VulnTracker Blog
Exploited-in-the-wild alerts, CVE deep-dives and practical guidance for the engineering and security teams who have to ship the fix.
Eight exploited CVEs from seven vendors entered CISA's KEV catalog between October 13 and 16. Five sit on edge or remote access products, seven had an EPSS of 5% or less, and all are marked Active in SSVC. Here is the list, the angle and what to patch first.
BeyondTrust patched a critical Remote Support flaw on October 15, but a China-linked group had been exploiting it since August 29. Here is what the attackers did, who must patch, and how to check an appliance for compromise.
Fortinet fixed CVE-2025-61624 in April and rated it Medium. In October, CISA added it to KEV after Unit 42 showed it helping deploy PEERSTITCH, a memory-only implant on FortiGate firewalls. Here are the fixed versions and what to hunt for.
A Linux kernel flaw, CVE-2026-99999 (PwnEscape), lets code inside a guest VM read host memory. It scores 9.3, needs a foothold in a guest, and has no reported exploitation. Fixed kernels are available for every stable branch.
CISA added four CVEs to KEV on October 14: Cisco Secure Email Gateway, AhsayCBS, and Palo Alto PAN-OS. All were exploited before a full fix existed, and the due date for every one is October 17.
Ivanti warned that CVE-2026-104935, an authentication bypass in Connect Secure, is exploited in the wild. Volexity saw a three-flaw chain reach root on a fully patched VPN, and the third flaw still has no fix.
Microsoft's October 2026 Patch Tuesday is the largest ever, with roughly 1,400 fixes. One Windows Shell flaw, CVE-2026-96951, was exploited and has an October 16 CISA deadline. Here is what to patch first.
CISA added five CVEs to KEV on October 8, all from 2015 to 2023: ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. A joint advisory ties them to a China-linked campaign, and EPSS scores range from 3.6 to 99.5 percent.
Six exploited CVEs reached CISA's KEV catalog between September 29 and October 4, covering Apple, Cisco, Fortinet, Zammad, and NetScaler. Each calls for a different first move, from a simple upgrade to a workaround because no patch exists.
Citrix calls CVE-2026-88779 a NetScaler denial of service, but admins logged shell commands in SAML login requests and a patched honeypot ran a malware binary. Citrix has not confirmed code execution. Appliances with the earlier fixes need this update too.
DIVD, the nonprofit that discloses vulnerabilities for a living, was breached through its own Zammad helpdesk in what it calls an agentic AI-powered attack chaining CVE-2026-102489 and CVE-2026-102490. The RCE half is patchable. The root-level flaw still has no fix.
Fortinet disclosed CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail, with active exploitation already underway and no fixed release available for any affected branch. Here's the mechanism, the IOCs to check, and the workaround Fortinet is recommending until patches ship.
A CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, found by Cisco's own support team during a TAC case and now under active exploitation. No workaround exists. Here's the mechanism, who's affected, and what to check in your logs.
Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after a weekend of quiet shutdown warnings and NCSC pre-notifications. Here's the mechanism, who's affected, and the September 30 deadline.
CISA added nine actively exploited CVEs to KEV last week, from F5 and Arista to WordPress, SharePoint, MikroTik, and a fresh pair of Citrix NetScaler zero-days. Here's what happened, and what's still due.
WatchTowr's honeypot network caught active exploitation of a WSO2 JWT algorithm bypass, with forged tokens granting full access to every backend API a compromised gateway proxies. CISA added it to KEV; federal agencies must patch by September 27.
Vercel has disclosed a critical remote code execution flaw in the Node.js implementation of ImageResponse in Next.js, tracked as CVE-2026-94545. It carries a CVSS of 9.5, and it is network-reachable with no authentication and no user interaction. But whether it affects you comes down to a detail that a version check alone will not answer: whether untrusted data reaches the SVG your app generates. This is a case where "am I running an affected version" is only half the question. What the vulner
CISA confirmed active exploitation of a Zyxel GS1900 switch vulnerability patched back in June, after GreyNoise found nearly 1,000 compromised devices across 48 countries. Here is the mechanism, who is affected, and what is due by September 24.
CISA added seven actively exploited vulnerabilities to its KEV catalog in one week, spanning Cisco, Acronis, Google Pixel, and the Linux kernel. Here is what happened, in order, and what is due today.
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE authentication entirely, CVSS 10.0, already under active exploitation. It's the second Cisco zero-day found via live incident response this week.
CVE-2026-65414 is a CVSS 9.8 out-of-bounds write in Apple's Bluetooth stack, patched across iOS, macOS, watchOS, tvOS, and visionOS. No known exploitation yet, but the CVSS "Network" label is easy to misread.
CVE-2026-76461 lets an unauthenticated attacker reach root on Cisco Secure Email Gateway with nothing but a crafted email. Cisco found it while investigating an active intrusion, not before one.
CVE-2026-85706, a path traversal flaw in GitLab's commits API, hit CVSS 10.0 and CISA's KEV catalog within a day. But there's one exposure condition that determines whether your instance is actually at risk.
