Tag: zero-day
46 entries tagged zero-day, latest activity first.
- CVE-2026-96951, Windows Shell: a Mark of the Web bypass exploited as a zero-day, fixed in the 2026-10-13 cumulative updates and listed in CISA KEV (CVSS 8.8)
- CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)
- CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, the root-escalation step was patched on 2026-10-29 and CISA lists all three chain flaws (CVSS 8.6)
- CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)
- Microsoft calls Nightmare Eclipse's six uncoordinated Windows zero-day releases "never justifiable"; the three May drops were fixed in June 2026
- Windows BitLocker "YellowKey" (CVE-2026-45585) and CTFMON "GreenPlasma" (CVE-2026-45586) zero-days: public PoCs in May, fixed in the June 2026 Windows updates
- Metabase CVE-2026-72898: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since at least 2 August, with VenariX counting fifteen downstream victims
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)
- CVE-2026-82078 / CVE-2026-81578, PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed
- Tangerhütte (Saxony-Anhalt): the vendor of the municipal citizen-portal software says attackers exploited a zero-day in it, classifies the intrusion as AI-driven, and four other communes took their portals offline
- CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)
- Belnet, the Belgian government and research network, confirms a supplier zero-day let attackers copy all incoming mail to Belnet-owned domains and the transfer links its FileSender and FedSender services sent directly for 65 days
- Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)
- GeoServer CVE-2026-76904: an unauthenticated SQL injection in the jsonArrayContains filter was exploited within hours of disclosure, before a patch existed, and NCSC-CH put it in front of Swiss operators
- BlueMoon: six separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration
- ShieldBreak: a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025
- CVE-2026-15409, SonicWall SMA1000: unauthenticated SSRF (CVSS 10.0) chained to post-auth code injection, actively exploited
- CVE-2026-67279 / CVE-2026-86060, MikroTik RouterOS "MikroTrick": an SSH rekey-during- authentication state-confusion bypass chained with a crafted-username privilege escalation reaches unauthenticated full device takeover, actively exploited
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)
- September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)
- CVE-2026-75650 ("StyleSmuggler"), Magento/Adobe Commerce: unauthenticated CVSS 10.0 RCE via template-engine injection, exploited three days before Adobe's hotfix existed
- CVE-2026-86206 / CVE-2026-86207 / CVE-2026-86218, N-able N-central: a third, unrelated auth-bypass/RCE chain in five weeks, the third CVE a pre-auth CVSS 10.0 zero-day N-able says is already exploited
- CVE-2026-85046, Google Chrome: V8 type confusion exploited in the wild via a crafted HTML page
- CVE-2026-83548 / CVE-2026-83549, SonicWall SMA1000: a pre-auth SSRF through an unintended alternate Work Place access path chains into post-auth command injection in the Management Console, both under active exploitation
- Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days, AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)
- Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets, FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers
- WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137), out-of-band 7.0.2 patch, exploited within days and KEV-listed
- TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)
- Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat'; the cause is a path-traversal flaw, fixed in 5.12.5 and 6.0.2
- CVE-2026-48939, iCagenda for Joomla: unauthenticated file-upload-to-RCE, exploited as a zero-day, added to CISA KEV (CVSS 4.0 10.0)
- KDDI third-party email platform breach exposes up to 14.22 million credentials across six Japanese ISPs
- CVE-2026-56291, Balbooa Forms for Joomla: unauthenticated file-upload RCE exploited as a zero-day (CVSS 10.0)
- CVE-2026-48908 / CVE-2026-56290, two Joomla page-builder extensions hit CISA KEV the same day for unauth file-upload RCE zero-days
- NAIC breached via Oracle PeopleSoft zero-day; ShinyHunters publishes 3.1 TB of US insurance-regulatory data and rating-agency feeds pause
- Nightmare/Chaotic Eclipse zero-day wave; the Defender LPE now carries a CVE, a public PoC, and Microsoft's "Exploitation More Likely" rating, with no patch
- "GreatXML": unpatched BitLocker bypass via crafted XML on the recovery partition, PoC public, practical severity contested
- "RoguePlanet" Microsoft Defender zero-day: TOCTOU race in the scan engine yields a SYSTEM shell, no CVE, no patch
- CVE-2026-11645, Google Chrome V8 out-of-bounds read/write exploited in the wild, added to CISA KEV
- CVE-2026-49200 / CVE-2026-49201, Acer Wave-7 mesh routers: cleartext-credential log + hardcoded backup key, CVSS 10.0, no patch
- CVE-2025-48595, Android Framework: actively-exploited integer-overflow privilege escalation
- CVE-2026-5426, Digital Knowledge KnowledgeDeliver LMS: pre-shared ASP.NET machineKey enables ViewState deserialization RCE, exploited as a zero-day
- Previously unknown flaw in Huawei enterprise router software caused POST Luxembourg's nationwide telecom outage of July 2025; no CVE ten months later
- MiniPlasma: Chaotic Eclipse PoC turns the 2020 Windows Cloud Files driver flaw CVE-2020-17103 into a SYSTEM shell on patched Windows 11; June 2026 updates fix it
- Pwn2Own Berlin 2026 results: 47 zero-days and $1,298,250 awarded, DEVCORE Master of Pwn, AI coding agents and inference tools exploited
- Pwn2Own Berlin 2026: DEVCORE's Orange Tsai chains three Exchange bugs to code execution as SYSTEM, one reported to be CVE-2026-62911