Our Blog

CISA added three new entries to its Known Exploited Vulnerabilities (KEV) catalog this week: CVE-2026-20349 (Cisco ASA and FTD Heap Inspection DoS), CVE-2026-68820 (Microsoft Windows WinSock AFD.sys Use-After-Free LPE), and CVE-2026-72898 (Metabase Unauthenticated SQL Injection Admin Takeover). These additions emphasize continued adversary focus on perimeter SSL VPN gateways, active kernel-level privilege escalation zero-days utilized by nation-state actors, and unauthenticated zero-day takeovers of business intelligence software holding stored data warehouse credentials. Security operations and infrastructure teams should prioritize immediate validation, emergency patching, and log hunting across these assets.

Reading time 10 minutes

CISA added six new entries to its Known Exploited Vulnerabilities (KEV) catalog this week: CVE-2026-8037 (Progress LoadMaster Command Injection), CVE-2026-63077 (JetBrains TeamCity Deserialization RCE), CVE-2026-18556 and CVE-2026-18577 (N-able N-central Authentication Bypasses), CVE-2026-34486 (Apache Tomcat EncryptInterceptor Bypass), and CVE-2026-9198 (IBM Langflow Unauthenticated Code Injection). These additions highlight heightened adversary targeting of tier-0 management interfaces, remote monitoring platforms (RMM), continuous integration/continuous delivery (CI/CD) pipelines, and AI orchestrators. Organizations operating these services must apply official vendor updates immediately to secure their perimeter and internal supply chains

Reading time 10 minutes

CISA added one new entry to its Known Exploited Vulnerabilities catalog this week: CVE-2026-20316, an actively exploited authentication bypass in Cisco Secure Firewall Management Center (FMC) caused by static credentials. This flaw matters operationally because FMC serves as the central management plane for enterprise firewalls and threat policies, meaning initial access gives attackers visibility into overall network security architectures and potential exploit chaining vectors. Organizations operating Cisco Secure FMC software must apply vendor hotfixes immediately to prevent unauthorized remote access to management interfaces.

Reading time 10 minutes

CISA added eight new vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog during the past seven days, spanning enterprise network orchestrators (Arista VeloCloud Orchestrator), security gateways (Check Point SmartConsole), firewalls & SD-WAN (Fortinet FortiOS), collaboration platforms (Microsoft SharePoint), web publishing platforms (WordPress Core), AI application frameworks (Langflow), and consumer/SOHO networking firmware (DD-WRT). The most significant operational trend is the active exploit chaining targeting web core architectures alongside perimeter authentication bypasses and deserialization vectors. Security, vulnerability management, and infrastructure teams should prioritize internet-facing management consoles, content management instances, and collaboration servers for immediate validation and remediation activity.

Reading time 10 minutes