MikroTik RouterOS is being actively exploited, and CVE-2026-86060 is in the CISA KEV catalog. Here is the interesting part for anyone who prioritizes by severity score: at the time of writing, this CVE has no CVSS score. NVD has not analyzed it yet. If your triage process starts with "what's the CVSS," this one falls through the cracks while attackers are already using it. That gap is exactly what SSVC is built to close. What the vulnerability is CVE-2026-86060 is a privilege escalation flaw
CVE-2026-81934 is a use-after-free in Redis that was first published as a CVSS 9.8 Critical, then reassessed down to High once the real exploitation conditions were weighed. It's a clean lesson in why the number on a CVE is a starting point, not the answer.
KB5120998 is an optional, non-security preview for Windows 11 24H2 and 25H2 — no CVE fixes. But two changes matter to security teams: Administrator Protection starts rolling out, and WMIC is finally removed. Here's what to pilot and what to weigh before deploying.
CVE-2026-72898 is an unauthenticated SQL injection in Metabase, scored CVSS 10.0 and already in CISA KEV. One request to /api/session/reset_password gives an attacker admin access and the credentials for every connected database. If you run Metabase, patch today.
CVE-2026-14669 is a CVSS 8.8 HIGH heap buffer overflow in PostgreSQL's to_char function that can run arbitrary code as the database OS user, patched August 13, 2026. Two questions decide your workload: is Postgres in your stack, and is your version older than 18.5 / 17.11 / 16.15 / 15.19 / 14.24?
A 9.1 critical authentication bypass in PAN-OS GlobalProtect, actively exploited and now in CISA KEV. But it only bites under a specific config. The two questions that decide your workload: is the product in your stack, and does your config meet the exposure conditions?
Active exploitation of an unauthenticated root RCE in PAN-OS firewalls. No patch until May 13. The one question your team needs to answer in the next two hours: is the User-ID Authentication Portal exposed to the internet?
732-byte exploit. First-try root on every modern Linux distribution. Page-cache-only corruption that on-disk integrity tools miss. Crosses container boundaries. Surfaced by an AI-assisted audit in roughly an hour.
A CVE is a license plate for vulnerabilities. You don't need to memorize acronyms — you need three things: how to tell if a CVE matters to you, what the score means, and what to do when one shows up in your stack.
A 27-character omission gave any network-adjacent attacker full control over 2,689+ publicly exposed nginx servers. The real story: every other app bolting MCP onto existing auth stacks.
CVE-2026-32201 allows unauthenticated spoofing on SharePoint Server. CISA added it to KEV immediately. Third SharePoint zero-day in under a year — ToolShell echoes loom large.
CVE-2026-34621 chains two logic bugs to escape Adobe Reader's sandbox — no memory corruption needed. Exploited since December 2025, patched April 11. Russian-language lures targeting oil & gas sector.
Same product, different vulnerability class, same outcome: unauthenticated RCE on your endpoint management server. Exploitation started Easter weekend.
Two CVSS 9.8 vulnerabilities hit Cisco management infrastructure. IMC auth bypass lets attackers take over any admin account. SSM On-Prem gives unauthenticated root access. Neither requires credentials.
For two hours on March 31, anyone who ran npm install axios got a North Korean RAT. The real package, the real registry, the real maintainer account — compromised.
A critical SQL injection in FortiClient EMS 7.4.4 allows unauthenticated attackers to dump admin credentials, endpoint data, and certificates with a single HTTP request. Active exploitation confirmed.
Google just released an urgent Chrome update patching eight high-severity vulnerabilities — all capable of enabling remote code execution, targeting GPU, audio, fonts, and federated auth components.
Between March 12-19, 2026, OpenClaw had 9 high-severity CVEs published — more than one critical flaw per day. This isn't a bad week. It's a systemic security architecture failure.
A high-severity vulnerability (CVSS 7.8) in Ubuntu Desktop 24.04+ allows any unprivileged local user to gain full root access. The exploit abuses a timing gap between snap-confine and systemd-tmpfiles — no memory corruption, no kernel exploit, just patience.
Google API keys deployed years ago for Maps and Firebase now silently authenticate to Gemini endpoints. Over 2,800 live keys were found exposed on the public internet — belonging to financial institutions, security companies, and Google itself.
A high-severity use-after-free vulnerability in Google Chrome's CSS engine (CVE-2026-2441) is being actively exploited. All Chromium-based browsers are affected — including headless deployments used in CI/CD pipelines and PDF generation services.
A denial-of-service vulnerability in PAN-OS Advanced DNS Security (CVE-2026-0229) allows unauthenticated attackers to force firewalls into repeated reboot cycles, potentially pushing them into maintenance mode. Upgrade affected PAN-OS versions immediately.
A critical authentication bypass in FortiCloud SSO (CVE-2026-24858, CVSS 9.4) is being actively exploited. Attackers with any FortiCloud account can potentially access devices belonging to other organizations. Patch immediately and audit your admin accounts.
When a new CVE like CVE-2025-14847 is published, the expectation is clear: teams should review it, assess impact, and take action if necessary. In reality, the hardest part usually isn't patching or mitigation...
Security is important — everyone agrees on that. But for most developers, security tracking is not the job they signed up for. You're building features, fixing bugs, shipping releases...
Let's be honest — whether you write code or secure it, vulnerability management today is a mess. You open a feed and see hundreds of CVEs, half of them irrelevant to your product...
