tag: Cve · 63 items
- Engineer — Plan: Linux kernel TCP UAF with CVSS 9.8 and a public PoC is real exposure for any cloud/Kubernetes workload, but EPSS 0.00 and no KEV listing means no observed exploitation yet; queue patching affected kernel versions within your next maintenance window rather than treating this as an emergency.
- SOC/IR — Learn: No active exploitation, no published IOCs, and no ATT&CK-mapped TTPs to hunt for right now; review the PoC’s exploitation path to understand what kernel panic or anomalous TCP behavior a future detection rule would need to catch.
- Leader — Skip
- Signals: CVE-2026-98432 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: A Linux kernel TCP use-after-free with a public PoC warrants scheduling a kernel update, even though EPSS is 0.00 and it lacks a KEV listing; audit your Linux host and container base image versions and plan a patch to the fixed kernel release.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-98432 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: Public PoC exists for this 9.8 kernel-level vulnerability affecting all Ubuntu releases, but EPSS sits at 0.00 and it is not CISA KEV-listed, indicating no active exploitation yet. Apply the Ubuntu security patch for CVE-2026-98432 in your next patch cycle, prioritizing internet-exposed or sensitive Linux hosts.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-98432 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA confirmation of active exploitation on a max-severity GitLab flaw demands immediate action: identify all self-hosted GitLab instances and patch to the version released earlier this month before your next patch window.
- SOC/IR — Act: With confirmed in-the-wild exploitation, sweep GitLab audit logs and authentication events for anomalous access since the patch release date, and hunt for lateral movement or credential theft originating from GitLab servers.
- Leader — Act: A max-severity, actively exploited flaw in a source-code and CI/CD platform is a supply-chain risk event — confirm this week whether your org runs self-hosted GitLab and verify patching status; if so, brief engineering leadership on exposure.
- Engineer — Act: A confirmed exploitation attempt combined with a public PoC on GitHub is enough to act even with EPSS at 0.18: identify your GitLab version, apply the security patch addressing CVE-2026-97229 immediately, and review instance logs for unauthorized access attempts.
- SOC/IR — Act: Read the full Alpine Linux incident post for any published IOCs or request patterns, then sweep GitLab authentication and API access logs from the incident date forward for anomalous behavior consistent with this CVE’s attack surface.
- Leader — Plan: This does not yet rise to board-level systemic risk, but confirm with engineering that self-hosted or internally managed GitLab instances are patched; if GitLab SaaS hosts sensitive IP or customer data, request a vendor security statement.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: 304 CVEs across Apple’s ecosystem is a standard large release with no KEV or public-PoC signals noted; schedule macOS/iOS/iPadOS patching through MDM this week to stay within your normal patch window.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: EPSS 1.00 plus a public, actively maintained exploit toolkit covering PHP 5.4–8.4.26 means exploitation pressure is immediate. Patch PHP to the latest release beyond 8.4.26 and audit any internet-exposed PHP applications for successful exploitation attempts.
- SOC/IR — Act: The toolkit’s JA3 impersonation capability specifically evades TLS fingerprint-based detections, requiring tuning beyond standard signatures. Hunt for unauthenticated HTTP sequences matching this RCE chain against PHP endpoints dating back to the toolkit’s first appearance on GitHub.
- Leader — Act: A public exploit kit with EPSS 1.00 covering the entire PHP version tree is a systemic exposure on par with Log4Shell in breadth. Confirm this week whether PHP is present across your estate and that engineering has emergency-patched it; be prepared to brief leadership if a breach follows.
- Signals: CVE-2026-109619 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: Public PoCs exist for both CVEs but EPSS is low (0.12/0.06) and neither is KEV-listed. If you run PHP 7.4/8.0/8.1 Docker images, pull from the mpyw backported images or use this as a forcing function to schedule migration to a supported PHP version (8.2+) this quarter.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 4 collected sources
- Engineer — Learn: The item signals a possible third critical PHP vulnerability in an already-active exploitation cluster, but provides no CVE identifier, affected versions, or patch status — monitor PHP security advisories closely and be ready to act once details are confirmed.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC on GitHub raises exploitation probability despite PHP’s ‘unlikely’ framing; audit your PHP application configurations for the affected feature and disable it per PHP’s mitigation guidance before a patch ships.
- SOC/IR — Plan: The public PoC makes opportunistic exploitation attempts plausible; build or tune detections for anomalous process spawning from web server processes and new webshell activity on PHP-serving hosts this sprint.
- Leader — Skip
- Signals: CVE-2026-115560 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: PHP carries a CVSS 9.4 RCE pair with public PoC already circulating before today’s emergency patch drop — update all PHP installations to the patched release as soon as it publishes and restrict external access to PHP services in the interim.
