Tag: actively-exploited
All entries tagged actively-exploited.
- CISA KEV adds three unrelated Linux kernel flaws in one day, kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write
- CVE-2026-58704, Google Pixel: zero-click privilege escalation out of the cellular modem sandbox, exploited in limited, targeted attacks
- CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found while resolving a customer support case, no workaround beyond ACLs (CVSS 10.0)
- CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)
- CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August
- CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots caught exploitation attempts one day after the patch (CVSS 10.0)
- CVE-2026-84869, ConnectWise ScreenConnect: a missing file-transfer authorization check lets an active remote session push and auto-run files on the Host, and Huntress traced worm-like exploitation back to 20 August, weeks before any patch existed (CVSS 9.9)
- BlueMoon: five separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain within one week
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)
- CVE-2025-25249, Fortinet FortiOS/FortiSwitchManager: unauthenticated CAPWAP heap overflow added to CISA KEV, actively exploited since July via the PivotC2 RAT
- September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)
- CVE-2026-75650 ("StyleSmuggler"), Magento/Adobe Commerce: unauthenticated CVSS 10.0 RCE via template-engine injection, exploited three days before Adobe's hotfix existed
- CVE-2026-86206 / CVE-2026-86207 / CVE-2026-86218, N-able N-central: a third, unrelated auth-bypass/RCE chain in five weeks, the third CVE a pre-auth CVSS 10.0 zero-day N-able says is already exploited
- CVE-2026-67276 / CVE-2026-86060, MikroTik RouterOS "MikroTrick": a forged-signature SSH authentication bypass chained with a crafted-username privilege escalation reaches unauthenticated full device takeover, actively exploited
- CVE-2026-85046, Google Chrome: V8 type confusion exploited in the wild via a crafted HTML page
- CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables
- CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped
- CVE-2026-83548 / CVE-2026-83549 (SonicWall SMA1000: a pre-auth SSRF through an undocumented Work Place access path chains into post-auth command injection in the Management Console) both under active exploitation
- CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session
- CVE-2026-82329, JFrog Artifactory: an unauthenticated attacker gets administrative access under default configuration (CVSS 9.8)
- AI infrastructure as the new control plane: Microsoft confirms three separate intrusions against a LiteLLM gateway, a RAGFlow deployment and a Kestra orchestration environment, converging on credential theft and persistence, with compute monetisation in two of the three
- CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment
- CVE-2026-21962: an unauthenticated request bypasses access control in the Oracle WebLogic Server Proxy Plug-in, CISA KEV-listed on 24 August with exploitation running since January
- CVE-2026-82078 / CVE-2026-81578, PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed
- Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV, an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published
- miniOrange's SAML2Core library ships the same openssl_verify() tri-state authentication bypass across both its WordPress and Joomla SAML SSO products, one vendor code defect, two ecosystems, exploitation already attempted against the WordPress line
- A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations
- JFrog Artifactory: authenticated Docker-cache path traversal (CVE-2026-66384) added to CISA KEV, a CI/CD artifact-store write primitive with no published exploitation narrative
- Sourcerer for Joomla: unauthenticated RCE exploited in the wild since before a working fix existed; the vendor's first two patches did not close it, and the CVE was re-scoped in place to widen the affected range
- Rapid7's Q2 2026 quarterly report: high- and critical-severity disclosures doubled year on year to 8,539 while the number newly exploited held flat at 40, and 62% of what was exploited needed no user interaction at all
