Expert insights on cybersecurity, vulnerability research, and security best practices.
One unauthenticated request to Jira, Confluence or Bitbucket reads files out of the webapp root -- including WEB-INF, where crowd.properties can hand over plaintext credentials and, from there, admin on the instance. CVSS 9.3, eight products, all versions, exploitation attempts within hours of the public write-up.
Citrix patched eight NetScaler CVEs on a Sunday, two of them already exploited as zero-days. CVE-2026-88771 affects every ADC and Gateway on an affected build -- default configuration included -- and the August builds most teams installed do not contain the fix.
One crafted request to an unauthenticated API endpoint hands an attacker the box that decides who is allowed on your network -- and then root on it. CVSS 10.0, exploited as a zero-day, in CISA KEV on September 16 with a three-day federal deadline, and no workaround that does not involve an ACL.
Two concurrent multipart requests to an unauthenticated Struts action hand an attacker Jetty's live configuration, and from there a root-adjacent shell on the box that manages every endpoint an MSP touches. CVSS 10.0, exploited before disclosure, in CISA KEV on September 8 -- the fourth N-central hotfix in five weeks.
A default-configuration authentication weakness in JFrog Artifactory lets an unauthenticated attacker mint administrator tokens. Patched on August 28, exploited in the wild by September 1, in CISA KEV by September 2 -- and the box it compromises is the one your entire build pipeline trusts.
Citrix shipped the fix on June 30 and called it a denial of service. Seven weeks later watchTowr turned the same heap overflow into pre-auth root, and web shells landed on unpatched NetScaler appliances within days -- CISA added it to KEV on August 26 with a three-day deadline.
Four separate failures in SharePoint's JWT validation pipeline let an unauthenticated attacker forge a token for any user -- including a site administrator -- and CISA added it to the KEV catalog on August 18 after exploitation followed the public PoC within a day.
A path traversal flaw in the vCenter syslog server lets an unauthenticated attacker execute code on the appliance that governs the entire virtual estate -- and researchers counted 361 compromised hosts across 47 countries five days after disclosure.
A hard-coded low-privilege account shipped inside every Cisco Secure Firewall Management Center lets unauthenticated attackers log in to the firewall management plane -- and it was exploited as a zero-day before Cisco ever published an advisory.
A REST API batch-route confusion in WordPress Core chained with a WP_Query SQL injection gives unauthenticated attackers remote code execution on a default WordPress install -- no plugins, no credentials, and it is already being exploited in the wild.
A pair of zero-days in SonicWall's SMA 1000 remote-access appliance -- an unauthenticated CVSS 10.0 SSRF chained to a post-auth root code injection -- is being actively exploited to steal credentials, session databases, and MFA seeds.
A 16-year-old use-after-free in the Linux KVM shadow MMU lets a root user inside a guest VM escape to the host on both Intel and AMD x86 -- exploited as a zero-day in Google's kvmCTF