without cryptographic signature verification. When this vulnerable configuration is present, a remote, unauthenticated attacker can submit a forged token with arbitrary identity claims to obtain a fully authenticated technician session. In certain configurations, this flaw also allows the attacker to bypass multi-factor authentication controls.
Why it matters: Compromising remote assistance tools provides adversaries with direct, elevated access to managed corporate endpoints. Bypassing token signature checks and multi-factor authentication undermines fundamental perimeter controls and enterprise identity governance. This creates acute operational risk by exposing internal environments to immediate lateral movement through privileged technician accounts.
Recommended action: Audit all SimpleHelp deployments for OIDC authentication use and apply required vendor patches immediately to remediate the vulnerability.
Source: CISA
GlobalJul 1, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data
Microsoft SharePoint Server is affected by a deserialization of untrusted data vulnerability tracked as CVE-2026-45659. The weakness enables an authorized attacker to execute arbitrary code over a network. The vulnerability was added to the Known Exploited Vulnerabilities catalog on July 1, 2026, with an urgent federal remediation timeline.
Why it matters: SharePoint environments frequently store sensitive business records and maintain broad connectivity across enterprise domains. Exploitation by an authenticated attacker allows code execution directly on the hosting server, creating avenues for persistent footholds and data exfiltration. Unaddressed instances expose internal enterprise collaboration services to severe compromise and privilege escalation.
Recommended action: Deploy the official vendor security updates for affected Microsoft SharePoint Server systems without delay.
Source: CISA

Week of June 22, 2026

Active exploitation targeted edge appliances, communications infrastructure, and enterprise product lifecycle software during the final week of June 2026.

CISA catalog additions for the week beginning June 22, 2026, highlighted critical exposures across product lifecycle management platforms, unified communications, and network management hardware. Adversaries actively leveraged flaws enabling arbitrary code execution, file write capabilities leading to privilege escalation, and command injection. Enterprise security leaders must enforce aggressive remediation timelines for internet-facing systems and internal management controllers to prevent deep network compromise.

GlobalJun 25, 2026
PTC Windchill and FlexPLM Remote Code Execution
PTC Windchill and FlexPLM contain an improper input validation vulnerability tracked as CVE-2026-12569. An unauthenticated, remote attacker can exploit this flaw by sending a malicious request to the network to execute arbitrary code. CISA added this vulnerability to the catalog on June 25, 2026, with federal remediation required by June 28, 2026.
Why it matters: Unauthenticated remote code execution in core enterprise lifecycle platforms creates immediate risk of full system takeover. Attackers can leverage network access to establish persistent footholds without requiring prior credentials. Organizations must treat externally accessible product lifecycle instances as critical attack surfaces.
Recommended action: Security teams must identify all network-accessible PTC Windchill and FlexPLM deployments and immediately apply vendor-provided fixes.
Source: CISA
GlobalJun 25, 2026
Cisco Unified Communications Manager Server-Side Request Forgery
Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition are affected by a server-side request forgery vulnerability designated as CVE-2026-20230. An unauthenticated remote attacker can exploit this flaw to write files directly to the underlying operating system. The written files can subsequently be utilized to elevate privileges to root level.
Why it matters: Targeting enterprise telephony and communications management enables threat actors to breach core collaboration backbones. Unrestricted file writes coupled with paths to root privileges severely undermine infrastructure isolation and trust boundaries. Compromising communications servers can facilitate extensive lateral movement across enterprise networks.
Recommended action: Security leaders should audit Cisco Unified CM deployments and apply necessary updates in accordance with the June 28, 2026 federal directive.
Source: CISA
GlobalJun 23, 2026
Lantronix EDS5000 Command Injection
Lantronix EDS5000 device servers contain a code injection vulnerability identified as CVE-2025-67038. Attackers can inject arbitrary operating system commands into the username parameter during authentication interactions. Injected commands execute with full root privileges on the device.
Why it matters: Device servers frequently bridge critical operational networks and enterprise IT infrastructure. Root command execution allows threat actors to manipulate connected devices, intercept sensitive traffic, or bypass perimeter controls. Insecure hardware interfaces remain high-value targets for persistent access.
Recommended action: Administrators should immediately isolate Lantronix EDS5000 interfaces from untrusted networks and apply recommended vendor patches.
Source: CISA
GlobalJun 23, 2026
Ubiquiti UniFi OS Command Injection
Ubiquiti UniFi OS contains an improper input validation vulnerability tracked as CVE-2026-34910. A malicious actor with access to the network can exploit this weakness to conduct command injection on the device. CISA added the flaw to the Known Exploited Vulnerabilities catalog on June 23, 2026.
Why it matters: Network management appliances run critical infrastructure services across distributed enterprise environments. Arbitrary command execution on UniFi OS controllers compromises network segmentation policies and administrative integrity. Threat actors operating inside the network perimeter can use these appliances to maintain unauthorized control.
Recommended action: Enterprises should restrict network access to UniFi OS management interfaces and update systems to remediate the vulnerability.
Source: CISA

Week of June 15, 2026

Active exploitation across enterprise monitoring, web publishing, and network management systems drove urgent patching requirements during the week of June 15, 2026.

The addition of four vulnerabilities to the CISA Known Exploited Vulnerabilities catalog highlighted serious risks across diverse technology layers. Exploits targeting core infrastructure enabled unauthenticated file manipulation in Splunk Enterprise and arbitrary code execution via the Widget Factory Joomla Content Editor. Enterprise security leaders were required to coordinate expedited remediation cycles to address active threats within compressed federal compliance windows.

GlobalJun 18, 2026
Splunk Enterprise Missing Authentication Vulnerability
CISA cataloged CVE-2026-20253 on 2026-06-18, establishing a federal remediation due date of 2026-06-21. The vulnerability is caused by missing authentication for a critical function within Splunk Enterprise. An unauthenticated user can exploit a PostgreSQL sidecar service endpoint to create or truncate arbitrary files on the affected system.
Why it matters: Compromising core enterprise monitoring infrastructure undermines logging integrity and baseline visibility. Arbitrary file creation or truncation can disable monitoring services or disrupt operational analytics. Security governance programs face immediate risk when critical enterprise logging platforms are exposed to unauthenticated tampering.
Recommended action: Apply vendor remediation for Splunk Enterprise immediately to secure the PostgreSQL sidecar service endpoint against unauthenticated requests.
Source: CISA
GlobalJun 16, 2026
Widget Factory Joomla Content Editor Improper Access Control
CISA added CVE-2026-48907 to the Known Exploited Vulnerabilities catalog on 2026-06-16 with a remediation due date of 2026-06-19. The vulnerability involves an improper access control flaw in Widget Factory Joomla Content Editor. Unauthenticated users can exploit this defect through the creation of new editor profiles to upload and execute PHP code.
Why it matters: Allowing unauthenticated remote code execution on web-facing assets presents an immediate route to full server compromise. Threat actors achieving code execution can leverage web infrastructure as a pivot point for broader enterprise intrusion. The short three-day federal remediation window underscores the severity of ongoing exploitation.
Recommended action: Identify all deployed instances of the Widget Factory Joomla Content Editor and deploy the appropriate vendor patch to halt unauthorized profile creation.
Source: CISA
GlobalJun 15, 2026
Cisco Catalyst SD-WAN Manager Directory Traversal Vulnerability
CVE-2026-20262 was listed by CISA on 2026-06-15, requiring federal remediation by 2026-06-29. Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability. An authenticated, remote attacker can leverage this flaw to create a file or overwrite any file on the underlying filesystem.
Why it matters: Software-defined networking managers control mission-critical routing and enterprise communication channels. Unauthorized file manipulation on these systems threatens network fabric availability and segmentation controls. Organizations must manage exposure to authenticated insider threats and compromised administrator credentials targeting core networking devices.
Recommended action: Deploy vendor updates to Cisco Catalyst SD-WAN Manager and verify filesystem access permissions across all management nodes.
Source: CISA
GlobalJun 15, 2026
LiteSpeed cPanel Plugin Symbolic Link Following Vulnerability
CISA incorporated CVE-2026-54420 into the Known Exploited Vulnerabilities catalog on 2026-06-15, setting a federal remediation deadline of 2026-06-18. The LiteSpeed cPanel plugin contains a UNIX symbolic link following vulnerability. The defect allows exploitation by a user possessing FTP or web shell access on a shared hosting server running CloudLinux/CageFS.
Why it matters: Flaws that bypass isolation mechanisms in shared hosting environments jeopardize tenant separation. Attackers with low-privilege access can exploit symlink traversal to compromise adjacent system resources. The brief timeline established for federal compliance reflects the ease of exploitation in environments with existing web shell presence.
Recommended action: Update the LiteSpeed cPanel plugin across all shared hosting servers running CloudLinux/CageFS to mitigate symlink traversal risks.
Source: CISA

Week of June 8, 2026

Active exploitation of perimeter security gateways and core enterprise platforms highlighted urgent patch cycles in early June 2026.

During the week of June 8, 2026, security leaders faced targeted exploitation against critical remote access, gateway, and business management systems. Identified flaws in Check Point, Ivanti, Oracle, and widely used Chromium-based browsers exposed organizations to authentication bypass, command injection, and remote code execution. Security teams must ensure internet-facing endpoints are shielded and patches are deployed promptly to avoid unauthorized network entry.

GlobalJun 8, 2026
Check Point Security Gateway Improper Authentication Vulnerability
Check Point Security Gateway contains an improper authentication vulnerability in its IKEv1 key exchange implementation. An unauthenticated remote attacker can exploit this weakness to bypass user authentication entirely. This enables the attacker to establish a remote access VPN connection without possessing a valid user password.
Why it matters: The compromise of VPN gateway authentication allows unauthorized remote access directly into protected enterprise networks. This invalidates perimeter boundaries and exposes internal resources to unauthenticated threat actors. Organizations face elevated risk of lateral movement and data exposure through illegitimate active sessions.
Recommended action: Apply vendor remediation for Check Point Security Gateways immediately to prevent unauthorized IKEv1 authentication bypass.
Source: CISA
GlobalJun 11, 2026
Ivanti Sentry OS Command Injection Vulnerability
Ivanti Sentry contains an OS command injection vulnerability that permits a remote unauthenticated user to achieve root-level remote code execution. The vulnerability is exploitable when the Sentry appliance resides in an unmanaged state with its endpoints reachable from external networks. Implementations using mTLS with EPMM or restricted HTTPS access through Neurons for MDM protect these interfaces from external access.
Why it matters: Root-level execution on edge appliances grants threat actors complete administrative control over mobile gateway infrastructure. Unmanaged or misconfigured appliances exposed to the internet present an immediate foothold into corporate environments. Failure to isolate these management interfaces leads to severe perimeter compromise.
Recommended action: Ensure all Ivanti Sentry appliances are managed with mTLS or restricted HTTPS access enabled, and install the appropriate security update.
Source: CISA
GlobalJun 12, 2026
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication Vulnerability
Oracle PeopleSoft Enterprise PeopleTools contains a vulnerability resulting from missing authentication for a critical function. This issue allows an unauthenticated remote attacker to obtain complete takeover of PeopleSoft Enterprise PeopleTools. The flaw was cataloged by CISA on June 12, 2026, with an immediate remediation timeline.
Why it matters: PeopleSoft Enterprise PeopleTools supports mission-critical enterprise resource planning, operational, and administrative workflows. Full platform takeover gives adversaries the ability to alter core business logic and access sensitive organizational data. Unauthenticated exploitation at this tier poses significant regulatory and business continuity risks.
Recommended action: Install the necessary Oracle PeopleSoft Enterprise PeopleTools security update to eliminate unauthenticated administrative takeover paths.
Source: CISA
GlobalJun 9, 2026
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Chromium V8 contains an out-of-bounds read and write vulnerability that can allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The affected component is utilized across multiple web browsers based on Chromium, including Google Chrome, Microsoft Edge, and Opera. CISA added this vulnerability to the catalog on June 9, 2026.
Why it matters: Because Chromium-based browsers are ubiquitous across enterprise endpoints, exploitation poses a widespread threat to daily user workflows. Attackers targeting this memory corruption flaw can leverage malicious web content to compromise browser processes. Widespread browser vulnerabilities present continuous exposure to client-side exploitation.
Recommended action: Update all enterprise installations of Google Chrome, Microsoft Edge, Opera, and related Chromium browsers to the latest patched releases.
Source: CISA

Week of June 1, 2026

Threat actors actively targeted critical enterprise infrastructure and web services through unauthenticated remote exploits and privilege escalation flaws during the first week of June 2026.