- CVE-2026-72529 and CVE-2026-72530, a pre-auth chain on TrueConf Server's port 4307 reaches SYSTEM, and the operators use it to replace the client installer the server hands to everyone who joins a meeting
- SPIP shipped two emergency releases in three days, each fixing an unconditional pre-authentication RCE the vendor says is already being exploited, and only the first one has a CVE
- CVE-2026-64849, MLflow: the SSRF guard resolves the webhook host and then throws the answer away, so one redirect turns an unauthenticated tracking server into a reader of its own cloud credentials
- CVE-2026-73570, Zimbra Collaboration: a pre-auth command injection patched without a CVE in July is now recorded as actively exploited, four weeks after the fix shipped
- CVE-2026-19490, Citrix NetScaler: an authentication bypass on Gateway and AAA virtual servers (CVSS 9.3), and on older builds no SAML configuration is needed to be exposed
- CVE-2026-19478; GitLab ships an out-of-band critical patch for a GraphQL directive flaw that lets an unauthenticated caller modify or delete public projects and user data (CVSS 9.4)
- CVE-2025-62593; Ray's dashboard is defended against browsers by a User-Agent string check, and CISA now records the DNS-rebinding bypass as exploited
- GeoServer: an unauthenticated SQL injection in the jsonArrayContains filter is being exploited with no CVE and no patch, and NCSC-CH has put it in front of Swiss operators
- CVE-2026-20349, Cisco Secure Firewall ASA/FTD: one crafted HTTP request to the Remote Access SSL VPN reloads the device, exploitation confirmed, no workaround and a three-day KEV deadline
- CVE-2026-58231, SAP Commerce Cloud: an unauthenticated request to the Data Hub Adapter import endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy
- Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets, FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers
- Gunra ransomware-as-a-service: a joint six-agency advisory documents FortiOS edge exploitation, a persistent MFA backdoor built from one fixed OTP value, and a Linux encryptor whose keys can be reconstructed
- CVE-2026-71851, crypto-js below 4.0.0 generates 'random' values with about 2^39 of real entropy, and attackers were draining wallets built on it while the investigation ran
- Metabase: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since 3 August, and no CVE was ever assigned
- CVE-2026-65400, macOS Screen Sharing lets a network attacker authenticate without valid credentials, the second severe defect in the same daemon in two releases
- CHAINDROP, the Shai-Hulud npm worm returns through the keyv maintainer, backdoors 400+ packages, and resolves its exfiltration endpoint from an Ethereum smart contract
- Canton Graubünden discloses a SharePoint server breach a day after the Confederation did; the on-premises wave has reached Swiss cantonal government
- CVE-2026-34486, Apache Tomcat: the fix for an earlier EncryptInterceptor flaw reintroduced a bypass, and CISA's KEV listing lands months after a China-nexus campaign was already exploiting it
- Switzerland's federal IT provider BIT confirms a SharePoint Server intrusion: ~200 federal user and technical accounts compromised while the July patches were already being installed
- CrowdStrike 2026 Threat Hunting Report: 88% of public-PoC exploitation landed inside 48 hours, and npm accounted for 87% of software-registry threats
- CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)
- CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
- COLDCARD: a preprocessor guard that tested whether a macro was defined rather than what it was set to routed key generation to a software PRNG for five years, and the keys are now being emptied
- Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual Citrix NetScaler exploitation (CVE-2026-3055), not the agent
- UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad, a five-day-old extortion brand whose other 14 claims look fabricated
- VMSA-2026-0006, VMware vCenter: unauthenticated Directory Service auth bypass and Syslog traversal RCE (both CVSS 9.8), plus a VMXNET3 guest-to-host escape
- CVE-2026-20316; Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms exploitation has been ongoing
- CVE-2013-4786, 24,650 internet-exposed BMCs hand a crackable password hash to any unauthenticated caller, and Lava found ransom notes on live management interfaces
