tag: Active-Exploitation · 109 items
- Engineer — Act: WordPress Core versions 4.7–7.1.3 are under active exploitation at high volume; patch all WordPress instances to 7.1.4 or later immediately, and audit any public-facing WordPress sites for signs of compromise before patching is confirmed complete.
- SOC/IR — Act: The attack volume indicates opportunistic mass scanning; sweep WAF and web server logs for anomalous POST requests to WordPress Core endpoints since the patch release date, and treat any unpatched WordPress hosts as potentially compromised pending investigation.
- Leader — Act: WordPress is one of the most widely deployed platforms in enterprise web estates; confirm this week that all WordPress properties are patched and request a status report from engineering, as active exploitation at this scale raises the likelihood of a successful breach across your organization or supply chain.
- Engineer — Act: Drupal itself has confirmed active exploitation of this critical access bypass in Commerce Core — patch to the fixed version immediately if you run any Drupal e-commerce sites; check for signs of unauthorized access to orders or admin functions.
- SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs or ATT&CK-mappable TTPs; build or tune web-application detections for abnormal access patterns on Drupal Commerce endpoints and review web server logs back to patch disclosure date.
- Leader — Plan: Verify whether Drupal Commerce is in your environment or any third-party vendor’s stack; active exploitation of an e-commerce access-bypass raises customer/payment-data exposure risk that may require notification review if compromise is found.
- Engineer — Act: Active exploitation plus a public GitHub PoC means immediate patching is warranted: upgrade Commerce Core to 3.3.14+ (3.x users) or 2.42+ (2.x users) and audit Commerce order/checkout endpoints for signs of unauthorized access.
- SOC/IR — Act: Active exploitation with a public PoC is in progress — review web application and access logs for anomalous requests to Drupal Commerce endpoints (order management, checkout, admin) dating back at least two weeks and tune WAF rules for authorization-bypass patterns against this module.
- Leader — Plan: Scope is limited to organizations running Drupal-based e-commerce; confirm whether any internal or customer-facing properties use Drupal Commerce Core and verify engineering has patched or has a dated remediation plan.
- Signals: CVE-2026-118539 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CISA confirmation of active exploitation on a max-severity GitLab flaw demands immediate action: identify all self-hosted GitLab instances and patch to the version released earlier this month before your next patch window.
- SOC/IR — Act: With confirmed in-the-wild exploitation, sweep GitLab audit logs and authentication events for anomalous access since the patch release date, and hunt for lateral movement or credential theft originating from GitLab servers.
- Leader — Act: A max-severity, actively exploited flaw in a source-code and CI/CD platform is a supply-chain risk event — confirm this week whether your org runs self-hosted GitLab and verify patching status; if so, brief engineering leadership on exposure.
- Engineer — Act: A confirmed exploitation attempt combined with a public PoC on GitHub is enough to act even with EPSS at 0.18: identify your GitLab version, apply the security patch addressing CVE-2026-97229 immediately, and review instance logs for unauthorized access attempts.
- SOC/IR — Act: Read the full Alpine Linux incident post for any published IOCs or request patterns, then sweep GitLab authentication and API access logs from the incident date forward for anomalous behavior consistent with this CVE’s attack surface.
- Leader — Plan: This does not yet rise to board-level systemic risk, but confirm with engineering that self-hosted or internally managed GitLab instances are patched; if GitLab SaaS hosts sensitive IP or customer data, request a vendor security statement.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Cisco ASA and FTD are common enterprise perimeter devices; the vendor confirms active wild exploitation of this unauthenticated crash bug and a public PoC exists. Patch ASA/FTD software to Cisco’s fixed release immediately — these are your outermost network defenses.
- SOC/IR — Plan: Active exploitation of perimeter VPN appliances warrants a new detection: alert on unexpected ASA/FTD process restarts or abnormal SSL VPN session drops that may signal crash-loop exploitation attempts against your edge devices.
- Leader — Plan: Widely deployed Cisco perimeter firewalls being actively exploited is a material perimeter-risk event; confirm with your engineering team this week that affected ASA/FTD devices are inventoried and patching is scheduled.
- Signals: CVE-2026-76418 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation; patch Linux kernel to the remediated version immediately on any internet-facing or multi-tenant Linux hosts, prioritizing those running PHP-based web applications where the PHP2Shell initial-access vector applies.
- SOC/IR — Act: Active chained exploitation means assume-breach posture on Linux web servers; hunt for PHP web shell artifacts (unusual PHP child process spawning, outbound connections from web server processes) followed by local privilege escalation behavior since the CISA advisory date.
- Leader — Plan: CISA KEV listing signals active exploitation but this is a patch-and-detect operational issue; confirm engineering teams have the Linux kernel patch queued as priority-one this sprint and verify SOC has added detection coverage for the attack chain.
- Engineer — Act: Palo Alto Networks has confirmed active exploitation of PHP2Shell vulnerabilities against internet-exposed management interfaces; immediately restrict management interface access to trusted IPs only and apply the available patches.
- SOC/IR — Act: Active exploitation of PAN-OS management interfaces is confirmed; sweep for unexpected outbound connections or lateral movement from firewall management IPs, and hunt for anomalous sessions in PAN-OS logs since the advisory date.
- Leader — Plan: If your organization runs Palo Alto Networks gear with internet-exposed management interfaces, verify remediation status with your network team and assess whether any appliances may already be compromised before this week closes.
- Engineer — Act: CISA KEV listed, EPSS 0.97, public PoC, and active exploitation since May — patch PeopleSoft to the June release addressing CVE-2026-35273, then audit web and application server logs from May onward for SSRF-to-loopback traffic patterns that indicate exploitation.
- SOC/IR — Act: ShinyHunters exploitation window opens in May, meaning systems may already be compromised — hunt PeopleSoft web logs for anomalous internal management-interface requests since May and sweep for ShinyHunters-associated IOCs in your SIEM using ATT&CK Initial Access/SSRF patterns.
- Leader — Act: PeopleSoft stores HR and financial data; a months-long exploitation window by a breach-and-extortion actor creates material data-exposure risk — confirm whether your organization runs PeopleSoft, assess the May–June breach window, and brief leadership on potential notification obligations before this surfaces in the news.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.97, public PoC on GitHub
- Engineer — Act: Public PoC on GitHub combined with confirmed active probing makes this Act despite low EPSS; apply Oracle’s Critical Patch Update to Oracle E-Business Suite immediately and verify no external exposure of EBS endpoints.
- SOC/IR — Act: Threat actors are already scanning for this RCE; hunt for exploitation attempts against Oracle EBS Application Object Library endpoints dating back to last week’s patch release, and tune WAF/IDS rules for CVE-2026-101767 probe patterns.
- Leader — Plan: Oracle EBS hosts sensitive financial and HR data — confirm whether the organization runs EBS, verify the Critical Patch Update is applied this sprint, and track escalation to Act if CISA KEV listing or confirmed exploitation follows.
- Signals: CVE-2026-101767 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA-confirmed active exploitation of a Brotli compression library flaw affecting Node.js and HTTP/2 stacks; audit all services for affected Brotli versions and apply vendor patches immediately, prioritizing internet-facing Node.js and HTTP/2 endpoints.
- SOC/IR — Act: Active exploitation confirmed by CISA warrants an assume-breach sweep; hunt for anomalous outbound connections and unusual process behavior on hosts running Node.js or Brotli-linked HTTP/2 services since the disclosure date.
- Leader — Plan: CISA confirmation of exploitation in a widely-used library could generate customer or board questions if exposure is significant; confirm engineering has inventoried affected systems and establish a patch-completion timeline to report upward.
- Engineer — Act: CVE-2026-111497 is CISA KEV-listed with EPSS 0.88 and a public PoC — patch Adobe Commerce/Magento to the latest vendor-released version immediately, and audit web server logs for PolyShell indicators and anomalous Brotli-encoded traffic.
- SOC/IR — Act: Hundreds of stores are actively compromised; hunt for PolyShell webshell artifacts and Brotli-encoded C2 traffic in web access logs since KEV listing date, and tune WAF/SIEM rules to flag unusual POST patterns on Commerce endpoints.
- Leader — Plan: If your org runs Adobe Commerce or Magento storefronts — or relies on a third-party e-commerce vendor that does — confirm patching status and request a written attestation; breach of payment pages may trigger PCI DSS incident-notification obligations.
- Signals: CVE-2026-111497 — CISA KEV: listed, EPSS 0.88, public PoC on GitHub
- Engineer — Act: Both CVEs carry EPSS 1.00 with public PoCs and confirmed in-the-wild exploitation; patch any PHP2Shell-dependent installations immediately and audit web server logs for indicators of post-exploitation activity such as newly written shells.
- SOC/IR — Act: Public PoCs and confirmed exploitation mean attack tooling is freely available; hunt for exploitation attempts against PHP2Shell endpoints and sweep for web shell artifacts or unexpected outbound connections since the PoC release date.
- Leader — Act: EPSS 1.00 plus confirmed exploitation warrants same-week action — confirm whether your organization runs PHP2Shell or any software dependent on it, and verify engineering has this on emergency patching priority.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active mass exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) with public PoCs on GitHub make patching urgent even though current attacks are reportedly unsuccessful; apply PHP patches for both CVEs now and confirm no internet-facing PHP instances remain on vulnerable versions.
- SOC/IR — Act: Millions of in-progress exploit attempts against PHP deployments attempting to install the Potassium Mirai variant provide a clear detection surface; hunt for HTTP request patterns matching known PHP2Shell exploitation attempts and sweep for Mirai/Potassium C2 beaconing from PHP server hosts since campaign start.