- SOC/IR — Act: PoC availability ahead of the patch means exploitation attempts are likely imminent; hunt for anomalous web-shell activity and suspicious PHP process spawning across web-facing servers since today, and tune WAF/EDR rules for PHP exploitation patterns.
- Leader — Plan: CVSS 9.4 with pre-patch PoC in wide-use infrastructure warrants confirming PHP exposure across your environment this week and ensuring engineering teams treat today’s emergency patch as P1 — not yet board-level but could escalate if exploitation becomes widespread.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Learn: The summary contains no details about affected software, versions, or remediation steps; read the full post-mortem to extract any architectural lessons or patch guidance relevant to your stack.
- SOC/IR — Learn: No IOCs, TTPs, or detection artifacts are surfaced in the summary; the incident report may contain hunt leads but cannot be actioned without reading the full article.
- Leader — Learn: High HN engagement (712 points) suggests a notable post-mortem worth reviewing for governance or disclosure lessons, but the summary provides no substance to act on now.
- Engineer — Learn: A retrospective technical deep-dive into how GNU IFUNC indirect-function dispatch enabled the XZ Utils backdoor — useful for understanding what to audit in security-sensitive C code and supply chain reviews, but no actionable patch or config change required today since the original issue was remediated in 2024.
- SOC/IR — Learn: Explains the low-level mechanism behind a two-year-old supply chain compromise; no new IOCs, TTPs, or detection opportunities beyond what was published at initial disclosure in 2024.
- Leader — Skip
- Signals: CVE-2024-3094 — CISA KEV: not listed, EPSS 0.86, public PoC on GitHub
- Engineer — Learn: No CISA KEV, no public PoC, and no exploitability signals — this is a milestone worth noting for teams running recent kernels with Rust-enabled builds, but no patch action is warranted yet without further details.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Public PoC on GitHub for a local privilege-escalation to root on Linux — patch the kernel on all Linux hosts and container nodes this sprint; verify your distro’s advisory for the patched version.
- SOC/IR — Plan: Public PoC makes this worth building a PrivEsc detection (watch for unexpected uid-change events following non-root process activity) before opportunistic use picks up; no active campaign confirmed yet.
- Leader — Skip
- Signals: CVE-2026-43284 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Starlette is the ASGI foundation under FastAPI and many Python web stacks; CISA KEV listing confirms active exploitation. Identify all services running Starlette, patch to the fixed version immediately, and audit request logs for anomalous Host header values as a signs-of-compromise check.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of this host-header bypass; hunt for requests with unexpected or spoofed Host header values in web application and reverse-proxy logs dating back at least 30 days, then tune WAF or detection rules to alert on further attempts.
- Leader — Plan: Despite active exploitation, this is an engineering-tier patch event rather than a board-level systemic event — task your AppSec team this week to enumerate all internal and customer-facing services built on Starlette or FastAPI and confirm patching is on track before the next sprint cycle.
- Signals: CVE-2026-48710 — CISA KEV: listed, EPSS 0.07, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE on Exim with a public PoC on GitHub means active exploitation could begin at any time — patch Exim to the fixed version and confirm no internet-exposed instances are running the vulnerable release.
- SOC/IR — Plan: No active exploitation confirmed yet, but the public PoC makes this an imminent detection priority — build or tune rules to flag anomalous child-process spawning and unexpected outbound connections from your Exim instances before exploitation begins.
- Leader — Skip
- Signals: CVE-2026-45185 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation despite the low EPSS (0.03); audit all rootless container deployments (podman, Docker rootless, or equivalent) and apply vendor patches for CVE-2026-31431 immediately — public PoC lowers the bar for attackers further.
- SOC/IR — Act: KEV listing means assume exploitation is occurring; hunt for anomalous file-copy operations and privilege escalation events on container hosts, sweeping logs back to at least May 2026 when the PoC was published.
- Leader — Plan: A KEV-listed container vulnerability merits confirming with engineering that CVE-2026-31431 is in the patch queue with a firm timeline this week, but it does not rise to board or customer disclosure level unless containers underpin a regulated or critical-path service.
- Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
- Engineer — Plan: macOS kernel vuln with a public PoC on GitHub but EPSS of 0.01 and no KEV listing — no active exploitation pressure yet. Schedule patching to the latest macOS 26.x release for developer workstations and any managed Mac fleet within your normal patch window.
- SOC/IR — Learn: No active exploitation campaigns documented, no published IOCs, and EPSS sits at 0.01 — there is no immediate hunt or detection to write. Worth tracking in case PoC matures into weaponized tooling; revisit if KEV listing or campaign activity emerges.