- Coordinated two-day cyberattack disrupts operational technology at 30+ Minnesota water and wastewater utilities; no authority has attributed it
- CVE-2026-0769, Langflow: an unpatched pre-auth eval-injection RCE that VulnCheck observes being exploited, and that CISA KEV does not list
- CVE-2026-63077, JetBrains TeamCity On-Premises: unauthenticated RCE through the agent-polling protocol, every on-prem version affected (CVSS 9.8)
- CVE-2025-68686, FortiOS SSL-VPN: the fix for the symlink-persistence technique is itself bypassable, and CISA now lists it as exploited
- CVE-2026-16812, Arista VeloCloud Orchestrator on-prem: unauthenticated OS command injection on an interface exposed by default, confirmed exploited (CVSS 10.0)
- CVE-2026-16723, Alibaba fastjson 1.2.68–1.2.83: remote code execution under stock defaults in Spring Boot fat-JARs, exploited in the wild with no 1.x patch
- CVE-2026-61425, Balbooa Gridbox for Joomla: a client-supplied cookie is accepted as proof of identity, giving anonymous Super User access
- Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory
- US agencies expand the Iranian PLC-intrusion advisory (AA26-097A) to Schneider Electric and Siemens controllers, with new project-file tampering detection
- CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)
- CVE-2026-0770, Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1
- WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137), out-of-band 7.0.2 patch, exploitation expected short-term
- CVE-2023-4346, KNX building-automation protocol: account-lockout DoS added to CISA KEV, no software patch (CVSS 7.5)
- CVE-2026-46817, Oracle E-Business Suite (Payments): unauthenticated RCE now CISA KEV-listed after quiet in-the-wild exploitation (CVSS 9.8)
- CVE-2026-15409, SonicWall SMA1000: unauthenticated SSRF (CVSS 10.0) chained to post-auth code injection, actively exploited
- Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days, AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)
- CVE-2026-6875, ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)
- Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat', day three, no patch or root cause disclosed
- FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions
- WP-SHELLSTORM: an exposed webshell-brokerage toolkit reveals 27 weaponized CVEs fired at 1.4M WordPress/Joomla sites plus a parallel Nacos/Spring Boot credential-theft track
- CVE-2026-48939, iCagenda for Joomla: unauthenticated file-upload-to-RCE, exploited as a zero-day, added to CISA KEV (CVSS 4.0 10.0)
- CitrixBleed 2 (CVE-2025-5777) weaponised into a repeatable IAB kill chain ending in DragonForce ransomware (STAC3725)
- CVE-2026-56291, Balbooa Forms for Joomla: unauthenticated file-upload RCE exploited as a zero-day (CVSS 10.0)
- CVE-2026-48908 / CVE-2026-56290, two Joomla page-builder extensions hit CISA KEV the same day for unauth file-upload RCE zero-days
- CVE-2026-55255, Langflow cross-tenant IDOR now CISA KEV-listed, chained with the pre-auth RCE CVE-2026-33017
- JADEPUFFER, Sysdig documents an autonomous, LLM-driven ransomware operation entering via Langflow CVE-2025-3248
- CVE-2026-48276, -48277, -48281, -48282, -48283, -48316, Adobe ColdFusion: six CVSS 10.0 unauthenticated RCE paths
- CVE-2026-45659, Microsoft SharePoint Server: authenticated deserialization RCE, now KEV-listed
- Oracle E-Business Suite CVE-2026-46817: pre-auth RCE in the Payments File Transmission servlet, first in-the-wild exploitation
- CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed lineage), public PoC
- CVE-2026-46817, Oracle E-Business Suite (Oracle Payments): pre-auth RCE now exploited in the wild
- CVE-2026-8037, Progress Kemp LoadMaster: pre-auth RCE via uninitialized heap in the /accessv2 API
- CVE-2026-48558, SimpleHelp RMM: OIDC SSO authentication bypass, actively exploited
- NAIC breached via Oracle PeopleSoft zero-day; ShinyHunters publishes 3.1 TB of US insurance-regulatory data and rating-agency feeds pause
- Cisco Catalyst SD-WAN Manager CVE-2026-20245
- Ubiquiti UniFi OS triple-flaw chain to unauthenticated root (CVE-2026-34908 / -34909 / -34910)
- CVE-2025-67038, Lantronix EDS5000 serial-to-IP converter: unauthenticated OS command injection to root, first BRIDGE:BREAK flaw added to CISA KEV