- Leader — Plan: A mass-scale campaign against widely deployed PHP infrastructure warrants confirming internal PHP exposure this quarter; exploitation is currently failing and neither CVE is KEV-listed, so no board brief is needed yet, but track for escalation if successful compromises are confirmed.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Act: CISA confirmation of active exploitation chains across four Plex Media Server vulnerabilities makes this urgent for any team hosting Plex. Patch Plex Media Server to the latest available version immediately and audit exposed instances for signs of compromise.
- SOC/IR — Plan: Active exploitation is confirmed but the summary lacks published IOCs or ATT&CK-mapped TTPs to hunt with now. Inventory any Plex Media Server instances in your estate and plan a sweep for post-compromise indicators (unexpected outbound connections, new scheduled tasks) once public technical analysis emerges.
- Leader — Skip
- Engineer — Act: Working exploits are in use against a pair of PHP flaws enabling full server takeover, affecting the majority of PHP deployments. Patch PHP to the latest stable release immediately and verify no web shells or unauthorized processes exist on PHP-backed servers.
- SOC/IR — Act: Active in-the-wild exploitation of a widespread PHP RCE means assume-breach posture is warranted for any PHP-backed systems. Hunt for anomalous child processes spawned from web server processes and audit PHP server logs for signs of exploitation since today.
- Leader — Act: A pair of actively exploited PHP flaws affecting roughly 70% of websites is a systemic event likely to generate board and customer questions. Confirm whether company-operated PHP properties and key SaaS vendors are exposed, and be prepared to brief leadership this week.
- Engineer — Act: PAN-OS is a common enterprise perimeter device; CISA KEV listing, EPSS 0.97, public PoC, and active ransomware exploitation all demand immediate action — patch PAN-OS to the vendor-specified fixed version now, and audit firewall management interfaces for signs of compromise before patching.
- SOC/IR — Act: Edge device exploitation by Qilin/Inc ransomware operators means assume-breach posture is warranted — sweep for IOCs published in the Unit 42 advisory, hunt for lateral movement or data staging activity originating from PAN-OS management plane since October 19, and tune EDR/SIEM for post-exploitation TTPs associated with these ransomware groups.
- Leader — Act: Active ransomware exploitation of a widely deployed enterprise firewall platform is a board-question-level event — confirm this week whether PAN-OS is in your estate, verify IR team is on heightened alert, and prepare a brief for leadership given the ransomware operators named are known for extortion and data theft.
- Signals: CVE-2026-0257 — CISA KEV: listed, EPSS 0.97, public PoC on GitHub
- Engineer — Act: Active exploitation of an OS command injection flaw in SiteGuard Server Edition grants full system access; if you run this WAF, apply the vendor patch immediately or isolate the appliance until patched.
- SOC/IR — Plan: Active exploitation is confirmed but the summary lacks published IOCs or ATT&CK-mapped TTPs; build a detection for anomalous process spawning from the SiteGuard service account and queue a hunt across any SiteGuard hosts in your estate.
- Leader — Skip
- Engineer — Act: Active exploitation of CVE-2026-110447 in the richdocumentscode Nextcloud app with a public PoC means any self-hosted Nextcloud instance running the built-in CODE Server is at immediate risk of RCE and backdoor implantation; patch the richdocumentscode app to the latest fixed version now and audit server filesystem and process history for signs of post-exploitation activity.
- SOC/IR — Act: With confirmed active exploitation leading to backdoor deployment, assume any Nextcloud server running richdocumentscode may already be compromised; sweep Nextcloud hosts for anomalous child processes from the CODE Server, unexpected outbound connections, and persistence mechanisms (cron, systemd units, webshells) established since this CVE’s disclosure window.
- Leader — Skip
- Signals: CVE-2026-110447 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation confirmed with web shells planted on Nextcloud servers since at least September 10. If you run Nextcloud with the Collabora Online Built-in CODE Server app, audit for web shell files in the web root and disable or patch the plugin immediately.
- SOC/IR — Act: Confirmed active exploitation with web shell deployment provides a concrete hunt target — sweep Nextcloud server logs for anomalous command execution spawned by the web server process dating back to September 10, and look for unauthorized files in Nextcloud’s web-accessible directories.
- Leader — Plan: Active backdooring of Nextcloud deployments via an optional collaboration plugin is a real risk if the organization runs self-hosted Nextcloud — confirm with engineering whether this plugin is in use and that incident response is underway; not yet a board-level event.
- Engineer — Act: Active exploitation plus a public PoC on GitHub means any WordPress instance running Bricksforge is at immediate risk; update the plugin to the patched version now or disable it entirely while you assess impact.
- SOC/IR — Act: Assume-breach sweep is warranted for any WordPress infrastructure: hunt for newly written PHP files under wp-content/plugins/bricksforge/, review web server logs for unauthenticated POST requests to plugin endpoints, and search EDR/SIEM for web shell execution patterns since the PoC dropped.
- Leader — Skip
- Signals: CVE-2026-85097 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CVE-2015-3306 (ProFTPD, CVSS 10.0) carries EPSS 0.98, a public GitHub PoC, and active exploitation by a Chinese nation-state actor — patch ProFTPD immediately and audit all five KEV-listed CVEs before the October 11 federal deadline.
- SOC/IR — Act: Flax Typhoon is conducting live exploitation of these edge-service flaws; initiate a threat hunt for Flax Typhoon TTPs and sweep logs for ProFTPD anomalies (suspicious anonymous access, lateral movement from FTP services) since at least early October.
- Leader — Act: A Chinese nation-state actor is actively exploiting these vulnerabilities under a binding CISA directive with an October 11 deadline — confirm whether ProFTPD or the other four affected products are present in your environment and brief leadership given the geopolitical attribution and imminent compliance requirement.
- Signals: CVE-2015-3306 — CISA KEV: listed, EPSS 0.98, public PoC on GitHub
- Engineer — Act: Active exploitation of AhsayCBS is confirmed with web shell and XMRig miner deployment, and a public PoC is available on GitHub. Patch AhsayCBS immediately and audit any instances for web shell artifacts and unauthorized processes on affected hosts.
- SOC/IR — Act: Attackers are actively deploying web shells and XMRig miners disguised as Microsoft Edge on compromised AhsayCBS hosts — hunt for msedge.exe processes running from unexpected directories and sweep backup server hosts for web shell indicators since the public PoC dropped.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: FortiGate firewalls and SSL VPN gateways are common enterprise edge devices; an active FBI-warned campaign locking out admins signals credential theft or config tampering at scale. Audit all FortiGate admin accounts for unauthorized additions or password changes, verify firmware is at latest patched version, and review admin-access logs from at least the past 30 days.
- SOC/IR — Act: Admin lockout is a concrete post-exploitation TTP indicating attackers have achieved privileged access to edge devices before defenders can respond. Hunt for unauthorized admin account creation or privilege changes on FortiGate devices since October 2026, and initiate assume-breach review of any network segments fronted by affected appliances.
- Leader — Act: An FBI advisory on a named, ongoing campaign against a widely-deployed enterprise VPN product warrants immediate internal exposure check. Confirm whether your environment runs FortiGate, get a status report from the network team this week, and be prepared to brief leadership on containment posture if exposure is confirmed.
- Engineer — Act: Active exploitation of stored XSS in Ninja Forms and WPC Product Bundles for WooCommerce is resulting in backdoor installation and rogue admin account creation — update both plugins to their latest patched versions immediately and audit existing WordPress admin accounts for unauthorized entries.
- SOC/IR — Act: Active exploitation with post-compromise persistence (backdoors and rogue admins) means assume-breach review is warranted; sweep WordPress admin user tables for accounts created after plugin install dates and hunt for unexpected file modifications in plugin directories.
- Leader — Skip
- Engineer — Act: Public PoC on GitHub plus confirmed exploitation attempts within hours of disclosure make this urgent despite low EPSS. Patch Atlassian Bitbucket, Confluence, Jira Software, and Jira Service Management Data Center instances to vendor-released fixed versions immediately.
- SOC/IR — Act: Active exploitation is underway; hunt for anomalous file-read requests and path traversal patterns against Atlassian Data Center endpoints in web and application logs since the disclosure date, and assume any internet-exposed instance may already be targeted.
- Leader — Plan: Active exploitation of a CVSS 9.3 flaw is underway, but this is not yet a named systemic event; if your org runs Atlassian Data Center (on-prem, not Cloud), direct engineering to prioritize the patch this week and confirm exposure before it escalates to a board-level incident.
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Pre-authentication exploitation with a public PoC and multi-source confirmation of active attacks makes this urgent despite low EPSS. Patch Jira, Confluence, and Bitbucket to the fixed versions immediately; if patching cannot happen within 24-48 hours, isolate or firewall these services from untrusted networks.
- SOC/IR — Act: Active exploitation of unauthenticated Atlassian access means assume-breach posture on any exposed instance. Hunt for anomalous API calls and unauthenticated sessions against Atlassian services since the PoC publication date, and alert on inbound requests matching known exploit patterns.
- Leader — Act: Atlassian tools typically house source code, project roadmaps, and credentials — a pre-auth compromise is a data-exposure risk worth escalating. Confirm whether Jira, Confluence, or Bitbucket instances are internet-facing and verify with engineering that patching is underway this week.
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: NetScaler ADC/Gateway is actively exploited for root access across multiple enterprise sectors per Mandiant and Google GTIG — patch to the latest released version immediately and audit appliance integrity for WHIPSHOT/SLAPSHOT indicators before treating the host as clean.
- SOC/IR — Act: Active exploitation of a perimeter NetScaler appliance to achieve root access warrants an assume-breach sweep — hunt for WHIPSHOT and SLAPSHOT artifacts on any NetScaler in the estate and review outbound connections from those devices since early September 2026.
