/
ttps_attack:T1190 × latest_source_host:securityweek.com × limpar

Resultados

2 casos · pág. 1/1

securityweek.com · · 3 fontes · 3 atualizações critical

Arista patches actively exploited VeloCloud Orchestrator zero-day CVE-2026-114625 (CVSS 9.9, authenticated SQL injection)

Arista Networks released security updates for CVE-2026-114625, a critical (CVSS 9.9) zero-day SQL injection in VeloCloud Orchestrator (VCO) that is being actively exploited. Any authenticated user, even with the lowest built-in Enterprise Read Only tenant role, who can reach the VCO web interface can escalate to operator privileges and ma…

CVE-2026-114625 CVE-2026-16812 CVE-2026-93952
securityweek.com · high

China-linked Storm-0940 uses AI pentest framework Artex to automate ConnectWise-related intrusions into hundreds of Microsoft 365 tenants

Microsoft reports that the China-linked APT Storm-0940 (active since at least 2021) used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers. ConnectWise suspended several services in response, including Cloud Backup, SaaS Security and Cloud Management. Huntress obse…

Storm-0940 aerospace automotive