- Leader — Skip
- Signals: CVE-2026-28952 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: cPanel/WHM is widely deployed as a hosting control panel; authentication bypass with CISA KEV listing, EPSS 0.99, and a public PoC means exploitation is trivial and active. Patch cPanel/WHM immediately to the vendor-issued fixed version and audit access logs for any unauthorized sessions.
- SOC/IR — Act: Active exploitation of an internet-facing control panel auth bypass warrants an immediate assume-breach sweep on any cPanel/WHM instances in your estate. Hunt for anomalous authenticated sessions or privilege escalation activity since the PoC dropped, and tune detections for unauthenticated access patterns against port 2083/2087.
- Leader — Act: CISA KEV listing with EPSS 0.99 on a widely-used hosting panel is a board-question-level event — confirm whether your infrastructure or managed hosting vendors run cPanel/WHM and request written confirmation of patching status before end of week.
- Signals: CVE-2026-41940 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
- Engineer — Act: A public PoC is available for this sandbox escape in Claude Code; any team running Claude Code in dev workflows or CI should update to the patched release listed in GHSA-vp62-r36r-9xqp immediately.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-39861 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listed, EPSS 0.55, public PoC, and active exploitation combine to demand immediate action. Update all Chrome and Chromium-based installations (including Electron apps and Chromium in CI/CD pipelines) to the latest stable channel release now.
- SOC/IR — Act: Active zero-day exploitation with public PoC means attacker tooling is already circulating. Hunt for suspicious child processes spawned by Chrome since early February, and tune EDR rules to flag anomalous browser subprocess activity consistent with renderer exploitation.
- Leader — Act: A CISA KEV-listed zero-day in the most widely deployed enterprise browser with confirmed in-the-wild exploitation warrants same-week confirmation. Verify that endpoint management has initiated an emergency Chrome patch cycle and confirm patch coverage metrics before end of week.
- Signals: CVE-2026-2441 — CISA KEV: listed, EPSS 0.55, public PoC on GitHub
- Engineer — Act: A public PoC for a guest-to-host KVM escape is available on GitHub now — even with low EPSS, VM breakout is a critical class that demands immediate response. Patch the Linux kernel on all KVM hosts (bare-metal hypervisors, Kubernetes nodes, cloud-adjacent infra) as soon as your distro ships the fix.
- SOC/IR — Learn: No active exploitation campaigns, no published IOCs, and VM-level escapes are largely invisible to SIEM/EDR — detection surface is thin. File the technique for future hypervisor-monitoring coverage work, but no hunt or rule to write today.
- Leader — Learn: A guest-to-host hypervisor escape is a significant vulnerability class, but exploitation signals remain low (EPSS 0.01, not KEV listed) — this sits below the threshold for board or customer communication. Confirm engineering teams are tracking the kernel patch; revisit only if active exploitation emerges.
- Signals: CVE-2026-53359 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Public PoC on GitHub plus confirmed exploitation attempts within hours of disclosure make this urgent despite low EPSS. Patch Atlassian Bitbucket, Confluence, Jira Software, and Jira Service Management Data Center instances to vendor-released fixed versions immediately.
- SOC/IR — Act: Active exploitation is underway; hunt for anomalous file-read requests and path traversal patterns against Atlassian Data Center endpoints in web and application logs since the disclosure date, and assume any internet-exposed instance may already be targeted.
- Leader — Plan: Active exploitation of a CVSS 9.3 flaw is underway, but this is not yet a named systemic event; if your org runs Atlassian Data Center (on-prem, not Cloud), direct engineering to prioritize the patch this week and confirm exposure before it escalates to a board-level incident.
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Atlassian products are near-universal in enterprise environments; a public PoC and confirmed active scanning mean exploitation attempts are live even with low EPSS. Patch all affected Atlassian products to the versions released October 5th and audit web-accessible configuration files for unintended exposure.
- SOC/IR — Act: Active scanning is underway; sweep Atlassian access logs for requests matching arbitrary file-read patterns (path traversal, config file targets) since October 5th, and tune WAF/SIEM rules to alert on exploitation attempts against these endpoints.
- Leader — Skip
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Pre-authentication exploitation with a public PoC and multi-source confirmation of active attacks makes this urgent despite low EPSS. Patch Jira, Confluence, and Bitbucket to the fixed versions immediately; if patching cannot happen within 24-48 hours, isolate or firewall these services from untrusted networks.
- SOC/IR — Act: Active exploitation of unauthenticated Atlassian access means assume-breach posture on any exposed instance. Hunt for anomalous API calls and unauthenticated sessions against Atlassian services since the PoC publication date, and alert on inbound requests matching known exploit patterns.
