Daily DefSec Brief

Aug 13, 20264m

1. VMware vCenter path-traversal RCE now APT-exploited — CVE-2026-59310 — SecurityWeek — https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/ 2. Fortinet FortiWeb auth bypass (any-p

Aug 12, 20264m

1. Windows WinSock use-after-free zero-day exploited by Lazarus — CVE-2026-68820 — SecurityWeek — https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/ 2. Cisco ASA/FTD VPN flaw expl

Aug 11, 20265m

1. Gunra ransomware exploits Fortinet and Schneider Electric flaws — joint FBI/CISA/South Korea advisory — CVE-2024-55591, CVE-2025-24472, CVE-2024-5559 (verify) — The Hacker News — https://thehackernews.com/2026/08/gunr

Aug 10, 20264m

1. WordPress supply-chain attack poisons BdThemes plugins via remote API feed — Cyber Security News — https://cybersecuritynews.com/wordpress-supply-chain-attack/ 2. Solidity Pro VS Code extensions steal wallets, tokens,

Aug 7, 20265m

1. SOGo webmail XSS exploited in the wild via malicious calendar invites — CVE-2026-8496 — CERT/CC — https://kb.cert.org/vuls/id/487613 2. INTERRUPT INJECTION / TONTOU bypasses Spectre v2 fixes, leaks Linux password hash

Aug 6, 20264m

1. JetBrains TeamCity deserialization RCE added to CISA KEV — CVE-2026-63077 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. Zbtlink Chinese routers ship a factory backdoor (ENDLESSDOORS) wit

Aug 5, 20265m

1. Langflow unauthenticated RCE now on CISA KEV — CVE-2026-9198 — SecurityWeek — https://www.securityweek.com/cisa-warns-of-exploited-langflow-n-central-and-tomcat-vulnerabilities/ 2. Apache Tomcat EncryptInterceptor byp

Aug 4, 20264m

1. Critical unauthenticated RCEs in Adobe Campaign Classic — CVE-2026-48317, -48323, -48326, -48330, -48331, -48333, -48399 — Cyber Security News — https://cybersecuritynews.com/adobe-campaign-classic-vulnerabilities/ 2.

Aug 3, 20265m

1. N-able N-central auth bypass under active exploitation (incomplete first fix) — CVE-2026-18556, CVE-2026-18577 — The Hacker News — https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html 2. SonicWall

Jul 31, 20264m

1. CISA warns of active attacks locking operators out of water-sector PLCs — CISA — https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-

Jul 30, 20265m

1. Cisco Secure Firewall Management Center hardcoded password added to CISA KEV — CVE-2026-20316 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. Cisco Secure FMC authentication bypass — hot f

Jul 29, 20265m

1. Coordinated OT attack disrupts 30+ Minnesota water utilities — SecurityWeek https://www.securityweek.com/dozens-of-minnesota-water-utilities-targeted-in-coordinated-ot-attacks/ · StateScoop https://statescoop.com/coor

Jul 28, 20263m

1. Arista VeloCloud Orchestrator zero-day exploited, added to CISA KEV — CVE-2026-16812 — SecurityWeek — https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/ 2. Critica

Jul 27, 20263m

1. Fastjson RCE under active exploitation in the Java ecosystem — Risky Business News — https://news.risky.biz/risky-bulletin-a-json-rce-bug-is-about-to-rock-the-java-world/ 2. Ransomware crews mass-exploiting edge VPN/f

Jul 24, 20263m

1. Russian espionage group reads Western mailboxes through zero-click Zimbra flaw — CVE-2025-66376 — CISA — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a 2. Clop exploits critical PTC Windchill/Flex

Jul 23, 20265m

1. Check Point SmartConsole authentication bypass zero-day (active exploitation) — CVE-2026-16232, CVE-2026-50751 — CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog · BleepingComputer: https://www.b

Jul 22, 20264m

1. CISA adds DD-WRT UPnP buffer overflow to KEV — CVE-2021-27137 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. Kratos AiTM phishing-kit infrastructure taken down — The Hacker News — https:/

Jul 21, 20264m

1. Palo Alto GlobalProtect auth-bypass now used in Qilin ransomware attacks — CVE-2026-0257 — BleepingComputer — https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-a

Jul 20, 20263m

1. ServiceNow AI Platform RCE now under active exploitation — CVE-2026-6875 — BleepingComputer — https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/ 2. WP2Shel

Jul 17, 20264m

1. FortiSandbox OS command injection added to CISA KEV, actively exploited — CVE-2026-25089 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. New HTTP/2 flow-control stall DoS — CVE-2019-9511,

Jul 16, 20264m

1. CISA adds actively exploited Oracle E-Business Suite flaw to KEV, feds have until Saturday — CVE-2026-46817 — CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog · BleepingComputer https://www.bleepi

Jul 15, 20264m

1. CISA adds SharePoint and AD FS zero-days to KEV, deadline Friday — CVE-2026-56164, CVE-2026-56155 (also CVE-2026-32201, CVE-2026-45659, CVE-2026-58644, CVE-2026-55040) — CISA KEV https://www.cisa.gov/known-exploited-v

Jul 14, 20265m

1. CISA adds 18-year-old Cisco IOS flaw to KEV catalog — CVE-2008-4128 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. Microsoft maps a year of ShinyHunters-style OAuth abuse against Salesfor

Jul 13, 20264m

1. Progress tells ShareFile customers to shut down Storage Zone Controller servers — CVE-2026-2699, CVE-2026-2701 — SecurityWeek — https://www.securityweek.com/progress-prompts-sharefile-storage-zone-controller-shutdown-

Jul 11, 20268m

1. Langflow authorization bypass on KEV, plus the first fully autonomous LLM-driven ransomware campaign — CVE-2026-55255, CVE-2025-3248 — CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Dark Readi