Expert insights on cybersecurity, vulnerability research, and security best practices.
Citrix shipped the fix on June 30 and called it a denial of service. Seven weeks later watchTowr turned the same heap overflow into pre-auth root, and web shells landed on unpatched NetScaler appliances within days -- CISA added it to KEV on August 26 with a three-day deadline.
Four separate failures in SharePoint's JWT validation pipeline let an unauthenticated attacker forge a token for any user -- including a site administrator -- and CISA added it to the KEV catalog on August 18 after exploitation followed the public PoC within a day.
A path traversal flaw in the vCenter syslog server lets an unauthenticated attacker execute code on the appliance that governs the entire virtual estate -- and researchers counted 361 compromised hosts across 47 countries five days after disclosure.
A hard-coded low-privilege account shipped inside every Cisco Secure Firewall Management Center lets unauthenticated attackers log in to the firewall management plane -- and it was exploited as a zero-day before Cisco ever published an advisory.
A REST API batch-route confusion in WordPress Core chained with a WP_Query SQL injection gives unauthenticated attackers remote code execution on a default WordPress install -- no plugins, no credentials, and it is already being exploited in the wild.
A pair of zero-days in SonicWall's SMA 1000 remote-access appliance -- an unauthenticated CVSS 10.0 SSRF chained to a post-auth root code injection -- is being actively exploited to steal credentials, session databases, and MFA seeds.
A 16-year-old use-after-free in the Linux KVM shadow MMU lets a root user inside a guest VM escape to the host on both Intel and AMD x86 -- exploited as a zero-day in Google's kvmCTF
A deserialization flaw in Microsoft SharePoint Server lets an authenticated low-privilege user run code on the server -- now added to the CISA KEV catalog under confirmed active exploitation
A critical OS command injection flaw in the FortiSandbox web GUI lets unauthenticated remote attackers run arbitrary system commands via crafted HTTP requests -- a foothold inside the very appliance built to detonate and analyze malware
A missing-authentication flaw in Splunk Enterprise's PostgreSQL sidecar service lets unauthenticated attackers create and overwrite arbitrary files -- chained into remote code execution, actively exploited in the wild, and the first Splunk bug ever added to CISA KEV
A logic flaw in Check Point Security Gateway's deprecated IKEv1 VPN lets unauthenticated attackers establish a Remote Access VPN session without a valid password -- exploited as a zero-day by a Qilin ransomware affiliate and listed in CISA KEV
Unauthenticated SSRF in the Cisco Unified Communications Manager WebDialer service lets remote attackers write files to the underlying OS and escalate to root -- public exploit code is already available