Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Topic

Active Exploitation, page 2

News, analysis and practical guidance on Active Exploitation.

75 articlesUpdated 26 Sep 2026Page 2 of 4

ThreatsCloud & SaaSCritical
WordPress Core Critical SQL Injection Flaw CVE-2026-60137 Exploited in Mass Web Attacks
CISA incorporates WordPress Core vulnerabilities CVE-2026-60137 and CVE-2026-63030 (CVSS 9.8) into KEV catalog following active in-the-wild web attacks.
CST Newsroom17 Sep 202614 min read
ThreatsCloud & SaaSHigh
Red Hat ABRT Crash Reporting Daemon Flaw CVE-2015-5287 Weaponized for Linux Root Privilege Escalation
CISA adds Red Hat ABRT vulnerability CVE-2015-5287 (CVSS 7.8) to KEV catalog following active exploitation against enterprise Linux host infrastructure.
Priya Raman17 Sep 202612 min read
ThreatsCloud & SaaSCritical
SimpleHelp Remote Support Platform Critical Authentication Bypass CVE-2026-48558 in Active Attacks
CISA adds SimpleHelp remote support platform vulnerability CVE-2026-48558 (CVSS 9.8) to KEV catalog following active exploitation against enterprise networks.
Daniel Okafor17 Sep 202613 min read
ThreatsCloud & SaaSCritical
N-able N-central Critical Authentication Bypass CVE-2026-18577 Exploited in MSP Supply Chain Attacks
CISA adds N-able N-central vulnerability CVE-2026-18577 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against MSP management infrastructure.
Mei-Lin Chen17 Sep 202614 min read
ThreatsCloud & SaaSHigh
Red Hat Enterprise Linux libuser Race Condition Flaw Exploited for Local Root Escalation
CISA adds Red Hat libuser vulnerability CVE-2015-3246 (CVSS 8.8) to KEV catalog following active in-the-wild exploitation for root privilege escalation.
Tom Verhoeven17 Sep 202612 min read
ThreatsCloud & SaaSCritical
DD-WRT Gateway Firmware Stack Buffer Overflow CVE-2021-27137 Weaponized in Network Perimeter Attacks
CISA adds DD-WRT gateway vulnerability CVE-2021-27137 (CVSS 9.8) to KEV catalog following active weaponization by botnets targeting network perimeter routers.
Aisha Noor17 Sep 202613 min read
ThreatsCloud & SaaSCritical
Microsoft SQL Server Memory Corruption RCE Flaw Exploited in Database Infiltration Attacks
CISA adds Microsoft SQL Server vulnerability CVE-2019-1068 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against enterprise database clusters.
CST Newsroom17 Sep 202614 min read
ThreatsCloud & SaaSCritical
TrueConf Enterprise Server Authentication Bypass Flaw Weaponized to Access Communications
CISA mandates urgent remediation of TrueConf Server vulnerability CVE-2026-72529 (CVSS 9.8) exploited in the wild to bypass administrative access controls.
Priya Raman17 Sep 202612 min read
ThreatsCloud & SaaSCritical
Fortinet FortiSandbox Critical OS Command Injection Flaws CVE-2026-25089 & CVE-2026-39808 in Active Exploitation
CISA adds Fortinet FortiSandbox vulnerabilities CVE-2026-25089 and CVE-2026-39808 (CVSS 9.8) to KEV following active attacks against enterprise security fabrics.
Daniel Okafor17 Sep 202613 min read
ThreatsCloud & SaaSCritical
Acronis Backup Critical Privilege Flaw CVE-2026-87886 Exploited Against Cloud Hosting Servers
CISA adds Acronis Backup plugin vulnerability CVE-2026-87886 (CVSS 9.8) to its KEV catalog following active exploitation against cPanel and Plesk hosting infrastructure.
Priya Raman17 Sep 202610 min read
ThreatsCloud & SaaSHigh
Linux Kernel Watch Queue Privilege Escalation Flaw CVE-2022-0995 Weaponized in Cloud Attacks
CISA adds Linux kernel watch queue vulnerability CVE-2022-0995 to its KEV catalog following widespread weaponization in cloud container breakout attacks.
Mei-Lin Chen17 Sep 202610 min read
ThreatsCloud & SaaSCritical
Cisco Identity Services Engine Critical API Flaw Weaponized to Compromise Network Access
CISA orders emergency patching of Cisco Identity Services Engine vulnerability CVE-2026-76460 (CVSS 9.8) enabling unauthenticated remote network policy takeover.