CISA expanded its Known Exploited Vulnerabilities catalog with five actively exploited flaws affecting enterprise middleware, web platforms, and foundational operating systems. The additions highlighted urgent exposure risks spanning remote code execution in web components to critical privilege escalation across Linux and Android environments. Security leadership must prioritize immediate patching and protocol validation to prevent unauthenticated intrusion and infrastructure disruption.

GlobalJun 1, 2026
Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability that enables unauthenticated attackers with network access via T3 or IIOP protocols to compromise the server. Successful exploitation can allow unauthorized access to critical data or complete access to all data accessible to Oracle WebLogic Server. CISA added this vulnerability to its catalog on June 1, 2026, establishing a federal remediation due date of June 4, 2026.
Why it matters: Because WebLogic servers frequently host core enterprise business applications, unauthorized access threatens sensitive operational data with compromise or total exfiltration. The ability for unauthenticated network actors to compromise the host via common protocols introduces severe perimeter risks. This jeopardizes enterprise regulatory compliance and could lead to widespread infrastructure takeover.
Recommended action: Restrict network access to T3 and IIOP protocols across the enterprise perimeter and immediately deploy vendor updates to all affected Oracle WebLogic instances.
Source: CISA
GlobalJun 3, 2026
Mirasvit Full Page Cache Warmer Deserialization Vulnerability
Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability exploitable through the CacheWarmer cookie. Unauthenticated attackers can supply a crafted serialized PHP object within this cookie to achieve remote code execution. CISA cataloged the actively exploited vulnerability on June 3, 2026, with a federal remediation deadline of June 6, 2026.
Why it matters: Unauthenticated remote code execution on web-facing components represents an immediate threat to application availability and data confidentiality. Attackers executing arbitrary code can harvest transaction data, inject secondary payloads, or pivot further into backend systems. Such exposures can lead to significant commercial loss and regulatory liability under global privacy frameworks.
Recommended action: Apply the official vendor security patch for Mirasvit Full Page Cache Warmer and inspect ingress web logs for malicious serialized objects within the CacheWarmer cookie.
Source: CISA
GlobalJun 5, 2026
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows unauthenticated actors to crash the Serv-U service. The denial of service condition is triggered by sending specially crafted POST requests that include the Content-Encoding: deflate header. CISA added this issue to the catalog on June 5, 2026, mandating federal remediation by June 19, 2026.
Why it matters: Adversaries can systematically disrupt enterprise secure file transfer operations without needing valid credentials. An outage in central file transfer platforms can halt automated business processes, data ingestion pipelines, and client data exchanges. Repeated service disruptions create operational bottlenecks and can breach contractual service level agreements.
Recommended action: Update SolarWinds Serv-U to the remediated software version and evaluate web application firewall filters for anomalies involving compressed POST request headers.
Source: CISA
GlobalJun 2, 2026
Linux Kernel Improper Authentication Vulnerability
The Linux Kernel contains an improper authentication vulnerability that enables privilege escalation through the cgroups v1 release_agent feature. Local attackers can leverage this mechanism to break permission boundaries and gain elevated privileges on the system. CISA cataloged the actively exploited flaw on June 2, 2026, with federal remediation required by June 5, 2026.
Why it matters: Privilege escalation vulnerabilities within the Linux kernel threaten multitenant environments, container hosts, and cloud-native architectures. If a threat actor establishes an initial foothold, this flaw allows them to gain administrative control over the underlying host. This severely undermines tenant isolation and compromises internal security baselines.
Recommended action: Prioritize deploying updated Linux kernel packages across server fleets and audit configurations relying on cgroups v1 release_agent features.
Source: CISA
GlobalJun 2, 2026
Android Framework Integer Overflow Vulnerability
The Android Framework contains an integer overflow vulnerability that allows for code execution. This condition can be exploited locally to facilitate local privilege escalation on affected devices. CISA included this vulnerability in the catalog on June 2, 2026, setting a federal remediation deadline of June 5, 2026.
Why it matters: Local privilege escalation on mobile platforms weakens operating system sandboxing and endpoint defense capabilities. Compromised mobile devices in an enterprise fleet can expose corporate applications, authentication credentials, and internal communications to unauthorized actors. This presents significant data governance risks for distributed and mobile workforces.
Recommended action: Ensure enterprise mobile device management platforms mandate and verify the deployment of the latest Android platform security updates across all managed devices.
Source: CISA

Week of May 25, 2026

Active exploitation targeted edge networking infrastructure, developer software supply chains, and web hosting environments.

During the week of May 25, 2026, CISA added multiple confirmed exploited vulnerabilities impacting perimeter systems, developer tooling, and hosting control panels to its catalog. Threat actors demonstrated the ability to establish unauthorized network access, compromise developer registries to deploy credential-harvesting malware, and gain root privileges on multi-user systems. Enterprise security leaders must enforce urgent patch cycles and review trust boundaries across external access points and developer pipelines.

GlobalMay 29, 2026
Palo Alto Networks PAN-OS Authentication Bypass
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows threat actors to bypass security controls and establish unauthorized VPN connections. The flaw was added to the CISA catalog on May 29, 2026, with federal remediation mandated by June 1, 2026.
Why it matters: Circumvention of VPN authentication exposes internal corporate networks directly to unauthorized external parties. This invalidates boundary controls and grants unauthorized network presence without requiring valid corporate credentials.
Recommended action: Apply necessary security updates from Palo Alto Networks to all affected PAN-OS deployments before the June 1, 2026 remediation deadline.
Source: CISA
GlobalMay 27, 2026
Nx Console Embedded Malicious Code
Nx Console was impacted by an embedded malicious code vulnerability that allowed an unauthorized, malicious version of the extension to be distributed. The compromised extension downloaded an obfuscated payload capable of harvesting credentials from disk and system memory. CISA added the vulnerability to the catalog on May 27, 2026.
Why it matters: Compromising developer environments introduces severe supply-chain risks, as exposed secrets can facilitate wider lateral movement into enterprise codebases. Credential harvesting directly degrades identity security by exposing access tokens and private developer credentials.
Recommended action: Audit engineering workstations for unauthorized Nx Console versions and remove compromised extensions by June 10, 2026.
Source: CISA
GlobalMay 27, 2026
TanStack Malicious Package Publication
TanStack contains an unspecified vulnerability that permitted malicious package releases to be published to the npm registry under a trusted identity. These releases were used to distribute credential-stealing malware to downstream consumers. CISA confirmed exploitation and listed the vulnerability on May 27, 2026.
Why it matters: Malicious packages published through reputable namespace identities undermine the security of open-source dependencies. Organizations ingesting these packages risk immediate credential exposure and subsequent data compromise across developer and build infrastructure.
Recommended action: Inspect software dependency manifests for affected TanStack packages and remediate builds prior to the June 10, 2026 deadline.
Source: CISA
GlobalMay 26, 2026
LiteSpeed cPanel Plugin Privilege Escalation
A privilege escalation vulnerability in the LiteSpeed cPanel Plugin permits any standard cPanel user account to run arbitrary scripts with root privileges. The flaw is exposed directly through the user-end plugin interface. CISA added the entry to the catalog on May 26, 2026.
Why it matters: Escalation to root privileges permits standard users to break host-level boundary protections completely. This grants threat actors full administrative control over shared hosting infrastructure and any hosted data.
Recommended action: Deploy the required vendor security fix to all LiteSpeed cPanel installations before the May 29, 2026 remediation date.
Source: CISA

Week of May 18, 2026

CISA expanded its Known Exploited Vulnerabilities catalog during the week of May 18, 2026, targeting critical weaknesses in content management platforms, AI workflow tooling, and endpoint protection solutions.

Enterprise security leaders observed the weaponization of vulnerabilities across vital infrastructure components including web management frameworks, enterprise AI tooling, and endpoint defense agents. Threat actors actively targeted authentication mechanisms and privileged server interfaces to achieve remote code execution and local elevation of privilege. Security teams must prioritize rapid patching within federal remediation windows to protect exposed operational environments.

