LIVE · cybersecurity feed
Live wire
Malware Hijacks Android Car Head UnitsCritical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command ExecutionCVE-2026-73570 · U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalogCVE-2024-3094 · Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2Hundreds of leaked AWS keys give full control over corporate accountsAndroid Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy BotnetMalware injected into popular Rust packages to steal developer credentialsSix Maximum-Severity Flaws Found in Cisco ProductsCritical Isolated-vm Vulnerability Leads to RCE on Host
CVE-2026-64849critical

U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog

CISA has added a critical server-side request forgery (SSRF) vulnerability in MLflow to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-64849 with a CVSS score of 9.3, the flaw allows unauthenticated attackers to make requests from exposed MLflow servers to internal services, potentially stealing cloud credentials. Exploitation has been observed in the wild, with active scanning for vulnerable instances occurring shortly after the CVE was assigned.

zeroday.news ·

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, to its Known Exploited Vulnerabilities (KEV) catalog. This designation indicates that the flaw is actively being exploited in the wild.

The vulnerability, which carries a CVSS score of 9.3, affects MLflow versions prior to 3.15.0. MLflow is an open-source platform widely used for managing machine learning and AI development workflows, with tens of millions of monthly downloads.

Exploitation of CVE-2026-64849 does not require authentication, allowing a remote attacker to make requests from an exposed MLflow server to internal services. This capability includes targeting cloud metadata endpoints, which can lead to the exposure and theft of temporary cloud credentials and other sensitive secrets.

Cybersecurity firm watchTowr reported observing active exploitation of this unauthenticated SSRF vulnerability. The firm's global honeypot network, Attacker Eye, detected widespread scanning for exposed MLflow instances within hours of the CVE being assigned on August 17, 2026. These scans included attempts against cloud-hosted instances, indicating attackers are specifically seeking to access cloud metadata services.

The inclusion of CVE-2026-64849 in CISA's KEV catalog mandates that federal civilian executive branch agencies patch their systems against this vulnerability within a specified timeframe to protect against ongoing threats.

mlflowcisakevssrfvulnerability
ShareXLinkedInWhatsAppFacebook

More News

view all →
security

Postal Service moves to finalize mail ballot regs before SCOTUS ruling

The rules have already been rejected by multiple state courts, but the Trump administration said it’s preparing in case of a favorable Supreme Court decision. The post Postal Service moves to finalize mail ballot regs before SCOTUS ruling appeared first on CyberScoop.

vulnerability

ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries

ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions […]

ai

If you're not using AI to attack your own systems, your adversaries will

Agents are also the new attack surface - cue defenders' existential angst

privacy

TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit

TikTok has agreed to a $400 million settlement with the U.S. Department of Justice to resolve a lawsuit alleging violations of child privacy laws. The lawsuit, filed in 2024, accused the company of improperly collecting data from users under 13 and failing to comply with parental requests to delete accounts. The settlement includes an immediate payment of $300 million and an additional $100 million contingent on the dissolution of a prior consent decree related to Musical.ly.

malware

Hackers infect Android car head units with proxy botnet malware

A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]

security

Named Pipes Under Attack: Securing Windows Interprocess Communication

Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication. [...]