21 casos · pág. 1/2
CISA, the FBI, the U.S. Secret Service and international partners issued a joint advisory on SafePay ransomware. The group has been highly active since August 2024 and has compromised roughly 600 organizations across multiple critical infrastructure sectors in the Americas, Europe and Australia. The FBI describes it as one of 2026's most …
CERT-FR advisory CERTFR-2026-AVI-1325, published 15 October 2026, reports a vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows a remote attacker to execute arbitrary code and compromise data integrity. Cisco states that CVE-2026-76519 is actively exploited. The advisory is based on Cisco security advisory c…
CERT-FR advisory CERTFR-2026-AVI-1317 is not the source here; this record covers CERTFR-2026-AVI-1326, which reports multiple vulnerabilities in Palo Alto Networks products fixed in vendor bulletins of October 14, 2026. Some flaws allow remote arbitrary code execution, privilege escalation and remote denial of service. Other impact classe…
CERT-FR advisory CERTFR-2026-AVI-1314 reports multiple vulnerabilities in Microsoft Windows and related components, covered by Microsoft's October 13, 2026 security bulletins (ADV260001 and dozens of CVEs). Some of them allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass and compro…
CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being activ…
The FBI, CISA, NSA, EPA, DOE, CNMF and Treasury warn of ongoing exploitation of internet-exposed PLCs by an Iranian-affiliated APT group, with activity observed since at least March 2026. Targets are Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens PLCs in the Government Services and Facilities, Water and Wastewater Syste…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. CISA describes these vulnerability types as a…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-14 based on evidence of active exploitation: CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the f…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-11 based on evidence of active exploitation: CVE-2026-85706, a path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors…
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-22, citing evidence of active exploitation. The entries affect Check Point (two flaws in multiple products), Arista VeloCloud Orchestrator and F5 BIG-IP APM. The alert gives no exploitation details, threat actor attribution or IOCs. CISA notes …
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-21 based on evidence of active exploitation: CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 Series Switches. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the …
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-25 based on evidence of active exploitation: CVE-2026-87902, a remote file inclusion flaw in WordPress Core. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterp…
CISA added two Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-88771, an improper input validation flaw, and CVE-2026-88772, a memory buffer bounds restriction flaw. CISA describes these vulnerability types as frequent attack vectors for malicious cyb…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-04, citing evidence of active exploitation: CVE-2026-88779, an improper restriction of operations within the bounds of a memory buffer flaw in Citrix NetScaler. CISA describes this vulnerability type as a frequent attack vector for malicious cyber…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on the basis of evidence of active exploitation: CVE-2025-61624, a path traversal flaw in multiple Fortinet products, and CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support. CISA describes these vulnerability types as a fre…
Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), on October 17, 2026. That was about a day after researcher Zach Main published a write-up on October 16, with a PoC following (bleepingcomputer.com dates the PoC to October 19, three da…
A joint StopRansomware advisory (AA26-293A) from CISA, the FBI, the USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026 (cisa.gov). The group has been active since August 2024 and has compromised …
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
CISA issued an alert on exploitation of critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, noting confirmed malicious activity involving at least some of them. The alert references Citrix bulletins for CVE-2026-107406, CVE-2026-88779 and CVE-2026-88771 through CVE-2026-88778. Because NetScaler updates can be …
