Why Should I Care? — 2026-08-26 | 🔴 3 HIGH · 🟡 5 MEDIUM · 🔵 22 RADAR · ⚪ 42 FILTERED

📋 Briefing — 2026-08-26

30 vendor intel items scanned  |  🔴 3 HIGH  |  🟡 5 MEDIUM  |  🔵 22 RADAR  |  ⚪ 42 FILTERED

🔴 Critical — action required:

1. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-60004) — Yes, if you run Gitea versions 1.18.0 to 1.20.5: this code injection vulnerability allows attackers to take full control of your server.
2. FURUNO FA-50 Class B AIS Transponder (CVE-2026-59769) — Yes, if you run any version of FURUNO FA-50 Class B AIS Transponder: An attacker can alter device settings if they know the hard-coded credentials and have network access.
3. Ebyte NE2-D11 (CVE-2026-73125, CVE-2026-73809, CVE-2026-73839) — Yes, if you run Ebyte NE2-D11 Firmware FW-9167-0-11: This advisory addresses critical vulnerabilities that could allow attackers to gain unauthorized access and disrupt device operation.

Everything else can wait.

🟡 Medium — review when time permits:

1. Bendix EC80 Brake ECU — Yes, if you run any of the affected versions of Bendix EC80 Brake ECU: an attacker could disable critical vehicle functions like ABS and steering assist.
2. Siemens SIMATIC IoT2050 Advanced — Yes, if you run SIMATIC IoT2050 Advanced version less than 4.3.4.1: An unauthenticated attacker could execute arbitrary code with maximum privileges.
3. Zoneminder — Yes, if you run Zoneminder versions 1.37.48 or 1.38.3: An authenticated user can execute arbitrary commands on your server.
4. PayRange API — Yes, if you run any version of PayRange API: This vulnerability allows attackers to access sensitive information and disrupt services, posing a significant risk.
5. Rently Smart Home — Yes, if you run Rently Smart Home <=20.1.0: An attacker could access sensitive information and override user permissions.

🔵 15 items on the radar — see below ↓

Why Should I Care? 🔴 HIGH — Handle Now

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVSS 9.8 | CVE-2026-60004

❓ Why Should I Care?
Yes, if you run Gitea versions 1.18.0 to 1.20.5: this code injection vulnerability allows attackers to take full control of your server.

🎯 Affected versions: 1.18.0 to 1.20.5
Not affected: 1.20.6 and later

🎭 In plain English:
This vulnerability lets hackers inject malicious code into your Gitea server, giving them full control over it. For example, an attacker could steal all your code repositories and sensitive data.

🔧 Prerequisites:

• Running Gitea versions 1.18.0 to 1.20.5
• Publicly exposed Gitea server

⏱ Urgency: High urgency due to active exploitation and the risk of full server compromise.

✅ Fixed in: 1.20.6, 1.21.0

💡 Context: The root cause is insufficient input validation in Gitea's code handling.

FURUNO FA-50 Class B AIS Transponder

CISA Advisories | CVSS 9.1 | CVE-2026-59769

❓ Why Should I Care?
Yes, if you run any version of FURUNO FA-50 Class B AIS Transponder: An attacker can alter device settings if they know the hard-coded credentials and have network access.

🎯 Affected versions: all/*

🎭 In plain English:
This vulnerability means an attacker can change the settings of your AIS transponder if they know the default login details and can access your ship's network. For example, they could disable critical safety features or alter the ship's identity.

🔧 Prerequisites:

• Knowledge of hard-coded credentials
• Network access to the device

⏱ Urgency: High urgency due to the critical nature of the device and the potential for severe operational impacts.

💡 Context: The root cause is the use of hard-coded credentials and lack of authentication for critical functions.

Ebyte NE2-D11

CISA Advisories | CVSS 9.8 | CVE-2026-73125, CVE-2026-73809, CVE-2026-73839

❓ Why Should I Care?
Yes, if you run Ebyte NE2-D11 Firmware FW-9167-0-11: This advisory addresses critical vulnerabilities that could allow attackers to gain unauthorized access and disrupt device operation.

🎯 Affected versions: FW-9167-0-11

🎭 In plain English:
This vulnerability means that without proper security measures, an attacker can easily access your device, change its settings, steal sensitive information, and even stop it from working. For example, an attacker could log in as an admin, change the device's configuration, and prevent you from using it.

