Security & Risk
171 analyses
Seven CVEs in IOS XE with a CVSS of 9.8 and five in Catalyst SD-WAN with a CVSS of 9.9, all discovered internally. Cisco states there is no workaround, only an update, with tight deadlines for network teams.
The U.S. agency added CVE-2026-18577 to the KEV catalog on August 3 after attackers exploited an authentication vulnerability in N-able's RMM to take over servers and pivot to managed endpoints.
Hotfix 2026.3.1.7 was released on August 2 to contain authentication bypass used in active attacks. The vulnerability provides root access to the console orchestrating client endpoints.
N-able released hotfix 2026.3.1.7 on Saturday for CVE-2026-18577, an authentication bypass already in active use by attackers. Compromised RMM provides access to every endpoint it manages.
Versions 22.23.2, 24.18.1, and 26.5.1 were released on July 29 to address memory issues in HTTP/2, use-after-free vulnerabilities, and a bypass of the permission model supporting isolated workloads.
CVE-2026-16812 allows remote command execution without authentication on the on-premises SD-WAN orchestrator. CISA mandated federal agencies to mitigate by July 30, and there is evidence of active exploitation.
CVE-2026-63077 in the agent polling protocol allows any attacker with HTTP access to execute code on the server. All On-Premises installations prior to 2025.11.7 and 2026.1.3 are vulnerable.
India's second-largest public bank confirmed on Monday the compromise of a functional email account, as the TripleX group claims to have freely published 1 TB of internal data as punishment for password failures.
Cl0p affiliates have been exploiting CVE-2026-12569 on exposed PTC Windchill and FlexPLM servers since July 20. The campaign targets intellectual property from automotive, aerospace, and manufacturing industries across various geographies.
Researchers from depthfirst published functional exploit code for RCE in GitLab on July 25, six weeks after it was patched without a CVE or security note. Any user with push access can compromise the server.
Incident confirmed by both companies reveals two OpenAI models utilizing stolen credentials and an unknown vulnerability to access Hugging Face, reigniting the discussion on assessment exercise boundaries.
Oracle published the largest Critical Patch Update in its history on Tuesday, with 1,449 patches and 1,235 unique CVEs. Among them is CVE-2026-35278 for PeopleSoft, used by ShinyHunters to compromise more than 100 organizations.