Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Topic

Active Exploitation, page 3

News, analysis and practical guidance on Active Exploitation.

75 articlesUpdated 26 Sep 2026Page 3 of 4

ThreatsCloud & SaaSCritical
JetBrains TeamCity Critical Deserialization Flaw Exploited in Active CI/CD Attacks
CISA orders federal agencies to patch CVE-2026-63077, an unauthenticated Java deserialization flaw enabling complete remote code execution on TeamCity CI/CD servers.
Priya Raman16 Sep 202610 min read
ThreatsCloud & SaaSCritical
IBM Langflow Visual AI Framework Remote Code Injection Vulnerability CVE-2026-9198 Exploited in Production Environments
CISA adds CVE-2026-9198 to KEV, warning of active remote code injection attacks weaponizing visual AI workflow builder IBM Langflow in enterprise environments.
Daniel Okafor15 Sep 20269 min read
ThreatsCloud & SaaSCritical
Progress LoadMaster Critical Root Command Injection Flaw CVE-2026-8037 Exploited for Perimeter Edge Takeover
CISA confirms in-the-wild exploitation of CVE-2026-8037, an unauthenticated command injection flaw granting root shell access on Progress LoadMaster appliances.
CST Newsroom15 Sep 20269 min read
ThreatsCloud & SaaSCritical
VMware vCenter Server Critical Path Traversal Flaw Exploited in Virtualization Attacks
CISA mandates urgent federal remediation as attackers weaponize CVE-2026-59310, an unauthenticated path traversal flaw granting root code execution on VMware vCenter appliances.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Apple macOS Screen Sharing Authentication Bypass Flaw Weaponized in Active Attacks
CISA confirms active exploitation of CVE-2026-65400, an unauthenticated network authentication bypass in Apple macOS Screen Sharing enabling remote desktop seizure.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Ray Distributed AI Framework Code Injection Flaw Exploited to Compromise AI Clusters
CISA issues an emergency directive on CVE-2025-62593, warning that unauthenticated code injection in Ray AI distributed computing clusters allows adversaries to seize GPU clusters and training models.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Microsoft Windows IKE Protocol Double-Free RCE Flaw Exploited in Active Network Attacks
CISA confirms active in-the-wild exploitation of CVE-2026-33824, an unauthenticated double-free memory corruption flaw in Windows IKE enabling remote root code execution over UDP 500.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
MLflow Open-Source AI Platform SSRF Flaw Weaponized to Exfiltrate Cloud Credentials
CISA issues urgent warning on CVE-2026-64849, a critical SSRF defect in open-source MLflow model registries allowing attackers to steal cloud IAM metadata and poison AI pipelines.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Ajax.NET Professional Object Deserialization Flaw Exploited for Remote Code Execution
Federal agencies and enterprise operators face urgent deadlines as CISA confirms active exploitation of CVE-2021-23758, an unauthenticated deserialization RCE in Ajax.NET Professional.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Oracle WebLogic Server & Proxy Plug-in Flaw Exploited to Bypass Access Controls
CISA adds CVE-2026-21962 to its KEV catalog, warning of active remote exploitation bypassing Oracle HTTP Server reverse proxy rules to seize WebLogic clusters.
Aisha Noor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Critical Zimbra Collaboration Suite OS Command Injection Flaw Exploited in In-the-Wild Attacks
Federal agencies face strict remediation deadlines as CISA confirms active exploitation of CVE-2026-73570, allowing unauthenticated adversaries to execute root shell commands on Zimbra mail servers.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
TrueConf Enterprise Video Server Remote Code Injection Flaw Weaponized in Enterprise Attacks
CISA warns of active exploitation targeting enterprise video conferencing systems via CVE-2026-72530, an unauthenticated remote code injection flaw on TrueConf port 4307.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Cisco Secure Email Gateway Critical SQL Injection Flaw Weaponized in Active Attacks
CISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
Mei-Lin Chen15 Sep 20268 min read
ThreatsCloud & SaaSCritical
JFrog Artifactory Path Traversal Flaw Enables Remote Cache Poisoning & Supply Chain Attacks
CISA adds CVE-2026-66384 to its KEV catalog, warning that path traversal in JFrog Artifactory allows remote adversaries to overwrite Docker layers and poison enterprise build pipelines.
Priya Raman15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Critical Gitea Git Diffpatch Code Injection Flaw Weaponized to Compromise Repositories
CISA issues binding remediation directive on CVE-2026-60004, a critical code injection defect in Gitea's git diffpatch parser enabling remote command execution on self-hosted repositories.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSHigh
Citrix NetScaler Gateway Memory Buffer Overflow Exploited in Active Attacks
CISA issued a binding directive on CVE-2026-8452, a high-severity memory buffer vulnerability in Citrix NetScaler ADC and Gateway appliances triggering perimeter denial of service.
Priya Raman15 Sep 20267 min read
ThreatsCloud & SaaSCritical
ownCloud Critical Authentication Bypass Flaw Under Active Exploitation
Federal agencies face urgent remediation deadlines as CISA confirms active exploitation of CVE-2023-49105, allowing attackers to access and delete cloud storage files without credentials.
Aisha Noor15 Sep 20267 min read
ThreatsCloud & SaaSCritical
Linux Kernel IPv6 Privilege Escalation Flaw Weaponized for Local Root Compromise
CISA added CVE-2026-53362 to its KEV catalog, warning of active privilege escalation exploits targeting the Linux Kernel IPv6 networking subsystem across major enterprise distros.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Patches Critical Remote Code Execution Flaw in Neurons for ITSM Infrastructure
Ivanti released emergency security patches addressing CVE-2026-12650, an unauthenticated deserialization RCE vulnerability in Neurons for ITSM on-premise deployments.
Priya Raman14 Sep 20268 min read
ThreatsCloud & SaaSCritical
Citrix NetScaler CVSS 9.3 authentication bypass CVE-2026-19490 under active in-the-wild exploitation
CISA and threat researchers warn that CVE-2026-19490 in Citrix NetScaler ADC and Gateway is under active exploitation, granting unauthenticated access to perimeter gateways.
Daniel Okafor14 Sep 20266 min read
ThreatsCloud & SaaSCritical
Cisco Secure FMC authentication bypass CVE-2026-20079 exploited by Qilin ransomware affiliates
Threat actors and Qilin ransomware affiliates are actively weaponizing CVE-2026-20079 in Cisco Secure FMC to bypass web authentication and achieve root command execution.
Daniel Okafor13 Sep 20266 min read
ThreatsIndustrial & OTCritical
MikroTrick exploit chain compromises MikroTik RouterOS devices as ScreenConnect client flaw hits KEV
CERT Polska discloses MikroTrick, an unauthenticated exploit chain hijacking MikroTik RouterOS devices, while CISA adds a dangerous ScreenConnect client condition to KEV.
Daniel Okafor12 Sep 20266 min read
ThreatsIndustrial & OTCritical
SonicWall SMA1000 Zero-Day Chain Hit CISA KEV in Three Days. Patching Is the Easy Part
SonicWall disclosed two actively exploited SMA1000 flaws on 1 September; CISA set a 5 September federal deadline. The harder problem is proving an appliance you cannot instrument is clean.
Daniel Okafor11 Sep 20265 min read
ThreatsCloud & SaaSCritical
FortiClient EMS CVE-2026-35616: the hotfix window was not the dangerous part
Fortinet's emergency hotfix for CVE-2026-35616 blocked the attack path without fixing the flaw, and the complete patch that followed needed its own re-release.
Priya Raman10 Sep 20266 min read