Why Should I Care? — 2026-09-21 | 🔴 23 HIGH · 🟡 32 MEDIUM · 🔵 209 RADAR · ⚪ 73 FILTERED

📋 Briefing — 2026-09-21

264 vendor intel items scanned  |  🔴 23 HIGH  |  🟡 32 MEDIUM  |  🔵 209 RADAR  |  ⚪ 73 FILTERED

🔴 Critical — action required:

1. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-76461) — Yes, if you run Cisco Secure Email Gateway versions 12.0.0 - 12.0.4: SQL injection vulnerability, actively exploited in the wild.
2. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-58704) — Yes, if you run Google Pixel devices with the affected versions: unauthenticated RCE, actively exploited in the wild.
3. CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-76460, CVE-2026-87886) — Yes, if you run Cisco Identity Services Engine or Acronis Backup versions affected: active exploitation reported.
4. ABB Ability Edgenius (CVE-2026-31431) — Yes, if you run ABB Ability Edgenius >=3.2.0.0|<3.2.4.1: local users or compromised containers can gain root access, leading to full system control.
5. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2025-39682) — Yes, if you run Linux Kernel versions 5.10.x - 5.10.123, 5.15.x - 5.15.123, 5.19.x - 5.19.123: unauthenticated RCE, actively exploited in the wild.
6. CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2025-39964, CVE-2026-53266) — Yes, if you run Linux Kernel versions affected by CVE-2025-39964 or CVE-2026-53266: these vulnerabilities are actively exploited and can lead to full system compromise.
7. CISA Adds Four Known Exploited Vulnerabilities to Catalog (CVE-2026-75650, CVE-2026-81963, CVE-2026-85880, CVE-2026-86218) — Yes, if you run any affected versions of Adobe Commerce, Microsoft Windows, or N-able N-central: these vulnerabilities are actively exploited and pose significant risks.
8. CISA Adds Four Known Exploited Vulnerabilities to Catalog (CVE-2025-25249, CVE-2026-19490, CVE-2026-87491, CVE-2026-20079) — Yes, if you run Fortinet, Citrix NetScaler, Google Chromium, or Cisco Firewall Management Center: multiple vulnerabilities, including unauthenticated RCE and authentication bypass, actively exploited in the wild.
9. CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-67277) — Yes, if you run MikroTik RouterOS versions 6.44.1 - 7.10.1: unauthenticated RCE, actively exploited in the wild.
10. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-85706) — Yes, if you run GitLab Community Edition or Enterprise Edition: path traversal vulnerability actively exploited, leading to full control of the asset post-exploitation.
11. CISA Adds Three Known Exploited Vulnerabilities to Catalog (CVE-2026-42016, CVE-2026-42018, CVE-2026-84869) — Yes, if you run JFrog Artifactory or ConnectWise ScreenConnect: unauthorized access and privilege escalation, actively exploited in the wild.
12. CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-81578, CVE-2026-82078) — Yes, if you run PaperCut NG/MF versions affected by CVE-2026-81578 or CVE-2026-82078: active exploitation reported, critical functions can be accessed without authentication, leading to full control of the system.
13. CISA Adds Seven Known Exploited Vulnerabilities to Catalog (CVE-2026-9586, CVE-2026-48710, CVE-2026-49869, CVE-2026-59822, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549) — Yes, if you use any of the affected products (Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, SonicWall SMA1000): these vulnerabilities are actively exploited and can lead to unauthorized access, data theft, or system compromise.
14. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-85046) — Yes, if you run Google Chromium versions affected by CVE-2026-85046: type confusion vulnerability actively exploited in the wild.
15. Digital Watchdog VMAX DVR and NVR Product Lineups (CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372) — Yes, if you run any version of Digital Watchdog VMAX DVR and NVR Product Lineups: unauthenticated access, full administrative control, and active exploitation risk.
16. Wärtsilä FOS-Onboard (CVE-2026-78225, CVE-2026-81855) — Yes, if you run Wärtsilä FOS-Onboard 5.07.0923.01: hard-coded cryptographic keys allow unauthorized updates, code execution, or credential extraction.
17. mySCADA myPRO Manager (CVE-2026-73807, CVE-2026-82567) — Yes, if you run mySCADA myPRO Manager <=2.1: unauthenticated access to privileged functions and arbitrary SMS sending, critical for industrial control systems.
18. Siemens Reyrolle 7SR5 (CVE-2024-42384, CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392, CVE-2026-62645, CVE-2026-62646, CVE-2026-62647, CVE-2026-62648, CVE-2026-62649, CVE-2026-62650, CVE-2026-62652, CVE-2026-62653, CVE-2026-62654) — Yes, if you run Siemens Reyrolle 7SR5 before V2.70: multiple critical vulnerabilities, including RCE and data leaks, actively exploitable.
19. JWT used for authentication in web GUI signed with static key — Yes, if you run FortiMonitorOnSight: unauthenticated access via forged JWT, high risk.
20. Improper Authentication of FortiPAM Server — Yes, if you use the Fortinet Privileged Access Agent Chrome Extension: unauthenticated attackers can proxy your browser traffic through their servers if you visit a malicious site.
21. Tycon Systems TPDIN-Monitor-WEB2 (Update A) (CVE-2026-61884, CVE-2026-55985) — Yes, if you run TPDIN-Monitor-WEB2 <2.4.5: unauthenticated access and cleartext storage of sensitive credentials, critical infrastructure at risk.
22. IXON VPN Client (CVE-2026-75925) — Yes, if you run IXON VPN Client <1.4.7: unauthenticated RCE with elevated privileges, actively exploited in the wild.
23. Pyramid Solutions NetStaX EtherNet/IP Stack (CVE-2026-78012) — Yes, if you run Pyramid Solutions NetStaX EtherNet/IP Stack < v5.6.1: unpatched buffer overflow can lead to memory corruption, device crashes, or remote attacks.

Everything else can wait.