- Leader — Act: Atlassian tools typically house source code, project roadmaps, and credentials — a pre-auth compromise is a data-exposure risk worth escalating. Confirm whether Jira, Confluence, or Bitbucket instances are internet-facing and verify with engineering that patching is underway this week.
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Active scanning for CVE-2026-61500 with a public PoC means exploitation is imminent for any exposed Rejetto HFS instance; identify and patch or take offline any internet-facing HFS servers immediately.
- SOC/IR — Act: Active scanning is underway — hunt for anomalous authentication or session-related traffic against HFS servers and sweep for signs of session forgery or RCE activity since the scanning began.
- Leader — Skip
- Signals: CVE-2026-61500 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVSS 9.3 with a public GitHub PoC lowers the exploitation bar significantly — unauthenticated reads of known-path files (think web.xml, config files with credentials) in widely-deployed Atlassian Data Center products. Patch all affected self-hosted Atlassian Data Center instances to the latest fixed versions immediately, prioritizing any internet-exposed deployments.
- SOC/IR — Plan: No active exploitation confirmed yet (EPSS 0.01, not KEV-listed), but the public PoC makes opportunistic scanning likely soon. Build detections for anomalous unauthenticated HTTP requests to Atlassian application paths matching known static file locations across Jira, Confluence, and related products.
- Leader — Skip
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: The CVSS 6.5 spoofing label may have caused teams to deprioritize this patch; full technical details are now public, raising PoC risk. Patch SharePoint Server 2016, 2019, and Subscription Edition to the vendor-supplied fix before a PoC materializes.
- SOC/IR — Plan: With detailed exploit mechanics now public, exploitation attempts are more likely in coming weeks. Build or stage SharePoint-targeted authenticated RCE hunt queries now so you can sweep quickly if active exploitation is reported.
- Leader — Skip
- Signals: CVE-2026-65660 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Act: Actively exploited CVSS 10.0 with a public PoC — if you run on-premises VeloCloud Orchestrator with certificate-based Edge authentication, apply Arista’s patch or available mitigations immediately and isolate the VCO management plane from untrusted networks while patching.
- SOC/IR — Act: Active exploitation of a network management appliance means you should assume potential compromise on affected systems; sweep VCO host logs for anomalous internal function invocations or unexpected outbound connections since September 22 and flag any certificate-authenticated VCO instances for immediate IR triage.
- Leader — Plan: Confirm with engineering whether the organization runs on-premises VeloCloud Orchestrator with certificate-based authentication; if so, escalate to engineering for priority patching this week given active exploitation of a maximum-severity flaw in a network control-plane component.
- Signals: CVE-2026-93952 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: The plugin is confirmed exploited in targeted attacks despite no KEV listing; if you run cPanel/WHM with the Acronis Backup plugin on Linux, update to the patched version immediately and audit file permissions on affected hosts.
- SOC/IR — Plan: No IOCs are published yet, but active targeted exploitation warrants building a detection for abnormal privilege escalation events originating from Acronis backup processes on cPanel/WHM Linux hosts; queue a hunt for unusual UID-0 transitions tied to Acronis service accounts.
- Leader — Skip
- Signals: CVE-2026-87886 — CISA KEV: not listed, EPSS n/a, no public PoC found
- Engineer — Act: CVE-2026-85706 is CISA KEV-listed with a public GitHub PoC and confirmed in-the-wild probes — patch GitLab to the fixed release immediately and audit server-side files (secrets, keys, configs) for unauthorized reads since public disclosure.
- SOC/IR — Act: Active exploitation probes are underway; hunt for unauthenticated requests containing path traversal sequences against the GitLab commits API in web/proxy logs going back to the disclosure date, and tune SIEM rules to alert on anomalous API access patterns.
- Leader — Act: Confirm with engineering this week that all self-hosted GitLab instances are patched; if using GitLab.com, request a written statement from GitLab on remediation status — unauthenticated source-code and secret exposure at CVSS 10 with active probes is a material risk worth verifying before it surfaces as a customer or board question.
- Signals: CVE-2026-85706 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: JFrog Artifactory is a core CI/CD artifact store in most cloud-native stacks; this auth bypass (CISA KEV listed, public PoC on GitHub) allows attackers to mint admin tokens and poison artifact repositories. Patch Artifactory to the vendor-fixed version immediately, rotate all existing API tokens, and audit recent token-creation events in Artifactory access logs for unauthorized entries.
- SOC/IR — Act: Active exploitation with CISA KEV listing means assume-breach posture for any org running Artifactory; hunt Artifactory audit logs for unexpected admin-token creation events since the CVE disclosure date, and watch for anomalous package downloads or uploads that may indicate a poisoned repository. Map activity to ATT&CK T1195 (Supply Chain Compromise) and T1550.001 (token abuse).