GlobalMay 22, 2026
Drupal Core SQL Injection Vulnerability
Drupal Core contains a SQL injection vulnerability within its database abstraction API. The flaw allows attackers to send specially crafted requests to achieve privilege escalation and execute arbitrary code remotely. CISA added the vulnerability on May 22, 2026, establishing a federal remediation deadline of May 27, 2026.
Why it matters: Web content management platforms host critical public-facing assets and interface directly with corporate databases. Successful exploitation grants remote code execution capabilities that can compromise core web infrastructure and backend data repositories. The compressed remediation timeline underscores the immediate threat posed by active exploitation in the wild.
Recommended action: Security leaders must apply vendor updates for Drupal Core immediately to satisfy remediation obligations by May 27, 2026. Teams should also review database logs for unauthorized queries initiated through the database abstraction API.
Source: CISA
GlobalMay 21, 2026
Langflow Origin Validation Error Vulnerability
Langflow contains an origin validation error arising from an overly permissive CORS configuration coupled with a refresh token cookie set to SameSite=None. A malicious webpage can execute cross-origin requests containing credentials to trigger the refresh endpoint. Attackers can obtain tokens permitting access to authenticated endpoints, execute arbitrary code, and achieve full system compromise.
Why it matters: Enterprise deployment of AI orchestration platforms creates critical pathways into corporate networks if identity controls fail. Unauthorized token acquisition bypasses perimeter controls and exposes underlying systems to code injection and complete takeover. Exploitation of emerging AI framework vulnerabilities highlights expanding exposure surfaces for enterprise AI initiatives.
Recommended action: Organizations running Langflow must implement vendor remediation updates before June 4, 2026, to correct cross-origin and cookie configurations. Security administrators should restrict network exposure for Langflow instances and audit authenticated endpoint access logs.
Source: CISA
GlobalMay 21, 2026
Trend Micro Apex One Directory Traversal Vulnerability
Trend Micro Apex One on-premise installations contain a directory traversal vulnerability. The defect allows a pre-authenticated local attacker to modify a key table located on the management server. This manipulation enables the attacker to inject malicious code and deploy it downward to agents across affected installations.
Why it matters: Centralized endpoint protection servers maintain trusted administrative access across the entire enterprise estate. Subverting the server to distribute malicious payloads directly to managed agents turns defensive infrastructure into a vehicle for enterprise-wide compromise. Organizations relying on on-premise deployments face severe operational risk when security management servers are breached.
Recommended action: Administrators must patch on-premise Trend Micro Apex One management servers ahead of the June 4, 2026 federal deadline. Security operations must inspect server-to-agent distribution queues and verify the integrity of server database tables.
Source: CISA
GlobalMay 20, 2026
Microsoft Defender Link Following Vulnerability
Microsoft Defender contains a link following vulnerability that impacts system security controls. The vulnerability allows an authorized attacker to elevate privileges locally on the affected host. CISA designated the vulnerability as actively exploited on May 20, 2026, setting a federal remediation deadline of June 3, 2026.
Why it matters: Security monitoring software operating with elevated system permissions represents an attractive vector for privilege escalation. Once an attacker obtains an initial foothold, abusing host defense software can establish system-level control while evading basic detection. Unpatched endpoint agents undermine defense-in-depth strategies across modern operating systems.
Recommended action: Enterprise administrators must verify that Microsoft Defender definitions and platform components are updated across all endpoints before June 3, 2026. Audit host-level authorization configurations to restrict local attacker traversal and link creation activities.
Source: CISA

Week of May 11, 2026

Active exploitation targeted enterprise networking controllers and on-premises messaging infrastructure during the week of May 11, 2026.

During this week, federal authorities added confirmed vulnerabilities in Cisco Catalyst SD-WAN and Microsoft Exchange Server to the Known Exploited Vulnerabilities catalog. These flaws enable remote administrative takeover of wide area network infrastructure and arbitrary script execution in webmail interfaces. Enterprise security leaders must prioritize rapid remediation to protect organizational communications and core routing fabrics.

GlobalMay 14, 2026
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass
Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication mechanisms. Upon exploitation, the attacker can obtain full administrative privileges on an affected system. The vulnerability was added to the Known Exploited Vulnerabilities catalog on May 14, 2026, with a remediation deadline set for May 17, 2026.
Why it matters: Unauthenticated administrative access to SD-WAN controllers allows adversaries to intercept, redirect, or disrupt critical enterprise network traffic across distributed sites. Compromise of the central management layer undermines network segmentation policies and core architectural trust. Security governance is severely impaired when infrastructure controllers fall under hostile control.
Recommended action: Locate all internet-facing and internal Cisco Catalyst SD-WAN Controller and Manager instances and immediately apply the vendor fixes to eliminate the authentication bypass.
Source: CISA
GlobalMay 15, 2026
Microsoft Exchange Server Outlook Web Access Cross-Site Scripting
Microsoft Exchange Server contains a cross-site scripting vulnerability that arises during web page generation in Outlook Web Access. When specific user interaction conditions are met, arbitrary JavaScript can be executed within the victim's browser context. CISA cataloged the flaw on May 15, 2026, requiring federal agencies to remediate it by May 29, 2026.
Why it matters: The execution of arbitrary script in a webmail session allows adversaries to hijack active sessions, access sensitive email communications, and impersonate legitimate users. Because Exchange systems house critical organizational correspondence, browser-based compromises can bypass traditional perimeter controls. Failing to resolve script injection flaws exposes internal communications to sustained surveillance and regulatory risk.
Recommended action: Apply the appropriate Microsoft security updates across all Exchange Server deployments hosting Outlook Web Access.
Source: CISA

Week of May 4, 2026

Active exploitation of network infrastructure, enterprise mobility platforms, and AI proxy tooling drove critical remediation mandates during the week of May 4, 2026.

During the week of May 4, 2026, CISA cataloged active exploitation affecting core network gateways, mobile management appliances, and specialized AI proxies. These vulnerabilities exposed enterprises to unauthenticated root code execution, administrative compromise, and sensitive credential extraction. Security leaders were required to prioritize urgent patching across perimeter defenses and proxy databases to mitigate immediate operational exposure.

GlobalMay 6, 2026
Palo Alto Networks PAN-OS Remote Code Execution
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability within the User-ID Authentication Portal, also known as the Captive Portal service. An unauthenticated attacker can exploit this flaw by sending specially crafted packets to PA-Series and VM-Series firewalls. This condition allows the attacker to execute arbitrary code with root privileges on the affected appliances.
Why it matters: Unauthenticated root-level code execution on edge firewalls undermines perimeter security boundaries across enterprise networks. Compromised firewalls allow adversaries to establish persistent control and potentially intercept or manipulate network traffic. Organizations face critical governance exposure if perimeter infrastructure is breached without requiring prior authentication.
Recommended action: Security teams must identify vulnerable PA-Series and VM-Series firewalls and apply the appropriate vendor patches immediately.
Source: CISA
GlobalMay 7, 2026
Ivanti Endpoint Manager Mobile Remote Code Execution
Ivanti Endpoint Manager Mobile contains an improper input validation vulnerability that affects administrative components. This security defect allows a remotely authenticated user possessing administrative access to achieve remote code execution on the server. The vulnerability was added to the CISA catalog following confirmed exploitation in production environments.
Why it matters: Administrative interfaces exposed to remote code execution grant attackers full operational control over enterprise device management platforms. An adversary leveraging compromised administrative access can alter configurations, target managed endpoints, and establish footholds within internal networks. This creates severe compliance and operational risks for organizations relying on centralized mobile device management.
Recommended action: Enterprise administrators should immediately update vulnerable Ivanti Endpoint Manager Mobile instances to supported versions and audit administrative access logs.
Source: CISA
GlobalMay 8, 2026
BerriAI LiteLLM SQL Injection
BerriAI LiteLLM contains a SQL injection vulnerability that affects the underlying proxy database. An attacker can exploit this vulnerability to read data from the database and potentially modify existing records. Successful exploitation leads to unauthorized access to the proxy and exposes the credentials it manages.
Why it matters: Exposure of managed credentials from an AI proxy database presents an immediate threat to connected downstream services and systems. If attackers manipulate or exfiltrate database contents, enterprise authentication posture and data integrity are severely degraded. Security leaders face severe compliance liabilities when centralized infrastructure components fail to protect stored secrets.
Recommended action: Remediate vulnerable deployments of BerriAI LiteLLM by applying vendor updates and rotating all credentials managed by the proxy.
Source: CISA

Week of April 27, 2026

Active exploitation across administrative platforms and foundational operating system components demands rapid remediation across enterprise environments.

During the week of April 27, 2026, CISA cataloged four newly confirmed exploited vulnerabilities spanning core operating systems, remote support infrastructure, and hosting control panels. The affected technologies include the Linux Kernel, Microsoft Windows Shell, ConnectWise ScreenConnect, and WebPros cPanel and WHM. Enterprise security teams must prioritize these vulnerabilities to prevent unauthorized remote access, code execution, and host privilege escalation.

GlobalApr 30, 2026
WebPros cPanel & WHM and WP2 Authentication Bypass
WebPros cPanel & WHM and WP2 contain an authentication bypass vulnerability within the login flow designated as CVE-2026-41940. CISA added the flaw to the Known Exploited Vulnerabilities catalog on April 30, 2026. The vulnerability allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Why it matters: Compromise of hosting management interfaces grants attackers direct control over underlying servers and hosted web services. Given the accelerated federal remediation deadline of May 3, 2026, the risk of rapid and widespread exploitation is acute.
Recommended action: Inspect exposed WebPros cPanel, WHM, and WP2 interfaces and apply required vendor patches immediately.
Source: CISA
GlobalApr 28, 2026
ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect contains a path traversal vulnerability cataloged under CVE-2024-1708. CISA confirmed active exploitation and added the flaw to the catalog on April 28, 2026. The issue allows an attacker to execute remote code or directly impact confidential data and critical systems.
Why it matters: Remote management tools are high-value targets that grant deep operational access across enterprise endpoints. Successful exploitation exposes sensitive data and provides threat actors with an avenue for arbitrary code execution on monitored hosts.
Recommended action: Ensure all ConnectWise ScreenConnect instances are updated to patched versions prior to the May 12, 2026 deadline.
Source: CISA
GlobalMay 1, 2026
Linux Kernel Privilege Escalation Vulnerability
The Linux Kernel contains an incorrect resource transfer between spheres vulnerability tracked as CVE-2026-31431. The vulnerability was added to the CISA catalog on May 1, 2026. The flaw allows an attacker to achieve local privilege escalation on affected systems.
Why it matters: Flaws in the operating system kernel bypass internal access controls and weaken system compartmentalization. Attackers can leverage kernel-level privilege escalation to establish persistence and fully compromise server workloads.
Recommended action: Identify vulnerable Linux systems across server fleets and apply the relevant kernel patches before May 15, 2026.
Source: CISA
GlobalApr 28, 2026
Microsoft Windows Shell Protection Mechanism Failure
Microsoft Windows Shell contains a protection mechanism failure vulnerability designated as CVE-2026-32202. Added to the CISA catalog on April 28, 2026, the vulnerability enables an unauthorized attacker to perform spoofing over a network. Federal agencies must complete remediation by May 12, 2026.
Why it matters: Network spoofing weakens core protection boundaries and enables attackers to mask malicious activities or mislead client communications. Unmitigated Windows Shell flaws provide an operational foothold to facilitate broader lateral movement within corporate networks.
Recommended action: Distribute and enforce the applicable Microsoft Windows security updates across all networked workstations and servers.
Source: CISA

Week of April 20, 2026

CISA catalog updates highlighted critical risks across network management appliances and administrative enterprise software.

During the week of April 20, 2026, CISA expanded its Known Exploited Vulnerabilities catalog with multiple flaws impacting foundational network operations, remote support tooling, and enterprise infrastructure. Organizations faced urgent remediation deadlines for exposed administrative platforms including Cisco Catalyst SD-WAN Manager and SimpleHelp. Security leaders needed to prioritize rapid patch verification and lifecycle assessments to neutralize active exploitation vectors.

