Topic

Active Exploitation

Latest Active Exploitation coverage — 7 articles.

Security Alert

MikroTik RouterOS Under Active Attack (CVE-2026-86060): When There's No CVSS Score to Wait For

MikroTik RouterOS is being actively exploited, and CVE-2026-86060 is in the CISA KEV catalog. Here is the interesting part for anyone who prioritizes by severity score: at the time of writing, this CVE has no CVSS score. NVD has not analyzed it yet. If your triage process starts with "what's the CVSS," this one falls through the cracks while attackers are already using it. That gap is exactly what SSVC is built to close. What the vulnerability is CVE-2026-86060 is a privilege escalation flaw

Sep 11, 20263 min read

Security Alert

Metabase Pre-Auth SQL Injection (CVE-2026-72898): CVSS 10.0, Actively Exploited

CVE-2026-72898 is an unauthenticated SQL injection in Metabase, scored CVSS 10.0 and already in CISA KEV. One request to /api/session/reset_password gives an attacker admin access and the credentials for every connected database. If you run Metabase, patch today.

Aug 27, 20262 min read

Security Alert

Critical and Already Being Exploited: PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)

A 9.1 critical authentication bypass in PAN-OS GlobalProtect, actively exploited and now in CISA KEV. But it only bites under a specific config. The two questions that decide your workload: is the product in your stack, and does your config meet the exposure conditions?

Jun 2, 20263 min read

Zero-Day

Adobe Reader Zero-Day Exploited for Months Before Emergency Patch

CVE-2026-34621 chains two logic bugs to escape Adobe Reader's sandbox — no memory corruption needed. Exploited since December 2025, patched April 11. Russian-language lures targeting oil & gas sector.

Apr 13, 20263 min read

Zero-Day

FortiClient EMS Gets a Second Zero-Day in One Week — CVE-2026-35616 Is Already Being Exploited

Same product, different vulnerability class, same outcome: unauthenticated RCE on your endpoint management server. Exploitation started Easter weekend.

Apr 6, 20262 min read

Security Alert

CVE-2026-21643: FortiClient EMS Critical SQL Injection — Actively Exploited, No Credentials Required

A critical SQL injection in FortiClient EMS 7.4.4 allows unauthenticated attackers to dump admin credentials, endpoint data, and certificates with a single HTTP request. Active exploitation confirmed.

Mar 31, 20263 min read

Security Alert

FortiCloud SSO Bypass (CVE-2026-24858): Active Exploitation and What You Need to Know

A critical authentication bypass in FortiCloud SSO (CVE-2026-24858, CVSS 9.4) is being actively exploited. Attackers with any FortiCloud account can potentially access devices belonging to other organizations. Patch immediately and audit your admin accounts.

Jan 28, 20263 min read