🔧 Prerequisites:

• Access to the device's network
• No authentication enforcement
• No encryption for sensitive data

⏱ Urgency: High urgency due to the critical nature of the vulnerabilities and the potential for unauthorized access and disruption of device operation.

💡 Context: The root cause includes missing authentication for critical functions, cleartext transmission of sensitive information, and insufficient protection of credentials.

Why Should I Care? 🟡 MEDIUM (5)

Bendix EC80 Brake ECU

CISA Advisories | CVSS 7.5 | CVE-2026-67560

❓ Why Should I Care?
Yes, if you run any of the affected versions of Bendix EC80 Brake ECU: an attacker could disable critical vehicle functions like ABS and steering assist.

🎯 Affected versions: EC80ESP+ J1708 Z228999, EC80ESP+ 6S/6M Z228999, EC80ESP+ PLC Z228999, EC80ESP+ 2nd CAN Z228999, EC80ESP+ Integrated TPMS Z228999, EC80ESP 6S/6M Z266494, EC80ESP PLC Z266494, EC80ESP 2nd CAN Z266494, EC80ESP CAN Gateway Z266494, EC80ESP 4S/4M Z286098, EC80ESP PLC Z286098

🎭 In plain English:
This vulnerability means an attacker could crash the brake control unit, causing your car to lose important safety features like ABS and steering assist. For example, an attacker could remotely disable your car's braking system, making it very dangerous to drive.

🔧 Prerequisites:

• Access to the CAN bus
• Knowledge of the specific vulnerabilities

⏱ Urgency: High urgency due to the potential for severe safety risks and loss of critical vehicle functions.

✅ Fixed in: Z300822, Z302578, Z302579

💡 Context: The root cause is a stack-based buffer overflow and out-of-bounds write vulnerabilities that allow arbitrary code execution.

Siemens SIMATIC IoT2050 Advanced

CISA Advisories | CVSS 10 | CVE-2026-58115

❓ Why Should I Care?
Yes, if you run SIMATIC IoT2050 Advanced version less than 4.3.4.1: An unauthenticated attacker could execute arbitrary code with maximum privileges.

🎯 Affected versions: SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) < 4.3.4.1

🎭 In plain English:
The device has a flaw that lets anyone on the internet access and control it without needing a password. An attacker could use this to take full control of the device and do anything they want, like shutting it down or stealing data.

🔧 Prerequisites:

• Node-RED is installed
• Device is accessible from the internet

⏱ Urgency: High urgency due to the critical nature of the vulnerability and the potential for unauthenticated remote code execution.

✅ Fixed in: 4.3.4.1

💡 Context: The root cause is the lack of authentication on the Node-RED HTTP interface, allowing unauthorized access to critical functions.

Zoneminder

CISA Advisories | CVSS 8.8 | CVE-2026-76060

❓ Why Should I Care?
Yes, if you run Zoneminder versions 1.37.48 or 1.38.3: An authenticated user can execute arbitrary commands on your server.

🎯 Affected versions: 1.37.48, 1.38.3

🎭 In plain English:
An attacker who has a user account can run any command on your server, potentially taking full control. For example, they could delete files, steal data, or install malware.

🔧 Prerequisites:

• Authenticated user with View Events permission

⏱ Urgency: High urgency due to the risk of full server compromise through Remote Code Execution.

✅ Fixed in: 1.38.3

💡 Context: The vulnerability arises from unsanitized input in the event export functionality, which is passed directly to an OS command.

PayRange API

CISA Advisories | CVSS 8.8 | CVE-2026-18965

❓ Why Should I Care?
Yes, if you run any version of PayRange API: This vulnerability allows attackers to access sensitive information and disrupt services, posing a significant risk.

🎯 Affected versions: all/*

🎭 In plain English:
The PayRange API has a flaw that lets attackers access sensitive data and disrupt services without needing a login. For example, an attacker could change the displayed images on your devices or cause them to stop working.

🔧 Prerequisites:

• Access to the PayRange API endpoints

⏱ Urgency: High urgency due to the potential for unauthenticated access and significant impact on operations.

💡 Context: The root cause is the lack of proper authorization checks on management endpoints, making sensitive information and control functions accessible to unauthorized users.

Rently Smart Home

CISA Advisories | CVSS 8.1 | CVE-2026-75960

❓ Why Should I Care?
Yes, if you run Rently Smart Home <=20.1.0: An attacker could access sensitive information and override user permissions.