- Leader — Act: A compromised Artifactory instance is a direct supply-chain risk — malicious packages could propagate to production software. Confirm this week whether your environment runs JFrog Artifactory and that your engineering team has applied the emergency patch; if Artifactory is customer-facing or feeds external releases, prepare a brief for stakeholders on exposure status.
- Signals: CVE-2026-82329 — CISA KEV: listed, EPSS 0.08, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation: if you run Sangoma Switchvox, patch CVE-2026-9586 immediately or isolate the admin interface from untrusted networks until a patch is applied.
- SOC/IR — Act: Attackers are landing reverse shells via unauthenticated exploitation on edge VoIP devices; hunt for anomalous outbound connections originating from Switchvox hosts and sweep for post-exploitation activity (new processes, lateral movement) since the vulnerability became public.
- Leader — Plan: Confirm with engineering whether Switchvox is in the environment; if so, verify patching is prioritized this week given CISA KEV status — not yet a board-level event, but the KEV listing warrants a same-week check-in.
- Signals: CVE-2026-9586 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: A public PoC exists for a root-level RCE in cPanel and WHM affecting all supported versions — update cPanel/WHM to the patched release immediately and verify no unauthorized access occurred on any exposed panels.
- SOC/IR — Plan: With a public PoC now available, write or enable detections for anomalous root-process spawning from cPanel/WHM processes and unusual web requests to the cPanel/WHM management interfaces before exploitation campaigns begin.
- Leader — Skip
- Signals: CVE-2026-65643 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC exists for this unauthenticated file upload RCE (CVSS 9.8) affecting 600,000+ WordPress installs; update Forminator Forms to the patched version immediately and verify no malicious PHP files were uploaded to wp-content directories.
- SOC/IR — Plan: With a public PoC available, exploitation attempts are likely imminent; build or tune WAF/SIEM rules to detect unauthenticated multipart file upload requests to Forminator endpoints and alert on unexpected PHP file creation under wp-content.
- Leader — Skip
- Signals: CVE-2026-15748 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Active exploitation with public PoC — audit your macOS fleet for Screen Sharing (VNC) exposure and apply Apple’s patch immediately; disable Screen Sharing on hosts where it isn’t required.
- SOC/IR — Act: Hunt for unexpected xmrig or Monero miner processes on macOS endpoints and check for anomalous outbound connections to mining pools since the PoC went public.
- Leader — Learn: Active cryptomining campaign on macOS is unlikely to require board-level action, but confirms macOS is not a safe-harbor — useful context for endpoint policy discussions.
- Engineer — Act: Active exploitation attempts against CVE-2026-71362 in Adobe Commerce and Magento have been observed despite low EPSS — if you run either platform, patch immediately and audit recent customer authentication logs for signs of account takeover.
- SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet, but active exploitation is reported; build or tune detections for anomalous authentication patterns and privilege changes on Commerce/Magento instances in your estate.
- Leader — Plan: If your organization or a key e-commerce vendor runs Adobe Commerce or Magento, confirm patching status this week and assess whether customer account data may have been exposed, given the reported exploitation activity.
- Signals: CVE-2026-71362 — CISA KEV: not listed, EPSS 0.00, no public PoC found
- Engineer — Act: Public PoC on GitHub for a CVSS 9.1 unauthenticated RCE across SharePoint Server Subscription Edition, 2019, and 2016 means exploitation risk is immediate even without KEV listing; apply Microsoft’s patch for CVE-2026-55040 across all affected on-prem SharePoint instances this week.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet (EPSS 0.02, no KEV), but a public PoC for unauthenticated RCE warrants building SharePoint-specific detections now — hunt for anomalous unauthenticated requests to SharePoint REST/SOAP endpoints and tune alerts on privilege escalation patterns in SharePoint audit logs before active campaigns emerge.
- Leader — Plan: A CVSS 9.1 unauthenticated RCE with public PoC against widely deployed SharePoint Server warrants confirming on-prem SharePoint scope with your team and ensuring patch prioritization this sprint — escalate to Act if exploitation is observed in the wild.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CISA KEV listed, actively exploited in the wild, and a public PoC exists — patch Cisco ASA and FTD software immediately per Cisco’s advisory for CVE-2026-20349; perimeter firewall availability is at direct risk from unauthenticated remote attackers.
- SOC/IR — Act: Active exploitation of an edge security appliance warrants an assume-breach sweep — hunt for anomalous or malformed HTTP requests targeting ASA/FTD management interfaces and investigate any unexplained firewall availability incidents since this KEV listing date.
