Critical-Vulnerability on CuraSec

Cosmos EVM shared module exploited across six blockchains, patch to 0.6.2

Fri, 28 Aug 2026 21:21:40 +0000

Engineer — Plan: If your organization runs any Cosmos EVM-based chain, treat this as Act: the shared module (GHSA-7g4w-cg88-2cq2) was actively exploited Aug 20–25 and must be patched to ≥ 0.6.2; for most enterprise stacks this is niche software, making this a conditional urgent patch rather than a universal action.
SOC/IR — Learn: Active fund-drain exploitation across six blockchains signals a real threat actor capability against Cosmos EVM infrastructure, but the summary provides no IOCs, ATT&CK-mappable TTPs, or detection artifacts; file for context and watch for follow-on threat intel with actionable indicators.
Leader — Plan: Assess whether your organization has custody, treasury, or operational exposure to any of the six affected Cosmos EVM chains, and request incident attestation and remediation status from relevant blockchain service providers this quarter.

Fri, 28 Aug 2026 21:21:40 +0000

Engineer — Plan: Three unauthenticated RCE/SQLi flaws at maximum severity demand prompt action, but no KEV listing or public PoC elevates this to Act yet. If running self-hosted ServiceNow, apply the patch this week and verify hosted instances received the automated update.
SOC/IR — Skip
Leader — Plan: Three CVSS 10.0 flaws in a widely deployed ITSM platform warrant confirming whether your organization runs self-hosted ServiceNow and ensuring the patch was applied; hosted tenants should receive confirmation from ServiceNow that their instances were updated.

Tue, 18 Aug 2026 11:37:25 +0000

Engineer — Act: A public PoC on GitHub for a CVSS 9.4 unauthenticated flaw sharply raises exploitation risk even without KEV listing; patch GitLab CE/EE to the vendor’s latest patched release this week and verify no public GraphQL endpoints are exposed without authentication.
SOC/IR — Act: With a public PoC already circulating, hunt for unauthenticated GraphQL mutation requests targeting GitLab’s project or user-data endpoints, and alert on anomalous project deletion or modification events since the vulnerability disclosure date.
Leader — Plan: Confirm whether the organization runs self-hosted GitLab and ensure engineering has a same-week patching commitment; unauthorized source-code deletion or tampering carries supply-chain and business-continuity implications worth a brief status check with the team.
Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Plan: CVSS 10.0 OS command injection in ColdFusion and companion critical flaws in Commerce and Campaign Classic warrant prioritized patching this sprint. No KEV listing or public PoC yet, but severity justifies treating this ahead of routine patch cycles — apply Adobe’s August updates to all three products immediately.
SOC/IR — Skip
Leader — Skip
Signals: CVE-2026-48362 — CISA KEV: not listed, EPSS n/a, no public PoC found

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Act: A public PoC on GitHub combined with a CVSS 9.8 unauthenticated RCE makes exploitation imminent — patch all on-premises TeamCity instances to 2025.11.7 or 2026.1.3 immediately; Cloud instances are already remediated.
SOC/IR — Act: With a public PoC now available, begin hunting for unauthenticated requests to TeamCity build/run endpoints and review build agent logs for unexpected OS command execution patterns since the PoC publication date.
Leader — Plan: Confirm whether your organization runs TeamCity On-Premises and verify the engineering team has prioritized emergency patching this week — a compromise of CI/CD pipelines carries supply-chain risk that could generate customer or board questions if exploitation is later confirmed.
Signals: CVE-2026-63077 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: SAP NetWeaver ABAP is widely deployed in enterprise environments and this authenticated out-of-bounds write carries a 9.9 CVSS; no KEV listing, EPSS near zero, and no public PoC mean there’s no immediate exploitation pressure, but apply SAP’s July 2026 security patches in your next maintenance window.
SOC/IR — Skip
Leader — Skip
Signals: CVE-2026-44747 — CISA KEV: not listed, EPSS 0.00, no public PoC found