Overview of incoming advisories.
2019 results found
CVE-2026-84869 affects ConnectWise ScreenConnect and involves both improper privilege management and missing authorization vulnerabilities. The flaw allows an attacker to perform file transfer and execution through active remote sessions without proper authorization or host confirmation. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Organizations using ScreenConnect are urged to apply security updates as prioritized by CISA guidance. ConnectWise published a security bulletin on 2026-09-08 addressing this issue. The vulnerability poses a significant risk as it can be exploited during legitimate remote sessions, bypassing host controls. CISA has also issued forensic triage requirements for affected systems under BOD 26-04 implementation guidance.
View original advisory →CVE-2026-67277 is a missing authentication for critical function vulnerability affecting MikroTik RouterOS. The flaw exists in the btest service and can be exploited to achieve kernel memory disclosure and denial of service. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in CISA's implementation guidance for BOD 26-04. MikroTik has published a dedicated support advisory for the September 2026 vulnerability. The vulnerability is rated High criticality. Organizations using MikroTik RouterOS are urged to apply patches immediately. The vulnerability is also tracked in the NVD under the same CVE identifier.
View original advisory →CVE-2026-86060 is a vulnerability in MikroTik RouterOS involving improper neutralization of argument delimiters in a command. The flaw allows an attacker to manipulate the trusted RouterOS policy mask, resulting in privilege escalation. It has been flagged by CISA under BOD 26-04, which prioritizes security updates based on risk. Federal agencies and organizations using MikroTik RouterOS are advised to apply patches promptly. The vulnerability is tracked in the NVD and CISA's Known Exploited Vulnerabilities catalog. Forensics triage requirements are outlined in CISA's BOD 26-04 implementation guidance. The issue poses significant risk to network infrastructure environments relying on RouterOS.
View original advisory →CVE-2026-20079 is a critical authentication bypass vulnerability affecting Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. The flaw allows an unauthenticated remote attacker to bypass authentication mechanisms via an alternate path or channel. Successful exploitation enables the attacker to execute script files on the affected device, ultimately achieving root access to the underlying operating system. The vulnerability is classified as high criticality and is listed under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Organizations using Cisco FMC or SCC are urged to apply patches immediately. Forensic triage requirements have also been outlined by CISA for affected systems. The vulnerability is tracked in the NVD and has a dedicated Cisco Security Advisory.
View original advisory →A critical out-of-bounds write vulnerability has been identified in Google Chromium's V8 JavaScript engine, tracked as CVE-2026-87491. The flaw allows remote attackers to execute arbitrary code within the sandbox by luring victims to a specially crafted HTML page. The vulnerability affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined in CISA's implementation guidance for BOD 26-04. Google has released a stable channel desktop update addressing this vulnerability. The vulnerability is rated as high severity due to its potential for remote code execution. Organizations using Chromium-based browsers are urged to apply patches immediately.
View original advisory →A heap-based buffer overflow vulnerability has been identified in multiple Fortinet products including FortiOS, FortiSwitchManager, and FortiSASE. The vulnerability allows remote attackers to execute unauthorized code or commands by sending specially crafted packets. It has been assigned CVE-2025-25249 and is tracked under Fortinet's PSIRT advisory FG-IR-25-084. CISA has flagged this vulnerability under BOD 26-04, indicating it requires prioritized remediation. The high criticality rating suggests active exploitation risk or significant potential impact on affected organizations. Forensic triage requirements have been outlined by CISA as part of the BOD 26-04 implementation guidance. Organizations using affected Fortinet products should apply patches immediately and review their network infrastructure for signs of compromise.
View original advisory →CVE-2026-19490 is a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw involves an alternate path or channel that allows unauthenticated remote attackers to bypass authentication controls. It is exploitable when the appliance is configured as an AAA virtual server or as a Gateway supporting SSL VPN, ICA Proxy, CVPN, or RDP Proxy. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements have also been published as part of BOD 26-04 implementation guidance. Citrix has released a security advisory (CTX696939) with remediation details. The vulnerability poses significant risk to enterprise environments relying on Citrix for remote access and identity management. Organizations are urged to apply patches immediately and review access logs for signs of exploitation.