GlobalApr 20, 2026
Cisco Catalyst SD-WAN Manager File Overwrite and Privilege Escalation
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability caused by improper file handling on its API interface. An attacker can exploit this issue by uploading a malicious file to the local file system. Successful exploitation allows the attacker to overwrite arbitrary files and obtain vmanage user privileges.
Why it matters: Compromising core software-defined networking management infrastructure threatens the integrity and segmentation of the entire enterprise wide area network. Elevated privileges on the manager console grant adversaries significant control over network routing and critical communication paths. Immediate intervention is required to avoid broader infrastructure takeover.
Recommended action: Apply vendor-supplied security patches immediately to address CVE-2026-20122 in accordance with federal remediation guidance.
Source: CISA
GlobalApr 24, 2026
SimpleHelp Path Traversal and Authorization Bypass
SimpleHelp contains a path traversal vulnerability that permits admin users to execute arbitrary code in the context of the server user by uploading crafted zip archives. Additionally, a missing authorization flaw allows low-privileged technicians to generate API keys with excessive permissions and escalate to the server admin role. When chained, these flaws allow low-level operators to achieve full host code execution.
Why it matters: Remote support and management tools represent high-value targets due to their pervasive access across internal workstations and servers. Unauthorized privilege escalation on these platforms undermines role-based access controls and exposes internal endpoints to secondary compromise. Failure to secure support software can turn legitimate administrative channels against the organization.
Recommended action: Upgrade SimpleHelp deployments to the latest release to remediate both the file upload path traversal and the API key authorization weaknesses.
Source: CISA
GlobalApr 23, 2026
Marimo Remote Code Execution Vulnerability
Marimo contains a pre-authorization remote code execution vulnerability. The flaw allows an unauthenticated attacker to obtain shell access on the affected system. Exploitation enables the arbitrary execution of system commands without requiring valid credentials.
Why it matters: Pre-authentication remote code execution represents the most severe class of threat to enterprise systems. Unauthenticated access allows external threat actors to establish immediate footholds on hosts running the software. Such compromises frequently lead to lateral movement, data exfiltration, and full host takeover.
Recommended action: Isolate exposed Marimo instances and immediately implement security updates to eliminate unauthenticated command execution risks.
Source: CISA
GlobalApr 24, 2026
D-Link DIR-823X Command Injection Vulnerability
D-Link DIR-823X routers contain a command injection vulnerability in the handling of POST requests sent to the /goform/set_prohibiting endpoint. An authorized attacker can leverage this flaw to execute arbitrary commands on the remote device. CISA noted that the impacted product could be end-of-life or end-of-service.
Why it matters: Edge routing hardware provides a gateway into organizational and remote office environments. Because end-of-life network devices no longer receive official security maintenance, persistent vulnerabilities cannot be reliably mitigated through standard patch cycles. Continued deployment of unsupported edge hardware poses an ongoing compliance and operational liability.
Recommended action: Discontinue utilization of the D-Link DIR-823X router and replace affected units with currently supported hardware.
Source: CISA

Week of April 13, 2026

Active exploitation across enterprise management platforms and messaging infrastructure demands rapid remediation of legacy and newly identified vulnerabilities.

During the week of April 13, 2026, CISA expanded its Known Exploited Vulnerabilities catalog with multiple critical flaws affecting core enterprise software from Fortinet, Apache, Microsoft, and Adobe. Several additions involve remote code execution and injection vectors that threat actors are actively leveraging in the wild. Enterprise leaders must enforce rigorous patch validation schedules, particularly where federal remediation mandates require immediate action within tight timeframes.

GlobalApr 13, 2026
Fortinet FortiClient EMS SQL Injection Vulnerability
CISA added CVE-2026-21643 to the Known Exploited Vulnerabilities catalog on April 13, 2026, with federal remediation required by April 16, 2026. The vulnerability involves an SQL injection flaw in Fortinet FortiClient EMS. It allows an unauthenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests.
Why it matters: This flaw introduces severe operational exposure because adversaries require no valid credentials to achieve command execution on critical management software. Because endpoint management platforms maintain broad access across corporate networks, unpatched systems provide high-value entry points. The three-day federal remediation window highlights the immediate severity of active threat activity.
Recommended action: Identify and patch all internet-facing and internal Fortinet FortiClient EMS instances immediately.
Source: CISA
GlobalApr 16, 2026
Apache ActiveMQ Improper Input Validation Vulnerability
Added to the CISA catalog on April 16, 2026, CVE-2026-34197 addresses an improper input validation vulnerability in Apache ActiveMQ. The defect allows threat actors to perform code injection against affected message broker instances. Federal agencies must complete remediation by April 30, 2026.
Why it matters: Enterprise message brokers handle high volumes of sensitive system-to-system communications across production environments. Successful code injection in this layer compromises application integrity and can facilitate unauthorized lateral movement across integrated back-end services. Failure to address the flaw exposes message-handling infrastructure to remote exploitation.
Recommended action: Apply the appropriate vendor updates to all Apache ActiveMQ deployments prior to April 30, 2026.
Source: CISA
GlobalApr 13, 2026
Microsoft Exchange Server Deserialization Vulnerability
CISA cataloged CVE-2023-21529 on April 13, 2026, setting a federal remediation deadline of April 27, 2026. The vulnerability stems from improper deserialization of untrusted data in Microsoft Exchange Server. This weakness enables an authenticated attacker to achieve remote code execution on the server.
Why it matters: Mail servers remain premier targets for adversaries seeking access to sensitive internal communications and enterprise directory services. Once an attacker obtains baseline credentials, this vulnerability allows them to gain code execution privileges on critical infrastructure. Unpatched mail environments represent significant data confidentiality and compliance risks.
Recommended action: Audit Microsoft Exchange Server patch levels and install the required security updates across all affected servers.
Source: CISA
GlobalApr 13, 2026
Adobe Acrobat and Reader Prototype Pollution Vulnerability
On April 13, 2026, CISA added CVE-2026-34621 to the Known Exploited Vulnerabilities catalog with a federal remediation date of April 27, 2026. The flaw consists of a prototype pollution vulnerability residing in Adobe Acrobat and Reader. Successful exploitation allows a threat actor to achieve arbitrary code execution on target hosts.
Why it matters: Document readers are broadly deployed across enterprise endpoints, creating an extensive client-side attack surface. Weaponized files targeting such vulnerabilities frequently bypass perimeter controls and execute malicious code directly on workstations. Leaving desktop software unpatched undermines endpoint protection strategies and user workstation integrity.
Recommended action: Deploy the latest vendor security updates for Adobe Acrobat and Reader to all enterprise workstations.
Source: CISA

Week of April 6, 2026

Active exploitation of enterprise endpoint and mobility management platforms demanded rapid remediation during the week of April 6, 2026.

The Cybersecurity and Infrastructure Security Agency added two critical vulnerabilities affecting endpoint management systems to its Known Exploited Vulnerabilities catalog. Both flaws expose centralized administrative infrastructure to unauthenticated remote code execution via network requests. Enterprise security leaders were required to prioritize emergency remediation due to short federal compliance deadlines and the severe access risks posed by compromised endpoint controllers.

GlobalApr 6, 2026
Fortinet FortiClient EMS Improper Access Control Vulnerability
CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities catalog on April 6, 2026, establishing a federal remediation due date of April 9, 2026. The vulnerability involves improper access control within Fortinet FortiClient EMS. It allows an unauthenticated attacker to execute unauthorized code or commands by sending crafted requests.
Why it matters: Endpoint management servers maintain direct communication channels and administrative rights across corporate device fleets. Unauthenticated remote command execution on these nodes allows threat actors to compromise central policy enforcement and deploy arbitrary payloads across managed hosts. The three-day remediation requirement highlights the acute operational risk posed to enterprise governance and boundary defense.
Recommended action: Enterprise administrators should have applied vendor-provided updates immediately to secure Fortinet FortiClient EMS instances against unauthorized command execution.
Source: CISA
GlobalApr 8, 2026
Ivanti Endpoint Manager Mobile Code Injection Vulnerability
CISA added CVE-2026-1340 to the Known Exploited Vulnerabilities catalog on April 8, 2026, with a federal remediation due date of April 11, 2026. The security defect consists of a code injection vulnerability in Ivanti Endpoint Manager Mobile. This flaw enables attackers to achieve unauthenticated remote code execution.
Why it matters: Mobile device management solutions sit at critical network boundaries to govern access to enterprise data and services. Exploitation of this platform permits unauthenticated adversaries to execute arbitrary code with elevated privileges, undermining mobile fleet security posture and potentially exposing corporate assets to broader network infiltration. The accelerated remediation window underscores the critical severity of active exploitation against perimeter infrastructure.
Recommended action: Security leaders should have ensured immediate application of vendor patches to all exposed Ivanti Endpoint Manager Mobile appliances to prevent unauthenticated code injection.
Source: CISA

Week of March 30, 2026

Active exploitation of network appliances, browser components, and collaboration software demanded immediate remediation during the week of March 30, 2026.

The Cybersecurity and Infrastructure Security Agency added three actively exploited vulnerabilities across enterprise perimeter appliances, web browser engines, and client collaboration software to its Known Exploited Vulnerabilities catalog. Security leaders faced urgent remediation timelines, notably an accelerated requirement for Citrix NetScaler appliances configured as SAML identity providers. Organizations operating affected Chromium-based browsers and TrueConf client endpoints required immediate patching to prevent memory overread and arbitrary code execution.

GlobalMar 30, 2026
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Citrix NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS and NDcPP contain an out-of-bounds read vulnerability when configured as a SAML identity provider. The flaw leads to memory overread conditions on affected systems. CISA added CVE-2026-3055 to the Known Exploited Vulnerabilities catalog on March 30, 2026, establishing a federal remediation due date of April 2, 2026.
Why it matters: Because NetScaler devices routinely handle authentication and edge ingress, memory overread vulnerabilities create critical exposures for enterprise environments. Active exploitation of identity provider infrastructure risks unauthorized exposure of sensitive memory contents. The expedited three-day remediation window highlights the acute risk to organizational boundary defenses.
Recommended action: Identify all NetScaler ADC and Gateway instances configured as SAML identity providers and apply vendor-issued updates immediately.
Source: CISA
GlobalApr 1, 2026
Google Dawn Use-After-Free Vulnerability in Chromium Browsers
Google Dawn contains a use-after-free vulnerability that allows a remote attacker who has compromised the renderer process to execute arbitrary code via a crafted HTML page. The affected component impacts multiple Chromium-based products, including Google Chrome, Microsoft Edge, and Opera. CISA added CVE-2026-5281 to the Known Exploited Vulnerabilities catalog on April 1, 2026, with federal remediation required by April 15, 2026.
Why it matters: Vulnerabilities embedded in foundational browser libraries threaten enterprise desktop environments due to widespread end-user web access. If an attacker leverages a compromised renderer, this flaw provides a path to arbitrary code execution directly on the endpoint. Widespread adoption of Chromium-based browsers across enterprise endpoints amplifies the overall organizational exposure.
Recommended action: Enforce updates across all enterprise deployments of Google Chrome, Microsoft Edge, Opera, and other Chromium-based browsers.
Source: CISA
GlobalApr 2, 2026
TrueConf Client Download of Code Without Integrity Check Vulnerability
TrueConf Client contains a flaw involving the download of code without an integrity check. An attacker who can influence the update delivery path is able to substitute a tampered update payload. If installed or executed by the updater, the substituted payload can yield arbitrary code execution within the context of the updating process or user.
Why it matters: Compromising the software update mechanism circumvents standard endpoint controls and allows attackers to introduce unauthorized code into enterprise systems. Threat actors positioned on the delivery path can achieve arbitrary execution on endpoints running collaboration software. This exposure enables unauthorized local access and compromises host integrity.
Recommended action: Upgrade TrueConf Client installations across all managed endpoints to secure versions prior to the April 16, 2026 remediation deadline.
Source: CISA

Week of March 23, 2026

Active exploitation across boundary infrastructure, build pipelines, and workflow orchestration expanded enterprise attack surfaces during the week of March 23, 2026.