- Leader — Plan: A CISA KEV-confirmed flaw in widely deployed perimeter firewalls is a priority patching event — confirm your engineering team has this on the sprint and assess whether any availability SLAs tied to ASA/FTD deployments are at risk; DoS scope limits board-level urgency but warrants direct follow-up with the team.
- Signals: CVE-2026-20349 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CISA KEV-listed, EPSS 0.99, public PoC, and 792 confirmed exploit attempts make this an emergency patch. Apply the Progress Kemp LoadMaster patch immediately or isolate the appliance from untrusted networks until patched.
- SOC/IR — Act: Active exploitation of a perimeter load balancer warrants an assume-breach sweep — hunt for command injection patterns in LoadMaster access logs since the first reported attempts, and check downstream hosts for lateral movement indicators.
- Leader — Act: CISA KEV listing plus confirmed active exploitation makes this a board-question-level appliance vulnerability; confirm this week whether LoadMaster is in your environment and verify engineering has patched or isolated affected instances.
- Signals: CVE-2026-8037 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
- Engineer — Act: A public PoC for a guest-to-host escape in KVM/x86 exists on GitHub — this breaks VM isolation and affects any Linux host using KVM (cloud workloads, CI runners, on-prem virtualization). Identify your kernel version, check vendor advisories for a patched kernel, and prioritize upgrading hypervisor hosts.
- SOC/IR — Learn: No active exploitation or published IOCs yet, so no immediate hunt is warranted; however, understanding the escape class is useful for future detection design around anomalous host-side activity originating from guest processes.
- Leader — Skip
- Signals: CVE-2026-64561 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-18577 is CISA KEV-listed with a public PoC and confirmed active exploitation — patch N-central immediately to the vendor-specified fixed version, and audit logs for unauthorized access since the vulnerability affects both hosted and on-premises deployments.
- SOC/IR — Act: Active exploitation of N-central means assume-breach posture for any org running it — sweep for anomalous authentication events on N-central servers and hunt for lateral movement originating from managed endpoints, as compromise of an RMM tool gives attackers broad access to managed devices.
- Leader — Act: N-central is an RMM platform used by MSPs; if your organization or any MSP managing your environment runs it, request an immediate attestation of patch status and review whether threat actors could have used it as a pivot into your estate — this is the type of systemic MSP-chain risk worth a brief to leadership this week.
- Signals: CVE-2026-18577 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: A public PoC on GitHub for a no-interaction arbitrary code execution flaw in Firefox’s renderer means drive-by exploitation is immediately practical; update Firefox to 151.0.3 across all managed endpoints and verify Tor Browser is similarly patched or blocked.
- SOC/IR — Plan: With a public PoC now circulating, watering-hole operators may weaponize this quickly; build or tune detections for unexpected child processes spawned from the Firefox renderer process and prepare a hunt query scoped to the weeks before the 151.0.3 fix shipped.
- Leader — Skip
- Signals: CVE-2026-10702 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: The patched Adobe Acrobat Chrome extension (CVE-2026-48294) could allow malicious sites to silently read WhatsApp Web session data; public PoC exists but EPSS is 0.01 and KEV-unlisted. Audit enterprise browser policies and confirm the extension has been updated to the patched version across managed endpoints.
- SOC/IR — Learn: No active exploitation campaign or IOCs published; the HermeticReader attack chain demonstrates how a privileged browser extension can be abused to silently cross-read web app data — useful context for evaluating browser extension detection coverage but no immediate hunt or rule-write warranted.
- Leader — Skip
- Signals: CVE-2026-48294 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2026-0257 is CISA KEV-listed with EPSS 0.87 and a public PoC; Qilin actors are actively using it as initial access via PAN-OS portal and gateway. Patch PAN-OS to the fixed release immediately and audit gateway/portal access logs for unauthorized sessions since June 2026.
- SOC/IR — Act: Qilin (Agenda) ransomware operators are actively exploiting PAN-OS edge devices as a beachhead — assume-breach sweep is warranted on any PAN-OS-fronted environment. Hunt for Qilin TTPs and lateral movement artifacts dating back to June 2026, and tune EDR/SIEM detections for Agenda ransomware staging behavior.
- Leader — Act: Qilin ransomware is actively deploying via a widely-used firewall/VPN product; this is board-question-level exposure if your organization runs PAN-OS. Confirm patch status with your engineering team this week and prepare a brief for leadership on whether any environment may have been affected during the June 2026 exploitation window.