🟡 Medium — review when time permits:

1. Siemens Mendix SAML — Yes, if you run Mendix SAML module versions < 4.2.3 for Mendix 10 and 11, or < 3.6.27 for Mendix 9.24: unauthenticated attackers can hijack accounts in specific SSO configurations.
2. CareCam CM2507 — Yes, if you run CareCam CM2507 Firmware v251211.1507: unauthenticated access to live video, unauthorized services, and arbitrary code execution.
3. Bransys ELD — Yes, if you run Bransys ELD Android <11.00.00 or iOS <1.1.54: unauthorized access to telemetry data and firmware, actively exploitable.
4. Schneider Electric Modicon M340 Controller and Communication Modules — Yes, if you run Schneider Electric Modicon M340 Controller or Communication Modules: unpatched versions can be exploited for Denial of Service attacks, rendering devices unavailable.
5. Schneider Electric NetBotz 5 750/755 — Yes, if you run NetBotz 5 750/755 <= 5.5.2: unpatched devices risk remote code execution and data access over the local network.
6. Hitachi Energy FACTS Control Platform (FCP) — Yes, if you run Hitachi Energy FACTS Control Platform (FCP) versions 3.4.0 to 4.1.1 with GWS component: authenticated attacker can inject code and access critical files, impacting confidentiality, integrity, and availability.
7. Mitsubishi Electric GX Works3 and Motion Control Settings — Yes, if you run any version of Mitsubishi Electric GX Works3 or Motion Control Settings: local attacker can authenticate with invalid passwords, view, tamper with, destroy, or delete control programs.
8. Schneider Electric PowerChute Serial Shutdown — Yes, if you run Schneider Electric PowerChute Serial Shutdown versions <=1.5, 1.6: improper authentication validation could allow unauthorized access to system data and disrupt operations.
9. Atomic macOS (AMOS) Stealer Activity — Yes, if you use macOS and download cracked software or follow deceptive setup guides: AMOS stealer can steal your credentials and sensitive data.
10. A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity — Yes, if you use AWS AgentCore Harness with default configurations: prompt injection can exfiltrate plaintext credentials.
11. ... and 22 more

🔵 15 items on the radar — see below ↓

Why Should I Care? 🔴 HIGH — Handle Now

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVSS 8.8 | CVE-2026-76461

❓ Why Should I Care?
Yes, if you run Cisco Secure Email Gateway versions 12.0.0 - 12.0.4: SQL injection vulnerability, actively exploited in the wild. Patch now.

🎯 Affected versions: Cisco Secure Email Gateway 12.0.0 - 12.0.4
Not affected: 12.0.5 and later

🎭 In plain English:
An attacker can inject malicious SQL commands into your email gateway, allowing them to read, modify, or delete sensitive data stored in your email system. For example, an attacker could access all your emails, change email addresses, or even delete critical email records without your knowledge.

🔧 Prerequisites:

• The attacker must be able to send specially crafted requests to the affected email gateway.

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The vulnerability arises from insufficient input validation in the SQL queries, allowing an attacker to inject arbitrary SQL commands.

✅ Fixed in: 12.0.5, 12.0.6

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVSS 9.8 | CVE-2026-58704

❓ Why Should I Care?
Yes, if you run Google Pixel devices with the affected versions: unauthenticated RCE, actively exploited in the wild. Patch now.

🎯 Affected versions: Google Pixel devices running versions 10.0 - 13.0
Not affected: Google Pixel devices running versions 14.0 and above

🎭 In plain English:
Your Google Pixel device has a flaw that allows anyone to take full control without needing your password. An attacker could remotely log in, steal your data, install malware, or spy on you.

🔧 Prerequisites:

• Device is running an affected version
• Device is connected to the internet

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The vulnerability allows unauthorized users to bypass authentication mechanisms and execute arbitrary commands.

✅ Fixed in: 14.0, 14.1, 15.0

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVE-2026-76460, CVE-2026-87886

❓ Why Should I Care?
Yes, if you run Cisco Identity Services Engine or Acronis Backup versions affected: active exploitation reported. Patch immediately.

🎯 Affected versions: Cisco Identity Services Engine versions affected, Acronis Backup versions affected

🎭 In plain English:
If you use Cisco Identity Services Engine or Acronis Backup, attackers can exploit vulnerabilities to gain unauthorized access and control your systems. For example, an attacker could log in as an admin and change critical settings, potentially locking you out of your own systems.

🔧 Prerequisites:

• Running affected versions of Cisco Identity Services Engine or Acronis Backup

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: Cisco Identity Services Engine incorrectly uses privileged APIs, while Acronis Backup has incorrect default permissions, both allowing unauthorized access.

ABB Ability Edgenius

CISA Advisories [CISA KEV] | CVSS 7.8 | CVE-2026-31431

❓ Why Should I Care?
Yes, if you run ABB Ability Edgenius >=3.2.0.0|<3.2.4.1: local users or compromised containers can gain root access, leading to full system control. Patch now.

🎯 Affected versions: ABB Ability Edgenius >=3.2.0.0|<3.2.4.1, 3.2.4.1

🎭 In plain English:
A flaw in the Linux kernel allows local users or compromised containers to escalate their privileges to root. This means an attacker with local access can take full control of your system, change configurations, steal data, or install malware.

🔧 Prerequisites:

• Local access or compromised container workload

⏱ Urgency: High urgency due to the potential for full system compromise by local attackers.

💡 Context: The vulnerability stems from a flaw in the Linux kernel’s cryptographic subsystem, allowing for privilege escalation.

✅ Fixed in: 3.2.4.1

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVSS 9.8 | CVE-2025-39682

❓ Why Should I Care?
Yes, if you run Linux Kernel versions 5.10.x - 5.10.123, 5.15.x - 5.15.123, 5.19.x - 5.19.123: unauthenticated RCE, actively exploited in the wild. Patch now.

🎯 Affected versions: Linux Kernel 5.10.x - 5.10.123, 5.15.x - 5.15.123, 5.19.x - 5.19.123
Not affected: Linux Kernel versions prior to 5.10 and 5.10.124 and above, 5.15.124 and above, 5.19.124 and above

🎭 In plain English:
Your Linux system can be taken over by attackers without needing a password or any user interaction. An attacker can remotely execute commands on your system, steal data, or install malware. For example, an attacker could remotely log into your server, steal sensitive files, and install a backdoor to maintain access.

🔧 Prerequisites:

• Running an affected Linux Kernel version
• No specific user interaction required

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The vulnerability arises from improper handling of certain system calls, allowing attackers to bypass normal security checks and gain unauthorized access.

✅ Fixed in: 5.10.124, 5.15.124, 5.19.124

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVSS 9.8 | CVE-2025-39964, CVE-2026-53266

❓ Why Should I Care?
Yes, if you run Linux Kernel versions affected by CVE-2025-39964 or CVE-2026-53266: these vulnerabilities are actively exploited and can lead to full system compromise.

🎯 Affected versions: Linux Kernel versions affected by CVE-2025-39964 and CVE-2026-53266

🎭 In plain English:
Your system's core software, the Linux Kernel, has flaws that allow attackers to take full control of your computer. An attacker can use these vulnerabilities to install malware, steal data, or even take over your entire network without you knowing.

🔧 Prerequisites:

• Running an affected version of the Linux Kernel
• No specific user interaction required

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The race condition and out-of-bounds write vulnerabilities allow attackers to execute arbitrary code with kernel privileges, leading to full system compromise.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVE-2026-75650, CVE-2026-81963, CVE-2026-85880, CVE-2026-86218

❓ Why Should I Care?
Yes, if you run any affected versions of Adobe Commerce, Microsoft Windows, or N-able N-central: these vulnerabilities are actively exploited and pose significant risks.

🎯 Affected versions: Adobe Commerce and Magento, Microsoft Windows, N-able N-central

🎭 In plain English:
If you use Adobe Commerce, Microsoft Windows, or N-able N-central, an attacker could exploit these vulnerabilities to take control of your systems, steal data, or cause disruptions. For example, an attacker could inject malicious code into your systems and execute it, leading to full control over your network.

🔧 Prerequisites:

• Running affected versions of Adobe Commerce, Microsoft Windows, or N-able N-central

⏱ Urgency: High urgency due to active exploitation in the wild.

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVE-2025-25249, CVE-2026-19490, CVE-2026-87491, CVE-2026-20079

❓ Why Should I Care?
Yes, if you run Fortinet, Citrix NetScaler, Google Chromium, or Cisco Firewall Management Center: multiple vulnerabilities, including unauthenticated RCE and authentication bypass, actively exploited in the wild. Patch immediately.

🎯 Affected versions: Fortinet Multiple Products, Citrix NetScaler, Google Chromium V8, Cisco Firewall Management Center

🎭 In plain English:
Your network devices and software have critical flaws that allow attackers to bypass security measures and take full control without needing passwords. For example, an attacker could remotely log into your firewall and change its settings, redirecting your network traffic to malicious servers without leaving any trace.

🔧 Prerequisites:

• The vulnerability must be present in the software version you are running.
• The attacker must have network access to the vulnerable component.

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The vulnerabilities include heap-based buffer overflows, authentication bypasses, and out-of-bounds writes, which can be exploited to gain unauthorized access and control over the affected systems.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVSS 9.8 | CVE-2026-67277

❓ Why Should I Care?
Yes, if you run MikroTik RouterOS versions 6.44.1 - 7.10.1: unauthenticated RCE, actively exploited in the wild. Patch now.

🎯 Affected versions: MikroTik RouterOS 6.44.1 - 7.10.1
Not affected: Versions 7.10.2 and later

🎭 In plain English:
Your router has a backdoor that allows anyone to log in without a password and take full control of your network. An attacker could redirect your internet traffic, steal data, or install malware.

🔧 Prerequisites:

• RouterOS version is 6.44.1 - 7.10.1

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The admin API accepts commands without verifying the caller's identity, allowing unauthenticated access.

✅ Fixed in: 7.10.2, 7.10.3

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVE-2026-85706

❓ Why Should I Care?
Yes, if you run GitLab Community Edition or Enterprise Edition: path traversal vulnerability actively exploited, leading to full control of the asset post-exploitation. Patch immediately.

🎯 Affected versions: All versions of GitLab Community Edition and Enterprise Edition

🎭 In plain English:
An attacker can exploit a flaw in GitLab to access files and directories they shouldn't, potentially gaining full control over your system. Imagine someone using a backdoor to enter your house and take control of your valuables without you knowing.

🔧 Prerequisites:

• GitLab Community Edition or Enterprise Edition is installed
• The system is accessible from the internet

⏱ Urgency: High urgency due to active exploitation in the wild.

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVSS 8.8, 8.8, 8.8 | CVE-2026-42016, CVE-2026-42018, CVE-2026-84869

❓ Why Should I Care?
Yes, if you run JFrog Artifactory or ConnectWise ScreenConnect: unauthorized access and privilege escalation, actively exploited in the wild. Patch immediately.

🎯 Affected versions: JFrog Artifactory versions prior to 7.30.1, ConnectWise ScreenConnect versions prior to 12.5.1
Not affected: JFrog Artifactory 7.30.1 and later, ConnectWise ScreenConnect 12.5.1 and later

🎭 In plain English:
If you use JFrog Artifactory or ConnectWise ScreenConnect, attackers can log in without proper credentials and take control of your systems. For example, an attacker could access your software repositories or remote control sessions, steal sensitive data, and alter system configurations.

🔧 Prerequisites:

• Running vulnerable versions of JFrog Artifactory or ConnectWise ScreenConnect
• Publicly exposed services

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The vulnerabilities stem from improper handling of user authentication and authorization, allowing unauthorized access and privilege escalation.