Enterprise security leaders needed to address confirmed exploitation spanning perimeter access management, pipeline security tooling, and AI orchestration frameworks. Adversaries actively leveraged these flaws to achieve remote code execution, harvest pipeline secrets, and execute arbitrary code without authentication. Immediate remediation across network appliances and developer environments was required to prevent downstream supply chain and internal network compromise.

GlobalMar 27, 2026
F5 BIG-IP APM Remote Code Execution
CISA cataloged CVE-2025-53521 on March 27, 2026, establishing a federal remediation due date of March 30, 2026. The vulnerability is a stack-based buffer overflow in F5 BIG-IP APM that enables a threat actor to achieve remote code execution.
Why it matters: Compromising an access policy manager allows threat actors to establish an authoritative foothold on perimeter infrastructure. Unauthenticated remote code execution on these systems undermines perimeter defenses and facilitates lateral movement across enterprise networks.
Recommended action: Security teams must identify all exposed F5 BIG-IP APM instances and immediately apply the vendor-provided security patches to prevent exploitation.
Source: CISA
GlobalMar 26, 2026
Aquasecurity Trivy Embedded Malicious Code
CVE-2026-33634 was added to the CISA catalog on March 26, 2026, with federal remediation required by April 9, 2026. Aquasecurity Trivy contains embedded malicious code that could grant an attacker complete access to the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and sensitive in-memory configurations.
Why it matters: Vulnerabilities within CI/CD components expose high-privilege credentials and sensitive environmental variables directly to attackers. A compromise of this tooling undermines supply chain integrity and permits deep lateral compromise into production cloud and database environments.
Recommended action: Organizations should audit all CI/CD pipelines utilizing Trivy, update the software, and revoke and rotate all credentials, tokens, and SSH keys managed by affected pipelines.
Source: CISA
GlobalMar 25, 2026
Langflow Unauthenticated Code Injection
CISA added CVE-2026-33017 to the Known Exploited Vulnerabilities catalog on March 25, 2026, setting a federal remediation due date of April 8, 2026. Langflow contains a code injection vulnerability that allows attackers to construct public flows without requiring authentication.
Why it matters: Unauthenticated code injection allows adversaries to manipulate application flows and execute arbitrary operations within the hosting environment. This directly risks the security of connected downstream services and internal application components integrated with the platform.
Recommended action: Security administrators must apply the latest vendor patches to Langflow deployments and ensure that all workflow management interfaces are protected behind strong authentication controls.
Source: CISA

Week of March 16, 2026

CISA added nine actively exploited vulnerabilities to its catalog during the week of March 16, 2026, highlighted by critical remote code execution flaws in enterprise infrastructure and application frameworks.

During the week of March 16, 2026, federal authorities mandated urgent remediation deadlines for actively exploited flaws across critical enterprise systems including Cisco Secure Firewall Management Center and Microsoft SharePoint. Organizations faced significant threats from unauthenticated remote code execution and deserialization vulnerabilities affecting network infrastructure, collaboration platforms, and web application stacks. Security leaders were required to prioritize rapid patch deployment to mitigate immediate risks of root-level compromise and unauthorized network access.

GlobalMar 19, 2026
Cisco Secure Firewall Management Center Deserialization Vulnerability
Cisco Secure Firewall Management Center Software and Cisco Security Cloud Control Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface. This flaw allows an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. CISA cataloged the issue on March 19, 2026, setting a remediation deadline of March 22, 2026.
Why it matters: Because this flaw grants root-level execution without authentication, adversaries can achieve total compromise of core network security infrastructure. Such access undermines perimeter defenses and enables unmonitored lateral movement across the enterprise.
Recommended action: Enterprise security teams must immediately apply vendor-provided patches or restrict network exposure to affected management interfaces.
Source: CISA
GlobalMar 18, 2026
Microsoft SharePoint Deserialization Remote Code Execution Vulnerability
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. The vulnerability was added to the Known Exploited Vulnerabilities catalog on March 18, 2026. Federal agencies were directed to remediate the vulnerability by March 21, 2026.
Why it matters: SharePoint servers host critical business assets and sensitive organizational documentation. Unauthorized remote code execution on these platforms presents severe risks of data exfiltration and credential harvesting.
Recommended action: Organizations should urgently deploy the required security updates to all on-premises SharePoint deployments and verify network isolation.
Source: CISA
GlobalMar 20, 2026
Laravel Livewire and Craft CMS Code Injection Vulnerabilities
Craft CMS and Laravel Livewire both contain code injection vulnerabilities that enable remote code execution. The Laravel Livewire flaw allows unauthenticated attackers to achieve remote command execution in specific scenarios, while the Craft CMS flaw permits arbitrary code execution by remote attackers. Both vulnerabilities were listed by CISA on March 20, 2026, with remediation required by April 3, 2026.
Why it matters: Exploitation of web framework components allows threat actors to seize control of public-facing web applications. Successful attacks can lead to web application compromise, backend infrastructure access, and widespread data exposure.
Recommended action: Security teams should update all instances of Craft CMS and Laravel Livewire to their latest patched releases and inspect application logs for suspicious payloads.
Source: CISA
GlobalMar 20, 2026
Apple Operating Systems Buffer Overflow and Memory Corruption Vulnerabilities
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain multiple actively exploited vulnerabilities, including an improper locking flaw and two buffer overflow defects. CVE-2025-43520 allows a malicious application to cause unexpected system termination or write kernel memory, while CVE-2025-31277 enables memory corruption via maliciously crafted web content. CISA cataloged these vulnerabilities on March 20, 2026, with an enforcement deadline of April 3, 2026.
Why it matters: Flaws that facilitate kernel memory writes or web-driven memory corruption undermine operating system isolation controls. If successfully exploited, these issues can lead to full device takeover across corporate mobile and desktop fleets.
Recommended action: Security administrators should push the latest Apple operating system and Safari browser updates to all managed endpoints.
Source: CISA

Week of March 9, 2026

Active exploitation of enterprise management platforms, workflow automation, and browser engines demanded rapid patch deployment across critical infrastructure.

CISA expanded its Known Exploited Vulnerabilities catalog during the week of March 9, 2026, targeting systems spanning endpoint administration, IT service management, workflow orchestration, and core browser components. Enterprise security leaders faced accelerated federal remediation deadlines, including an urgent turnaround for IT help desk infrastructure. Organizations must prioritize auditing exposed enterprise services and applying vendor updates to mitigate risks of remote code execution and unauthorized access.

GlobalMar 9, 2026
SolarWinds Web Help Desk Deserialization Vulnerability
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability within AjaxProxy. This flaw allows an attacker to execute commands directly on the host machine. CISA added the vulnerability to its catalog on March 9, 2026, establishing a federal remediation due date of March 12, 2026.
Why it matters: Arbitrary command execution on IT service management hosts compromises internal ticket records and infrastructure control. An attacker gaining host-level control can pivot deeper into internal corporate networks. The compressed federal remediation timeline highlights the critical operational risk posed by active exploitation.
Recommended action: Identify all instances of SolarWinds Web Help Desk and apply vendor patches immediately.
Source: CISA
GlobalMar 9, 2026
Ivanti Endpoint Manager Authentication Bypass
Ivanti Endpoint Manager contains an authentication bypass vulnerability using an alternate path or channel. This vulnerability allows a remote unauthenticated attacker to leak specific stored credential data. CISA cataloged the issue on March 9, 2026, with remediation required by March 23, 2026.
Why it matters: Endpoint management systems hold elevated privileges and store critical access tokens across the corporate environment. An unauthenticated leak of stored credentials undermines network segmentation and exposes downstream managed devices. Exploitation enables adversaries to harvest enterprise credentials without triggering standard authentication alerts.
Recommended action: Isolate affected Ivanti Endpoint Manager servers and deploy the official vendor update before March 23, 2026.
Source: CISA
GlobalMar 9, 2026
Omnissa Workspace ONE UEM Server-Side Request Forgery
Omnissa Workspace ONE UEM, formerly known as VMware Workspace ONE UEM, contains a server-side request forgery vulnerability. A malicious actor with network access can send requests without authentication to gain access to sensitive information. CISA added the entry on March 9, 2026, with a federal remediation deadline of March 23, 2026.
Why it matters: Unified endpoint management platforms centralize corporate device policies and sensitive configuration details. Unauthorized information disclosure through server-side request forgery can facilitate lateral movement and further compromise enterprise endpoints. Active targeting of older infrastructure assets demonstrates continued adversary focus on unpatched perimeter systems.
Recommended action: Restrict network access to Workspace ONE UEM administrative interfaces and apply vendor remediations by March 23, 2026.
Source: CISA
GlobalMar 11, 2026
n8n Workflow Automation Remote Code Execution
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system. This flaw allows an attacker to achieve remote code execution. CISA added the vulnerability on March 11, 2026, setting a federal remediation deadline of March 25, 2026.
Why it matters: Workflow automation tools frequently possess deep API integrations and read-write privileges across disparate enterprise systems. Remote code execution within an orchestration engine enables adversaries to intercept data flows, exfiltrate credentials, and subvert automated business logic. Compromising such platforms presents systemic risk to interconnected IT and cloud operations.
Recommended action: Audit all enterprise n8n instances and update them to a remediated version before March 25, 2026.
Source: CISA
GlobalMar 13, 2026
Google Chromium V8 Sandbox Code Execution
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability. A remote attacker can exploit this flaw via a crafted HTML page to execute arbitrary code inside a sandbox. This vulnerability affects multiple browsers including Google Chrome, Microsoft Edge, and Opera, and carries a federal remediation deadline of March 27, 2026.
Why it matters: Broad reliance on Chromium-based browsers creates widespread exposure across corporate desktop fleets. In-sandbox arbitrary code execution provides adversaries with an initial foothold on client workstations through routine web browsing. When combined with other system exploits, such client-side compromises can jeopardize user credentials and local enterprise assets.
Recommended action: Update Google Chrome, Microsoft Edge, Opera, and other Chromium-based browsers across all enterprise endpoints before March 27, 2026.
Source: CISA

Week of March 2, 2026

Federal advisories confirmed active exploitation across enterprise virtualization, industrial control systems, surveillance hardware, and mobile operating systems.

Enterprise security leaders faced confirmed exploitation across core operational technology, virtualization management infrastructure, and mobile endpoints. The additions emphasize that adversaries target legacy protocol vulnerabilities and edge physical security devices alongside newly identified enterprise administration flaws. Organizations must maintain strict network segmentation and prioritize remediation across both corporate IT systems and operational technology assets.

GlobalMar 3, 2026
Broadcom VMware Aria Operations Command Injection Vulnerability
Broadcom VMware Aria Operations, formerly known as vRealize Operations, contains a command injection vulnerability. An unauthenticated attacker can execute arbitrary commands during support-assisted product migration. This exploitation can potentially lead to remote code execution.
Why it matters: Unauthenticated remote execution within central administrative platforms presents critical enterprise risk. Compromise of operational management tooling enables attackers to gain control over broader virtualization infrastructure. Organizations must ensure that migration and administrative interfaces are strictly protected against unauthorized access.
Recommended action: Identify all VMware Aria Operations deployments and apply vendor updates before the remediation deadline of March 24, 2026.
Source: CISA
GlobalMar 5, 2026
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Multiple Rockwell products contain an insufficient protected credentials vulnerability involving Studio 5000 Logix Designer software. The flaw may allow an unauthorized user with network access to discover a key used to verify communication between Logix controllers and design software. Successful exploitation could allow an unauthorized application to connect with Logix controllers.
Why it matters: Unauthorized access to industrial controllers introduces substantial risk to operational integrity and physical process safety. Attackers who gain network access to industrial environments can abuse key verification weaknesses to establish rogue connections. This underscores the imperative for continuous isolation between enterprise IT and industrial networks.
Recommended action: Restrict network access to Logix controllers and update vulnerable engineering workstations before March 26, 2026.
Source: CISA
GlobalMar 5, 2026
Hikvision Multiple Products Improper Authentication Vulnerability
Multiple Hikvision products contain an improper authentication vulnerability. The flaw allows a malicious user to escalate privileges on the affected system. Successful exploitation allows attackers to gain unauthorized access to sensitive information.
Why it matters: Physical surveillance systems often reside on peripheral networks with inconsistent patch governance. Gaining elevated access to these devices allows threat actors to harvest sensitive operational data and obtain persistence. Enterprise asset management must integrate physical security technology into standardized patching pipelines.
Recommended action: Audit physical security environments for affected Hikvision devices and implement required patches by March 26, 2026.
Source: CISA
GlobalMar 5, 2026
Apple iOS and iPadOS Use-After-Free Vulnerability
Apple iOS and iPadOS contain a use-after-free vulnerability. A malicious application may exploit this condition to execute arbitrary code on the device. Exploitation allows code execution to occur with kernel privileges.
Why it matters: Vulnerabilities that grant kernel privileges break underlying operating system protections and application sandboxing. Compromised mobile devices present significant exposure risks for corporate communications, credentials, and enterprise authentication tools. Mobile device fleets require automated patch enforcement to mitigate active exploitation.
Recommended action: Enforce mobile device management policies to update all managed iOS and iPadOS endpoints by March 26, 2026.
Source: CISA

Week of February 23, 2026

Active exploitation of core network routing and enterprise file transfer appliances drove security priorities during the week of February 23, 2026.

The addition of flaws affecting Cisco SD-WAN infrastructure and Soliton Systems FileZen to the Known Exploited Vulnerabilities catalog highlights active threats against enterprise perimeter and transport technologies. Attackers are weaponizing an authentication bypass flaw in SD-WAN controllers to manipulate fabric configurations alongside command execution vulnerabilities in appliance interfaces. Security leaders must ensure accelerated patching cycles are applied to protect network management planes and file exchange platforms from unauthorized administrative control.

GlobalFeb 25, 2026
Cisco Catalyst SD-WAN Controller and Manager
Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager contain an authentication bypass vulnerability stemming from a malfunctioning peering authentication mechanism. An unauthenticated remote attacker can exploit this flaw by sending crafted requests to an affected system. Successful exploitation allows the attacker to log in as an internal, high-privileged, non-root user and access NETCONF to manipulate network configurations across the SD-WAN fabric.
Why it matters: Compromise of the central SD-WAN management layer permits attackers to rewrite routing logic and redirect or disrupt enterprise traffic without valid credentials. This undermines fundamental network isolation and trust boundaries across geographically distributed operations. The ability to manipulate NETCONF configurations introduces widespread governance and availability risks for enterprise network operations.
Recommended action: Apply vendor-supplied security updates for all affected Cisco Catalyst SD-WAN Controller and Manager instances immediately.
Source: CISA
GlobalFeb 25, 2026
Cisco SD-WAN Command Line Interface
A path traversal vulnerability in the Cisco SD-WAN command line interface results from improper access controls on CLI commands. An authenticated local attacker can leverage this condition to gain elevated privileges on the system. Successful exploitation enables the execution of arbitrary commands with root privileges.
Why it matters: Elevation of privilege to the root level grants an attacker total administrative control over the underlying operating system of the SD-WAN appliance. This allows an adversary who has obtained local appliance access to establish persistent administrative footholds and bypass security restrictions. Such compromises jeopardize the integrity of network endpoints and complicate incident detection.
Recommended action: Deploy the required security patches across all affected Cisco SD-WAN appliances to eliminate improper CLI access controls.
Source: CISA
GlobalFeb 24, 2026
Soliton Systems K.K FileZen
Soliton Systems K.K FileZen contains an operating system command injection vulnerability. The flaw is triggered when an authenticated user logs in to the affected product and transmits a specially crafted HTTP request. This behavior permits the execution of unauthorized operating system commands on the appliance.
Why it matters: Enterprise file transfer tools process and store sensitive institutional data, making host-level compromise an acute operational hazard. Successful command injection allows an authenticated threat actor to execute arbitrary actions directly on the server operating system. This capability exposes confidential transfers to unauthorized manipulation and risks underlying infrastructure integrity.
Recommended action: Upgrade all Soliton Systems K.K FileZen appliances to the latest patched software release prior to the remediation deadline.
Source: CISA

Week of February 16, 2026

Active exploitation of virtualization management systems, enterprise webmail, and core browser software highlighted critical enterprise patching obligations during the week of February 16, 2026.

Federal authorities added eight actively exploited vulnerabilities across enterprise virtualization, collaboration platforms, and web browsers to the Known Exploited Vulnerabilities catalog. Security leadership needed to prioritize urgent remediation for deeply embedded administrative platforms and internet-facing communication services. Addressing these exposures required immediate patch validation alongside strict enforcement of credential and network exposure controls.

GlobalFeb 18, 2026
Dell RecoverPoint for Virtual Machines Hard-Coded Credentials
Dell RecoverPoint for Virtual Machines contains a vulnerability stemming from the use of hard-coded credentials. This issue allows an unauthenticated remote attacker to gain unauthorized access to the underlying operating system. Successful exploitation enables an adversary to establish root-level persistence on the affected system.
Why it matters: Hard-coded credentials present severe governance risks because they bypass standard enterprise identity access management and auditing controls. Gaining root-level persistence on virtualization management appliances compromises the integrity of connected virtual infrastructure and disaster recovery operations. This flaw required immediate operational intervention due to an expedited federal remediation deadline of February 21, 2026.
Recommended action: Isolate all deployed Dell RecoverPoint for Virtual Machines appliances and apply the vendor remediation immediately. Restrict administrative management network access to authorized subnets to mitigate unauthorized remote connections.
Source: CISA
GlobalFeb 17, 2026
Google Chromium CSS Use-After-Free Memory Corruption
Google Chromium contains a use-after-free vulnerability within its CSS component. A remote attacker can potentially exploit heap corruption by enticing a user to view a specially crafted HTML page. The vulnerability impacts multiple web browsers utilizing the Chromium engine, including Google Chrome, Microsoft Edge, and Opera.
Why it matters: Browser-based memory corruption flaws expose enterprise endpoints to drive-by compromises through routine web browsing activity. Because the underlying flaw affects several major browser platforms, exposure cuts across mixed enterprise desktop environments. Unpatched browser engines undermine standard perimeter defenses and leave endpoint systems vulnerable to arbitrary execution.
Recommended action: Deploy the latest browser updates across all enterprise endpoints for Google Chrome, Microsoft Edge, and Opera. Verify complete update distribution through centralized endpoint management systems before the March 10, 2026 deadline.
Source: CISA
GlobalFeb 20, 2026
Roundcube Webmail Untrusted Data Deserialization
Roundcube Webmail contains a deserialization of untrusted data vulnerability in program/actions/settings/upload.php. The flaw occurs because the _from parameter in a URL is not properly validated by the application. This vulnerability allows authenticated users to achieve remote code execution on the server.
Why it matters: Enterprise webmail servers represent critical communications infrastructure and are commonly positioned with direct access to internal messaging networks. Remote code execution on these platforms enables attackers to intercept communications, access credentials, and move laterally across the network. Leaving webmail interfaces exposed to verified exploits compromises compliance and enterprise confidentiality standards.
Recommended action: Upgrade all Roundcube Webmail instances to patched releases prior to the March 13, 2026 federal remediation due date. Review web application logs for suspicious URL requests directed at the settings upload component.
Source: CISA
GlobalFeb 18, 2026
GitLab Server-Side Request Forgery via Webhooks
GitLab contains a server-side request forgery vulnerability that manifests when requests to the internal network for webhooks are enabled. CISA confirmed active exploitation and added the vulnerability to the catalog on February 18, 2026. The flaw permits attackers to leverage webhook functionality to route unauthorized requests directly into internal networks.
Why it matters: Server-side request forgery risks exposing protected internal services, administrative interfaces, and cloud metadata to external manipulation. Because development platforms store core intellectual property and automate software deployments, unauthorized internal network pivot points present significant supply chain risks. Organizations fail essential zero trust objectives when development infrastructure is permitted to forge internal requests unchecked.
Recommended action: Disable webhook requests to internal networks within GitLab network settings unless strictly required by operational needs. Apply current security updates across all GitLab instances to meet the March 11, 2026 compliance requirement.
Source: CISA

Week of February 9, 2026

Active exploitation of administrative platforms and core operating systems demanded urgent remediation across enterprise environments.

During the week of February 9, 2026, federal authorities confirmed active exploitation across critical administrative tools, configuration managers, and operating systems. Enterprise security leaders faced accelerated remediation windows for privileged access and service desk platforms, notably BeyondTrust and SolarWinds solutions. Organizations must prioritize patching exposed administrative software and client endpoints to prevent unauthenticated command execution and network access.