- Signals: CVE-2026-0257 — CISA KEV: listed, EPSS 0.87, public PoC on GitHub
- Engineer — Plan: A privilege escalation CVE in OpenClaw warrants patching, but with no KEV listing, public PoC, or EPSS signal in the enrichment data, exploitation pressure is unconfirmed — schedule a patch to the latest fixed version within your normal critical-patch window and verify if OpenClaw is present in your environment.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Patches are available for Cursor, Codex, and Gemini CLI; update all three and audit any AI agent file-write permissions to ensure automated pipelines don’t blindly execute AI-generated scripts. No active exploitation is reported and no KEV/PoC signals present, so this is patch-cycle priority rather than emergency.
- SOC/IR — Learn: The attack class — an AI agent writing files that trusted host tools later execute — is a novel indirect execution path worth understanding for future detection work, but this disclosure provides no IOCs, no ATT&CK mapping, and no evidence of in-the-wild exploitation to act on now.
- Leader — Plan: Multiple widely-used AI coding assistants were found to have sandbox escapes; inventory which tools developers are using, confirm patched versions are deployed, and this quarter establish a policy requiring approved-tool lists and update cadence for AI development tooling before broader enterprise rollout.
- Engineer — Act: NGINX is near-universal in cloud stacks and a public PoC already exists on GitHub, lowering the bar for exploitation despite low EPSS. Upgrade to nginx 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1, before the PoC matures into a weaponized exploit.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-42533 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2026-15719 has a public PoC on GitHub and Mozilla acknowledges public exploit code exists; update Firefox to the patched release immediately across all managed endpoints and developer workstations.
- SOC/IR — Plan: With public exploit code confirmed for Firefox WebAssembly and DOM navigation flaws, build or tune detections for browser exploitation patterns (unusual child processes, suspicious renderer crashes) and prepare to hunt if active exploitation is reported.
- Leader — Skip
- Signals: CVE-2026-15718 — CISA KEV: not listed, EPSS 0.00, no public PoC found · CVE-2026-15719 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: Dnsmasq is embedded in Kubernetes nodes, containers, and network appliances at scale; six CERT-issued serious CVEs warrant auditing all deployments and scheduling patches as soon as vendor-specific builds are available — no exploitation signals yet, but the network-accessible attack surface (DNS/DHCP) is historically high-value.
- SOC/IR — Skip
- Leader — Learn: Noteworthy as a potential systemic risk given dnsmasq’s ubiquity in Linux and embedded network gear, but without confirmed exploitation or a Log4Shell-scale event there is no leadership action required today — confirm teams are tracking patches.
- Engineer — Plan: MinIO is widely deployed as self-hosted S3-compatible storage in Kubernetes environments; the vendor’s refusal to ship patched Docker images means the standard
docker pullupdate path will not remediate CVE-2025-62506. Engineers running MinIO via Docker should plan to build from source or use official binary releases to obtain the fix, and track the issue — public PoC raises exposure even at EPSS 0.01. - SOC/IR — Skip
- Leader — Learn: The vendor’s policy of withholding patched Docker images is a meaningful vendor security posture signal worth noting in vendor risk reviews if MinIO is in your stack, but low EPSS and no KEV listing mean this does not rise to executive action yet.
- Signals: CVE-2025-62506 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Learn: Notable milestone — Rust in the kernel is not immune to CVEs; no exploitation signals, PoC, or KEV listing, so no immediate patching action, but worth tracking this new vulnerability class as Rust kernel code expands.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: A public PoC exists for this critical langchain-core flaw, making exploitation practical for any AI pipeline that processes untrusted input; audit Python environments and upgrade langchain-core to the patched release immediately.
- SOC/IR — Plan: No active exploitation campaign observed (EPSS 0.14, not KEV-listed), but the public PoC warrants building detections for anomalous subprocess or file-system activity spawned from LangChain worker processes before exploitation picks up.
- Leader — Skip
- Signals: CVE-2025-68664 — CISA KEV: not listed, EPSS 0.14, public PoC on GitHub
- Engineer — Learn: High community engagement (712 HN points) suggests a substantive technical incident post-mortem worth reading, but the summary contains no software names, patch targets, or affected versions — read the full post to determine if it touches systems you run.
- SOC/IR — Learn: No IOCs, TTPs, or detection surface are visible in the summary; if the linked post-mortem contains campaign or exploitation details, revisit for detection value after reading.
- Leader — Skip
- Engineer — Act: GoAnywhere MFT is a common enterprise managed-file-transfer appliance; CISA KEV listing plus EPSS 1.00 plus a public GitHub PoC means exploitation is active now. Patch to the vendor-fixed release immediately or take the instance offline until patching is complete.
- SOC/IR — Act: Prior GoAnywhere exploitation by Cl0p hit hundreds of organizations; treat any unpatched instance as potentially compromised. Hunt for anomalous outbound transfers, newly created admin accounts, and lateral movement originating from GoAnywhere servers since the PoC became public.
