exploitation news
25 stories
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers have been exploiting two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, designated CVE-2026-88771 and CVE-2026-88772, to gain root access, deploy web shells, and infiltrate internal networks. Citrix confirmed the active exploitation of both flaws and released security updates to address them.
CISA Adds 5 Exploited Flaws in Artifactory, ScreenConnect, RouterOS to KEV
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog, adding five new flaws that have been observed under active exploitation. These vulnerabilities impact products from JFrog, ConnectWise, and MikroTik, specifically affecting Artifactory, ScreenConnect, and RouterOS platforms. The inclusion in the KEV catalog mandates that…
Microsoft Patches Record 973 Vulnerabilities Amidst Active Exploitation
Microsoft has released patches for an unprecedented 973 vulnerabilities as part of its latest Patch Tuesday update, a new record for the company. Among these, two specific vulnerabilities, identified as CVE-2026-81963 and CVE-2026-85880, are confirmed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to be actively exploited in the wild.
Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
MikroTik has issued an urgent advisory for its RouterOS, confirming active exploitation of a critical vulnerability chain, dubbed "MikroTrick," that allows unauthenticated attackers to gain full control of devices with SSH exposed to the internet. The company released patches on September 3, 2026, but evidence suggests exploitation began as early as September 2, making it a zero-day event.
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Reports indicate that a critical arbitrary file upload vulnerability within the Elementor Pro WordPress plugin is currently being actively exploited to compromise websites. The flaw, identified as CVE-2026-32475, allows attackers to upload malicious files to affected sites, potentially leading to full site compromise.
Critical Citrix NetScaler auth bypass now leveraged in attacks
Attackers have begun exploiting a critical authentication bypass vulnerability in Citrix NetScaler appliances, identified as CVE-2026-19490. The flaw allows unprivileged remote attackers to bypass authentication when the NetScaler appliance is configured as a AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). The specific impact depends on the NetScaler firmware version…
Hackers now exploit critical Gitea flaw in code injection attacks
A critical vulnerability in Gitea, a self-hosted Git service, is now being actively exploited by attackers, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, tracked as CVE-2026-60004, is a code injection vulnerability that allows an authenticated user with repository write access to execute arbitrary shell commands on affected servers.
GitLab Critical GraphQL Flaw Actively Exploited
GitLab has confirmed that a critical vulnerability in its GraphQL API, identified as CVE-2026-19478, is being actively exploited in the wild. The flaw, which carries a CVSS score of 9.4, allows unauthenticated attackers to remotely modify or delete public projects and associated user data on self-managed GitLab instances.
GitLab Code Injection Vulnerability Actively Exploited
A critical code injection vulnerability in GitLab, tracked as CVE-2026-19478, is reportedly being actively exploited in the wild. The flaw was publicly disclosed recently, and exploitation attempts have been observed shortly thereafter. This vulnerability allows unauthenticated attackers to manipulate or remove public projects and their associated data, though specific conditions must be met…
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
Attackers are reportedly exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS) that enables unauthenticated remote code execution. The flaw, tracked as CVE-2026-73570 and assigned a CVSS score of 8.9, is attributed to insufficient input sanitization within the Simple Network Management Protocol (SNMP) notification processing component of ZCS.
Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
Cybersecurity researchers have reported a campaign, identified as Operation CameraSwarm, that led to the compromise of more than 14,500 Dahua devices. The activity was observed between June and July 2026. The attackers reportedly leveraged a combination of credential-based attacks, specific authentication bypass vulnerabilities, and a peer-to-peer (P2P) relay method to achieve unauthorized…
macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
Hackers are actively exploiting a recently patched vulnerability in macOS Screen Sharing to gain root access on compromised systems and deploy Monero cryptocurrency miners. The Dutch National Cyber Security Centre (NCSC-NL) has confirmed reports of this exploitation, noting that affected systems typically have port 5900, used by Screen Sharing, exposed to the internet.