View original advisory →Citrix heeft twee kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. CVE-2026-19489 betreft een memory overflow die optreedt wanneer de producten zijn geconfigureerd als SIP ALG binnen een Large Scale NAT (LSN) groep, wat kan leiden tot denial of service of onvoorspelbaar gedrag. CVE-2026-19490 stelt aanvallers in staat authenticatiemechanismen te omzeilen voor ongeautoriseerde toegang, waarbij de producten geconfigureerd moeten zijn als Gateway, AAA virtual server of SAML Identity Provider. Er is Proof of Concept code beschikbaar voor CVE-2026-19490. Het NCSC acht het zeer waarschijnlijk dat op korte termijn actief misbruik zal plaatsvinden van CVE-2026-19490. Organisaties worden geadviseerd de beschikbare patches zo snel mogelijk toe te passen.
View original advisory →Cybersecurity researchers at Huntress have identified worm-like activity abusing ConnectWise ScreenConnect to distribute malicious VBScript payloads to newly connected systems. Three unrelated incidents were discovered, each using different initial access methods: a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake application. The attack chain consists of four stages delivered via Visual Basic Script. Once a rogue ScreenConnect client is established, it spreads the malicious payload to other hosts that connect to the compromised instance. This lateral movement capability makes the threat particularly dangerous in enterprise environments where ScreenConnect is widely used for remote management. The activity highlights the ongoing abuse of legitimate remote access tools by threat actors.
View original advisory →N-able has patched a critical pre-authentication remote code execution vulnerability in N-central versions prior to 2026.3.1.14. The flaw allows an unauthenticated attacker to remotely execute arbitrary code on affected systems. All on-premises installations running vulnerable versions are affected. On-premises customers are strongly advised to upgrade immediately to N-central 2026.3 HF4. Hosted N-central (NCOD) instances have already been patched automatically. Active exploitation attempts have been observed in the wild. N-able recommends investigating Indicators of Compromise (IoCs) as a precautionary measure.
View original advisory →Hackers are actively exploiting a chain of two recently disclosed vulnerabilities in MikroTik RouterOS to gain control of affected devices. The attack targets routers with SSH services exposed to the internet. The vulnerability chain allows attackers to hijack the routers remotely. MikroTik is a widely used networking equipment vendor, making this a significant threat to network infrastructure globally. Organizations using MikroTik routers with internet-facing SSH are at risk. The exploitation of chained vulnerabilities increases the severity of the threat. Users are advised to apply patches and restrict SSH access to mitigate risk.
View original advisory →ConnectWise has disclosed a new vulnerability affecting its ScreenConnect remote access software. The flaw does not yet have a patch available, though ConnectWise has shared temporary mitigation measures for affected users. A patch is planned for release later in the week. ScreenConnect is widely used in enterprise environments for remote support and access, making vulnerabilities in it high-impact targets. The lack of an immediate patch increases the risk window for exploitation. Organizations using ScreenConnect are advised to apply the temporary mitigations as soon as possible. This follows a pattern of prior high-severity vulnerabilities in ScreenConnect that were actively exploited by threat actors. The article serves as an early warning advisory for administrators to act before a formal fix is released.
View original advisory →N-able has released its fourth hotfix in five weeks for its N-central remote monitoring and management (RMM) platform to address an unauthenticated remote code execution (RCE) vulnerability. Every on-premises N-central build below version 2026.3.1.14 is affected, including those updated to Hotfix 3 just a day prior. The vulnerability is serious enough that N-able's incident notice states it has been exploited in the wild, although the release notes describe exploitation as unconfirmed. The rapid succession of hotfixes indicates the complexity and severity of fully remediating the underlying flaw. RMM platforms like N-central are high-value targets as they provide broad access to managed endpoints across many organizations. Administrators are urged to apply Hotfix 4 immediately to all affected on-premises deployments.
