Section

Threats, page 3

Vulnerability intelligence, exploited CVEs, malware families and live campaigns — with the detection guidance and mitigations defenders need first.

231 articlesUpdated 28 Sep 2026Page 3 of 10

ThreatsIndustrial & OTCritical
Critical lwIP MQTT Client Buffer Overflow Enables Remote Code Execution on Industrial IoT Devices CVE-2026-87121
CISA releases advisory ICSA-26-265-01 for critical CVSS 9.8 flaw CVE-2026-87121 in lwIP MQTT client, allowing unauthenticated attackers to execute arbitrary code.
CST Newsroom24 Sep 202616 min read
ThreatsCloud & SaaSHigh
Amazon Ion-C Library Recursion Flaw Triggers Cloud Service Stack Exhaustion Crashes CVE-2026-84851
AWS publishes Bulletin 2026-094-AWS for high-severity flaw CVE-2026-84851 in Amazon Ion-C library, allowing attackers to exhaust stack memory and crash services.
CST Newsroom24 Sep 202615 min read
ThreatsCloud & SaaSHigh
Amazon OpenSearch SQL Plugin Cursor Deserialization Flaw Enables Remote Code Execution CVE-2026-83497
AWS and OpenSearch release bulletin 2026-092-AWS for high-severity flaw CVE-2026-83497 in the SQL plugin allowing authenticated users to execute code via cursors.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSHigh
Azure AI Foundry Server-Side Request Forgery Flaw Exposes Internal Agent Infrastructure CVE-2026-85917
Microsoft discloses high-severity flaw CVE-2026-85917 in Azure AI Foundry allowing unauthenticated attackers to execute SSRF and elevate privileges over the network.
CST Newsroom23 Sep 202615 min read
ThreatsIndustrial & OTHigh
Critical lwIP Embedded TCP/IP Stack Double Free Flaw Exposes Industrial Controllers to Remote Hijacking CVE-2026-91018
CISA and lwIP maintainers warn of high-severity flaw CVE-2026-91018 in the lwIP TCP/IP stack allowing unauthenticated remote memory corruption across IoT and PLCs.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Critical Azure Cosmos DB Downstream Injection Flaw Enabled Cloud Privilege Escalation CVE-2026-87701
Microsoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical Check Point Security Management Server Path Traversal Flaw Exploited to Gain Root System Access CVE-2026-93616
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Critical Arista VeloCloud Orchestrator Zero-Day Exploited to Hijack SD-WAN Edge Gateways CVE-2026-93952
Arista confirms active in-the-wild exploitation of CVSS 10.0 CVE-2026-93952, allowing unauthenticated attackers to hijack on-prem VeloCloud Orchestrators.
CST Newsroom23 Sep 202617 min read
ThreatsCloud & SaaSHigh
Critical OCI Artifact Library Flaw in ORAS-Go Enables Symlink Path Traversal and Supply Chain Compromise CVE-2026-85731
A high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
CST Newsroom23 Sep 202616 min read
ThreatsIndustrial & OTCritical
Siemens Siveillance Control Arbitrary File Upload Flaw Grants Unauthenticated Root Access to Physical Security Systems CVE-2026-50093
Siemens patches critical CVSS 9.0 flaw CVE-2026-50093 in Siveillance Control OIS web service, enabling unauthenticated remote attackers to obtain root privileges.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical F5 BIG-IP APM Heap Overflow Weaponized to Hijack Enterprise Gateway Data Planes CVE-2026-94127
F5 confirms active zero-day exploitation of CVE-2026-94127, a critical heap buffer overflow in BIG-IP APM OAuth gateways allowing unauthenticated remote code execution.
CST Newsroom23 Sep 202617 min read
ThreatsCloud & SaaSCritical
Google Cloud Patches Critical GKE Multi-Cloud Flaw Enabling Cross-Project Cluster Hijack and Service Account Impersonation
Google Cloud remediates critical GCP-2026-058 flaw in GKE Multi-Cloud APIs where missing project checks enabled unauthorized cluster registration and IAM impersonation.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSHigh
BragJack Prompt Forcing Flaws in Chrome and Edge Allow Malicious Extensions to Seize Agentic Browser Control Planes
Security researchers demonstrate BragJack prompt forcing attacks against Chrome and Edge, hijacking agentic AI control planes to exfiltrate files and spy via camera.
Mei-Lin Chen23 Sep 202617 min read
ThreatsIndustrial & OTHigh
OpenPLC Runtime Stored XSS Flaw Enables Operator Session Hijacking and Unauthorized Physical Process Control CVE-2026-88020
CISA warns of CVE-2026-88020 in OpenPLC Runtime v3 web interface, allowing attackers to hijack operator sessions and manipulate physical industrial processes.
CST Newsroom23 Sep 202615 min read
ThreatsIndustrial & OTHigh
CareCam CM2507 IP Cameras Exposed to Video Stream Interception and Privileged Access Takeover CVE-2026-88259
CISA issues advisory for CareCam CM2507 IP cameras detailing unauthenticated video streaming, empty ONVIF passwords, and hardcoded root hashes risking facility surveillance.
CST Newsroom22 Sep 202615 min read
ThreatsCloud & SaaSHigh
OpenNext Cloudflare Adapter Flaw Enables Server-Side Request Forgery and Private Cache Disclosure CVE-2026-3125
Cloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.
CST Newsroom22 Sep 202615 min read
ThreatsIndustrial & OTHigh
Siemens Teamcenter Authentication Redirect Flaw Exposes Industrial PLM Blueprints to Session Hijacking CVE-2026-58113
Siemens and CISA issue advisory ICSA-26-258-07 for CVE-2026-58113 in Teamcenter PLM, where reflected XSS in authentication redirects allows remote attackers to hijack CAD sessions.
CST Newsroom22 Sep 202615 min read
ThreatsCloud & SaaSHigh
Strands Agents Tools HTTP Request Authorization Flaw Enables Indirect Prompt Injection Credential Theft CVE-2026-18394
AWS resolves high-severity vulnerability CVE-2026-18394 in Strands Agents Tools, where indirect prompt injection forces AI agents to exfiltrate bearer credentials via malicious proxy parameters.
CST Newsroom22 Sep 202615 min read
ThreatsCloud & SaaSHigh
AWS SDK for Go v2 Event Stream Header Decoder Flaw Triggers Remote Denial of Service Panic CVE-2026-89090
AWS patches medium-severity flaw CVE-2026-89090 in AWS SDK for Go v2, where malformed event stream response frames trigger unrecovered runtime panics and service crashes.
CST Newsroom22 Sep 202614 min read
ThreatsIndustrial & OTHigh
Bransys Electronic Logging Devices Exposed to Fleet Telemetry Hijack via Hardcoded MQTT Credentials Flaw CVE-2026-86520
CISA advisory ICSA-26-260-01 details hardcoded MQTT credentials across Bransys ELD telematics units, allowing remote adversaries to eavesdrop on live freight telemetry.
CST Newsroom22 Sep 202615 min read
ThreatsCloud & SaaSHigh
Zyxel GS1900 Smart Managed Switches Exploited in the Wild via CGI Stack Buffer Overflow Flaw CVE-2026-7273
Zyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
Daniel Okafor22 Sep 202615 min read
ThreatsCloud & SaaSHigh
CrewAI Multi-Agent Framework Flaw CVE-2026-37007 Allows Remote Code Execution via Path Traversal Tool Poisoning
Critical path traversal vulnerability CVE-2026-37007 in CrewAI FileWriterTool allows autonomous agents to be manipulated into executing arbitrary code on host systems.
Mei-Lin Chen22 Sep 202616 min read
ThreatsCloud & SaaSCritical
Critical Oracle WebLogic Server Flaw CVE-2026-83021 Allows Unauthenticated Remote Code Execution Across Enterprise Java Clusters
Oracle's Critical Security Patch Update fixes maximum-severity CVSS 10.0 flaw CVE-2026-83021 in WebLogic Server Core enabling unauthenticated remote takeover.
Priya Raman22 Sep 202617 min read
ThreatsCloud & SaaSHigh
Microsoft Azure CLI Command Injection Vulnerability CVE-2026-83948 Exposes Cloud CI/CD Automation Runners
Microsoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Aisha Noor22 Sep 202614 min read