- Leader — Plan: Broad targeting across government, finance, technology, education, and legal sectors in North America and Europe elevates organizational exposure if NetScaler is in the stack — confirm with the engineering team that patching is prioritized and ask for a written exposure assessment this week.
- Engineer — Act: CVE-2026-86950 is CISA KEV-listed with active exploitation and a public PoC; update all iOS 26 and macOS 26/15 devices to Apple’s latest patched release immediately — iOS/macOS 27 branches are unaffected.
- SOC/IR — Act: Active exploitation of a CISA KEV-listed Apple vulnerability means you should assume some corporate macOS/iOS devices may already be compromised; hunt for anomalous activity on unpatched macOS 15/26 and iOS 26 endpoints since at least the patch release date of 2026-09-28.
- Leader — Act: Active exploitation of corporate Apple devices (macOS 15/26, iOS 26) with a CISA KEV listing warrants confirming this week that MDM-managed endpoints are receiving the emergency update and verifying coverage for any unmanaged devices.
- Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed in-the-wild exploitation; CVE-2026-88772 achieves unauthenticated root access on NetScaler ADC/Gateway. Apply Citrix’s latest patches immediately, then audit NetScaler systems for WHIPSHOT PHP web shells and anomalous SLAPSHOT-style proxy traffic in access logs.
- SOC/IR — Act: Exploitation deploys custom tooling — WHIPSHOT (PHP web shell masking C2 in HTTP headers) and SLAPSHOT (Python proxy tunneler for internal recon and credential theft) — giving concrete hunt targets. Sweep NetScaler appliances for unexpected PHP files and unusual outbound proxy sessions, and hunt for lateral movement or credential-access activity originating from NetScaler hosts since early September 2026.
- Leader — Act: An active, multi-sector campaign (government, finance, legal, education in North America and Europe) exploiting edge appliances via authentication-bypass zero-days is a board-question-level event. Confirm whether Citrix NetScaler is in your environment or a key vendor’s, request Citrix incident status attestation, and brief leadership before this surfaces in the news.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA emergency directive implies KEV listing with active exploitation of these NetScaler flaws — patch Citrix NetScaler to the vendor-specified remediated version immediately; Wednesday federal deadline signals urgency applicable beyond government.
- SOC/IR — Act: Active exploitation of NetScaler edge appliances warrants an assume-breach sweep — hunt for post-exploitation activity (credential harvesting, lateral movement) originating from NetScaler nodes and check for anomalous sessions since the vulnerability window opened.
- Leader — Act: Confirm whether the organization runs Citrix NetScaler and verify the engineering team has patching underway; CISA emergency directives on widely-deployed edge appliances frequently generate customer and board inquiries, so brief leadership proactively.
- Engineer — Act: CVE-2026-35273 is CISA KEV-listed with active exploitation; WAF-based mitigations are being circumvented via URL-encoding tricks, so apply Oracle’s vendor patch directly rather than relying on WAF rules — do not treat a WAF rule as a substitute for patching.
- SOC/IR — Act: ShinyHunters is actively exploiting internet-facing PeopleSoft instances; hunt for URL-encoding anomalies in WAF and web server logs, sweep PeopleSoft access logs since KEV listing date for exploitation indicators, and flag any PeopleSoft-exposed assets for assume-breach review.
- Leader — Act: ShinyHunters is an extortion actor now actively compromising PeopleSoft (an HR/ERP system often holding sensitive employee and financial data); confirm whether your org runs PeopleSoft, verify patch status with the responsible team, and brief leadership on extortion exposure before this surfaces in the news.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-35273 is CISA KEV-listed with active mass exploitation and a public PoC; WAF rules blocking /PSEMHUB/ are bypassed by the URL-encoded path /%50SEMHUB/, meaning appliances that appeared mitigated may still be exposed — patch PeopleSoft immediately, update WAF rules to match post-decode paths, and audit PSEMHUB access logs for web shell drops going back to June 2026.
- SOC/IR — Act: UNC6240 is deploying web shells at scale across healthcare, government, tech, and other sectors; hunt web server logs for requests to /%50SEMHUB/ or other URL-encoded variants of the PSEMHUB path, sweep PeopleSoft systems for new or modified files consistent with web shell staging, and treat any PeopleSoft exposure prior to patching as assume-breach.
- Leader — Act: Named threat actor is conducting cross-sector mass exploitation with a bypass that defeats the most common mitigation; if your organization runs Oracle PeopleSoft, confirm exposure status with your engineering team this week, assess whether the June–September window created undetected compromise, and brief leadership given the breadth of affected sectors including healthcare and government.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-35273 (CVSS 9.8, unauthenticated RCE) is CISA KEV-listed with a public GitHub PoC and confirmed mass exploitation; patch Oracle PeopleSoft immediately and audit web-accessible directories for newly created web shells.
- SOC/IR — Act: ShinyHunters-linked actors are actively deploying web shells post-exploitation, indicating persistent footholds; sweep PeopleSoft-adjacent hosts for web shell artifacts and hunt for anomalous outbound connections from PeopleSoft servers since this campaign began.
- Leader — Act: A mass global campaign by a known data-exfiltration actor targeting PeopleSoft — widely used for HR and ERP — warrants same-week action; confirm whether PeopleSoft is in your environment, verify patch status with engineering, and prepare a brief for leadership given ShinyHunters’ history of large-scale data theft.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing plus public GitHub PoC confirm active exploitation of CVE-2026-5430 (WSO2 auth bypass); patch all affected WSO2 products immediately and audit authentication logs for anomalous bypass activity since PoC is publicly available.
- SOC/IR — Act: Active exploitation confirmed via CISA KEV across WSO2, SharePoint, and Adobe Commerce; hunt for authentication bypass patterns in logs for these platforms and sweep for any anomalous sessions or privilege escalations tied to these products since the PoC went public.
- Leader — Act: CISA-confirmed active exploitation of multiple widely-deployed enterprise platforms (SharePoint, WSO2, Adobe Commerce) warrants an immediate internal exposure check; confirm which products are in the estate and ensure patching teams treat these as P1 this week.
- Signals: CVE-2026-5430 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation confirmed by a national cyber security authority plus a public PoC on GitHub makes this urgent despite low EPSS; patch Roundcube to 1.6.16 (1.6.x branch) or 1.7.1 (1.7.x branch) immediately on any self-hosted instance.
- SOC/IR — Act: Pre-auth exploitation means no valid credentials needed, so assume-breach posture for any environment running Roundcube; sweep Roundcube database and web logs for anomalous virtuser_query parameter patterns dating back to when the PoC became public, and hunt for post-exploitation activity such as unexpected outbound connections from the webmail host.
- Leader — Plan: Confirm whether self-hosted Roundcube is in use across internal systems or managed-service dependencies; if so, escalate to engineering for same-week patching given active exploitation of this webmail attack surface, which could expose sensitive communications or credentials.
- Signals: CVE-2026-48842 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE in WordPress (CVSS 9.2) is being actively exploited with a public PoC; patch WordPress core to the latest fixed release immediately and audit any internet-exposed WordPress instances for signs of compromise via local file inclusion.
- SOC/IR — Act: Active exploitation is underway — hunt for anomalous unauthenticated requests to WordPress endpoints involving path traversal or unexpected PHP file inclusion patterns, and baseline your web access logs against activity starting at the hour of CVE disclosure.
- Leader — Plan: Not yet a board-level event (no KEV, low EPSS), but WordPress’s ubiquity makes this a priority for this quarter — confirm engineering has inventoried and is patching all WordPress deployments before this escalates to KEV status.
- Signals: CVE-2026-87902 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation confirmed — attackers are writing PHP webshells to disk via CVE-2026-87902; patch WordPress immediately and audit wp-content directories and recently modified PHP files for unauthorized shells.
- SOC/IR — Act: Assume-breach posture for any WordPress hosts; hunt for newly created or modified PHP files in web roots, anomalous HTTP requests reaching previously non-existent paths, and OS command execution spawning from web server processes.
- Leader — Plan: Confirm whether the organization runs WordPress and direct engineering to prioritize patching this quarter; active exploitation is under way but this has not yet reached Log4Shell-scale board visibility.
- Signals: CVE-2026-87902 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Patch Roundcube Webmail to the version released in May or later immediately — active exploitation confirmed by a national cyber authority means this is no longer a routine patch-window item; prioritize any self-hosted Roundcube instances over other queued work.
- SOC/IR — Act: Sweep Roundcube server logs for signs of code injection attempts since May; active exploitation of a webmail platform can yield credential access or persistent footholds before patching occurs, so assume-breach investigation is warranted on any unpatched instances.
- Leader — Skip
- Engineer — Act: Actively exploited CVSS 10.0 with a public PoC — if you run on-premises VeloCloud Orchestrator with certificate-based Edge authentication, apply Arista’s patch or available mitigations immediately and isolate the VCO management plane from untrusted networks while patching.
- SOC/IR — Act: Active exploitation of a network management appliance means you should assume potential compromise on affected systems; sweep VCO host logs for anomalous internal function invocations or unexpected outbound connections since September 22 and flag any certificate-authenticated VCO instances for immediate IR triage.
- Leader — Plan: Confirm with engineering whether the organization runs on-premises VeloCloud Orchestrator with certificate-based authentication; if so, escalate to engineering for priority patching this week given active exploitation of a maximum-severity flaw in a network control-plane component.
- Signals: CVE-2026-93952 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CISA confirmation of active exploitation is effectively a KEV signal — pull the advisory for CVE IDs and patch Linux kernels on all cloud hosts, container nodes, and CI runners to fixed versions immediately; one flaw is rated critical.