✅ Fixed in: JFrog Artifactory 7.30.1, ConnectWise ScreenConnect 12.5.1

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVE-2026-81578, CVE-2026-82078

❓ Why Should I Care?
Yes, if you run PaperCut NG/MF versions affected by CVE-2026-81578 or CVE-2026-82078: active exploitation reported, critical functions can be accessed without authentication, leading to full control of the system.

🎯 Affected versions: PaperCut NG/MF versions affected by CVE-2026-81578 and CVE-2026-82078

🎭 In plain English:
An attacker can access critical functions of your PaperCut NG/MF system without needing to authenticate, which means they can take full control of the system. For example, they could change user permissions, modify print jobs, or even shut down the service entirely.

🔧 Prerequisites:

• PaperCut NG/MF is running an affected version
• The system is accessible from the internet or an untrusted network

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The missing authentication for critical functions and unsafe reflection issues allow attackers to bypass normal security checks and execute commands with full privileges.

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVE-2026-9586, CVE-2026-48710, CVE-2026-49869, CVE-2026-59822, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549

❓ Why Should I Care?
Yes, if you use any of the affected products (Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, SonicWall SMA1000): these vulnerabilities are actively exploited and can lead to unauthorized access, data theft, or system compromise.

🎯 Affected versions: All versions of Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, SonicWall SMA1000

🎭 In plain English:
If you use any of these products, an attacker can exploit these vulnerabilities to gain unauthorized access to your systems, steal sensitive data, or take control of your devices. For example, an attacker could use a SQL injection to extract sensitive information from your database or use improper authentication to log in without credentials.

🔧 Prerequisites:

• The product must be in use and accessible from the internet or an attacker's network.
• No specific user interaction is required for exploitation.

⏱ Urgency: High urgency due to active exploitation in the wild.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVE-2026-85046

❓ Why Should I Care?
Yes, if you run Google Chromium versions affected by CVE-2026-85046: type confusion vulnerability actively exploited in the wild. Patch now.

🎯 Affected versions: Google Chromium versions prior to the latest patched version

🎭 In plain English:
A flaw in Google Chromium allows attackers to trick the browser into misinterpreting data types, leading to arbitrary code execution. An attacker could exploit this to run malicious code on your computer, potentially taking full control of your system without your knowledge.

🔧 Prerequisites:

• The vulnerability must be actively exploited by an attacker
• The user must be running an affected version of Google Chromium

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The vulnerability arises from improper handling of data types in the V8 JavaScript engine, leading to potential memory corruption and code execution.

✅ Fixed in: Latest patched version of Google Chromium

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA Advisories | CVSS 9.6 | CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372

❓ Why Should I Care?
Yes, if you run any version of Digital Watchdog VMAX DVR and NVR Product Lineups: unauthenticated access, full administrative control, and active exploitation risk. Patch now.

🎯 Affected versions: VMAX A1 G4 DVRs vers:all/*, VMAX IP G4 NVRs vers:all/*, VMAX A1 PLUS vers:all/*, VA1G4 Recorder vers:all/*, VG4 Recorder vers:all/*

🎭 In plain English:
Your surveillance system has a backdoor that allows anyone to log in without a password, view live and recorded footage, change settings, and even use your device to attack other systems on your network. An attacker could watch your premises, disable security features, and hide their tracks.

🔧 Prerequisites:

• Device must be accessible from the internet or network

⏱ Urgency: High urgency due to the risk of full administrative control and potential active exploitation.

💡 Context: The devices are missing authentication for critical functions and use hard-coded credentials, allowing unauthorized access and control.

✅ Fixed in: Updated firmware versions available at https://digital-watchdog.com/downloads/

Wärtsilä FOS-Onboard

CISA Advisories | CVSS 9.1 | CVE-2026-78225, CVE-2026-81855

❓ Why Should I Care?
Yes, if you run Wärtsilä FOS-Onboard 5.07.0923.01: hard-coded cryptographic keys allow unauthorized updates, code execution, or credential extraction. Patch immediately.

🎯 Affected versions: Wärtsilä FOS-Onboard 5.07.0923.01

🎭 In plain English:
Your system uses a secret key that everyone knows. An attacker can use this key to update your system with malicious software, run any code they want, or steal login details to pretend they are a trusted user. This means they can take full control of your system without you knowing.

🔧 Prerequisites:

• Product not installed as recommended

⏱ Urgency: High urgency due to the critical nature of the vulnerabilities and the potential for unauthorized access and control.

💡 Context: Hard-coded cryptographic keys in the deployer-ng Update Controller and robot testing framework components allow attackers to bypass security measures.

mySCADA myPRO Manager

CISA Advisories | CVSS 9.8 | CVE-2026-73807, CVE-2026-82567

❓ Why Should I Care?
Yes, if you run mySCADA myPRO Manager <=2.1: unauthenticated access to privileged functions and arbitrary SMS sending, critical for industrial control systems.

🎯 Affected versions: mySCADA myPRO Manager <=2.1

🎭 In plain English:
An attacker can access your system's admin functions and send fake SMS messages without needing any login details. This means they can change critical settings and send misleading messages to your contacts, potentially disrupting operations.

🔧 Prerequisites:

• Network access to the affected API
• Connected GSM modem

⏱ Urgency: High urgency due to the critical nature of the vulnerabilities and potential for unauthorized access and disruption.

💡 Context: The command API and notification gateway do not enforce proper authentication, allowing unauthorized access to critical functions.

✅ Fixed in: 2.2

Siemens Reyrolle 7SR5

CISA Advisories | CVSS 9.8 | CVE-2024-42384, CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392, CVE-2026-62645, CVE-2026-62646, CVE-2026-62647, CVE-2026-62648, CVE-2026-62649, CVE-2026-62650, CVE-2026-62652, CVE-2026-62653, CVE-2026-62654

❓ Why Should I Care?
Yes, if you run Siemens Reyrolle 7SR5 before V2.70: multiple critical vulnerabilities, including RCE and data leaks, actively exploitable. Patch immediately.

🎯 Affected versions: Reyrolle 7SR5 < V2.70
Not affected: Reyrolle 7SR5 V2.70 and later

🎭 In plain English:
Your Siemens control system has multiple flaws that allow attackers to crash your system, read sensitive data, or execute arbitrary code. An attacker could remotely shut down your industrial processes or steal confidential information without your knowledge.

🔧 Prerequisites:

• System is running version < V2.70
• Attacker has network access to the system

⏱ Urgency: High urgency due to the critical nature of the vulnerabilities and potential for active exploitation.

💡 Context: The vulnerabilities stem from issues like improper input validation and use of out-of-range pointer offsets in the Cesanta Mongoose Web Server.

✅ Fixed in: V2.70

JWT used for authentication in web GUI signed with static key

Fortinet PSIRT | CVSS 9.6

❓ Why Should I Care?
Yes, if you run FortiMonitorOnSight: unauthenticated access via forged JWT, high risk.

🎯 Affected versions: FortiMonitorOnSight all versions

🎭 In plain English:
The web portal uses a static key to sign authentication tokens. An attacker can create fake tokens to log in as an admin without needing a password. They can then change settings, steal data, or cause disruptions.

🔧 Prerequisites:

• Static key used for JWT signing

⏱ Urgency: High urgency due to the risk of unauthenticated access and potential for severe impact.

💡 Context: The static key used for signing JWTs is included in the source code, allowing attackers to forge valid tokens.

Improper Authentication of FortiPAM Server

Fortinet PSIRT | CVSS 9.1

❓ Why Should I Care?
Yes, if you use the Fortinet Privileged Access Agent Chrome Extension: unauthenticated attackers can proxy your browser traffic through their servers if you visit a malicious site. Patch immediately.

🎯 Affected versions: Fortinet Privileged Access Agent Chrome Extension

🎭 In plain English:
If you have the Fortinet Privileged Access Agent Chrome Extension installed, visiting a malicious website could allow attackers to secretly reroute your internet traffic through their servers. This means they could intercept and modify your web traffic without you knowing.

🔧 Prerequisites:

• User must have the Fortinet Privileged Access Agent Chrome Extension installed
• User must visit a malicious website

⏱ Urgency: High urgency due to the potential for unauthenticated attackers to intercept and modify your web traffic.

💡 Context: The vulnerability stems from improper authentication mechanisms in the Fortinet Privileged Access Agent Chrome Extension, allowing attackers to exploit the extension's functionality.

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

CISA Advisories | CVSS 9.8 | CVE-2026-61884, CVE-2026-55985

❓ Why Should I Care?
Yes, if you run TPDIN-Monitor-WEB2 <2.4.5: unauthenticated access and cleartext storage of sensitive credentials, critical infrastructure at risk.

🎯 Affected versions: TPDIN-Monitor-WEB2 <2.4.5

🎭 In plain English:
Your device's web management interface can be accessed without a password, allowing attackers to control critical functions and read sensitive credentials in plain text. An attacker could disrupt connected infrastructure or cause physical damage to equipment.

🔧 Prerequisites:

• Network access to the device
• Device running firmware <2.4.5

⏱ Urgency: High urgency due to the critical nature of the vulnerabilities and potential for physical damage.

💡 Context: The device ships without HTTP credentials configured, and firmware <2.4.5 serves the web management interface without requiring any login.

✅ Fixed in: 2.4.5

IXON VPN Client

CISA Advisories | CVSS 9.6 | CVE-2026-75925

❓ Why Should I Care?
Yes, if you run IXON VPN Client <1.4.7: unauthenticated RCE with elevated privileges, actively exploited in the wild. Patch now.

🎯 Affected versions: IXON VPN Client <1.4.7

🎭 In plain English:
An attacker can inject malicious commands into your computer through the IXON VPN Client, gaining full control with admin rights. They can install malware, steal data, or take over your system without you noticing any changes.

🔧 Prerequisites:

• IXON VPN Client version <1.4.7 installed
• No authentication required to send configuration changes

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The configuration interface accepts changes without verifying the origin or neutralizing line-ending sequences, allowing attackers to inject malicious commands into the configuration file.

✅ Fixed in: 1.4.7

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA Advisories | CVSS 9.8 | CVE-2026-78012

❓ Why Should I Care?
Yes, if you run Pyramid Solutions NetStaX EtherNet/IP Stack < v5.6.1: unpatched buffer overflow can lead to memory corruption, device crashes, or remote attacks. Patch now.

🎯 Affected versions: Pyramid Solutions NetStaX EtherNet/IP Stack < v5.6.1

🎭 In plain English:
A flaw in the software can let attackers send oversized data requests that overflow the buffer, causing the device to crash or allowing remote attacks. An attacker could send a large request, causing your device to malfunction or be taken over without any warning.

🔧 Prerequisites:

• The device must be running a version < v5.6.1

⏱ Urgency: High urgency due to the potential for memory corruption and remote attacks, which can lead to device crashes or unauthorized access.

💡 Context: The application-side receive buffer does not properly check the size of incoming Class 3 explicit-message requests, leading to potential buffer overflow.

✅ Fixed in: v5.6.1

Why Should I Care? 🟡 MEDIUM (32)

Siemens Mendix SAML

CISA Advisories | CVSS 8.7 | CVE-2026-80465

❓ Why Should I Care?
Yes, if you run Mendix SAML module versions < 4.2.3 for Mendix 10 and 11, or < 3.6.27 for Mendix 9.24: unauthenticated attackers can hijack accounts in specific SSO configurations. Patch now.

🎯 Affected versions: Mendix SAML (Mendix 10 compatible) < 4.2.3, Mendix SAML (Mendix 11 compatible) < 4.2.3, Mendix SAML (Mendix 9.24 compatible) < 3.6.27

🎭 In plain English:
An attacker can hijack user accounts without needing a password or authentication, potentially gaining full access to your system through Single Sign-On (SSO). For example, an attacker could log in as an admin, change settings, and access sensitive data without leaving a trace.

🔧 Prerequisites:

• The SAML module must be in use
• The system must be configured with specific SSO settings

⏱ Urgency: High urgency due to the potential for unauthenticated attackers to hijack accounts and gain unauthorized access.

💡 Context: The module does not properly validate the SAML response signature, allowing attackers to forge valid responses.

✅ Fixed in: 4.2.3, 3.6.27

CareCam CM2507

CISA Advisories | CVSS 7.5 | CVE-2026-88259, CVE-2026-84398, CVE-2026-84400, CVE-2026-81305, CVE-2026-85478, CVE-2026-85497, CVE-2026-81321

❓ Why Should I Care?
Yes, if you run CareCam CM2507 Firmware v251211.1507: unauthenticated access to live video, unauthorized services, and arbitrary code execution. Patch now.

🎯 Affected versions: HMT.CM2507 Firmware v251211.1507

🎭 In plain English:
Your security camera can be accessed without a password, allowing attackers to watch live video, change settings, and run malicious code. An attacker could watch you in real-time and take control of your camera's functions.

🔧 Prerequisites:

• Network access to the affected device
• Physical access to the device for some vulnerabilities

⏱ Urgency: High urgency due to the risk of unauthorized access and potential for live video surveillance.

💡 Context: The camera lacks proper authentication mechanisms and stores sensitive information in an insecure manner, allowing unauthorized access and execution of arbitrary code.

Bransys ELD

CISA Advisories | CVSS 7.5 | CVE-2026-86520, CVE-2026-86689, CVE-2026-77960

❓ Why Should I Care?
Yes, if you run Bransys ELD Android <11.00.00 or iOS <1.1.54: unauthorized access to telemetry data and firmware, actively exploitable.

🎯 Affected versions: Android <11.00.00, iOS <1.1.54

🎭 In plain English:
Your Bransys ELD device has hard-coded passwords and sends data in plain text, allowing attackers to access sensitive information like telemetry data and firmware updates. An attacker could intercept this data to monitor your vehicle's operations or even tamper with firmware updates.

🔧 Prerequisites:

• Device running Android <11.00.00 or iOS <1.1.54

⏱ Urgency: High urgency due to active exploitation in the wild.

💡 Context: The product ships with hard-coded credentials and transmits sensitive information in cleartext, allowing unauthorized access.

✅ Fixed in: Android 11.00.00, iOS 1.1.54

Schneider Electric Modicon M340 Controller and Communication Modules

CISA Advisories | CVSS 7.5 | CVE-2025-6625

❓ Why Should I Care?
Yes, if you run Schneider Electric Modicon M340 Controller or Communication Modules: unpatched versions can be exploited for Denial of Service attacks, rendering devices unavailable. Patch now.

🎯 Affected versions: Ethernet / Serial RTU Module: all versions, M580 Global Data module: all versions, Modicon M340 X80 Ethernet Communication modules: all versions, Modbus/TCP Ethernet Modicon M340 module: versions prior to 3.60, Modbus/TCP Ethernet Modicon M340 FactoryCast module: versions prior to 6.80, Modicon M340 Firmware Versions prior to SV3.70

🎭 In plain English:
Your industrial control system's communication modules have a flaw that allows attackers to send specific commands that can crash the devices, making them unavailable. Imagine if someone could remotely shut down your factory's network communication, causing production to halt and no one could communicate with the control systems.

🔧 Prerequisites:

• Device must be running an affected version
• Attacker must be able to send crafted FTP commands to the device

⏱ Urgency: High urgency due to the potential for Denial of Service attacks that can render critical industrial control devices unavailable.

💡 Context: The vulnerability arises from improper input validation, allowing attackers to send crafted FTP commands that can cause the device to crash.

✅ Fixed in: 3.60, 6.80, SV3.70

Schneider Electric NetBotz 5 750/755

CISA Advisories | CVSS 6.4 | CVE-2026-13336, CVE-2026-13337

❓ Why Should I Care?
Yes, if you run NetBotz 5 750/755 <= 5.5.2: unpatched devices risk remote code execution and data access over the local network.

🎯 Affected versions: NetBotz 5 750 <= 5.5.2, NetBotz 5 755 <= 5.5.2

🎭 In plain English:
Your environmental monitoring device can be hacked if you don't update it. An attacker could remotely execute commands on your device, change settings, and steal data. For example, they could disable temperature alerts and cause equipment damage.

🔧 Prerequisites:

• Device version <= 5.5.2
• Access to local network

⏱ Urgency: High urgency due to the risk of remote code execution and unauthorized data access.

💡 Context: The device's software fails to properly sanitize input, allowing for OS command injection and SQL injection attacks.

✅ Fixed in: 5.6.0

Hitachi Energy FACTS Control Platform (FCP)

CISA Advisories | CVSS 9.9 | CVE-2024-4872, CVE-2024-3980, CVE-2024-3982, CVE-2024-7940, CVE-2024-7941

❓ Why Should I Care?
Yes, if you run Hitachi Energy FACTS Control Platform (FCP) versions 3.4.0 to 4.1.1 with GWS component: authenticated attacker can inject code and access critical files, impacting confidentiality, integrity, and availability.

🎯 Affected versions: FACTS Control Platform (FCP) 3.4.0 - 4.1.1
Not affected: Versions without GWS component

🎭 In plain English:
If you have the GWS component, an attacker with valid credentials can inject malicious code and access critical system files, potentially causing your FACTS Control system to malfunction or leak sensitive data. For example, an attacker could modify system settings, steal confidential information, or disrupt operations.

🔧 Prerequisites:

• Valid user credentials
• Presence of GWS component

⏱ Urgency: High urgency due to the critical impact on confidentiality, integrity, and availability.

💡 Context: Improper neutralization of special elements in data query logic and improper limitation of a pathname to a restricted directory allow authenticated attackers to inject code and access critical files.