GlobalFeb 13, 2026
BeyondTrust Remote Support and Privileged Remote Access OS Command Injection
BeyondTrust Remote Support and Privileged Remote Access contain an operating system command injection vulnerability. An unauthenticated remote attacker can exploit this flaw without user interaction to execute operating system commands in the context of the site user. CISA added the vulnerability on February 13, 2026, with a federal remediation due date of February 16, 2026.
Why it matters: Exploitation poses severe operational risk, including total system compromise, unauthorized access, data exfiltration, and service disruption. Because the vulnerability requires zero authentication or interaction, internet-facing remote access appliances present immediate entry points for attackers. Compromise of a privileged access gateway undermines core identity and access management controls.
Recommended action: Deploy the official vendor security fix across all BeyondTrust Remote Support and Privileged Remote Access deployments immediately to meet mandated remediation timelines.
Source: CISA
GlobalFeb 12, 2026
Microsoft Configuration Manager SQL Injection
Microsoft Configuration Manager contains an SQL injection vulnerability triggered by specially crafted requests processed in an unsafe manner. This flaw allows an unauthenticated attacker to execute commands on the server as well as the underlying database. The vulnerability was added to the catalog on February 12, 2026, with a federal remediation deadline of March 5, 2026.
Why it matters: Configuration Manager controls enterprise software distribution, policy enforcement, and client telemetry. Unauthenticated command execution on the host server or database jeopardizes the integrity of all managed enterprise endpoints. Attackers can leverage this level of access to gain persistent control over central management infrastructure.
Recommended action: Apply the appropriate Microsoft security update for Configuration Manager to eliminate unsafe request handling across all management servers.
Source: CISA
GlobalFeb 12, 2026
SolarWinds Web Help Desk Security Control Bypass
SolarWinds Web Help Desk contains a security control bypass vulnerability. Successful exploitation permits an unauthenticated attacker to gain access to restricted application functionality. Added by CISA on February 12, 2026, this vulnerability carried an expedited federal remediation deadline of February 15, 2026.
Why it matters: Help desk infrastructure frequently stores internal ticketing details, support documentation, and user identity metadata. Bypassing security controls allows unauthenticated actors to access sensitive internal workflows and features. The compressed remediation timeframe emphasizes the critical need to secure exposed help desk systems against unauthorized access.
Recommended action: Update SolarWinds Web Help Desk to the latest supported release immediately to restore proper access control enforcement.
Source: CISA
GlobalFeb 12, 2026
Apple Multiple Operating Systems Buffer Overflow
Apple iOS, macOS, tvOS, watchOS, and visionOS contain a vulnerability involving the improper restriction of operations within memory buffer bounds. An attacker with memory write capability can exploit this condition to execute arbitrary code. CISA listed this vulnerability on February 12, 2026, establishing a federal remediation due date of March 5, 2026.
Why it matters: This flaw impacts the entire breadth of the Apple operating system ecosystem across mobile, desktop, and wearable hardware. Arbitrary code execution allows attackers to defeat platform security boundaries and compromise host system integrity. Broad enterprise adoption of Apple devices necessitates rapid lifecycle patch management to mitigate exploitation risks.
Recommended action: Deploy operating system updates across all managed enterprise Apple devices to remediate memory handling flaws.
Source: CISA

Week of February 2, 2026

Active exploitation across enterprise software underscored severe risks from unauthenticated command injection and authentication bypass vulnerabilities.

During the week of February 2, 2026, security authorities identified active exploitation targeting development servers, messaging systems, help desk software, and communications platforms. Multiple vulnerabilities allow attackers to bypass authentication or execute arbitrary commands remotely on affected hosts. Enterprise risk leaders must prioritize hardening administrative interfaces and verifying patch compliance for externally reachable services.

GlobalFeb 3, 2026
SolarWinds Web Help Desk Deserialization Vulnerability
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability. An attacker can exploit this issue without authentication to execute commands directly on the host machine. The flaw results in full remote code execution.
Why it matters: Unauthenticated code execution in help desk platforms exposes core IT administration environments to complete hostile takeover. Compromised service desk infrastructure can be leveraged by adversaries to move laterally and compromise sensitive internal operations. Governance teams must mandate immediate mitigation due to the severe operational impact.
Recommended action: Apply the official vendor patch to SolarWinds Web Help Desk immediately to eliminate unauthenticated command execution pathways.
Source: CISA
GlobalFeb 5, 2026
React Native Community CLI Command Injection
React Native Community CLI contains an operating system command injection vulnerability in an exposed endpoint. Unauthenticated network attackers can send POST requests to the Metro Development Server to execute arbitrary executables. On Windows systems, attackers can execute arbitrary shell commands with fully controlled arguments.
Why it matters: Exposing developer tooling to network-accessible endpoints introduces direct pathways into software engineering environments. Command execution on developer endpoints threatens proprietary intellectual property and software supply chain integrity. Enterprise security policies must enforce network segmentation around local development services.
Recommended action: Deploy available security updates for React Native Community CLI and ensure Metro Development Server endpoints are restricted from untrusted network traffic.
Source: CISA
GlobalFeb 5, 2026
SmarterTools SmarterMail Authentication Failure
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability within the ConnectToHub API method. An attacker can exploit this flaw to point the SmarterMail instance toward a malicious HTTP server. That malicious server serves an operating system command that can lead to command execution.
Why it matters: Business communications infrastructure remains a primary target for external threat actors seeking persistence. A failure in API authentication that enables arbitrary command execution severely undermines the confidentiality and availability of corporate email services. Security leaders must ensure critical communication platforms maintain stringent authentication controls across all exposed interfaces.
Recommended action: Update SmarterTools SmarterMail to the latest supported release and monitor outbound traffic from mail servers for unauthorized HTTP connections.
Source: CISA
GlobalFeb 3, 2026
Sangoma FreePBX Authentication Bypass
Sangoma FreePBX contains an improper authentication vulnerability. This defect potentially allows unauthorized users to bypass password authentication completely. Consequently, unauthorized actors can access services provided by the FreePBX administrator interface.
Why it matters: Authentication bypasses on voice-over-IP management consoles strip away primary defense barriers for organizational telephony. Gaining administrative control over FreePBX allows adversaries to alter system configurations and manipulate enterprise voice communications. Security oversight must ensure telephony management interfaces are insulated from unauthorized access.
Recommended action: Apply the relevant vendor update for Sangoma FreePBX and restrict administrative interface access to authorized administrative subnets.
Source: CISA

Week of January 26, 2026

Emergency remediation directives for critical authentication bypass and remote code execution vulnerabilities in enterprise infrastructure led active exploitation additions in late January 2026.

Enterprise security leaders faced compressed remediation windows for high-impact flaws discovered in mobile management and network infrastructure. Federal catalog updates emphasized immediate risk reduction for edge appliances, identity federation channels, and exposed administrative endpoints. Organizations must prioritize applying vendor mitigations, disabling risky single sign-on integrations, and retiring legacy services.

GlobalJan 29, 2026
Ivanti Endpoint Manager Mobile Code Injection Vulnerability
Ivanti Endpoint Manager Mobile contains a code injection vulnerability that allows unauthenticated threat actors to achieve remote code execution. Added to the CISA catalog on January 29, 2026, the vulnerability carried an accelerated federal remediation deadline of February 1, 2026. The flaw poses severe risks to perimeter mobile management instances.
Why it matters: Unauthenticated execution capabilities on device management servers undermine internal security boundaries. Attackers compromising this software can obtain deep visibility into enterprise mobile fleets and potentially pivot into adjacent internal networks. The compressed remediation timeline reflects the critical operational risk posed to enterprise environments.
Recommended action: Apply the appropriate vendor updates to all Ivanti Endpoint Manager Mobile deployments immediately to prevent unauthenticated remote code execution.
Source: CISA
GlobalJan 27, 2026
Fortinet Multiple Products Authentication Bypass
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass vulnerability using an alternate path or channel. An attacker possessing a FortiCloud account and a registered device can log into devices registered to other accounts when FortiCloud single sign-on authentication is enabled. The entry was added on January 27, 2026, with remediation required by January 30, 2026.
Why it matters: Cross-account administrative access breaks core multi-tenancy protections across central management and firewall appliances. Attackers can leverage legitimate FortiCloud assets to hijack external appliances without possessing valid target credentials. This exposure compromises centralized network configuration, policy enforcement, and logging controls.
Recommended action: Disable FortiCloud single sign-on authentication where feasible or apply the vendor security updates across affected FortiAnalyzer, FortiManager, FortiOS, and FortiProxy systems.
Source: CISA
GlobalJan 26, 2026
SmarterTools SmarterMail Password Reset Authentication Bypass
SmarterTools SmarterMail contains an authentication bypass vulnerability within its password reset API. The application force-reset-password endpoint permits anonymous requests without validating existing passwords or reset tokens for system administrator accounts. An unauthenticated attacker can supply an administrator username alongside a new password to gain full administrative access to the mail instance.
Why it matters: Administrative compromise of enterprise mail infrastructure grants adversaries access to business communications and sensitive corporate intelligence. Trivial takeover of administrative credentials enables rapid lateral movement and persistent tenant-level control. Unrestricted endpoint exposure directly invalidates core identity and access management assurances.
Recommended action: Deploy the latest vendor patch for SmarterTools SmarterMail and audit administrative access logs for unauthorized password reset activity.
Source: CISA
GlobalJan 26, 2026
GNU InetUtils Telnetd Remote Authentication Bypass
GNU InetUtils contains an argument injection vulnerability within its telnet daemon service. The flaw allows remote authentication bypass when a specific value is supplied for the USER environment variable. CISA added the vulnerability on January 26, 2026, mandating remediation by February 16, 2026.
Why it matters: Permitting unauthorized root access over legacy services presents severe risk to host integrity and confidentiality. Cleartext administration protocols lack modern access controls and expose underlying systems to direct takeover. Legacy software remaining active within corporate boundaries creates persistent footholds for threat actors.
Recommended action: Disable telnetd services across all production hosts or apply necessary security updates while transitioning management traffic to secure protocols.
Source: CISA

Week of January 19, 2026

Active exploitation of core enterprise virtualization, networking, and communications infrastructure defined threat activity during the week of January 19, 2026.

During the week of January 19, 2026, federal advisories confirmed active exploitation across fundamental enterprise backbones, including virtualization management, SD-WAN orchestration, and unified communications. These vulnerabilities exposed organizations to remote code execution, root privilege escalation, and unauthorized access to administrative endpoints. Security leaders were required to prioritize rapid remediation to safeguard perimeter controls and prevent lateral movement across internal networks.

GlobalJan 23, 2026
Broadcom VMware vCenter Server Out-of-Bounds Write Vulnerability
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in its implementation of the DCERPC protocol. A malicious actor with network access to the server can send specially crafted network packets. This flaw can potentially lead to remote code execution on the appliance.
Why it matters: Compromise of virtualization management platforms poses severe risk to all hosted workloads and virtualization boundaries. Unauthenticated network access leading to remote code execution enables attackers to seize control of enterprise infrastructure. Organizations face substantial operational disruption and data exposure if hypervisor controls are undermined.
Recommended action: Apply the appropriate vendor patches to all vulnerable VMware vCenter Server deployments prior to the February 13, 2026 remediation deadline.
Source: CISA
GlobalJan 21, 2026
Cisco Unified Communications Products Code Injection Vulnerability
A code injection vulnerability affects multiple Cisco platforms, including Cisco Unified Communications Manager, Unified CM Session Management Edition, Unified CM IM & Presence Service, Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance. An attacker can exploit this weakness to gain user-level access to the underlying operating system. The attacker can subsequently elevate those privileges to root access.
Why it matters: Unified communications systems handle sensitive internal and external organizational communications. Gaining root access to these platforms gives threat actors complete administrative control over critical telephony infrastructure. Such deep operating system access facilitates sustained persistence and unauthorized reconnaissance inside protected enterprise environments.
Recommended action: Deploy official vendor security updates to affected Cisco Unified Communications appliances ahead of the February 11, 2026 deadline.
Source: CISA
GlobalJan 22, 2026
Versa Concerto Improper Authentication Vulnerability
The Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability within its Traefik reverse proxy configuration. This flaw enables attackers to access administrative endpoints without proper validation. The internal Actuator endpoint can also be leveraged to access heap dumps and trace logs.
Why it matters: SD-WAN orchestration tools control wide-area network routing policies and core traffic flows. Exposing administrative interfaces and diagnostic logs permits threat actors to extract sensitive operational telemetry and system memory data. A compromise at this layer jeopardizes boundary controls and enterprise segmentation architecture.
Recommended action: Apply vendor fixes to resolve Traefik reverse proxy misconfigurations on Versa Concerto platforms before February 12, 2026.
Source: CISA
GlobalJan 22, 2026
Synacor Zimbra Collaboration Suite PHP Remote File Inclusion Vulnerability
Synacor Zimbra Collaboration Suite contains a PHP remote file inclusion vulnerability in its rest handling components. Remote attackers can craft malicious requests to the /h/rest endpoint to influence internal request dispatching. This manipulation allows the inclusion of arbitrary files located within the WebRoot directory.
Why it matters: Enterprise messaging and collaboration suites serve as high-value repositories of sensitive corporate information. Exploitation of file inclusion weaknesses permits attackers to manipulate server logic and potentially execute unauthorized actions. Breaching collaboration servers threatens message confidentiality and can provide initial access for wider corporate intrusions.
Recommended action: Update all Synacor Zimbra Collaboration Suite servers to patched versions to protect the rest endpoint prior to February 12, 2026.
Source: CISA

Week of January 12, 2026

Active exploitation alerts targeted Microsoft Windows local components and Gogs code hosting services during the week of January 12, 2026.