- CVE-2026-20230, Cisco Unified CM: WebDialer SSRF to arbitrary file write to root, reconnaissance-stage exploitation observed
- SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog
- CVE-2026-20896, Gitea (Docker): trust-all reverse-proxy default lets an unauthenticated attacker impersonate any user via X-WEBAUTH-USER
- ShapedPlugin build pipeline compromised, three Pro WordPress plugins backdoored to steal credentials, 2FA secrets and drop a web shell
- AryStinger: a reconnaissance-and-proxy botnet built on end-of-life D-Link routers and QNAP NAS
- CVE-2026-4020, Gravity SMTP WordPress plugin: unauthenticated config-dump of email-connector credentials, mass-exploited
- PTC Windchill CVE-2026-12569: unauthenticated Java deserialization to RCE on the PLM management plane
- CVE-2026-52806, Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch)
- FortiBleed, 73,932 internet-facing FortiGate devices exposed, Russian-speaking group cracking credentials into Active Directory
- CVE-2026-48907, Widget Factory Joomla Content Editor (JCE) before version 2.9.99.5: unauthenticated profile-import → PHP RCE (CVSS v4 10.0)
- Cisco Catalyst SD-WAN Manager CVE-2026-20262: authenticated arbitrary file write to root RCE
- CVE-2026-54420, LiteSpeed cPanel/WHM plugin: symlink-following on shared hosting, exploited in the wild (CISA KEV)
- CVE-2026-20262, Cisco Catalyst SD-WAN Manager: authenticated arbitrary file write to root RCE (CISA KEV)
- CVE-2026-20253, Splunk Enterprise: unauthenticated pre-auth RCE via the PostgreSQL sidecar proxy
- CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8)
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration
- Windows Netlogon RCE CVE-2026-41089 now confirmed exploited in the wild in the EU; CERT-EU issues advisory 2026-007
- CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild
- ServiceNow unauthenticated REST endpoint queried customer instance tables before a silent 5 June patch
- Year-old WinRAR flaw (CVE-2025-8088) still fuels Ukraine intrusions, GIFTEDCROOK via UAC-0226 and an Earth Dahu chain
- CVE-2026-7473, Arista EOS tunnel-decapsulation logic flaw bypasses segmentation, added to CISA KEV
- CVE-2026-11645, Google Chrome V8 out-of-bounds read/write exploited in the wild, added to CISA KEV
- CVE-2026-10520 / CVE-2026-10523, Ivanti Sentry: pre-auth OS command injection to root (CVSS 10.0), public PoC published today
- Check Point IKEv1 VPN Authentication Bypass (CVE-2026-50751)
- CVE-2026-42271, BerriAI LiteLLM: low-privilege command injection to host RCE, added to CISA KEV
- CVE-2026-50751, Check Point Security Gateway: IKEv1 VPN authentication bypass, actively exploited by a Qilin affiliate
- CVE-2026-3300: unauthenticated eval() injection in a commercial WordPress plugin, and the patch-lag that turned a March fix into a June mass-exploitation campaign
- CVE-2026-3300, Everest Forms Pro (WordPress): unauthenticated eval() injection, actively exploited at scale
- CVE-2026-28318, SolarWinds Serv-U: unauthenticated DoS added to CISA KEV
- CVE-2026-20245, Cisco Catalyst SD-WAN Manager: actively-exploited command-injection to root (no patch)
- CVE-2026-8206 + CVE-2026-8181, Kirki and Burst Statistics WordPress plugins: unauthenticated account takeover under active mass-exploitation
- CVE-2026-45247, Mirasvit Full Page Cache Warmer (Magento 2 / Adobe Commerce): unauthenticated PHP object-injection RCE, now in CISA KEV
- Linux cgroups v1 release_agent container escape (CVE-2022-0492) re-enters active exploitation
- CVE-2025-48595, Android Framework: actively-exploited integer-overflow privilege escalation
- CVE-2024-21182, Oracle WebLogic Server: unauthenticated T3/IIOP data access, KEV-listed on active exploitation
- Sekoia consolidates Gamaredon tooling under GammaPhish / GammaWorm, details an NTFS-ADS USB+network worm
- CVE-2026-8732, WP Maps Pro WordPress plugin: unauthenticated admin-account creation, actively exploited
- CVE-2026-0257: PAN-OS GlobalProtect Pre-Auth VPN Authentication Bypass
- CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: Pre-Auth Authentication Bypass via Certificate Reuse
- FortiClient EMS CVE-2026-35616 + EKZ Infostealer kill chain
- The Gentlemen ransomware, Microsoft publishes full technical dissection of the Storm-2697 Go-encryptor
