#cisa
-
Ransomware Gangs Join Attacks on Critical VMware vCenter RCE Flaw
CISA warns that ransomware operations have joined the exploitation of a critical vCenter vulnerability that Broadcom patched back in July.
-
CISA: Critical GitLab Vulnerability Already Being Exploited in Attacks
The CISA agency has warned of active exploitation of a maximum-severity vulnerability in GitLab that allows secrets to be read from vulnerable servers without authentication.
-
CISA: WatchGuard Firebox Flaw Now Exploited by Ransomware Gangs Too
The US cybersecurity agency has confirmed that a critical RCE vulnerability in WatchGuard Firebox firewalls is being used in ransomware attacks. Nine months after the patch shipped, thousands of unprotected devices remain online.
-
CISA Adds Critical N-able N-central RCE Vulnerability to Its Actively Exploited Catalog
The flaw, which carries the maximum CVSS score of 10.0, allows unauthenticated code execution and is already being used in attacks. U.S. federal agencies have been ordered to remediate it by September 11, 2026.
-
CISA Adds Seven Exploited Vulnerabilities to Its Catalog
The U.S. agency CISA has added seven fresh vulnerabilities to its Known Exploited Vulnerabilities catalog — among them flaws in SonicWall, JFrog Artifactory and AI infrastructure that attackers are using to install reverse shells and miners.
-
CISA Adds Six Exploited Vulnerabilities to Its KEV Catalog, Including a Citrix NetScaler Flaw
The U.S. agency CISA has added six new entries to its list of actively exploited vulnerabilities — ranging from a fresh Citrix NetScaler flaw to old holes in Linux, SQL Server and Red Hat utilities.
-
Critical RCE Vulnerability in Gitea Already Being Exploited for Cryptojacking
CISA has warned of active attacks against CVE-2026-60004 in Gitea. Rated 9.8, the flaw allows arbitrary command execution, and the first victims have found a miner-like payload on their servers.
-
Attack on Zimbra: Over 270 Servers Breached Through an SNMP Vulnerability
Attackers are actively exploiting the critical vulnerability CVE-2026-73570 in Zimbra Collaboration Suite, which allows remote code execution without authentication. According to Shadowserver, hundreds of servers have been compromised.
-
CISA Adds Critical Oracle WebLogic Vulnerability to Its Catalog of Actively Exploited Flaws
The CVE-2026-21962 vulnerability, with a maximum CVSS score of 10.0, lets an unauthenticated attacker access critical data over HTTP. Patches shipped back in January, but the attacks continue.
-
CISA Orders Urgent Patching of TrueConf Server Flaws Being Exploited in Attacks
The U.S. agency CISA has given federal agencies two weeks to remediate two critical vulnerabilities in the TrueConf Server platform. According to Kaspersky Lab, the Head Mare group is using them against Russian companies.
-
CISA: Critical Windows IKE Vulnerability Already Exploited in Attacks
The U.S. agency CISA has warned of active exploitation of a critical RCE vulnerability in the IKE service extensions component, affecting all supported versions of Windows.
-
CISA: Windows Task Host Vulnerability Now in the Ransomware Playbook
The US agency CISA has confirmed that ransomware groups are exploiting a privilege-escalation vulnerability in the Windows Task Host component. The flaw was patched back in November 2025, but the attacks continue.
-
CISA Adds Actively Exploited Ray Vulnerability to KEV Catalog
The critical CVE-2025-62593 vulnerability in the Ray distributed computing framework allows arbitrary code execution through a developer's browser via a DNS rebinding attack.
-
CISA: SharePoint Vulnerability Being Used in Ransomware Attacks
The US agency CISA has confirmed that ransomware groups have begun exploiting a serious remote code execution vulnerability in Microsoft SharePoint. Active attacks have been observed since early July.
-
SonicWall SMA1000 Vulnerabilities Now Weaponized by Ransomware Operators
CISA has confirmed that ransomware gangs have begun exploiting two recently patched vulnerabilities in SonicWall SMA1000 remote access gateways, including a critical SSRF flaw.
-
CISA Adds Critical Progress Kemp LoadMaster Vulnerability to KEV Catalog
CVE-2026-8037, rated CVSS 9.6, lets an unauthenticated attacker run arbitrary commands on the load balancer. Over 41 days, 792 exploitation attempts were recorded.
-
CISA: Critical JetBrains TeamCity Vulnerability Already Under Active Exploitation
The newly disclosed vulnerability CVE-2026-63077 (CVSS 9.8) in on-premise versions of TeamCity lets an unauthenticated attacker execute arbitrary commands. CISA reports active attacks and is requiring federal agencies to apply the patch by August 8.
-
CISA Adds Actively Exploited Flaws in Langflow, Tomcat and N-central to Its Catalog
On August 5, 2026, CISA added three vulnerabilities to its KEV catalog, citing evidence that they are being exploited in real-world attacks. One of the flaws is tied to an autonomous AI-driven hacking campaign.
-
CISA: attacks on water treatment systems knocked out more than 30 facilities in Minnesota
The U.S. cybersecurity agency has recorded a sharp rise in attacks on internet-facing industrial water-supply controllers. The attackers change passwords and disconnect equipment from the network.
-
Iran-Linked Hackers Are Targeting U.S. Water and Power Industrial Systems
The FBI, NSA, Department of Energy and CISA warn that Iran-linked hackers are breaking into industrial controllers at U.S. critical infrastructure sites, causing failures and outages.
- More