#cisa
-
CISA Adds Exploited GitLab and Cisco Firewall Flaws to KEV Catalog
The U.S. agency CISA has added a critical GitLab flaw enabling remote code execution and a Cisco firewall bug leading to denial of service to its catalog of known exploited vulnerabilities.
-
CISA warns Fragnesia Linux kernel flaw is being chained with PHP2Shell in attacks
The U.S. agency CISA has ordered federal agencies to fix a Linux kernel privilege escalation flaw. Attackers are already pairing it with the PHP2Shell bugs to gain root access to servers.
-
China-Linked Warp Panda Used VMware ESX Zero-Day to Hide Its Tracks
CISA has added CVE-2026-41709 in VMware ESX to its catalog of exploited vulnerabilities. According to CrowdStrike, the Warp Panda group used it as a zero-day to leave fewer traces in audit logs during attacks on U.S. law firms.
-
CISA adds Adobe Commerce and Brotli flaws to KEV as PolyShell hits hundreds of stores
CISA has confirmed active exploitation of two critical vulnerabilities, one in Adobe Commerce and Magento and one in Google's Brotli decoder library. The first has already been used to breach hundreds of online stores, and the second has prompted emergency updates from dozens of vendors.
-
CISA Adds Actively Exploited Flaws in Collabora Online and Arista VeloCloud to KEV
The U.S. cybersecurity agency CISA has added two critical vulnerabilities, both already seen in real-world attacks, to its Known Exploited Vulnerabilities catalog.
-
CISA: SafePay ransomware has breached 600+ critical infrastructure orgs
The U.S. agency CISA reports that since August 2024 the SafePay gang has breached over 600 critical infrastructure organizations worldwide, becoming one of the most active ransomware operations.
-
CISA Orders Agencies to Patch Exploited Plex, Siemens, and SiteGuard Flaws
The U.S. cybersecurity agency CISA has added the Plex2Shell bug cluster, plus flaws in Siemens Software Center and SiteGuard, to its catalogue of actively exploited vulnerabilities.
-
Fortinet warns of critical FortiMail flaw already exploited in the wild
Fortinet has disclosed a critical FortiMail vulnerability with a CVSS score of 9.8 that attackers are exploiting as a zero-day. Patches are not yet available for every affected version.
-
CISA flags critical pre-auth RCE flaw in MikroTik RouterOS
The U.S. cybersecurity agency warns of a flaw in the RouterOS web interface that lets an unauthenticated attacker run code as root with a single request.
-
CISA orders federal agencies to patch exploited Citrix flaws by Wednesday
The US cybersecurity agency has ordered agencies to shield their systems against attacks abusing two critical NetScaler vulnerabilities that are already being exploited in the wild.
-
LuaRocks Breach: an RCE Found a Year Late, Exploited All Summer
A flaw in LuaRocks.org allowed arbitrary code execution on the server via rockspec uploads. It was exploited from July 9 to August 20, 2026; the team revoked every credential and moved to a new server.
-
CISA Flags SharePoint and MikroTik RouterOS Flaws as Actively Exploited
CISA added two vulnerabilities — in Microsoft SharePoint and MikroTik RouterOS — to its KEV catalog, citing evidence of active exploitation. One RouterOS flaw is part of the MikroTrick chain that hijacks routers without a password.
-
CISA Adds Exploited WSO2 and Adobe Commerce Flaws to Its KEV Catalog
The U.S. cybersecurity agency CISA has added two critical flaws in WSO2 and in Adobe Commerce and Magento to its KEV catalog, citing evidence of active attacks. Federal agencies must patch them by September 27, 2026.
-
CISA: Ransomware gangs now exploiting critical TeamCity flaw
The U.S. cybersecurity agency CISA warned that a critical JetBrains TeamCity flaw patched in July is now being abused by ransomware gangs.
-
Check Point confirms attacks on VPN Security Gateway RCE flaw
The company reports active exploitation of a pre-authentication flaw, CVE-2026-85102, in its VPN certificate handling, alongside a second bug used as a zero-day since July.
-
F5 Patches Critical BIG-IP APM Zero-Day Allowing Unauthenticated RCE
CVE-2026-94127 threatens only systems where the APM module acts as an OAuth authorization server. F5 has shipped engineering hotfixes while attacks are already under way.
-
CISA Flags Active Attacks on Zyxel Switches and Veeam Windows Agent
A Zyxel GS1900 switch flaw has been added to the known-exploited catalog, while researchers warn of attacks on a local Veeam Agent bug that grants SYSTEM-level access.
-
CISA Adds Three Linux Kernel Vulnerabilities to Its Actively Exploited Catalog
The U.S. agency CISA has added three Linux kernel flaws to its catalog of known exploited vulnerabilities, citing evidence of attacks in the wild. Federal agencies are ordered to remediate them by September 21.
-
Cisco Fixes a Critical 0-Day in Identity Services Engine Already Being Used in Attacks
The CVE-2026-76460 vulnerability allows authentication to be bypassed via the API and grants access to the device without credentials. Cisco and CISA strongly urge installing the updates immediately.
-
A Critical ScreenConnect Vulnerability Is Already Being Exploited in Attacks
CISA warns of active exploitation of a critical flaw in ConnectWise ScreenConnect and orders federal agencies to fix it within three days.
- More