Signal
31 articles covering "zero-day"
DIVD says attackers chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) and used an automated AI agent; volunteer data was exposed.
Citrix confirmed exploitation of two critical NetScaler ADC and Gateway flaws, both CVSS v4 9.5, and shipped fixes; CISA added both to its KEV catalog as of September 27, 2026.
A researcher known as Nightmare Eclipse disclosed an unpatched Windows Defender privilege-escalation flaw, saying Microsoft's legal threats left public disclosure as the only option.
An unpatched SQL injection flaw in GeoServer's jsonArrayContains function is already being probed by attackers, watchTowr says, with no CVE or fix yet available.
Arista patched a maximum-severity command injection flaw in VeloCloud Orchestrator that attackers were already exploiting; CISA gave federal agencies until July 30 to fix it.
CVE-2026-15409 and CVE-2026-15410 were exploited together against SMA1000 appliances before patches shipped, CISA says.
A perfect-score authentication bypass in SimpleHelp's OIDC login is being exploited in the wild to deploy TaskWeaver and Djinn Stealer, prompting CISA to give federal agencies until July 2 to patch.
CVE-2026-35273, a CVSS 9.8 missing-authentication flaw in Oracle PeopleSoft PeopleTools, was exploited as a zero-day by UNC6240 before Oracle shipped mitigations and CISA set a June 15 federal deadline.
Cisco says CVE-2026-20245, a 7.8-rated command-injection flaw in Catalyst SD-WAN Manager, is being exploited to gain root. No patch or workaround is available; Mandiant reported it.
Google's June 2026 Android update patches a Framework privilege-escalation zero-day under limited, targeted exploitation. CISA added it to the KEV catalog with a June 5 federal deadline.
Arctic Wolf found attackers abusing a critical 9.8-CVSS FortiClient EMS authentication bypass to silently push EKZ Infostealer to every managed endpoint via legitimate VPN scripting workflows.
A directory traversal flaw in Trend Micro Apex One lets an attacker with admin server access inject malicious code into managed endpoints. CISA added it to KEV on May 21 with a June 4 federal deadline.