[?] Related tags:
Citrix patched eight NetScaler CVEs on a Sunday, two of them already exploited as zero-days. CVE-2026-88771 affects every ADC and Gateway on an affected build -- default configuration included -- and the August builds most teams installed do not contain the fix.
One crafted request to an unauthenticated API endpoint hands an attacker the box that decides who is allowed on your network -- and then root on it. CVSS 10.0, exploited as a zero-day, in CISA KEV on September 16 with a three-day federal deadline, and no workaround that does not involve an ACL.
A hard-coded low-privilege account shipped inside every Cisco Secure Firewall Management Center lets unauthenticated attackers log in to the firewall management plane -- and it was exploited as a zero-day before Cisco ever published an advisory.
A pair of zero-days in SonicWall's SMA 1000 remote-access appliance -- an unauthenticated CVSS 10.0 SSRF chained to a post-auth root code injection -- is being actively exploited to steal credentials, session databases, and MFA seeds.
Critical improper access control vulnerability in Fortinet FortiClient EMS actively exploited as zero-day - Unauthenticated API bypass leads to remote code execution
Critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager actively exploited - Unauthenticated access with netadmin privileges possible
Critical zero-day vulnerability in Windows Shell allows attackers to bypass SmartScreen and Mark of the Web protections through a single malicious click
Critical zero-day vulnerability in Cisco Unified Communications Manager and Webex actively exploited - Root access via code injection possible
root@sekurity:~# echo "End of results for tag: Zero-Day"
End of results for tag: Zero-Day
root@sekurity:~# _