Topic

Active Exploitation: news, advisories and analysis

93 articlesUpdated 30 Oct 2026

CyberSecureToday covers Active Exploitation across 93 articles published between 8 Sep 2026 and 30 Oct 2026. The coverage includes 91 vulnerability advisories, 1 incident or breach report and 1 analysis or guidance piece. 87 advisories are rated critical or high severity, and 80 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Active Exploitation most often intersect with CVSS 9.8, CISA KEV and Security Advisory, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Vulnerability Exploited in Wild Attacks”, was published 30 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

CISA KEV advisory hub: severity, KEV status and fixes in one table

Latest coverage

ThreatsCloud & SaaSBreaking
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Vulnerability Exploited in Wild Attacks
CVE-2026-76418 in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (Security Vulnerability) allows remote attackers to trigger active syste
CST Editorial Desk30 Oct 202610 min read
ThreatsCloud & SaaSBreaking
Broadcom VMware ESX Vulnerability Exploited in Wild Attacks
CVE-2026-41709 in Broadcom VMware ESX (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Vendor security patch
CST Editorial Desk29 Oct 202610 min read
ThreatsCloud & SaaSCritical
Google Brotli Vulnerability Exploited in Wild Attacks
CVE-2026-111497 in Google Brotli (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Version 1.2.0.
CST Editorial Desk28 Oct 202610 min read
ThreatsCloud & SaaSCritical
Adobe Commerce and Magento Unrestricted File Upload Flaw Exploited in Wild Attacks
CVE-2026-48356 in Adobe Commerce and Magento (Unrestricted File Upload) allows remote attackers to trigger active system exploitation. Patch: Vendor securi
CST Editorial Desk28 Oct 202610 min read
ThreatsCloud & SaaSCritical
Collabora Online – Built-in CODE Server OS Command Injection Flaw Exploited in Wild Attacks
CVE-2026-110447 in Collabora Online – Built-in CODE Server (OS Command Injection) allows remote attackers to trigger active system exploitation. Patch: Ver
CST Editorial Desk24 Oct 202610 min read
ThreatsCloud & SaaS
Siemens Software Center Vulnerability Exploited in Wild Attacks
CVE-2026-110936 in Siemens Software Center (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Vendor security p
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaS
Plex Media Server Server-Side Request Forgery Flaw Exploited in Wild Attacks
CVE-2026-96655 in Plex Media Server (Server-Side Request Forgery) allows remote attackers to trigger active system exploitation. Patch: Version 1.43.3.1086
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSCritical
Plex Media Server Input Validation Flaw Exploited in Wild Attacks
CVE-2026-96654 in Plex Media Server (Input Validation) allows remote attackers to trigger active system exploitation. Patch: Vendor security patch release.
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
EG Secure Solutions SiteGuard Server Edition OS Command Injection Flaw Exploited in Wild Attacks
CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition (OS Command Injection) allows remote attackers to trigger active system exploitation. Patch
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
Plex Media Server Vulnerability Exploited in Wild Attacks
CVE-2026-96656 in Plex Media Server (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Version 1.43.3.10861 and
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
Palo Alto Networks PAN-OS Management Interface RCE Exploited in Attacks
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with…
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaS
AhsayCBS Authentication Bypass Exploited Against Backup Servers
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Atlassian Data Center Flaw Spanning Jira, Confluence and Bitbucket Exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data…
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway AMP Flaw Exploited for Unauthenticated File Writes
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write…
CST Editorial Desk15 Oct 20267 min read
ThreatsCloud & SaaSCritical
AhsayCBS Backup Server Command Injection Exploited in Attacks
A flaw has been found in Ahsay AhsayCBS up to 10.3.2.
CST Editorial Desk15 Oct 20267 min read
$Citrix NetScaler ADC perimeter gateway appliance with fractured glowing binary memory buffers under cybernetic attack$
ThreatsCloud & SaaSCritical
Citrix NetScaler ADC Memory Buffer Flaws Exploited to Breach Perimeter Gateways
Threat actors are actively weaponizing memory buffer overflow and command injection flaws in Citrix NetScaler ADC to breach enterprise perimeter gateways.
Priya Raman2 Oct 20269 min read
ThreatsCloud & SaaSCritical
Apple Patches CoreGraphics In-The-Wild Zero-Day Memory Corruption Across iOS and macOS (CVE-2026-86950)
Apple resolves a critical out-of-bounds write zero-day in CoreGraphics (CVE-2026-86950) exploited in targeted cyber-espionage attacks against iOS and macOS.
CST Editorial Desk29 Sep 20268 min read
ThreatsCloud & SaaSCritical
Cisco Catalyst SD-WAN Manager Hex Encoding Flaw Exploited to Hijack Enterprise Routing (CVE-2026-76504)
A critical URL hex-encoding vulnerability in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to bypass authentication and hijack fabrics.
CST Editorial Desk29 Sep 20269 min read
ThreatsCloud & SaaSCritical
WordPress Core Template Traversal Flaw Weaponized for Remote Code Execution
WordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Mei-Lin Chen26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Microsoft SharePoint SafeControls Bypass Weaponized for Remote Code Execution
Microsoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
CST Editorial Desk26 Sep 202614 min read
ThreatsCloud & SaaSHigh
Zyxel GS1900 Switches Exploited in the Wild via CGI Buffer Overflow
Zyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
Daniel Okafor22 Sep 202615 min read
ThreatsCloud & SaaSHigh
LMDeploy Vision-Language Model Flaw CVE-2026-33626 Exploited in the Wild to Breach Internal Cloud Networks
Threat actors actively weaponize high-severity flaw CVE-2026-33626 in LMDeploy within hours of release, using multimodal image loaders as SSRF proxies into cloud metadata.
Mei-Lin Chen21 Sep 202614 min read
ThreatsCloud & SaaSCritical
Cisco Secure Firewall Flaw Weaponized to Compromise Perimeter Gateways
Cisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
Priya Raman19 Sep 202613 min read
ThreatsCloud & SaaSHigh
Linux Kernel In-Kernel TLS Receive Path Flaw Weaponized in Active Multi-Tenant Cloud Attacks
Threat actors weaponize improper condition check flaw CVE-2025-39682 in Linux kernel kTLS receive path, triggering out-of-bounds corruption in multi-tenant workloads.
CST Editorial Desk19 Sep 202611 min read