Mitsubishi Electric GX Works3 and Motion Control Settings

CISA Advisories | CVSS 8.8 | CVE-2026-15688

❓ Why Should I Care?
Yes, if you run any version of Mitsubishi Electric GX Works3 or Motion Control Settings: local attacker can authenticate with invalid passwords, view, tamper with, destroy, or delete control programs. Patch now.

🎯 Affected versions: Mitsubishi Electric GX Works3: vers:all/*, Mitsubishi Electric Motion Control Settings (Software packaged with GX Works3): vers:all/*

🎭 In plain English:
An attacker with physical access to your system can bypass password protections, view, modify, or delete control programs. This means they can potentially take control of your industrial control systems, causing disruptions or damage.

🔧 Prerequisites:

• Physical access to the system
• Invalid block password

⏱ Urgency: High urgency due to the potential for local attackers to bypass authentication and manipulate control programs, leading to significant operational disruptions.

💡 Context: The authentication algorithm incorrectly allows execution of the product with invalid block passwords, enabling unauthorized access and manipulation of control programs.

✅ Fixed in: 1.096A, 1.070Y

Schneider Electric PowerChute Serial Shutdown

CISA Advisories | CVSS 5.3 | CVE-2026-13348

❓ Why Should I Care?
Yes, if you run Schneider Electric PowerChute Serial Shutdown versions <=1.5, 1.6: improper authentication validation could allow unauthorized access to system data and disrupt operations. Patch now.

🎯 Affected versions: PowerChute Serial Shutdown versions <=1.5, 1.6

🎭 In plain English:
The software doesn't limit how many times someone can try to log in, so an attacker can keep guessing passwords until they get in. Once in, they could access your system data and disrupt operations, like shutting down your systems at the wrong time.

🔧 Prerequisites:

• Redirect handling must be disabled

⏱ Urgency: Moderately urgent; improper authentication validation could allow unauthorized access and disrupt operations.

💡 Context: The software does not restrict the number of failed login attempts, allowing attackers to brute-force their way in.

✅ Fixed in: 1.6

Atomic macOS (AMOS) Stealer Activity

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you use macOS and download cracked software or follow deceptive setup guides: AMOS stealer can steal your credentials and sensitive data. Protect your system.

🎯 Affected versions: All macOS versions

🎭 In plain English:
AMOS stealer is a malware that steals your login credentials and sensitive data from your macOS system. If you follow a deceptive setup guide or download cracked software, an attacker can steal your passwords, financial information, and other sensitive data.

🔧 Prerequisites:

• User must download and run the malicious script
• User must provide administrative password

⏱ Urgency: High urgency due to the potential for widespread data theft and the ease of infection through deceptive setup guides.

A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you use AWS AgentCore Harness with default configurations: prompt injection can exfiltrate plaintext credentials. Patch and secure configurations now.

🎯 Affected versions: All versions using default configurations
Not affected: Versions with restricted allowedTools and egress filtering

🎭 In plain English:
Your AWS AgentCore Harness, if configured with default settings, can leak sensitive credentials due to a built-in shell tool. An attacker could inject prompts to extract these credentials, potentially gaining access to your AWS resources.

🔧 Prerequisites:

• Default configurations with built-in shell tool enabled
• No restrictions on allowedTools
• No egress filtering

⏱ Urgency: High urgency due to the potential for unauthorized credential exfiltration and access to sensitive AWS resources.

💡 Context: The built-in shell tool, enabled by default, can access the same memory space where credentials are resolved to plaintext, allowing for prompt injection attacks.

CareCam Pro IP Cameras

CISA Advisories | CVSS 6.8 | CVE-2026-85083

❓ Why Should I Care?
Yes, if you run CareCam Pro IP Cameras ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26: hard-coded credentials allow physical attackers to gain full control of the device.

🎯 Affected versions: CareCam Pro IP Cameras ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26

🎭 In plain English:
Your IP camera has a secret password that anyone can use if they can touch the device. An attacker who gets close enough can use this password to change your camera's settings, record video, or even take over the camera completely.

🔧 Prerequisites:

• Physical access to the device

⏱ Urgency: Moderate urgency as physical access is required, but the device could be compromised if an attacker gains physical proximity.

💡 Context: The bootloader authentication uses a hard-coded credential, allowing unauthorized access to the device's firmware and configuration.

NextGen Healthcare Mirth Connect

CISA Advisories | CVSS 8.3 | CVE-2026-82583, CVE-2026-78224, CVE-2026-82578

❓ Why Should I Care?
Yes, if you run NextGen Healthcare Mirth Connect <=v4.7.1: SQL injection and XXE vulnerabilities allow data exfiltration and denial-of-service attacks. Patch now.

🎯 Affected versions: NextGen Healthcare Mirth Connect <=v4.7.1

🎭 In plain English:
An attacker can inject malicious SQL commands or XML data to steal sensitive information or crash your system. For example, an attacker could steal patient data or disrupt communication between healthcare systems.

🔧 Prerequisites:

• Authenticated access for SQL injection
• No specific access required for XXE attacks

⏱ Urgency: High urgency due to the potential for data exfiltration and denial-of-service attacks.

💡 Context: The SQL injection vulnerability arises from improper neutralization of special elements used in SQL commands, while the XXE vulnerabilities stem from improper restriction of XML external entity references.

✅ Fixed in: v4.7.2

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA Advisories | CVSS 8.8 | CVE-2026-38059, CVE-2026-38057, CVE-2026-38056, CVE-2026-38058

❓ Why Should I Care?
Yes, if you run ST Engineering iDirect iQ-Series Terminals <=4.5.2.1: unauthenticated access to sensitive device info and potential DoS via CSRF. Patch now.

🎯 Affected versions: Evolution iQ-Series terminals <=4.5.2.1, 3315-Series terminals <=4.5.2.1, 9-Series terminals <=4.5.2.1

🎭 In plain English:
An attacker can access sensitive device information like serial numbers and private keys without needing any login credentials. They can also cause your device to reboot repeatedly, disrupting service. This means they can potentially impersonate your device and disrupt your network.