🎯 Affected versions: Smart Home <=20.1.0

🎭 In plain English:
This vulnerability means that an attacker could steal sensitive information like PINs and take control of user permissions. For example, an attacker could access the Master Pin and change settings or lock out legitimate users.

🔧 Prerequisites:

• Running Rently Smart Home <=20.1.0

⏱ Urgency: High urgency due to the high CVSS score and potential for unauthorized access and control.

✅ Fixed in: 20.1.1 and later

💡 Context: The root cause is insufficient protection of credentials, allowing unauthorized access to sensitive information.

Why Should I Care? 🔵 On the Radar (22)

• Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data (The Hacker News) — A critical flaw in Oracle WebLogic and HTTP Server allows attackers to access and modify critical data without authentication. This is a high-severity issue that is actively being exploited.
• Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows (The Hacker News) — A phishing campaign called Mirage2FA has hit 4,500 US and EU companies by exploiting Microsoft 365 login flows. It bypasses two-factor authentication, potentially compromising 48% of targeted email addresses. This could lead to unauthorized access to corporate email and other sensitive data.
• Hackers breached over 270 Zimbra servers in ongoing attacks (BleepingComputer) — Hackers have exploited a critical vulnerability in Zimbra servers, compromising over 270 instances. This vulnerability allows unauthenticated attackers to execute remote code and potentially steal sensitive data.
• Hospital operator Nutex Health says data stolen in cyberattack (BleepingComputer) — A cyberattack on Nutex Health has led to the theft of potentially sensitive data from their servers. This highlights the ongoing risk of cyberattacks in healthcare and the importance of robust cybersecurity measures.
• Massive DDoS attack disrupts Norway’s government digital services (BleepingComputer) — A massive DDoS attack has disrupted Norway's government digital services, affecting public sector operations and citizens' access to essential services. This highlights the vulnerability of digital infrastructure to such attacks.
• AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes (BleepingComputer) — A new phishing service, AnonyMousKIT, uses AI to trick iPhone owners into revealing their passcodes, allowing thieves to unlock stolen devices and access personal and corporate data. This impacts security measures for Apple devices and could expose sensitive corporate information.
• Hackers abuse npm mirrors to host phishing redirect pages (BleepingComputer) — Hackers are using npm and its mirrors to host phishing pages that mimic Cloudflare CAPTCHAs, redirecting users to malicious sites. This impacts developers and organizations that rely on npm for package management.
• E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands (The Hacker News) — Cybercriminals are using FTP banners to deliver RATs, which can take over your systems and steal data. This is a new technique that can bypass some security controls.
• 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages (The Hacker News) — Cybercriminals are using 24 npm packages to host fake CAPTCHA pages that redirect users to phishing sites. This affects developers and users who might unknowingly download these packages or access their mirrored content.
• Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode (The Hacker News) — Marimo Notebook had a flaw that allowed attackers to run unauthorized commands before cells execute in edit mode, which could lead to unauthorized access and code execution.
• A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw (The Hacker News) — A security flaw in NVIDIA NemoClaw allows attackers to control your local AI model through a malicious webpage, potentially altering its behavior without your knowledge. This could impact any AI-driven applications relying on these technologies.
• From Fake Workers to Account Recovery: The Growing Identity Verification Risk (BleepingComputer) — Attackers are increasingly targeting the processes used to establish or recover identities, such as onboarding new employees and account recovery. This can lead to unauthorized access and significant financial losses. For example, the 2025 M&S ransomware breach, partly due to social engineering attacks, cost the retailer an estimated $400 million.
• Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access (The Hacker News) — Two severe vulnerabilities in the miniOrange SAML plugin for WordPress can allow attackers to log in as any user, including admins, without authentication. This can lead to full control of your WordPress site.
• LACMA data breach last year exposed social security and medical data (BleepingComputer) — LACMA experienced a data breach that exposed sensitive personal and medical information of customers and employees. This is important for individuals affected but does not directly impact IT infrastructure professionals.
• Fast Track ISM-ready cloud environments and IRAP Assessments with Landing Zone Accelerator on AWS (AWS Security Blog) — New report on AWS Artifact for ISM-ready cloud environments.

⚪ 42 low-priority items filtered.

🦅 Aggregated and triaged by Donna AI  |  Sources: 8 vendor feeds  |  CISA KEV