Zero-days, CVEs, and the things actively hitting the wild. Read these when the clock is ticking.
27 dispatches · 25 still on the board · latest 17 SEP 2026
What gets filed here
Full archive →What is actively breaking, being exploited, or needs patching before you go to bed.
Insecure file permissions in Acronis's cPanel & WHM plugin and Plesk extension let a low-privilege local user escalate to root. Exploited in the wild in limited, targeted attacks; fixed builds are out now.
A single crafted request to an unauthenticated REST endpoint in Cisco Identity Services Engine bypasses the management interface entirely and lands at root. CVSS 10, actively exploited, no workarounds. CISA's federal due date is Saturday.
A SQL injection in Cisco Secure Email Gateway's AsyncOS email parser lets an unauthenticated attacker run arbitrary commands as root by delivering a single crafted email. No login, no exotic ports — just SMTP. CISA added it to KEV on 2026-09-14 with a due date of 2026-09-17.
An unauthenticated path traversal in GitLab's repository commits API reads arbitrary files off self-managed CE/EE. Fixed Sept 10 in 19.3.2 / 19.2.6 / 19.1.8, on KEV with a federal due date of Sept 14 — and watchTowr's honeypots are already seeing behavioral probes.
Two patched JFrog Artifactory flaws chain into unauth-to-admin in under five minutes, CISA put both on KEV with a Sep 25 due date, and Wiz found attackers installing Groovy plugins and a custom Rust backdoor that reportedly outlived patching.
CERT Polska disclosed six RouterOS vulnerabilities found with GPT-5.5-cyber; two chain into zero-auth full device takeover when SSH is internet-reachable, both are on KEV with a Sep 13 due date, and the patched build scans your config for signs of compromise.
Five days after our last Chrome zero-day post, Google patched a second exploited V8 bug — rated Medium by the vendor with no vector of its own, and CISA added it to KEV the next day. Browser patching is a cadence problem now.
An unauthenticated auth bypass in Citrix NetScaler ADC/Gateway landed on CISA's KEV catalog with a Sep 12 due date and a forensic-triage requirement. The vendor published exact config strings to grep before you patch.
CVE-2026-86218 is a CVSS 10.0 pre-auth RCE in N-able's on-prem RMM appliance, fixed in 2026.3 Hotfix 4 (build 2026.3.1.14) and now on KEV with a September 11 due date. Hosted customers are patched; self-hosted ones need to move tonight.
A missing authorization check on the logical-decoding path means any account with REPLICATION can dlopen an arbitrary file as the postgres OS user — 12 years old, fixed this month, and not even on KEV yet. Fix your box tonight.
IXON's OT-focused VPN client writes config from a local endpoint that checks no credentials, then feeds it to a root subprocess with CRLF un-neutralized. CVSS 9.6 — and the injected config survives reboots while your VPN keeps working perfectly.
A type-confusion bug in V8's Maglev compiler turns an ordinary sort() into arbitrary read/write on the JS heap. Fixed in 152.0.7977.82, actively exploited, and it's the sixth of these this year.
Ignition <= 8.1.53 ships its 'Create Project Role(s)' gateway setting empty — and in Ignition, empty means 'anyone.' CVE-2026-77393 (CVSS 8.8) is the five-minute config check your SCADA box has been waiting for.
CVE-2026-59822 lets an unauthenticated attacker open an authenticated LiteLLM MCP session with a fabricated Authorization header — the OAuth2 passthrough fallback replaced failed key validation with an empty auth object. CVSS v4 8.8, fixed in 1.84.0, on KEV with a Sep 16 due date.
CVE-2026-83548 is a pre-auth CVSS 10.0 SSRF in the SMA1000 Work Place interface that chains with post-auth command injection into unauth RCE on internet-facing remote-access gateways. Exploited in the wild, KEV due date Sep 5.
Sygnia's Fire Ant update shows a China-nexus actor PLT-hooking accept() inside a running tac_plus process to harvest admin credentials, while turning Cisco IOS XR routers into covert PCAP collectors.
CVE-2026-16347 (CVSS 8.8) hits every version of RouterOS: the API auth path has no real rate-limiting, lockout, or source restriction, so admin credentials can be hammered at high volume. CISA published ICSA-26-209-05 with a mitigation checklist that is the whole post.
SAB-067 covers 22 vulnerabilities across the entire UniFi line, three of them CVSS 10.0 unauth flaws — including a CRLF auth-bypass on UniFi OS that chains into RCE. Fixes for everything are out; the update order matters.
A ~$63 Chinese wireless USB print server whose entire job is to sit on your LAN and share a dumb printer just got a CISA ICS advisory: three CVEs, two of them CVSS 9.8 with no authentication required. All fixed in firmware 2.1.240. If you own one, patch it and VLAN it.
ICSA-26-239-05 rates the under-$40 Ebyte NA111-M RS485-to-Ethernet gateway with 13 CVEs on firmware 9013-2-17 — six of them CVSS 9.8, including an unauthenticated admin interface and cleartext MQTT. If you bolt one onto a PLC, a printer, or an e-bike, read this.
An actively-exploited zero-day in PaperCut NG/MF affects every supported version. The alert came from a university's forensics team, an emergency patch for v25/v26 shipped the next morning, hardened Release 2 for every branch followed by 10:08pm AEST on Aug 28, and it published two new CVEs plus concrete IOCs to hunt.
A delegated authentik user manager can grant themselves admin-equivalent by assigning arbitrary groups, including is_superuser=True, via the user API. No KEV, no confirmed in-the-wild — but if you run delegated admins, check your SSO.
CVE-2026-8452 is a Citrix NetScaler flaw the vendor rated as high-severity DoS, but watchTowr Labs demonstrated unauthenticated RCE. CISA added it to KEV Aug 26 with a Saturday due date.
A Git hook planted through Gitea's diffpatch endpoint gives unauthenticated attackers RCE as the Gitea service account. ~5,000 instances are exposed and the KEV due date is today.
A 2023 ownCloud flaw lets anyone who knows a username mint pre-signed URLs and touch any file. CISA just added it to KEV — your ownCloud has probably been quietly vulnerable for three years.
August Patch Tuesday shipped hundreds of CVEs, one of them an exploited zero-day in afd.sys — the fourth in four years.
CISA added a Broadcom VMware vCenter vulnerability to the Known Exploited Vulnerabilities catalog with a 46% EPSS. If you run vCenter, you know the drill.