The Cybersecurity and Infrastructure Security Agency added two confirmed exploited vulnerabilities to its catalog affecting Microsoft Windows and Gogs. Enterprise defenders face exposure ranging from local information disclosure in core operating system components to code execution stemming from path traversal in developer infrastructure. Security leaders must track and remediate these cataloged flaws across relevant enterprise environments to comply with federal guidance and mitigate active threats.

GlobalJan 12, 2026
Gogs Path Traversal Vulnerability
Gogs contains a path traversal vulnerability designated as CVE-2025-8110. The security flaw stems from improper symbolic link handling in the PutContents API and could allow for code execution. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on January 12, 2026, with federal remediation due by February 2, 2026.
Why it matters: Vulnerabilities that facilitate code execution in version control platforms introduce critical operational risks to source code repositories. Active exploitation of such infrastructure can compromise developmental integrity and provide adversaries an initial foothold. Governance teams must ensure repository platforms are secured to protect sensitive internal assets.
Recommended action: Apply relevant security patches to Gogs installations before the February 2, 2026 federal remediation due date.
Source: CISA
GlobalJan 13, 2026
Microsoft Windows Desktop Window Manager Information Disclosure
Microsoft Windows contains an information disclosure vulnerability tracked as CVE-2026-20805. The issue resides in the Desktop Window Manager and allows an authorized attacker to disclose information locally. The flaw was added to the Known Exploited Vulnerabilities catalog on January 13, 2026, with federal remediation mandated by February 3, 2026.
Why it matters: Local information disclosure weaknesses permit authenticated actors to read restricted data directly from system processes. Attackers routinely leverage leaked system information to bypass security boundaries or assist subsequent privilege escalation attempts. Maintaining timely operating system patch cycles is vital to prevent local compromise escalation.
Recommended action: Deploy updates addressing CVE-2026-20805 across all impacted Microsoft Windows endpoints by February 3, 2026.
Source: CISA

Week of January 5, 2026

CISA added actively exploited code injection vulnerabilities in Hewlett Packard Enterprise OneView and Microsoft Office PowerPoint to its catalog.

During the week of January 5, 2026, federal authorities confirmed active exploitation spanning data center infrastructure management software and legacy office productivity applications. Both vulnerabilities allow remote attackers to achieve arbitrary code execution, underscoring ongoing exposure from both modern control planes and persistent legacy software. Enterprise security leaders must align with the federal remediation deadline of January 28, 2026, to neutralize exposure across endpoints and management infrastructure.

GlobalJan 7, 2026
Hewlett Packard Enterprise OneView Code Injection Vulnerability
Hewlett Packard Enterprise OneView contains a code injection vulnerability that permits a remote unauthenticated user to perform remote code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog on January 7, 2026, confirming active exploitation in the wild. Federal agencies must complete remediation for affected systems by January 28, 2026.
Why it matters: Unauthenticated remote code execution on centralized management platforms presents a severe operational risk to enterprise data centers. Attackers gaining control over infrastructure management planes can pivot across linked environments and disrupt critical hardware resources. Enterprise governance requires immediate verification of perimeter defenses and patch levels for all deployed management consoles.
Recommended action: Audit all enterprise deployments of Hewlett Packard Enterprise OneView and apply official vendor updates before the January 28, 2026 deadline.
Source: CISA
GlobalJan 7, 2026
Microsoft Office PowerPoint Code Injection Vulnerability
Microsoft Office PowerPoint contains a code injection vulnerability that enables remote attackers to execute arbitrary code using a specially crafted presentation file. The flaw is triggered when an OutlineTextRefAtom with an invalid index value causes memory corruption during file processing. CISA cataloged the vulnerability on January 7, 2026, setting a federal remediation deadline of January 28, 2026.
Why it matters: The confirmed exploitation of this vulnerability illustrates that adversaries continue to target legacy application flaws to establish initial access on enterprise endpoints. Successful exploitation can compromise local user sessions and grant attackers a foothold inside corporate networks via standard document-sharing channels. Organizations retaining older software suites face compounded risk when legacy components escape standard vulnerability lifecycle management.
Recommended action: Identify any systems running vulnerable Microsoft Office PowerPoint installations and deploy required security patches or retire legacy software instances.
Source: CISA

Industry Pulse: this week in global cybersecurity

Critical enterprise perimeter infrastructure and core business platforms face widespread exploitation alongside emerging strategic threats to artificial intelligence assets.

CISA Warns of Industrial-Scale AI Model Distillation Campaigns

CERT-EU Alerts on Critical Vulnerabilities in Check Point Products

Critical Weaknesses Reported in SAP Kernel and NetWeaver Message Server

CISA Adds Exploited Cisco, Citrix, and Fortinet Flaws to KEV Catalog

CISA Issues Strategic Call to Action for Post-Quantum Migration

Active exploitation across enterprise developer tooling, communications infrastructure, and web components prompted aggressive federal remediation timelines.

JFrog Artifactory Authentication Flaw

Sangoma Switchvox SQL Injection

Kestra OSS Command Injection

Google Chromium V8 Type Confusion

Active exploitation across enterprise data infrastructure, development pipelines, and core operating systems dominated the threat landscape.

Microsoft SQL Server Remote Code Execution

Oracle HTTP Server and WebLogic Proxy Plug-in Access Control

Gitea Code Injection

ownCloud Improper Authentication

Linux Kernel IPv6 Subsystem Privilege Escalation

Active exploitation targeted foundational enterprise infrastructure, messaging platforms, and network authentication mechanisms during the week of August 17, 2026.

Broadcom VMware vCenter Path Traversal Vulnerability

Synacor Zimbra Collaboration Suite OS Command Injection

Microsoft Internet Key Exchange Service Extensions Double Free Vulnerability

Apple macOS Screen Sharing Improper Authentication Vulnerability

Active exploitation of vulnerabilities in network firewalls, operating system drivers, and analytics platforms demanded rapid enterprise remediation.

Cisco Secure Firewall ASA and FTD Heap Inspection Vulnerability

Metabase Application SQL Injection Vulnerability

Microsoft Windows Ancillary Function Driver Privilege Escalation

Active exploitation targeted enterprise infrastructure and developer tooling through critical unauthenticated execution and authentication bypass flaws.

Progress LoadMaster Command Injection

JetBrains TeamCity Untrusted Deserialization

N-able N-central Authentication Bypass

IBM Langflow Code Injection

Active exploitation targeted enterprise network management appliances and orchestrators during the final week of July 2026.

Arista VeloCloud Orchestrator On-Prem Command Injection

Cisco Secure Firewall Management Center Hard-Coded Password Vulnerability

Fortinet FortiOS Patch Bypass and Information Exposure

Active exploitation targeted enterprise management consoles, collaboration servers, and web platforms through critical authentication and code execution vulnerabilities.

Check Point SmartConsole Authentication Bypass

Microsoft SharePoint Untrusted Data Deserialization

WordPress Core Interpretation Conflict and Chained Remote Code Execution

Langflow Untrusted Control Sphere Code Execution

CISA added ten actively exploited vulnerabilities across critical enterprise infrastructure including collaboration platforms, security appliances, and enterprise business suites during the week of July 13, 2026.

Microsoft SharePoint Remote Code Execution and Privilege Escalation

Fortinet FortiSandbox Remote OS Command Injection

Oracle E-Business Suite Oracle Payments Takeover

SonicWall SMA1000 Appliances SSRF and Code Injection

Active exploitation of web component file upload flaws and application access controls drove urgent remediation mandates.

Adobe ColdFusion Path Traversal Vulnerability

Langflow Flow Execution Authorization Bypass

Balbooa Forms Unauthenticated Remote Code Execution

JoomShaper SP Page Builder Arbitrary File Upload

Active exploitation targeted authentication flaws in remote administration software and deserialization vulnerabilities in enterprise collaboration platforms.

SimpleHelp Authentication Bypass Vulnerability

Microsoft SharePoint Server Deserialization of Untrusted Data

Active exploitation targeted edge appliances, communications infrastructure, and enterprise product lifecycle software during the final week of June 2026.

PTC Windchill and FlexPLM Remote Code Execution

Cisco Unified Communications Manager Server-Side Request Forgery

Lantronix EDS5000 Command Injection

Ubiquiti UniFi OS Command Injection

Active exploitation across enterprise monitoring, web publishing, and network management systems drove urgent patching requirements during the week of June 15, 2026.

Splunk Enterprise Missing Authentication Vulnerability

Widget Factory Joomla Content Editor Improper Access Control

Cisco Catalyst SD-WAN Manager Directory Traversal Vulnerability

LiteSpeed cPanel Plugin Symbolic Link Following Vulnerability

Active exploitation of perimeter security gateways and core enterprise platforms highlighted urgent patch cycles in early June 2026.

Check Point Security Gateway Improper Authentication Vulnerability

Ivanti Sentry OS Command Injection Vulnerability

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication Vulnerability

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Threat actors actively targeted critical enterprise infrastructure and web services through unauthenticated remote exploits and privilege escalation flaws during the first week of June 2026.

Oracle WebLogic Server Unspecified Vulnerability

Mirasvit Full Page Cache Warmer Deserialization Vulnerability

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

Linux Kernel Improper Authentication Vulnerability

Android Framework Integer Overflow Vulnerability

Active exploitation targeted edge networking infrastructure, developer software supply chains, and web hosting environments.

Palo Alto Networks PAN-OS Authentication Bypass

Nx Console Embedded Malicious Code

TanStack Malicious Package Publication

LiteSpeed cPanel Plugin Privilege Escalation