Priya Raman17 Sep 202611 min read
ThreatsCloud & SaaSHigh
Apache Tomcat Session Data Exposure Flaw Weaponized in Credential Hijacking Attacks
CISA flags Apache Tomcat vulnerability CVE-2026-34486 exploited in enterprise intrusions to intercept unencrypted session tokens and hijack authenticated user access.
Daniel Okafor16 Sep 202610 min read
ThreatsCloud & SaaSCritical
Google Pixel Cellular Modem Zero-Day Flaw Exploited in Targeted Mobile Attacks
CISA adds Google Pixel baseband modem flaw CVE-2026-58704 to its KEV catalog following active zero-day exploitation against high-value target devices.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
Microsoft SharePoint Server Critical Deserialization Flaw CVE-2026-50522 Exploited in Active Attacks
CISA adds Microsoft SharePoint Server deserialization flaw CVE-2026-50522 (CVSS 9.8) to its KEV catalog following active exploitation against enterprise document farms.
Priya Raman16 Sep 202611 min read
ThreatsCloud & SaaSCritical
Check Point SmartConsole Authentication Bypass Flaw Exploited to Hijack Firewall Management
CISA orders emergency remediation of Check Point SmartConsole flaw CVE-2026-16232, which allows network adversaries to bypass authentication on management servers.
Daniel Okafor16 Sep 202610 min read
ThreatsCloud & SaaSCritical
Oracle E-Business Suite Critical Privilege Escalation Flaw CVE-2026-46817 Exploited in Enterprise Intrusions
CISA adds Oracle E-Business Suite privilege management flaw CVE-2026-46817 (CVSS 9.8) to its KEV catalog following active exploitation against cloud ERP deployments.
Priya Raman16 Sep 202611 min read
ThreatsCloud & SaaSCritical
Microsoft ADFS Cloud Identity Privilege Escalation Flaw CVE-2026-56155 Under Active Exploitation
CISA flags Microsoft Active Directory Federation Services vulnerability CVE-2026-56155 (CVSS 9.8) exploited in attacks forging SAML claims across hybrid Azure clouds.
Daniel Okafor16 Sep 202610 min read
ThreatsCloud & SaaSCritical
Arista VeloCloud SD-WAN Orchestrator Critical Command Injection Flaw CVE-2026-16812 Exploited in the Wild
CISA adds CVE-2026-16812 to KEV, warning of active exploitation targeting on-premise Arista VeloCloud SD-WAN Orchestrator management appliances.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
N-able N-central MSP Platform Authentication Bypass Flaw Weaponized in Perimeter Attacks
CISA mandates immediate remediation of CVE-2026-18556, an unauthenticated alternate path bypass in N-able N-central allowing full MSP administrative takeover.
Daniel Okafor16 Sep 20269 min read
ThreatsCloud & SaaSHigh
Fortinet FortiOS SSL-VPN Sensitive Information Disclosure Flaw CVE-2025-68686 Actively Targeted for Initial Access
CISA updates KEV with CVE-2025-68686, a critical information disclosure vulnerability in Fortinet FortiOS exploited to harvest active VPN session tokens.
CST Newsroom16 Sep 20269 min read
ThreatsCloud & SaaSCritical
Cisco Secure Firewall ASA and FTD Critical Heap Inspection Flaw CVE-2026-20349 Weaponized in the Wild
CISA adds CVE-2026-20349 to KEV, warning of active exploitation targeting Cisco Secure Firewall ASA and FTD packet inspection engines.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSHigh
Microsoft Windows WinSock Driver Zero-Day Flaw CVE-2026-68820 Exploited by Ransomware Groups for SYSTEM Takeover
CISA warns of in-the-wild exploitation of CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) granting SYSTEM privilege.
Daniel Okafor16 Sep 20269 min read
ThreatsCloud & SaaSCritical
Metabase Business Intelligence SQL Injection Flaw Exploited to Breach Analytics Warehouses
CISA alerts enterprises to active exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase analytics dashboards allowing database exfiltration.
CST Newsroom16 Sep 20269 min read