Threat briefs
The vulnerabilities attackers are using right now, explained for defenders. Each brief is researched across vendor, government and research sources, cross-checked, and cites every claim.
Openwave Webtop Media Transcoder file-type restriction bypass exploited, in CISA KEV
An authenticated user can make Openwave's Webtop Media Transcoder convert file types that administrators have blocked. Openwave told JVN that attacks have been observed, and CISA set a 2026-11-24 deadline. Upgrade to 1.1.22.0 or later, preferably the latest Media Server 2.0 release.
JVN relays the developer's statement that attacks have been observed, and CISA added the CVE to KEV on 2026-11-10. No source gives an actor, start date or victim data.
Latest
- Network security
Check Point Gaia DynamicCLI flaw gives local users root, exploited after PHP2Shell
Attackers chained PHP2Shell with a world-writable root socket in Gaia's DynamicCLI service to take over internet-facing Check Point gateways. Install the November Jumbo Hotfix and hunt dynamicCli.log for unexpected commands.
Check Point Gaia OS DynamicCLI (Quantum Security Gateway / Security Management)CVE-2026-123039CVSS7.8Exploited in the wild - Remote access
N-able N-central unauthenticated XXE chains to RCE; public PoC, attempts seen
An unauthenticated XXE in N-central opens the public Able2Shell chain to command execution and rogue admin accounts. Upgrade on-prem servers to 2026.4 HF2 (build 2026.4.1.26), keep them offline until then, and confirm the Legacy API is off.
N-able N-centralCVE-2026-125883CVSS9.3Public proof of concept - Collaboration
Cisco BroadWorks unauthenticated XXE exploited to read files, now in CISA KEV
An unauthenticated XXE in the BroadWorks OCI-P XML parser lets remote attackers read configuration and files. CISA lists it as exploited. Upgrade every BroadWorks component to RI.2026.07, and rotate keys on systems that were exposed.
Cisco BroadWorks (ADP, Application Server, Profile Server, XSP)CVE-2026-20320CVSS7.5Exploited in the wild - Endpoint & OS
Chrome XML use-after-free CVE-2026-125350 exploited in the wild; fixed in 157.0.8103.50
Google patched a use-after-free in Chrome's XML component on 2026-11-09 and says an exploit exists in the wild. Update Chrome to 157.0.8103.50 or later, and patch Edge, Opera and other Chromium-based browsers as their vendors ship fixes.
Google Chrome / Chromium (XML component)CVE-2026-125350CVSS8.8Exploited in the wild - Email
Barracuda ESG auth bypass chains to root command injection; both CVEs in CISA KEV
Barracuda ESG's authorization bypass chains with a command injection found in six Barracuda appliance lines. The chain gives root without credentials wherever the Admin UI is reachable. Barracuda and CISA report exploitation. Patch, and take admin interfaces off the internet.
Barracuda Networks Email Security Gateway, WAF, Load Balancer ADC, WSG, Message Archiver, WCCCVE-2026-116606 +1CVSS8.6Exploited in the wild - Email
Exploited Outlook zero-day leaks users' NTLMv2 hashes when crafted files are opened
Opening a crafted file makes classic Outlook connect to an attacker's server without warning, which exposes the user's NTLMv2 hash. Microsoft reports in-the-wild exploitation. Patch Office before CISA's KEV deadline of 2026-11-24.
Microsoft Outlook (Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024)CVE-2026-124194CVSS6.5Exploited in the wild - AI & dev tools
GPUStack auth bypass grants unauthenticated admin, exploited to run worker shells
GPUStack servers before 2.2.0 in default configuration treat loopback-looking requests as the built-in admin. A same-host reverse proxy or a spoofed header gives remote attackers full control. The flaw is in CISA KEV. Upgrade to 2.2.0, then hunt for rogue backends and API keys.
GPUStack (pip package gpustack)CVE-2026-102895CVSS9.8Exploited in the wild - Collaboration
IBM Aspera Faspex 5 authorization bypass grants admin rights, exploited per CISA
A crafted message lets an authenticated Faspex 5 user bypass authorization checks and gain full admin privileges. CISA lists it as exploited, with a federal deadline of 2026-11-12. Upgrade to 5.0.19 PL1 now. IBM lists no workaround.