- SOC/IR — Act: Active exploitation confirmed by CISA warrants an assume-breach posture on Linux servers — sweep for anomalous kernel-level activity and privilege escalation events since the advisory date, and tune EDR/auditd rules for kernel exploit post-exploitation behavior while patching proceeds.
- Leader — Plan: Confirm your engineering team has triaged and prioritized the CISA-flagged CVEs; organizations under FedRAMP or federal contracts face mandatory KEV remediation deadlines and should verify compliance timelines are met.
- Engineer — Act: Actively exploited pre-auth RCE with a public PoC on GitHub overrides the low EPSS; patch Orkes Conductor to 3.30.2 or later immediately if running any version before that.
- SOC/IR — Act: Active exploitation confirmed by Fortinet means assume-breach posture for any environment running Orkes Conductor — sweep for anomalous process spawns from the Conductor service and pull Fortinet’s report for available IOCs to hunt against SIEM data.
- Leader — Plan: Verify whether Orkes Conductor is in your tech stack; if confirmed, escalate to engineering as urgent given active exploitation of a 9.8 CVSS pre-auth RCE — this is not yet a board-level systemic event unless your org is exposed.
- Signals: CVE-2026-58138 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
- Engineer — Act: All three CVEs are CISA KEV-listed with confirmed active exploitation; CVE-2025-39682 carries CVSS 9.8 with a public GitHub PoC. Apply available Linux kernel patches immediately across all hosts, prioritizing internet-facing or TLS-terminating systems.
- SOC/IR — Act: Active exploitation is confirmed by CISA KEV for kernel-level flaws — assume-breach posture is warranted on Linux hosts. Run an EDR sweep for unusual kernel module loads, privilege escalations, or post-exploitation behavior on Linux systems since the date of first exploitation disclosure.
- Leader — Plan: Three actively exploited Linux kernel CVEs including a CVSS 9.8 flaw warrant confirming your team’s patch response this week; direct engineering to validate patch status across Linux infrastructure and report back before the next leadership sync.
- Signals: CVE-2025-39682 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation of an unauthenticated OS command execution flaw (CVSS 9.8) in Issabel PBX — if you run Issabel, patch immediately or isolate the management interface from public network access and audit for indicators of prior compromise.
- SOC/IR — Act: Active exploitation reported; hunt for anomalous command execution or outbound connections from Issabel/PBX systems since this vulnerability became public, and check whether any internet-exposed PBX management interfaces exist in the estate.
- Leader — Skip
- Signals: CVE-2026-89026 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Cisco ISE is a common enterprise NAC/identity platform; max severity plus confirmed active exploitation demands immediate patching — apply Cisco’s released security update to all ISE nodes now and verify no unauthorized admin sessions exist.
- SOC/IR — Act: Compromise of ISE could yield network access bypass or credential theft; hunt for anomalous authentication events, unexpected admin logins, and unusual policy changes in ISE audit logs since the vulnerability window opened.
- Leader — Act: Cisco ISE is widely deployed for network access control; confirm whether your organization runs it and direct teams to emergency-patch this week — active exploitation of identity infrastructure at max severity is a likely board or customer question.
- Engineer — Act: A critical ScreenConnect vulnerability is under active exploitation with CISA issuing a warning — patch ConnectWise ScreenConnect to the latest patched version immediately, or isolate/disable instances until patching is complete.
- SOC/IR — Act: Active exploitation of a remote access tool is a priority assume-breach scenario; hunt for anomalous ScreenConnect sessions, unexpected remote access activity, and lateral movement originating from ScreenConnect processes since the disclosure date.
- Leader — Act: Confirm whether ScreenConnect is in use across your environment (including MSP vendors who may use it to manage your systems) and verify emergency patching is underway; active exploitation of remote access tools frequently precedes ransomware deployment.
- Engineer — Act: Active mass-scanning campaign targeting internet-exposed Vite dev servers to exfiltrate AWS/Azure credentials and infrastructure state files; audit for any Vite dev servers reachable from the internet, restrict network access immediately, and rotate cloud credentials for any instances that may have been exposed.
- SOC/IR — Plan: No specific IOCs surfaced in available reporting, but this active campaign warrants building detections for anomalous AWS/Azure API calls (unusual regions, new IAM key usage, credential enumeration) that could indicate stolen dev-server credentials being leveraged.
- Leader — Plan: Cloud credential theft from exposed dev tooling can cascade into full infrastructure compromise; confirm with engineering that no Vite dev servers are internet-facing and that credential rotation procedures cover this scenario before it becomes a material incident.
- Engineer — Act: Active exploitation of a critical file-upload flaw is in progress; if you run WooCommerce Wholesale Lead Capture, update or disable it immediately and audit wp-content for recently created PHP files that could be backdoors.
- SOC/IR — Act: PHP backdoor upload attacks against WordPress sites are active; hunt for anomalous PHP files in wp-content/uploads and similar directories, and review web logs for suspicious POST requests to this plugin’s endpoints since the campaign began.
- Leader — Skip
- Engineer — Act: All five CVEs are KEV-listed with confirmed active exploitation; a public PoC exists for CVE-2026-42016 (CVSS 8.1). Audit your estate for JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS and apply vendor patches immediately — these are common CI/CD, remote-access, and network infrastructure components.
- SOC/IR — Act: Active exploitation of ScreenConnect (remote access) and Artifactory (build pipeline) creates high-value footholds; initiate assume-breach sweeps by reviewing ScreenConnect session logs and Artifactory access logs for unauthorized activity since the KEV listing date, and tune detections for anomalous authentication or file-access patterns on these systems.
- Leader — Plan: Confirm with engineering this week whether Artifactory, ScreenConnect, or RouterOS are deployed and verify an expedited patch cycle is underway; KEV listing raises the risk register for these assets but does not yet constitute a systemic breach event requiring board or customer notification.
- Signals: CVE-2026-42016 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation of critical/high Artifactory flaws on self-hosted instances leads to admin takeover and Rust backdoor installation — patch your Artifactory deployment immediately and audit build infrastructure for signs of backdoor presence.
- SOC/IR — Act: Attackers are actively backdooring self-hosted Artifactory servers; hunt for anomalous admin-level activity and unexpected outbound connections from your Artifactory hosts, and sweep build pipeline logs for signs of unauthorized access dating back to when flaws became public.
- Leader — Act: Compromised Artifactory servers sit at the heart of software supply chains — if your organization runs self-hosted Artifactory, treat this as a potential supply-chain incident: confirm patch status with your engineering team this week and assess whether any built artifacts could have been tampered with.
- Engineer — Act: Two actively exploited flaws in PaperCut NG/MF now have proper maintenance releases; patch to version 26.0.5, 25.0.13, or 24.1.10 depending on your supported branch — emergency patches are superseded and these are the authoritative fixes.
- SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs, TTPs, or detection signatures; plan to review PaperCut server logs and vendor advisory for exploitation indicators, and prepare a hunt query for abnormal print-server outbound connections once technical details surface.
- Leader — Plan: Active exploitation of widely deployed print-management software warrants confirming whether PaperCut is in your environment and ensuring the engineering team prioritizes patching this quarter; not a board-level systemic event but relevant if PaperCut is part of your estate.
- Engineer — Act: Active exploitation of self-hosted Artifactory was confirmed Aug 15–Sep 8; verify your instance is fully patched for both chained flaws, and if it was unpatched during that window, audit all artifacts built or stored then for injected backdoors.
- SOC/IR — Act: If your org runs self-hosted Artifactory that was unpatched between Aug 15 and Sep 8, initiate an assume-breach sweep of that server and downstream build artifacts for backdoor indicators, and look for lateral movement originating from it.
- Leader — Act: Confirmed supply-chain attack against self-hosted Artifactory during Aug 15–Sep 8; determine this week whether your organization runs self-hosted Artifactory, confirm patch status during that window, and escalate to incident review if exposure existed given the backdoor-planting risk to your software pipeline.
- Engineer — Act: PaperCut NG/MF is being actively exploited at scale with hundreds of organizations confirmed compromised; patch PaperCut to the latest version immediately and audit server logs for exploitation indicators of compromise.
- SOC/IR — Act: This is an active, wide campaign — hunt for post-exploitation behavior on PaperCut servers (unusual process spawns, outbound connections from the print server) and expand scope to look for lateral movement from any PaperCut host since the campaign’s start date.
- Leader — Act: With 395 confirmed victims and a suspected nation-state-adjacent actor, confirm whether PaperCut NG/MF is in your environment, demand a patching and compromise-assessment status from engineering, and prepare a brief for leadership given the likelihood of press and customer questions.
- Engineer — Act: Active exploitation of recently disclosed PaperCut NG/MF flaws at scale — patch PaperCut to the latest version immediately and audit instances for IOC 45.142.193[.]132 in access logs.
- SOC/IR — Act: Multi-source-corroborated (Blackpoint Cyber + GreyNoise) campaign with a concrete IOC: sweep for 45.142.193[.]132 across network and proxy logs, and run an assume-breach hunt on any PaperCut NG/MF hosts in your estate.
- Leader — Act: 440+ compromised PaperCut instances attributed to a Russian-speaking actor is board-relevant scale — confirm whether PaperCut NG/MF is in your environment and verify patching status before this surfaces in news cycles.
- Engineer — Act: CVE-2026-20079 carries a CVSS 10.0, is KEV-listed, has a public PoC, and EPSS 0.75 — all three signal immediate exploitation pressure on Cisco, Citrix, and Fortinet devices common in enterprise perimeters; patch all three affected products to vendor-specified fixed versions before September 12.
