Topic
Latest Zero-Day coverage — 14 articles.
BeyondTrust patched a critical Remote Support flaw on October 15, but a China-linked group had been exploiting it since August 29. Here is what the attackers did, who must patch, and how to check an appliance for compromise.
CISA added four CVEs to KEV on October 14: Cisco Secure Email Gateway, AhsayCBS, and Palo Alto PAN-OS. All were exploited before a full fix existed, and the due date for every one is October 17.
Ivanti warned that CVE-2026-104935, an authentication bypass in Connect Secure, is exploited in the wild. Volexity saw a three-flaw chain reach root on a fully patched VPN, and the third flaw still has no fix.
Microsoft's October 2026 Patch Tuesday is the largest ever, with roughly 1,400 fixes. One Windows Shell flaw, CVE-2026-96951, was exploited and has an October 16 CISA deadline. Here is what to patch first.
Citrix calls CVE-2026-88779 a NetScaler denial of service, but admins logged shell commands in SAML login requests and a patched honeypot ran a malware binary. Citrix has not confirmed code execution. Appliances with the earlier fixes need this update too.
DIVD, the nonprofit that discloses vulnerabilities for a living, was breached through its own Zammad helpdesk in what it calls an agentic AI-powered attack chaining CVE-2026-102489 and CVE-2026-102490. The RCE half is patchable. The root-level flaw still has no fix.
Fortinet disclosed CVE-2026-104286, a CVSS 9.8 path traversal flaw in FortiMail, with active exploitation already underway and no fixed release available for any affected branch. Here's the mechanism, the IOCs to check, and the workaround Fortinet is recommending until patches ship.
A CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, found by Cisco's own support team during a TAC case and now under active exploitation. No workaround exists. Here's the mechanism, who's affected, and what to check in your logs.
Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after a weekend of quiet shutdown warnings and NCSC pre-notifications. Here's the mechanism, who's affected, and the September 30 deadline.
CISA added seven actively exploited vulnerabilities to its KEV catalog in one week, spanning Cisco, Acronis, Google Pixel, and the Linux kernel. Here is what happened, in order, and what is due today.
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE authentication entirely, CVSS 10.0, already under active exploitation. It's the second Cisco zero-day found via live incident response this week.
CVE-2026-76461 lets an unauthenticated attacker reach root on Cisco Secure Email Gateway with nothing but a crafted email. Cisco found it while investigating an active intrusion, not before one.
CVE-2026-34621 chains two logic bugs to escape Adobe Reader's sandbox — no memory corruption needed. Exploited since December 2025, patched April 11. Russian-language lures targeting oil & gas sector.
Same product, different vulnerability class, same outcome: unauthenticated RCE on your endpoint management server. Exploitation started Easter weekend.
