CVE-2026-73570 enables unauthenticated command injection on Zimbra mail servers with confirmed active exploitation. Remote attackers execute arbitrary commands without authentication. Immediate patching and detection deployment required for internet-facing infrastructure.
Cisco warns of CVE-2026-76504, a critical zero-day in Catalyst SD-WAN Manager under active exploitation. Attackers can gain unauthenticated administrative access remotely. Organizations must apply emergency patches immediately to prevent network compromise.
Attackers exploited PaperCut MF print server zero-days to breach networks and reach Active Directory domain controllers. The campaign highlights security risks in overlooked peripheral systems that maintain privileged network access and credentials.
Citrix released emergency patches for actively exploited NetScaler zero-day vulnerabilities after a weekend of unofficial warnings. The critical flaws allow remote code execution on internet-facing appliances. Immediate patching and compromise assessment required.
31 malicious Chrome extensions disguised as VPN tools have compromised 356,000 users by routing browser traffic through attacker-controlled proxy servers. The extensions remain active and expose credentials, session tokens, and sensitive data to interception.
CVE-2026-48842, a critical SQL injection vulnerability in Roundcube Webmail (CVSS 8.1), is now actively exploited. The flaw allows authenticated attackers to execute arbitrary SQL commands against databases. Organizations must immediately patch to versions 1.6.7, 1.5.8, or 1.4.16.
Citrix confirmed two critical NetScaler zero-day vulnerabilities actively exploited before patches were available. CVE-2025-24046 and CVE-2025-24047 enable remote code execution on NetScaler ADC and Gateway appliances, requiring immediate patching and compromise investigation.
Microsoft acknowledges August 2026 Windows preview updates cause desktop loading failures and black screens. IT teams should postpone deployment to production systems until corrective patches release. Multiple recovery options available including Safe Mode and recovery environment procedures.
Chinese-speaking APT group exploits ZyXEL GS1900 switch and WordPress vulnerabilities to steal 18,500+ government records from 996 devices. Multi-vector campaign targets network infrastructure and web applications simultaneously for intelligence collection.
F5 BIG-IP Access Policy Manager contains a critical zero-day vulnerability (CVE-2026-94127) enabling unauthenticated remote code execution on systems with OAuth Authorization Server configurations. Active exploitation confirmed requiring immediate mitigation action.