- SOC/IR — Act: Active exploitation of edge appliances from all three vendors means assume-breach posture is warranted — hunt for anomalous authentication events and lateral movement originating from Cisco, Citrix, and Fortinet devices since before today’s disclosure, and sweep for any available IOCs tied to these CVEs.
- Leader — Act: Three critical-severity, actively exploited flaws across widely deployed network vendors represent a systemic perimeter risk; confirm your team has prioritized patching all affected Cisco, Citrix, and Fortinet products before the Sept 12 deadline, and verify no prior compromise occurred on exposed appliances.
- Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.75, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Actively exploited Chrome zero-day warrants immediate action — force-update Chrome across all managed endpoints and verify enterprise Chrome update policies are not lagging behind the patched release.
- SOC/IR — Learn: No IOCs, TTPs, or exploit specifics are available in the summary to build detections around; monitor threat intel feeds for follow-on analysis that may surface behavioral indicators of exploitation.
- Leader — Skip
- Engineer — Act: All Magento and Adobe Commerce versions are affected and actively exploited to plant a Linux backdoor — patch to Adobe’s latest released fix immediately and audit web server processes and file systems for signs of backdoor installation.
- SOC/IR — Act: Active exploitation is deploying Linux backdoors on Magento hosts; hunt for unexpected processes, outbound connections, or new files spawned from web server contexts in Magento environments since the vulnerability became public.
- Leader — Act: Active exploitation of an all-versions Magento/Adobe Commerce flaw with backdoor deployment has direct PCI and breach-notification implications — confirm whether your org or key e-commerce vendors run Magento and verify patching and compromise-assessment status before customers or auditors ask.
- Engineer — Act: CVE-2026-75650 is actively exploited with a public PoC and an emergency patch available; if you run Magento or Adobe Commerce, update to the patched version immediately and audit server filesystems and web roots for backdoor artifacts.
- SOC/IR — Act: Active server backdooring via StyleSmuggler means assume-breach posture for any Magento/Adobe Commerce hosts; hunt for unauthorized web shells or modified files in Commerce directories and check for outbound C2 behavior since the vulnerability was first disclosed.
- Leader — Plan: If your organization runs Magento or Adobe Commerce for e-commerce, confirm with engineering that the emergency patch has been applied and ask whether any servers showed indicators of compromise — active exploitation with backdoor capability could create customer-data exposure requiring disclosure review.
- Signals: CVE-2026-75650 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Unauthenticated RCE on an RMM platform with a credible (if contradictory) exploitation-in-the-wild claim — highest-priority patch category. Upgrade every on-premises N-central instance to 2026.3.1.14 (Hotfix 4) immediately; servers patched to Hotfix 3 yesterday are still vulnerable.
- SOC/IR — Act: Compromised RMM infrastructure gives attackers admin reach across all managed endpoints — an assume-breach posture is warranted. Hunt for anomalous outbound connections or command execution originating from N-central servers since the Hotfix 3 deployment date, and monitor for lateral movement from MSP-managed jump hosts.
- Leader — Act: If your organization uses an MSP that runs N-central, contact them this week to confirm Hotfix 4 is applied and request evidence of no compromise; RMM breaches are a proven ransomware delivery path. The conflicting exploitation signals from N-able’s own communications (incident notice vs. release notes) also warrant asking for a formal vendor statement.
- Engineer — Act: Patch all MikroTik devices to the latest release immediately, then audit every device for unauthorized accounts added by attackers as a persistence mechanism — patching alone will not evict existing backdoors.
- SOC/IR — Act: Sweep MikroTik devices for newly created accounts and anomalous SSH sessions prior to patch date; adopt an assume-breach posture and hunt for lateral movement originating from edge devices that may already be implanted.
- Leader — Act: Confirm this week whether MikroTik routers are in your environment; if so, direct teams to treat affected devices as potentially compromised, since attackers are pre-installing persistence before patches are applied — this is not a routine patch cycle.
- Engineer — Act: Active exploitation of a chained vulnerability pair targeting MikroTik RouterOS devices with SSH exposed to the internet; patch RouterOS to the latest stable release immediately and restrict SSH access to trusted management IPs via firewall rules.
- SOC/IR — Act: Router hijacking via exposed SSH is an assume-breach scenario for any MikroTik devices in the estate; sweep SSH auth logs on edge devices for anomalous logins, and hunt for lateral movement originating from RouterOS management interfaces since disclosure.
- Leader — Plan: Actively exploited edge-device flaws can expose the entire network perimeter; confirm whether MikroTik equipment is present in the environment and verify the engineering team has a patch plan for exposed devices this week.
- Engineer — Act: Active exploitation of internet-exposed MikroTik SSH granting full admin access is confirmed by CERT Polska; immediately audit all MikroTik devices for internet-reachable SSH, restrict SSH to management-only networks, and review recent device configurations for unauthorized changes since September 2.
- SOC/IR — Act: Edge device full-takeover with confirmed active exploitation since at least September 2 is an assume-breach signal; sweep MikroTik routers for unauthorized admin sessions and configuration changes, and check for anomalous outbound traffic from these devices as a lateral-movement indicator.
- Leader — Plan: MikroTik is common in SMB and branch-office environments; direct the security team to inventory internet-facing MikroTik SSH exposure and confirm whether any devices were reachable since September 2 — not yet a systemic board-level event but escalate if exposure is confirmed.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation chaining an auth bypass into RCE. Identify your PaperCut version immediately and patch to the vendor-specified fixed release; treat as critical given the exploitation chain severity.
- SOC/IR — Act: An active credential-theft campaign is exploiting PaperCut installations, with command execution and reconnaissance observed. Hunt for post-authentication anomalies in PaperCut server logs and sweep for Arctic Wolf’s published IOCs dating back to the initial disclosure window.
- Leader — Plan: Verify whether PaperCut is deployed anywhere in your estate and confirm engineering is treating remediation as priority given CISA KEV listings and active credential harvesting; education-sector orgs face the highest exposure.
- Signals: CVE-2026-81578 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub · CVE-2026-82078 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: NetScaler is a widely deployed internet-facing edge appliance; a public PoC plus reported active exploitation makes patching urgent even absent a KEV listing — apply Citrix’s fix for CVE-2026-19490 immediately and audit NetScaler access logs for anomalous sessions since the PoC was published.
- SOC/IR — Act: Auth bypass on an edge device in active exploitation is assume-breach territory — sweep NetScaler access logs for unauthorized session establishment and anomalous management-plane activity dating back to when the public PoC dropped, and tune detections for post-auth lateral movement from NetScaler source IPs.
- Leader — Plan: Exploitation is reported by a single vendor source and EPSS remains low; confirm engineering has NetScaler patching on this week’s priority list and set a check-in to escalate if KEV listing or multi-source confirmation of widespread compromise emerges.
- Signals: CVE-2026-19490 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: Actively exploited V8 type confusion (CVSS 8.8) with a public PoC on GitHub; update all managed Chrome installations to 152.0.7977.82 immediately and check for pending Chromium-based browser updates (Edge, Brave).
- SOC/IR — Act: Active in-the-wild exploitation means assume-breach posture for unpatched endpoints; hunt for anomalous child processes or shell activity spawned from browser processes since the disclosure date, and monitor web proxy logs for suspicious redirect chains that may indicate exploit delivery.
- Leader — Learn: High-severity browser zero-day under active exploitation, but this is a standard patch-cycle item your engineering team should drive; escalate only if internal compromise indicators surface during the hunt.
- Signals: CVE-2026-85046 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active campaign with public PoC and 440k observed attempts makes this urgent despite low EPSS — if you run Super Forms or Elementor Pro on any WordPress site, update both plugins immediately and audit web-accessible upload directories for dropped files.
- SOC/IR — Act: The scale of this campaign (440k attempts) warrants sweeping web server logs for unauthenticated POST requests to Super Forms and Elementor Pro upload endpoints, and hunting for newly created PHP files in WordPress upload paths since the PoC became public.
- Leader — Plan: Confirm whether WordPress with these plugins exists in any customer-facing or internal properties; if so, ensure the patch-and-audit cycle is assigned and tracked — the exploitation volume makes this a realistic exposure risk worth validating this week.
- Signals: CVE-2026-14894 — CISA KEV: not listed, EPSS 0.05, public PoC on GitHub
- Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation: if you run Sangoma Switchvox, patch CVE-2026-9586 immediately or isolate the admin interface from untrusted networks until a patch is applied.
- SOC/IR — Act: Attackers are landing reverse shells via unauthenticated exploitation on edge VoIP devices; hunt for anomalous outbound connections originating from Switchvox hosts and sweep for post-exploitation activity (new processes, lateral movement) since the vulnerability became public.
- Leader — Plan: Confirm with engineering whether Switchvox is in the environment; if so, verify patching is prioritized this week given CISA KEV status — not yet a board-level event, but the KEV listing warrants a same-week check-in.
- Signals: CVE-2026-9586 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: If you run Sangoma Switchvox SMB Edition 8.3, patch immediately — a public PoC exists and active exploitation is reported. Restrict network access to the Switchvox admin interface as an interim control while a patch is applied.
- SOC/IR — Act: Active exploitation is deploying reverse shells from VoIP infrastructure; hunt for anomalous outbound connections originating from Switchvox hosts and sweep network logs for unexpected C2 traffic since the PoC went public.
- Leader — Skip
- Signals: CVE-2026-9586 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: PaperCut NG/MF was exploited as a zero-day and attacks are ongoing — patch to the latest released version immediately and audit server logs for signs of unauthorized access or data exfiltration.
- SOC/IR — Act: Active data theft via PaperCut exploitation means assume-breach posture for any organization running PaperCut — hunt for anomalous outbound traffic and lateral movement from PaperCut servers since before the patch date.