- FortiClient EMS CVE-2026-35616 actively exploited to push EKZ Infostealer through trusted endpoint-management channel
- Nx Console / TanStack / DAEMON Tools supply-chain cascade lands three CISA KEV entries
- CVE-2026-5426, Digital Knowledge KnowledgeDeliver LMS: pre-shared ASP.NET machineKey enables ViewState deserialization RCE, exploited as a zero-day
- Ghost CMS CVE-2026-26980 → ClickFix: the CMS-compromise-to-endpoint kill chain
- CVE-2026-26980, Ghost CMS Content API: unauthenticated blind SQL injection in the slug filter, actively exploited
- Large-scale ClickFix campaign mass-compromises self-hosted Ghost CMS sites via CVE-2026-26980
- CVE-2026-48172, LiteSpeed User-End cPanel plugin: authenticated cPanel user to root via lsws.redisAble, actively exploited
- CVE-2025-34291, Langflow AI Workflow Platform: CORS misconfiguration + SameSite=None refresh token enables cross-origin token theft (CISA KEV, ITW, Flodric botnet)
- CVE-2026-34926, Trend Micro Apex One On-Premise: post-auth directory traversal by admin-credential holder injects code deployed fleet-wide to all managed agents (CISA KEV, ITW)
- SonicWall Gen6 SSL-VPN incomplete-patching (CVE-2024-12802), Akira-linked actors brute-force MFA via UPN/SAM account-name split, February–March 2026 intrusions
- CVE-2026-41091, Microsoft Defender Engine link-following EoP, actively exploited
- Drupal core "highly critical" pre-patch warning, unauthenticated, zero-complexity, patch window today 17:00–21:00 UTC
- CVE-2026-0300 PAN-OS Captive Portal, revised fix-release timelines for 10.2.13-h21 and 10.2.16-h7; wave-2 target remains 2026-05-28
- CVE-2026-42945 NGINX Rift, in-the-wild exploitation confirmed by VulnCheck honeypots
- CVE-2026-42897 Exchange OWA, EM Service auto-mitigation depends on outbound connectivity to officemitigations.microsoft.com
- Exchange CVE-2026-42897, Pwn2Own DEVCORE three-bug SYSTEM RCE chain emerges alongside active OWA-XSS exploitation
- FunnelKit "Funnel Builder for WooCommerce" actively exploited as Magecart skimmer on 40,000+ WordPress stores, no CVE assigned
- Microsoft Exchange CVE-2026-42897: Active Exploitation Without a Patch
- CVE-2026-42897, Microsoft Exchange Server 2016 / 2019 / SE: stored XSS in OWA, actively exploited, no permanent patch
- Cisco Catalyst SD-WAN: CVE-2026-20182 Authentication Bypass and UAT-8616 Kill Chain
- CVE-2026-20182, Cisco Catalyst SD-WAN Controller/Manager: pre-auth authentication bypass enabling full fabric takeover
- UAT-8616 exploits Cisco Catalyst SD-WAN CVE-2026-20182; 10+ clusters exploit companion February 2026 CVEs; CISA Emergency Directive ED-26-03 issued
- CVE-2026-0300 PAN-OS Captive Portal, patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those builds
- CVE-2026-41089 / CVE-2026-41096 / CVE-2026-41103 / CVE-2026-42898; Microsoft May 2026 Patch Tuesday (120+ CVEs, no zero-days)
- Palo Alto PAN-OS CVE-2026-0300, first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only option
- CVE-2026-31431 "Copy Fail", CISA KEV deadline 2026-05-15 approaching; Microsoft documents Linux LPE cluster post-compromise chain
- CVE-2026-0300, Palo Alto PAN-OS Captive Portal KEV deadline TODAY (2026-05-09); no patch exists; first patches expected 2026-05-13; CL-STA-1132 post-exploitation detail
- CVE-2026-42208, LiteLLM Proxy pre-authentication SQL injection: CISA KEV deadline 2026-05-11; all upstream LLM API keys at risk
- CVE-2026-43284 / CVE-2026-43500, Linux "Dirty Frag": deterministic LPE chain via page-cache write primitives in xfrm-ESP and RxRPC, active exploitation confirmed
- Ivanti EPMM CVE-2026-5787 → CVE-2026-6973, Pre-Auth Certificate Impersonation Chaining to RCE in Enterprise Mobile Device Management
- CVE-2026-0300 (PAN-OS Captive Portal unauthenticated root RCE): CISA KEV deadline is today (2026-05-09); no patch until 2026-05-13
- CVE-2026-32202, Windows Shell NTLM coercion, APT28 ITW (CVSS 4.3, CISA KEV deadline 2026-05-12)
- CVE-2026-6973, Ivanti EPMM admin API improper input validation → RCE (CVSS 7.2, CISA KEV deadline 2026-05-10)
- CVE-2026-5787, Ivanti EPMM improper certificate validation (pre-auth Sentry impersonation, CVSS 9.1)
- Pro-Russian hacktivists modify OT pump settings at five Polish water treatment facilities
- CVE-2026-5787 / CVE-2026-6973, Ivanti EPMM pre-auth certificate impersonation → admin RCE (CISA KEV deadline 2026-05-10)