- Leader — Act: The 2023 Cl0p GoAnywhere campaign was a marquee supply-chain breach; this CVE matches or exceeds that severity signal (EPSS 1.00, KEV-listed). Confirm this week whether your org or critical MFT vendors run GoAnywhere and obtain patch attestations before history repeats.
- Signals: CVE-2025-10035 — CISA KEV: listed, EPSS 1.00, public PoC on GitHub
- Engineer — Act: EPSS 0.93 plus a public GitHub PoC makes exploitation practical now — patch the Linux kernel to the distro-provided fixed package (check RHEL, Ubuntu, Debian advisories) across all Linux hosts and container base images within your patch window.
- SOC/IR — Act: With a public PoC and EPSS 0.93, exploitation attempts are likely imminent; hunt for anomalous privilege escalation events on Linux endpoints since PoC publication and tune EDR/SIEM rules for kernel LPE behavior patterns.
- Leader — Plan: A second high-severity Linux LPE with a public PoC in eight days signals a pattern worth tracking; confirm your Linux patch cadence will address this within days and assess the size of your externally accessible Linux estate.
- Signals: CVE-2026-43284 — CISA KEV: not listed, EPSS 0.93, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE on a widely-deployed internet-facing MTA with a public PoC on GitHub demands immediate action regardless of low EPSS — Exim has a history of mass exploitation. Patch Exim to the version addressing CVE-2026-45185; if no patch is yet available, restrict SMTP exposure at the network layer while tracking vendor advisory.
- SOC/IR — Plan: No active exploitation confirmed in enrichment signals, but a public PoC for pre-auth RCE on an internet-facing mail server shortens the window — build or stage Exim-specific detections (unusual child processes spawned from the Exim process, unexpected outbound connections from mail servers) before exploitation ramps up.
- Leader — Skip
- Signals: CVE-2026-45185 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listed, EPSS 0.96, and public PoC on GitHub — exploitation is active and practical. Identify your container runtime version, patch to the fixed release immediately, and audit container environments for signs of exploitation.
- SOC/IR — Act: Active exploitation confirmed via CISA KEV; hunt for container escape and unexpected privilege escalation events in your EDR and container logs since the PoC dropped in early May 2026, and tune detections for abnormal rootless container behavior.
- Leader — Plan: CISA KEV listing and near-perfect EPSS signal active exploitation in the wild; confirm with engineering that all container runtime deployments are on a patched version and add this to the sprint’s prioritized patch list.
- Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.96, public PoC on GitHub
- Engineer — Plan: Kernel privilege-escalation vulnerability with a public PoC but EPSS of 0.01 and no KEV listing indicates no active exploitation yet; apply the Apple security update for macOS 26.5 in your next patching cycle, prioritizing any macOS-based CI/CD or developer endpoints where LPE would be high-impact.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-28952 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Public PoC exists for a symlink-based sandbox escape in Claude Code, which engineers and CI/CD pipelines commonly run; update Claude Code to the patched release immediately and audit any pipelines that invoke it with elevated filesystem access.
- SOC/IR — Learn: Low EPSS (0.01) and no active exploitation campaign; no IOCs or ATT&CK-mappable TTPs are provided, but the symlink sandbox-escape technique is worth noting if Claude Code runs in monitored developer environments.
- Leader — Skip
- Signals: CVE-2026-39861 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: KEV-listed zero-day actively exploited in Chrome’s CSS engine; update Chrome/Chromium to the patched stable release immediately and verify managed browsers in your fleet are on the latest version.
- SOC/IR — Act: Active in-the-wild exploitation means assume-breach posture for any endpoint running unpatched Chrome; hunt for suspicious child processes or unusual network connections from Chrome since the February 2026 stable release date, and check EDR telemetry for exploitation indicators.
- Leader — Plan: CISA KEV listing confirms active exploitation of a Chrome browser zero-day; validate that your IT/engineering teams have a forced browser-update mechanism and confirm rollout completion — this is routine but warrants a status check given KEV designation.
- Signals: CVE-2026-2441 — CISA KEV: listed, EPSS 0.22, public PoC on GitHub
- Engineer — Plan: Public PoC exists for a guest-to-host VM escape in KVM/x86, meaning any Linux host running KVM hypervisors is potentially exposed; patch your kernel to a fixed version once available and audit whether untrusted VMs run on shared KVM hosts.
- SOC/IR — Learn: No active exploitation or IOCs reported yet; monitor for exploitation activity targeting KVM hosts, but no detection work is actionable until TTPs or exploitation patterns emerge.
- Leader — Skip
- Signals: CVE-2026-53359 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub