Command-Injection on CuraSec

Progress LoadMaster command injection flaw actively exploited (CISA KEV)

Mon, 10 Aug 2026 11:57:16 +0000

Engineer — Act: CISA has flagged active exploitation of this critical command injection flaw in Progress Kemp LoadMaster; patch to the latest fixed version immediately and audit LoadMaster logs for signs of prior compromise.
SOC/IR — Act: Edge device under active exploitation warrants an assume-breach posture — sweep LoadMaster access logs for anomalous commands or unexpected outbound connections since the vulnerability was disclosed, and tune detections on traffic originating from load balancer management interfaces.
Leader — Plan: Confirm whether LoadMaster is deployed anywhere in the environment and verify your engineering team has prioritized patching; this is not yet a board-level systemic event but CISA active-exploitation designation means it should be on the remediation radar this week.

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Act: Maximum-severity command injection in VeloCloud Orchestrator is actively exploited — if you run on-premises VeloCloud Orchestrator, patch immediately and audit for signs of compromise.
SOC/IR — Act: Active exploitation of a max-severity edge orchestrator means assume-breach posture for any environment running on-prem VeloCloud Orchestrator — hunt for anomalous command execution or lateral movement from those hosts since before the patch date.
Leader — Act: A maximum-severity zero-day actively exploited in SD-WAN infrastructure warrants immediate confirmation of whether VeloCloud Orchestrator is in use on-premises, and if so, direct the team to patch and assess exposure before this surfaces as a board-level incident.

Wed, 22 Jul 2026 12:46:13 +0000

Engineer — Plan: Upgrade Zimbra to 10.1.20 to remediate the SNMP command injection (triggered when SNMP notifications are enabled) and four XSS issues; no KEV listing or public PoC raises urgency to Act, but the critical rating warrants scheduling patching this sprint.
SOC/IR — Skip
Leader — Skip

Tue, 21 Jul 2026 12:43:35 +0000

Engineer — Act: FortiSandbox is actively exploited per CISA KEV listing with a public PoC on GitHub; patch to the fixed version immediately and check for signs of compromise on any internet-facing FortiSandbox appliances.
SOC/IR — Act: KEV listing plus public PoC means exploitation is likely underway; hunt for anomalous outbound connections or new processes spawned from FortiSandbox hosts since the PoC publication date, and check edge appliance logs for unauthenticated command-injection attempts.
Leader — Plan: KEV-listed Fortinet RCE warrants confirming whether FortiSandbox is in the environment and requesting patch status from the infrastructure team; brief on remediation timeline if deployed, given the active exploitation signal.
Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.36, public PoC on GitHub