- Leader — Plan: PaperCut is widely used in enterprise and education; confirm whether the organization runs it and verify that engineering has applied the patch — brief leadership only if patch status is unconfirmed or delayed.
- Engineer — Act: CVE-2026-0768 in Langflow is a CVSS 9.8 RCE running as root with a public PoC and confirmed active exploitation — patch or take Langflow offline immediately; also audit Rails deployments for CVE-2026-66066 exposure and apply the latest Rails patch given the 0.28 EPSS and available PoC.
- SOC/IR — Act: Active exploitation includes credential-probing and C2 callback activity — hunt for anomalous outbound connections and lateral movement originating from Langflow or Rails app servers since these flaws became public, and build detections for post-exploitation behavior on those hosts.
- Leader — Skip
- Signals: CVE-2026-0768 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub · CVE-2026-66066 — CISA KEV: not listed, EPSS 0.28, public PoC on GitHub
- Engineer — Act: PaperCut NG and MF are actively exploited and the first fix was bypassed, meaning unpatched and initially-patched instances remain at risk; update to the latest emergency release immediately and verify the new version is applied end-to-end.
- SOC/IR — Plan: Active exploitation with a bypassed patch means print servers in the estate may already be compromised; build or tune detections for anomalous outbound connections and process spawning from PaperCut service accounts, and sweep logs back to the original disclosure date.
- Leader — Plan: If PaperCut is in the environment, confirm with engineering that the second emergency patch is deployed and request a status update — active exploitation plus a failed first fix is the kind of event that can escalate to a breach if patching is delayed.
- Engineer — Act: PaperCut NG and MF print management software is under active zero-day exploitation with confirmed customer incidents; apply PaperCut’s emergency patch for v25/v26 immediately and isolate unpatched instances from the network until patched.
- SOC/IR — Act: Confirmed active exploitation means assume-breach posture for any PaperCut server in the estate; sweep PaperCut application logs for anomalous requests and lateral movement indicators since PaperCut servers have been used as initial-access footholds in prior ransomware campaigns.
- Leader — Act: Active zero-day with confirmed customer incidents in widely deployed enterprise print software; this week confirm whether your organization runs PaperCut NG or MF, verify emergency patching is underway, and prepare a brief for leadership if exposure is confirmed.
- Engineer — Act: Unauthenticated RCE via chained flaws in PaperCut NG/MF is being actively exploited; apply the emergency patch immediately and audit PaperCut server logs for unexpected Java process execution or outbound connections predating the patch.
- SOC/IR — Act: Active exploitation of PaperCut print servers means assumed-breach posture is warranted — hunt for anomalous Java child processes or unusual network activity originating from PaperCut hosts since before the emergency patch date, and check EDR telemetry on any print-management systems.
- Leader — Plan: PaperCut NG/MF is common in enterprise and education environments; confirm with engineering that all instances are patched this week and verify no lateral movement occurred from print servers — prior PaperCut exploits (2023) drew board attention, so have a status update ready if asked.
- Engineer — Act: Zero-day active exploitation in PaperCut NG and MF means no waiting for a patch window; immediately check whether your organization runs either product, apply any vendor-published mitigations or workarounds, and monitor PaperCut’s advisory page for patch availability.
- SOC/IR — Act: Active exploitation of PaperCut servers creates an immediate assume-breach window; hunt for anomalous child-process spawning from PaperCut services, unusual outbound connections from print-management hosts, and review authentication logs on those servers going back at least two weeks.
- Leader — Act: PaperCut NG/MF is broadly deployed in enterprise environments and prior PaperCut vulnerabilities were rapidly weaponized by ransomware actors; confirm with your team this week whether either product is in use and verify that mitigations are being applied before a patch is available.
- Engineer — Act: Over 270 confirmed compromises signals mass exploitation of this Zimbra Collaboration Suite RCE flaw — immediately determine if you run ZCS and apply the available patch; treat any internet-exposed Zimbra instance as potentially compromised pending verification.
- SOC/IR — Act: Widespread active exploitation means assume-breach posture for any Zimbra environment: audit Zimbra server logs and web directories for web shells or anomalous POST requests since the campaign began, even without specific published IOCs.
- Leader — Act: Confirmed mass compromise of enterprise email infrastructure warrants same-week action — verify whether your organization or key SaaS/hosting vendors run on-premises Zimbra and direct your security team to assess exposure immediately before this surfaces as a board-level question.
- Engineer — Act: CISA KEV-listed RCE (CVSS 9.8) with public PoC requires only repository write access to execute arbitrary shell commands — patch Gitea immediately and audit server process trees and outbound connections for miner-related IOCs.
- SOC/IR — Act: Active exploitation with miner-like payload delivery gives a clear detection angle — hunt for anomalous child processes spawned by the Gitea process, unusual outbound connections from CI/Git infrastructure, and unexpected CPU spikes on self-hosted Git servers since the CVE was published.
- Leader — Plan: If your organization runs self-hosted Gitea, confirm with engineering teams this week whether the patch has been applied; a compromised source code host is a supply-chain risk that may warrant customer notification depending on your disclosure obligations.
- Signals: CVE-2026-60004 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: If you run a self-hosted Gitea instance, patch to the fixed version immediately — CISA-confirmed active exploitation of a critical code injection flaw means your CI/CD pipeline and source repositories are at direct risk.
- SOC/IR — Act: Audit any Gitea instances in your estate for signs of code injection compromise dating back to initial disclosure; a compromised source-code host can stage supply-chain attacks that require assume-breach investigation of downstream build artifacts.
- Leader — Plan: Direct your teams to inventory self-hosted Gitea deployments and validate patch status; a code injection flaw in source-code infrastructure carries supply chain risk worth confirming is closed before it surfaces in a customer security questionnaire.
- Engineer — Act: CISA KEV listing with active exploitation means immediate action: patch Zimbra Collaboration Suite to the vendor-recommended version within the 3-day federal window, or sooner if possible.
- SOC/IR — Act: Active exploitation is confirmed; hunt for anomalous Zimbra activity (unusual logins, webshell artifacts, outbound connections from ZCS hosts) dating back at least 30 days and tune detections for ZCS-specific abuse patterns.
- Leader — Plan: If your org runs Zimbra, confirm patching is underway and verify no compromise occurred; if Zimbra is a vendor dependency, request their remediation attestation this week.
- Engineer — Act: Active exploitation confirmed by CERT Polska plus a public PoC on GitHub makes this urgent regardless of the low EPSS score. Patch Zimbra Collaboration (ZCS) to the fixed release immediately; prioritize any internet-facing Zimbra instances.
- SOC/IR — Act: Active in-the-wild exploitation of an email server RCE creates an assume-breach exposure window. Hunt Zimbra SNMP and application logs for anomalous command execution patterns since the PoC publication date, and pull any IOCs published by CERT Polska for sweeping.
- Leader — Skip
- Signals: CVE-2026-73570 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Max-severity flaw in Microsoft Entra ID with confirmed active exploitation makes this immediate-action territory regardless of missing EPSS/KEV signals. Apply Microsoft’s Entra ID patch now and review sign-in and audit logs for anomalous authentication activity around and before the disclosure date.
- SOC/IR — Act: Active exploitation of an IAM platform means compromise may have already occurred in unpatched environments. Hunt for anomalous Entra ID authentication events (unexpected sign-ins, token grants, role assignments) and check whether Microsoft has published associated IOCs or TTPs to tune detections.
- Leader — Act: Entra ID underpins identity for the vast majority of enterprise environments, and confirmed active exploitation of a maximum-severity flaw is a board-question-level event. Confirm patching status with your engineering team this week and be ready to brief leadership before customers or auditors raise it.
- Engineer — Act: Microsoft has applied a server-side fix requiring no customer patch, but active exploitation occurred before remediation — audit Entra ID sign-in and audit logs for anomalous authentication, new service principals, or privilege escalation events from the period prior to the fix, and verify no credential or token abuse persists.
- SOC/IR — Act: Confirmed in-the-wild exploitation of an identity provider with a public PoC warrants an immediate hunt — query Entra ID audit and sign-in logs for suspicious app registrations, delegated permission grants, and admin role assignments occurring in the exploitation window, and tune detections for anomalous OAuth consent flows.
- Leader — Act: A CVSS 10.0 actively exploited RCE on the organization’s cloud identity plane is a board-level event analogous to Log4Shell in blast radius — brief leadership this week on the pre-patch exposure window and confirm with the security team that no evidence of compromise was found in Entra ID logs before Microsoft’s server-side fix landed.
- Signals: CVE-2026-69836 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Zimbra Collaboration Suite is common enterprise mail infrastructure; active exploitation confirmed by a national CERT means patch immediately — update ZCS to the vendor’s latest patched release and audit web-accessible Zimbra instances for signs of prior compromise.
- SOC/IR — Act: Active exploitation of a Zimbra RCE means assume-breach posture for orgs running it — sweep Zimbra servers for web shells, anomalous child processes from the mail service, and unusual outbound connections; pull CERT Polska’s advisory for any published IOCs to run against SIEM.
- Leader — Act: Zimbra hosts enterprise email, so a critical RCE under active attack is a data-exposure risk — confirm whether Zimbra is in your environment, and if so direct teams to treat patching as priority-one this week and assess whether any compromise warrants customer or regulatory notification.
- Engineer — Act: CISA confirmed active exploitation of this critical Windows IKE RCE — patch all Windows systems running IPsec/VPN services immediately; treat as emergency patch given KEV-level signal from CISA warning.
- SOC/IR — Act: Active exploitation confirmed by CISA — hunt for anomalous IKE/IPsec traffic and suspicious activity originating from VPN-adjacent or edge Windows systems since the campaign began; assume-breach sweep warranted for internet-exposed IKE endpoints.
- Leader — Plan: Confirm with infrastructure teams that Windows IPsec/VPN systems are prioritized in the current patch cycle; active exploitation elevates this above routine cadence but it falls short of board-level disclosure unless a breach is discovered.
- Engineer — Act: Four KEV-listed critical vulns across platforms you likely run — patch macOS (CVE-2026-65400, CVSS 9.8), SharePoint, vCenter, and Microsoft IKE immediately; a public PoC exists for the macOS flaw, making exploitation trivial.
- SOC/IR — Act: Active exploitation of vCenter and SharePoint warrants an assume-breach sweep — hunt for post-exploitation activity (credential dumping, lateral movement) on these systems dating back at least 30 days, and tune detections for anomalous SharePoint API calls and vCenter admin actions.
- Leader — Act: KEV-listed active exploitation across macOS endpoints, SharePoint, and vCenter is a systemic risk event — confirm patch status and exposure scope with engineering this week, and be prepared to brief leadership if any of these systems host sensitive data or are business-critical.
- Signals: CVE-2026-65400 — CISA KEV: listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A max-severity RCE in SAP Commerce Cloud is under active attack just days after patching — apply the SAP patch immediately and audit Commerce Cloud logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation is confirmed by threat intelligence, so sweep SAP Commerce Cloud application and access logs for anomalous activity indicative of RCE or post-exploitation behavior since the patch release date.
- Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and verify the emergency patch has been applied; if patching is delayed, request an incident status from the team given active exploitation is already underway.
- Engineer — Act: vCenter is core infrastructure for most enterprise estates and active exploitation is deploying persistent reverse SSH tunnels — patch CVE-2026-59310 immediately and audit vCenter hosts for unexpected outbound SSH connections or new SSH tunnel processes.
- SOC/IR — Act: The campaign’s TTP is specific and huntable: sweep for outbound SSH sessions originating from vCenter server hosts, flag any reverse tunnel tools (socat, plink, autossh) running on hypervisor management nodes since the vulnerability’s disclosure date.
- Leader — Plan: Active exploitation of a critical vCenter RCE means full-estate exposure for organizations running VMware — confirm with engineering this sprint that patching is complete and request a status update before this surfaces in a customer security questionnaire.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: SharePoint CVSS 9.1 authentication bypass is now under active exploitation following public PoC release; apply Microsoft’s July 2026 Patch Tuesday update to all on-premises and hybrid SharePoint instances immediately and verify patch status in your estate.
- SOC/IR — Act: Active exploitation of a SharePoint auth bypass means adversaries may already be inside unpatched tenants; hunt for anomalous SharePoint authentication events and unexpected file access patterns in audit logs dating back to the PoC release.
- Leader — Act: SharePoint is ubiquitous in enterprise environments and this critical auth bypass is under active attack; confirm patch completion with engineering this week and assess whether any exposure window existed that could trigger customer notification obligations.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Active exploitation attempts against CVE-2026-71362 in Adobe Commerce and Magento have been observed despite low EPSS — if you run either platform, patch immediately and audit recent customer authentication logs for signs of account takeover.
- SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet, but active exploitation is reported; build or tune detections for anomalous authentication patterns and privilege changes on Commerce/Magento instances in your estate.
- Leader — Plan: If your organization or a key e-commerce vendor runs Adobe Commerce or Magento, confirm patching status this week and assess whether customer account data may have been exposed, given the reported exploitation activity.
- Signals: CVE-2026-71362 — CISA KEV: not listed, EPSS 0.00, no public PoC found
- Engineer — Act: Cisco ASA and FTD are cornerstone edge appliances in most enterprise environments; active exploitation confirmed by the vendor makes this urgent — apply available patches or workarounds immediately and verify your ASA/FTD version is not in the affected range.
- SOC/IR — Act: Active exploitation of edge VPN appliances means you should hunt for unexpected device crashes or reboots on your ASA/FTD fleet and monitor for anomalous inbound traffic targeting VPN endpoints consistent with DoS attempts since the disclosure date.
- Leader — Plan: A DoS against widely deployed VPN appliances carries real business-continuity risk; confirm your team is treating patching as priority-one this week and identify contingency plans (backup access paths) if appliances are targeted before patches are applied.
- Engineer — Act: vCenter is core infrastructure and a CVSS 9.8 directory-traversal-to-RCE with reported active exploitation warrants immediate patching despite weak enrichment signals (not KEV, EPSS 0.01). Apply Broadcom’s patch for CVE-2026-59310 and audit vCenter network access controls to reduce exposure while rolling out.
- SOC/IR — Plan: Active exploitation is reported by a single vendor (QUIRSO) but no IOCs or ATT&CK-mapped TTPs are published yet, leaving no sweep surface today. Build or tune detections for post-exploitation behavior originating from vCenter hosts (unusual process spawning, outbound connections from vCenter management IPs) in anticipation of broader disclosure.
- Leader — Plan: A 9.8-severity RCE in widely deployed VMware vCenter with reported exploitation is worth a prompt check-in with the engineering team to confirm patch status, but the single-source report and absence of a KEV listing mean this does not yet require board escalation or a customer-facing statement.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Act: CISA KEV-listed, EPSS 0.99, public PoC, and 792 confirmed exploit attempts make this an emergency patch. Apply the Progress Kemp LoadMaster patch immediately or isolate the appliance from untrusted networks until patched.
- SOC/IR — Act: Active exploitation of a perimeter load balancer warrants an assume-breach sweep — hunt for command injection patterns in LoadMaster access logs since the first reported attempts, and check downstream hosts for lateral movement indicators.
- Leader — Act: CISA KEV listing plus confirmed active exploitation makes this a board-question-level appliance vulnerability; confirm this week whether LoadMaster is in your environment and verify engineering has patched or isolated affected instances.
- Signals: CVE-2026-8037 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
- Engineer — Act: Active exploitation of N-central is confirmed, with attackers persisting on managed endpoints — a full-estate compromise risk. Apply N-central Hotfix 2 immediately and audit N-central activity logs for unauthorized sessions or lateral movement to managed systems.
- SOC/IR — Act: Attackers are persisting on N-central-managed systems, meaning compromise may predate the patch. Hunt for anomalous RMM-initiated process execution or new scheduled tasks/services on managed endpoints since the original vulnerability disclosure, and look for unexpected outbound connections from N-central infrastructure.
- Leader — Act: RMM compromise is a systemic risk — if your MSP or internal team runs N-central, attackers may already have access to managed endpoints. Confirm Hotfix 2 deployment status with your MSP or internal team this week and request attestation of any anomalous access findings.
- Engineer — Act: Actively exploited zero-day in Metabase with a 10.0 CVSS allows unauthenticated SQL injection leading to full admin takeover — apply the vendor patch immediately or take any internet-exposed Metabase instance offline until patched.
- SOC/IR — Act: Confirmed in-the-wild exploitation means assume-breach posture for any Metabase instance in your estate: hunt for unauthorized admin logins and anomalous SQL activity in application logs since the disclosure date, and sweep for lateral movement from those hosts.
- Leader — Act: Confirm whether the organization runs Metabase — BI tools commonly hold access to sensitive operational data, and a CVSS 10.0 actively exploited vulnerability elevates this to a same-week check; if exposed, brief leadership on potential data access risk and request remediation status from the engineering team.
- Engineer — Act: All three products are KEV-listed with confirmed active exploitation and a 72-hour federal patch deadline — check your inventory for Langflow, N-able N-central, and Apache Tomcat instances and apply vendor patches immediately, prioritizing any internet-exposed deployments.
- SOC/IR — Act: Actively exploited RMM (N-central) and Java servlet (Tomcat) instances are high-value footholds; hunt for web shells on Tomcat endpoints and audit N-central for unauthorized agent activity or lateral-movement artifacts since the CISA advisory date.
- Leader — Plan: Confirm with engineering whether the organization runs Langflow, N-able N-central, or Apache Tomcat and ensure the patch sprint is underway; the federal 3-day deadline signals regulator attention and may surface in upcoming audit or customer questionnaire conversations.
- Engineer — Act: CVE-2026-18577 is CISA KEV-listed with a public PoC and confirmed active exploitation — patch N-central immediately to the vendor-specified fixed version, and audit logs for unauthorized access since the vulnerability affects both hosted and on-premises deployments.
- SOC/IR — Act: Active exploitation of N-central means assume-breach posture for any org running it — sweep for anomalous authentication events on N-central servers and hunt for lateral movement originating from managed endpoints, as compromise of an RMM tool gives attackers broad access to managed devices.
- Leader — Act: N-central is an RMM platform used by MSPs; if your organization or any MSP managing your environment runs it, request an immediate attestation of patch status and review whether threat actors could have used it as a pivot into your estate — this is the type of systemic MSP-chain risk worth a brief to leadership this week.
- Signals: CVE-2026-18577 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-18577 is CISA KEV-listed with a public PoC and confirmed in-the-wild exploitation; if you run N-able N-central, apply the latest patch immediately and treat any N-central host as potentially compromised pending verification.
- SOC/IR — Act: Confirmed customer compromises via an RMM platform mean privileged agent access may already be weaponized; hunt for anomalous lateral movement or command execution originating from N-central agents since the disclosure date and sweep admin audit logs for unauthorized access.
- Leader — Act: RMM platforms have privileged access across entire client estates — if your organization uses an MSP that runs N-able N-central, this week confirm whether they are patched and request a written attestation, as confirmed customer compromises indicate active supply-chain risk through managed-service relationships.
- Signals: CVE-2026-18556 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub · CVE-2026-18577 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation is confirmed and a public PoC exists; patch N-central to build 2026.3.1.7 immediately, then audit server and managed-endpoint logs for unauthorized admin sessions or lateral movement originating from N-central.
- SOC/IR — Act: Compromised N-central servers give attackers a pivot into every managed customer environment; hunt for anomalous RMM-originated connections and unexpected privileged actions on managed endpoints, sweeping back to at least early August 2026.
- Leader — Act: If your organization runs N-central or relies on an MSP that does, confirm patch status and request a compromise-assessment attestation this week — an RMM breach exposes all downstream managed environments and may carry disclosure obligations.
- Signals: CVE-2026-18577 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Fastjson 1.x is embedded in many Spring Boot applications; unauthenticated RCE with a public PoC and confirmed active attacks means immediate action is required — audit all services for Fastjson 1.x dependencies, apply WAF rules to block the malicious JSON chain, and isolate or rate-limit exposed endpoints until a patch is available.
- SOC/IR — Act: Multi-source confirmation of active exploitation gives a detection mandate now — hunt for anomalous JSON deserialization patterns in HTTP request logs to Spring Boot services and monitor for unexpected outbound connections or process spawning from Java app servers since the earliest confirmed attack date.
- Leader — Plan: A critical, unpatched RCE in a widely-used Java library under active attack warrants commissioning an urgent Fastjson 1.x exposure inventory across development teams this week; if use is confirmed, allocate engineering time for compensating controls and track remediation until a vendor patch is released.
- Signals: CVE-2026-16723 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active Cl0p data-extortion campaign exploiting internet-exposed PTC Windchill and FlexPLM via chained pre-auth flaws; immediately audit for internet-exposed instances, apply available patches, and if patching is delayed, restrict Windchill login servlet and FlexPLM WSDL endpoint from external access.
- SOC/IR — Act: Active Cl0p campaign with a concrete exploit chain (pre-auth FlexPLM WSDL disclosure chained into Windchill login servlet); hunt for anomalous pre-authenticated requests to these endpoints since campaign start and sweep for Cl0p-associated IOCs in PLM server logs and EDR telemetry.
- Leader — Plan: Cl0p affiliates are running a targeted data-extortion campaign against manufacturing and engineering organizations using PTC Windchill/FlexPLM; if your org or key suppliers use these platforms, assess exposure now and be prepared to brief leadership on potential data theft risk before it surfaces in the press.
- Engineer — Act: Active in-the-wild exploitation confirmed by VulnCheck and a public PoC is available; if you self-host Windmill, patch immediately and audit web server logs for unauthenticated requests to the
/api/w/{workspace}/jobs_u/get_log_file/endpoint containing traversal sequences. - SOC/IR — Act: Active exploitation with public PoC means opportunistic scanning is already underway; hunt web proxy and WAF logs for path traversal patterns (e.g.,
../) in requests to Windmill’sget_log_fileendpoint, and sweep for unusual file reads on any Windmill hosts since the PoC dropped. - Leader — Skip
- Signals: CVE-2026-29059 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: Active exploitation confirmed with a public GitHub PoC; patch SharePoint immediately AND regenerate machine keys — patching alone does not evict attackers who already exfiltrated them, so key rotation is the critical second step.
- SOC/IR — Act: Stolen machine keys enable persistent, post-patch impersonation attacks — hunt SharePoint IIS logs for exploitation artifacts since the vulnerability became public, and write detections for anomalous ViewState or token-forging activity tied to mismatched machine keys.
- Leader — Plan: Confirm SharePoint is in scope, then ensure your engineering team understands that patching alone is insufficient — key rotation and a post-exploitation sweep are required; flag this as a two-step remediation so it isn’t closed prematurely in the ticket queue.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVSS 9.8 deserialization RCE with public PoC and confirmed active exploitation — patch SharePoint Server to the July 2026 Patch Tuesday build immediately; do not wait for CISA KEV confirmation given exploitation is already underway.
- SOC/IR — Act: Active exploitation predating your patch window means assume-breach posture is warranted — hunt for anomalous deserialization or code execution activity on SharePoint servers back to at least the PoC publication date, and review watchTowr’s reporting for any available IOCs or behavioral signatures.
- Leader — Act: A CVSS 9.8 unauthenticated RCE in widely-deployed enterprise SharePoint under active exploitation requires a same-week exposure check — confirm whether the org runs on-premises SharePoint Server and verify the engineering team has prioritized the July Patch Tuesday update.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Both CVEs have public PoCs and exploitation is already underway with mass scanning — patch all WordPress instances to the fixed versions immediately and audit exposed sites for webshell artifacts, especially any unexpected PHP files or modified themes.
- SOC/IR — Act: Active exploitation confirmed since early Saturday UTC; hunt for webshell uploads and anomalous POST requests targeting WordPress endpoints across your estate, and sweep for post-compromise persistence on any internet-facing WordPress hosts.
- Leader — Plan: Active exploitation with mass scanning is in progress but hasn’t reached Log4Shell-scale board attention yet; confirm whether WordPress appears in your web portfolio and ensure it’s on your engineering team’s immediate patching queue this week.
- Signals: CVE-2026-60137 — CISA KEV: not listed, EPSS 0.04, public PoC on GitHub · CVE-2026-63030 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Public PoC exists and in-the-wild exploitation is reported for this unauthenticated sandbox-escape RCE (CVSS 9.5) in the ServiceNow AI Platform. Confirm your ServiceNow instance has the available patch applied via the admin console, and audit platform logs for anomalous code execution since the disclosure date.
- SOC/IR — Act: Active exploitation of unauthenticated RCE on a widely deployed enterprise ITSM platform creates immediate detection work. Hunt for anomalous outbound connections, unusual process spawning, or lateral movement originating from ServiceNow infrastructure since the vulnerability was disclosed, and tune EDR/SIEM for post-exploitation behavior on hosts that ServiceNow agents touch.
- Leader — Act: A critical unauthenticated RCE in ServiceNow with confirmed in-the-wild exploitation could expose ITSM data and integrated systems. This week, confirm with your ServiceNow admin that the patch is applied to your instance and assess whether any sensitive data (HR, IT credentials, integrations) in the platform warrants a precautionary leadership or customer notification.
- Signals: CVE-2026-6875 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing with active exploitation means patch FortiSandbox to the vendor-fixed version immediately — treat this as a critical-priority change with a days-level window, not weeks.
- SOC/IR — Act: Active exploitation of FortiSandbox warrants an assume-breach sweep on any FortiSandbox instances in the estate; hunt for anomalous outbound connections or config changes on those appliances since the vulnerability window opened.
- Leader — Act: Confirm whether FortiSandbox is deployed anywhere in your environment, verify the patching timeline with your engineering team, and be prepared to brief leadership if you are a federal agency facing CISA’s Sunday deadline.
- Engineer — Act: CISA KEV listing with confirmed active exploitation and an imminent Saturday deadline; audit your environment for Oracle E-Business Suite deployments and apply Oracle’s patch immediately.
- SOC/IR — Act: Active exploitation is underway against Oracle EBS financial systems; initiate a hunt for anomalous EBS access patterns and monitor threat intel feeds for IOCs to sweep across relevant log sources.
- Leader — Act: A CISA-mandated Saturday deadline on actively exploited financial software warrants same-week confirmation from your engineering team that Oracle E-Business Suite is either patched or absent from your environment.
- Engineer — Act: CISA warning indicates KEV-level active exploitation against internet-exposed on-premises SharePoint Server. Apply Microsoft’s patches immediately and verify no externally reachable SharePoint instances remain unpatched.
- SOC/IR — Act: Active exploitation of internet-facing SharePoint means assume-breach posture is warranted; hunt for post-exploitation activity (lateral movement, credential access) on SharePoint hosts since the earliest known exploitation date and review IIS/ULS logs for anomalous request patterns.
- Leader — Act: Confirm whether the organization runs on-premises SharePoint Server exposed to the internet, and get a patching status update from engineering this week — active exploitation with a CISA advisory is the kind of event that surfaces in board or customer security reviews.
- Engineer — Act: CISA warning signals KEV-level active exploitation — update or disable the iCagenda and Balbooa Forms Joomla extensions immediately, and audit web roots for unexpectedly uploaded files that may indicate prior compromise.
- SOC/IR — Act: Active exploitation via arbitrary file upload means webshells may already be in place — hunt Joomla web directories for recently uploaded executables and review web server logs for POST requests targeting these extension upload endpoints.
- Leader — Plan: Confirm whether any company-owned or vendor-hosted web properties run Joomla with these extensions and verify engineering teams have patch SLAs in motion; this does not yet rise to board-briefing level.
- Engineer — Act: GoAnywhere MFT is a common enterprise managed-file-transfer appliance; CISA KEV listing plus EPSS 1.00 plus a public GitHub PoC means exploitation is active now. Patch to the vendor-fixed release immediately or take the instance offline until patching is complete.
- SOC/IR — Act: Prior GoAnywhere exploitation by Cl0p hit hundreds of organizations; treat any unpatched instance as potentially compromised. Hunt for anomalous outbound transfers, newly created admin accounts, and lateral movement originating from GoAnywhere servers since the PoC became public.
- Leader — Act: The 2023 Cl0p GoAnywhere campaign was a marquee supply-chain breach; this CVE matches or exceeds that severity signal (EPSS 1.00, KEV-listed). Confirm this week whether your org or critical MFT vendors run GoAnywhere and obtain patch attestations before history repeats.
- Signals: CVE-2025-10035 — CISA KEV: listed, EPSS 1.00, public PoC on GitHub