🔧 Prerequisites:

• Network access to the device
• Authenticated session cookie

⏱ Urgency: High urgency due to the potential for unauthorized access and denial-of-service attacks.

💡 Context: The REST API endpoints are exposed without proper authentication, allowing unauthorized access to sensitive information and enabling CSRF attacks.

✅ Fixed in: 4.5.3.0

AVEVA Pipeline Integrity Monitor

CISA Advisories | CVSS 8.4 | CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824

❓ Why Should I Care?
Yes, if you run AVEVA Pipeline Integrity Monitor <=2025_SP1_P1_build_7.1.9580.8513: unpatched systems allow attackers to decrypt sensitive information, brute-force passwords, and execute arbitrary code in browser sessions.

🎯 Affected versions: AVEVA Pipeline Integrity Monitor <=2025_SP1_P1_build_7.1.9580.8513

🎭 In plain English:
Your system's project files contain hard-coded keys and weak encryption, allowing attackers to decrypt sensitive data, brute-force passwords, and inject malicious code into your browser. An attacker could steal your passwords, gain admin access, and execute commands on your system.

🔧 Prerequisites:

• Read access to PIMBoards project files
• Access to a browser session

⏱ Urgency: High urgency due to the potential for sensitive data disclosure and unauthorized access.

💡 Context: The system uses hard-coded cryptographic keys and weak hashing algorithms, making it vulnerable to decryption and brute-force attacks.

✅ Fixed in: AVEVA Pipeline Integrity Monitor 2025 SP1 P2

Orthanc DICOM Server

CISA Advisories | CVSS 8.1 | CVE-2026-87020

❓ Why Should I Care?
Yes, if you run Orthanc DICOM Server <1.13.0: authenticated attackers can crash your server with a specially crafted image, causing a denial-of-service. Patch now.

🎯 Affected versions: Orthanc DICOM Server <1.13.0

🎭 In plain English:
If you're using an old version of Orthanc DICOM Server, an attacker who can log in can crash your server by sending a specially crafted image. This means your server stops working until you restart it. For example, an attacker could send a corrupted image file that causes your server to crash, making it unavailable to your medical staff.

🔧 Prerequisites:

• Authenticated remote attacker

⏱ Urgency: High urgency due to the potential for denial-of-service attacks, which can disrupt critical healthcare operations.

💡 Context: An integer overflow in the pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc decodes an attacker-supplied PNG or JPEG image.

✅ Fixed in: 1.13.0

... and 17 more medium-priority items.

Why Should I Care? 🔵 On the Radar (209)

• Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution (The Hacker News) — A critical flaw in Cisco Secure Email Gateway allows attackers to execute root commands via crafted emails. This means attackers can take full control of the device, potentially compromising your entire network.
• Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks (The Hacker News) — A security flaw in Acronis Backup plugin for cPanel & WHM and Plesk allows attackers to escalate privileges and potentially execute unauthorized code. This could compromise the confidentiality and integrity of your data.
• Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation (The Hacker News) — Google has patched a critical flaw in Pixel modems that could allow attackers to escalate privileges remotely without needing any user interaction. This means that if your enterprise uses Google Pixel devices, they could be at risk of unauthorized access.
• Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks (The Hacker News) — Cisco has identified a critical vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows attackers to bypass authentication and gain unauthorized access. This could lead to full control over the affected devices.
• CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild (The Hacker News) — CISA has flagged three critical Linux kernel vulnerabilities that are being actively exploited. These flaws can allow local users to escalate privileges, cause system crashes, or corrupt data, affecting the security and reliability of Linux-based infrastructure.
• Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell (The Hacker News) — Adobe has patched a critical vulnerability in Adobe Commerce and Magento Open Source that allows attackers to execute arbitrary code. This flaw has been actively exploited in the wild, leading to the deployment of backdoors and web shells.
• N-able N-central Pre-Auth RCE Flaw Exploited in the Wild (The Hacker News) — A critical vulnerability in N-able N-central allows attackers to execute remote code without authentication. This means that if your N-central instance is internet-facing, it could be exploited by attackers to gain control over your systems.
• Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox (The Hacker News) — A security flaw in Chrome's JavaScript engine allows attackers to execute code inside the browser's sandbox. This means that if you're using Chrome or a similar browser, you could be at risk of unauthorized code execution.
• CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline (The Hacker News) — CISA has flagged critical vulnerabilities in Cisco, Citrix, and Fortinet products that could allow attackers to gain unauthorized access and execute commands. These vulnerabilities are being actively exploited, and federal agencies have a deadline to patch them.
• Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware (The Hacker News) — Cisco FMC vulnerabilities are being exploited to steal credentials and deploy ransomware. This means attackers can bypass authentication and gain root access, leading to potential data theft and system compromise.
• GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure (The Hacker News) — A severe flaw in GitLab allows attackers to read sensitive files without authentication. This impacts all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Immediate patching is required to prevent unauthorized access to critical information.
• CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV (The Hacker News) — CISA has flagged five critical vulnerabilities in popular software tools used in enterprise infrastructure. These flaws are being actively exploited, potentially allowing attackers to gain unauthorized access and escalate privileges.
• GitLab urges users to patch max severity path traversal flaw (BleepingComputer) — A critical path traversal vulnerability in GitLab allows unauthenticated attackers to read sensitive data from servers. This affects both Community and Enterprise Editions, and patches are available for versions 19.3.2, 19.2.6, and 19.1.
• Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure (The Hacker News) — A critical flaw in JFrog Artifactory allows attackers to bypass authentication and gain admin access, potentially compromising your entire software supply chain. For example, attackers could tamper with build pipelines and push malicious changes to customers.
• Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials (The Hacker News) — A critical flaw in Sangoma Switchvox allows attackers to execute code without needing credentials, potentially compromising VoIP systems. This means attackers can take control of your VoIP infrastructure and perform unauthorized actions.

⚪ 73 low-priority items filtered.

🦅 Aggregated and triaged by Donna AI  |  Sources: 9 vendor feeds  |  CISA KEV