Critical Adobe Commerce Flaw Exploited After Disclosure
Attackers have begun exploiting a critical vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source that could allow unauthenticated account takeovers and access to sensitive customer data. The flaw, identified as CVE-2026-71362, carries a CVSS score of 9.1 and was publicly disclosed by Adobe in its APSB26-92 security bulletin.
SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit
Attackers have begun exploiting a critical authentication bypass vulnerability in Microsoft SharePoint, designated CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit. The flaw, which carries a CVSS score of 9.1, allows unauthenticated attackers to impersonate any SharePoint user, including administrators.
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability, identified as CVE-2026-55040, according to recent reports. This exploitation campaign began shortly after a proof-of-concept (PoC) exploit for the flaw was publicly released. The vulnerability is described as a security feature bypass, enabling unauthenticated attackers to impersonate legitimate users within…
Ransomware Gangs Exploit SonicWall SMA1000 Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware groups are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 secure remote access gateways. These flaws, identified as CVE-2026-15409 and CVE-2026-15410, include a maximum-severity server-side request forgery (SSRF) vulnerability.
N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist
N-able has issued Hotfix 2 for its N-central platform in response to an actively exploited zero-day vulnerability. The company confirmed that attackers leveraged this flaw to achieve administrative access on managed systems and establish persistence. This activity prompted the release of the hotfix, alongside additional guidance for affected customers.
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
Reports indicate that a sophisticated threat actor, identified as UTA0533, has been actively exploiting two zero-day vulnerabilities within SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. These exploits were reportedly chained together to achieve arbitrary command execution and subsequently gain root access on affected systems. The exploitation occurred prior to the public…
Metasploit Adds Linux Fetch Multi Payload for Architecture Agnostic Exploits
The Metasploit Framework has introduced a new Linux Fetch Multi payload family, designed to simplify exploitation by automatically identifying and delivering the correct architecture-specific payload to a target Linux host. This enhancement means that users no longer need to manually determine a target's architecture when selecting a payload, as a single payload and handler can now serve…
Microsoft SharePoint Server RCE Vulnerability Exploited in the Wild
Microsoft has confirmed active exploitation of a critical remote code execution (RCE) vulnerability, CVE-2026-58644, affecting on-premises deployments of its SharePoint Server. The vulnerability, which stems from the deserialization of untrusted data (CWE-502), allows an unauthenticated attacker to execute arbitrary code with a CVSS v3.1 score of 9.8 (Critical).
Critical Gitea Docker Bug Under Active Exploitation Exposes Repositories and Secrets
Attackers are actively exploiting a critical vulnerability in Gitea's official Docker images, enabling them to bypass authentication and gain access to sensitive repositories and secrets. The flaw, identified as CVE-2026-20896, carries a high severity score of 9.8.
Critical Gitea Flaw Under Active Exploitation, Researchers Warn
A critical security vulnerability in the popular open-source Git service Gitea is currently being actively exploited by attackers, according to security researchers. The flaw, identified as CVE-2026-20896, allows unauthorized individuals to bypass authentication mechanisms and gain access to sensitive data, including private repositories and secrets.
Critical Adobe ColdFusion Vulnerability Exploited in Attacks
Adobe ColdFusion is facing active exploitation due to a critical vulnerability, identified as CVE-2026-48282. This security flaw carries the highest possible CVSS score of 10, indicating a severe risk to systems running the affected software.
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
A new cyberattack campaign has been detected, specifically targeting academic institutions in North America. The perpetrators of this campaign are suspected to be aligned with China and are leveraging security weaknesses in the Roundcube webmail system. The attacks appear to be concentrated on physics and engineering departments within these universities.
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw
A critical vulnerability in Cisco Unified Communications Manager (CUCM) and CUCM Small and Medium Edition (SME) has been actively exploited by attackers less than a day after its public disclosure. The flaw allows for server-side request forgery (SSRF) and enables attackers to escalate their privileges to root access on affected systems.