IBM Aspera FaspexCVE-2026-123218CVSS9.8Exploited in the wild - Collaboration
FreeSWITCH SIP MESSAGE injection exploited to run API and OS commands
One SIP MESSAGE can make FreeSWITCH 1.11.2 and earlier run arbitrary API and OS commands. Installs that keep the sample passwordless user need no account. It is exploited in the wild and in CISA KEV. Upgrade to 1.11.3 before the 2026-11-12 KEV deadline.
SignalWire FreeSWITCHCVE-2026-116779CVSS9.8Exploited in the wild - Remote access
OpenSSH 'SSHole' musl bypass gives shell on no-password accounts; exploited, in CISA KEV
CISA added the musl-only sshd password bypass to KEV on 2026-11-09, and honeypot intrusions show C2 agents being installed. Upgrade openssh and restart sshd, or set PasswordAuthentication no. Federal due date: 2026-11-12.
OpenSSH project (OpenBSD); Alpine Linux OpenSSH Portable sshd (musl libc, no PAM)CVE-2026-123158CVSS8.1Exploited in the wild - Endpoint & OS
Linux kernel IPv4 TCP race lets remote attackers crash hosts; no known exploitation
A race in Linux kernel IPv4 TCP connection handling can free socket options that are still in use, so a remote attacker can crash the host. No exploitation is reported. Install your distribution's fixed kernel and reboot.
Linux (kernel.org) Linux kernel (IPv4/TCP networking)CVE-2026-98432CVSS8.1No known exploitation - Edge & VPN
Ivanti Connect Secure chain exploited for unauthenticated root; CISA adds linked CVE to KEV
CISA added Ivanti Connect Secure CVE-2026-118527 to KEV on 2026-10-30 as part of an exploited chain that ends in unauthenticated root access. Apply Ivanti's fixes for all three CVEs and investigate. The Integrity Checker misses this chain.
Ivanti Connect Secure (ICS)CVE-2026-118527 +2Exploited in the wild - Edge & VPN
Ivanti Connect Secure root privilege escalation exploited in zero-day chain
A privilege escalation in Ivanti Connect Secure was the root stage of a three-bug zero-day chain exploited since 2026-10-03. Upgrade to a build that fixes it, then run forensics. Ivanti's Integrity Checker can miss this intrusion.
Ivanti Connect Secure (ICS)CVE-2026-111357CVSS7.0Exploited in the wild - Cloud & virtualization
VMware ESXi logging bypass exploited as zero-day to hide admin activity
A low-severity ESXi flaw lets an attacker with admin rights run some operations without logging them. CrowdStrike says a China-nexus actor used it as a zero-day, and CISA added it to KEV. Patch ESX hosts to the fixed builds.
Broadcom (VMware) VMware ESX / ESXiCVE-2026-41709CVSS2.7Exploited in the wild - Endpoint & OS
Linux kernel "Fragnesia" lets a local user reach root; chained in firewall attacks
A logic flaw in the Linux kernel's ESP-in-TCP path lets a low-privileged local user corrupt the page cache of read-only files and escalate to root. CISA added it to KEV on 2026-10-28; researchers report it was chained with PHP2Shell to root firewalls.
Linux (kernel.org) Linux kernel (XFRM ESP-in-TCP / skbuff coalescing)CVE-2026-46300CVSS7.8Exploited in the wild - Web & app servers
Adobe Commerce "PolyShell" file upload exploited to plant webshells on stores
An unauthenticated upload flaw in Magento's REST API has been used since March 2026 to drop webshells and inject JavaScript loaders into stores. CISA added it to KEV on 2026-10-27. Install APSB26-73, then check for existing compromise.
Adobe Commerce and Magento Open SourceCVE-2026-48356CVSS9.6Exploited in the wild - Libraries & supply chain
Brotli decoder flaw behind Node2Shell now exploited; CISA adds to KEV
A crafted Brotli stream can corrupt memory in Google's C decoder, which Node.js, .NET, Bun and Python packages bundle. CISA added it to KEV on 2026-10-27 after honeypots logged exploit traffic. Patch runtimes, then rebuild and redeploy images.
Google Brotli C decoder (bundled in Node.js, .NET, Bun, Python Brotli, Envoy)CVE-2026-111497CVSS9.2Exploited in the wild - Edge & VPN
Arista VeloCloud Orchestrator zero-day lets low-privilege users take operator control
Any authenticated VCO On-Prem user, down to Enterprise Read Only, can escalate to operator. Arista and CISA confirm exploitation. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and check for compromise.