View original advisory →Cybersecurity researchers from Check Point Research have analyzed JSCeal, a sophisticated malware compiled as V8 JavaScript (JSC). The malware is capable of credential harvesting, surveillance, and traffic interception. JSCeal is notably able to bypass Google authentication by stealing session cookies, effectively circumventing multi-factor authentication protections. The payloads are protected using javascript-obfuscator with multiple advanced obfuscation techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers. This makes analysis and detection significantly more challenging. The malware represents a growing trend of sophisticated browser-targeting threats that can undermine modern authentication mechanisms.
View original advisory →N-able has issued an emergency hotfix addressing a maximum-severity remote code execution (RCE) vulnerability in its N-central remote monitoring and management (RMM) platform. The flaw carries a critical severity rating and is being actively exploited in ongoing attacks. N-central is widely used by managed service providers (MSPs) to monitor and manage client endpoints, making this vulnerability particularly impactful. The emergency patch was released outside of the normal update cycle due to the severity and active exploitation. Organizations using N-central are urged to apply the hotfix immediately. RMM platforms are high-value targets for threat actors as they provide broad access to managed environments. The vulnerability could allow unauthenticated remote attackers to execute arbitrary code on affected systems. Details about the specific CVE identifier and technical exploitation method were not fully disclosed in the article snippet.
View original advisory →A vulnerability was identified in the sfturing hosp_order application up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The flaw exists in the orderRecordsService.cancelOrder function within OrderController.java, specifically in the Order Cancellation component. Manipulation of the ID argument enables an attacker to bypass authorization controls remotely. A public exploit is already available, increasing the risk of active exploitation. The product uses a rolling release model, so no specific version information is disclosed for affected or patched releases. The project maintainer was notified via an issue report but has not yet responded. This represents an actively exploitable, unpatched authorization bypass in a hospital order management system. The lack of vendor response and public exploit availability significantly elevates the risk level.
View original advisory →commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension. The vulnerability arises from a failure to deduplicate footnote definitions, allowing attackers to craft malicious documents with duplicate footnote definitions and references. This causes quadratic output expansion, leading to excessive memory and CPU consumption. The attack can exhaust server resources, effectively causing a denial of service. The vulnerability affects the PHP League's commonmark library and has been assigned CVE-2026-86435. A fix is available in version 2.8.4 and later. Users are advised to upgrade to the patched version to mitigate the risk.
View original advisory →A command injection vulnerability was identified in multiple Advantech WISE-6610 series devices running firmware version 1.2.1_20251110. The flaw exists in the basicstation_apply function within the Basic Station Certificate-Deletion Handler component, where manipulation of the 'act' argument enables command injection. The vulnerability can be exploited remotely and a public exploit has been disclosed. Affected models include WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, their EL variants, and WISE-6610P-DEA, WISE-6610P-DNA, and WISE-6610P-DTA. The vendor responded promptly and released a patched firmware version 1.2.4_20260821. Users are advised to upgrade immediately to mitigate the risk.
View original advisory →league/commonmark versions >= 2.0.0 and < 2.8.4 contain a denial of service vulnerability in the UniqueSlugNormalizer::normalize() function. The flaw causes an O(K^2) time complexity when K headings collapse to the same base slug due to restarting the numeric-suffix search from 1 on every collision. The vulnerability is triggered when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can craft a small Markdown document with many headings sharing the same base slug (e.g., empty ATX headings, identical text, or punctuation-only headings) to consume excessive CPU. The issue is patched in version 2.9.0. This is a remotely exploitable, low-complexity attack requiring no authentication or special privileges.
View original advisory →A stack-based buffer overflow vulnerability has been identified in the D-Link DIR-822A router (firmware version A_101). The vulnerability resides in the strcpy function within the udhcpcd/serverpacket.c file of the udhcpcd component, related to TR-111 Option 125 parsing. An attacker can exploit this vulnerability remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-86296 and is tracked on NVD and VulDB. D-Link home/SMB routers are the affected products, posing a risk to network infrastructure. Users are advised to monitor for patches from D-Link and apply mitigations promptly.
View original advisory →