Arista Networks VeloCloud Orchestrator (VCO) On-PremCVE-2026-114625CVSS9.9Exploited in the wild - Collaboration
Collabora built-in CODE app for Nextcloud exploited for unauthenticated RCE and webshells
An unauthenticated command injection in the richdocumentscode app's proxy.php has been used since 2026-09-10 to plant PHP webshells on Nextcloud servers. Upgrade to 26.4.303 or remove the app, then hunt for shx*.php files. Disabling the app is not enough.
Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode)CVE-2026-110447CVSS9.2Exploited in the wild - Web & app servers
PHP core use-after-free (PHP2Shell) gives unauthenticated RCE, exploitation reported
A stale-state use-after-free in the PHP runtime lets unauthenticated attackers run code as the web worker. Apache mod_php carries the highest risk. Attacks were reported on disclosure day. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker.
The PHP Group PHP (php-src core runtime)CVE-2026-109619CVSS8.1Exploited in the wild - Other
Plex Media Server file write exploited via Plex2Shell chain for code execution
CVE-2026-96656 is the last link in the four-CVE Plex2Shell chain. Attackers use it to plant code in the Codecs folder, and exploitation began 2026-10-17. Upgrade to 1.43.3.10861 or later, then check for implants.
Plex Media ServerCVE-2026-96656CVSS7.2Exploited in the wild - Web & app servers
PHP2Shell OOM-corruption RCE added to CISA KEV after honeypot shells confirmed
An unauthenticated flaw in PHP's out-of-memory handling gives remote code execution as the web worker. Apache mod_php is the most exposed setup. CISA added it to KEV on 2026-10-26. Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 by 2026-10-29 and restart all workers.
PHP Group (PHP project) PHP core engineCVE-2026-109618CVSS9.2Exploited in the wild - Web & app servers
Exploited SiteGuard Server Edition command injection can run commands as root
An OS command injection in the statistics feature of EG Secure Solutions' SiteGuard Server Edition lets attackers run commands as root or SYSTEM, and the vendor has confirmed exploitation. Preserve diagnostic data, then update or patch.
EG Secure Solutions SiteGuard Server EditionCVE-2026-106931CVSS7.8Exploited in the wild - Remote access
BeyondTrust Remote Support pre-auth file flaw exploited as zero-day by China-nexus actor
An unauthenticated flaw in self-hosted BeyondTrust Remote Support 26.2.3 and earlier was exploited from late August to plant webshells and steal stored credentials. Apply the BT26-05-RS patch and hunt for compromise before rotating secrets.
BeyondTrust Remote SupportCVE-2026-102764CVSS9.8Exploited in the wild - Edge & VPN
Ivanti Connect Secure auth bypass exploited as zero-day, chained to root on patched VPNs
An unauthenticated bypass and code execution flaw in Ivanti Connect Secure was exploited before the 2026-10-13 fix. Upgrade now; Volexity and CISA warn Ivanti's Integrity Checker Tool may miss this intrusion, so hunt with forensics.
Ivanti Connect SecureCVE-2026-104935CVSS8.6Exploited in the wild - Identity & access
Cisco ISE API authentication bypass exploited as a zero-day; Cisco warns of possible root access
A crafted, unauthenticated request to a Cisco ISE or ISE-PIC API endpoint bypasses the management interface, and Cisco confirms in-the-wild exploitation. Patch to the fixed release for your train, then check API gateway logs on every node.
Cisco Identity Services Engine (ISE) and ISE-PICCVE-2026-76460CVSS10.0Exploited in the wild
From the archive
Landmark vulnerabilities, revisited: what happened, and what still applies.
Log4Shell: Log4j 2 JNDI lookups gave unauthenticated RCE, exploited before disclosure
A single logged string let remote attackers run code through Apache Log4j 2. Exploitation began before disclosure in December 2021 and still turns up years later. Find every copy of log4j-core and move it to 2.17.1, 2.12.4 or 2.3.2.
Citrix Bleed: NetScaler session token leak exploited as zero-day and by LockBit
An unauthenticated over-read in NetScaler ADC and Gateway leaked post-MFA session cookies. Patching closed the leak but not stolen sessions, so killing all sessions after the upgrade was part of the fix.
PAN-OS GlobalProtect command injection gave unauthenticated root, exploited as a zero-day
An unauthenticated file-creation bug in GlobalProtect chained into root command execution on PAN-OS 10.2, 11.0 and 11.1 firewalls. A suspected state actor exploited it for weeks before disclosure. Patch, check gpsvc logs, and reset devices that show exfiltration or interactive access.