🚨 ACTIVE EXPLOITATION
CISA adds exploited Ivanti Connect Secure auth bypass zero-day CVE-2026-104935 to KEV
CVE-2026-104935
CISA added actively exploited Ivanti Connect Secure zero-day CVE-2026-104935, an authentication bypass allowing remote unauthenticated command execution, to its KEV catalog.- Affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; fixed in 25.1.3.0.
- High-severity (CVSS 8.6) authentication bypass by spoofing (CWE-290) allowing remote unauthenticated attackers to execute arbitrary commands.
- Exploited as a zero-day before disclosure; attackers use it for credential theft and data exfiltration.
- CISA added it to the KEV Catalog on Oct 13, 2026, with federal patching due Oct 16, 2026.
- Volexity reports the threat actor also chained an as-yet unpatched privilege escalation vulnerability; commands execute in memory, so Ivanti's Integrity Checker Tool may miss exploitation.
CISA adds actively exploited Chrome V8 zero-day CVE-2026-85046 to KEV catalog
CVE-2026-85046
CISA has added actively exploited Chrome V8 type confusion zero-day CVE-2026-85046 to its KEV catalog.- Affects Google Chrome prior to 152.0.7977.82 and all Chromium-based browsers including Microsoft Edge and Opera
- V8 type confusion (CWE-843, CVSS 8.8) in Maglev/Turbofan inline Array.prototype.sort allows arbitrary code execution inside the sandbox via a crafted HTML page
- Exploitation requires user interaction, e.g. visiting a malicious or compromised page; Google confirmed exploitation in the wild but published no IOCs
- Fixed in Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux), released September 3, 2026; KEV patch deadline is 2026-09-18
- Reported by Salvatore Gulizia (Serotav); it is Chrome's sixth exploited zero-day of 2026
CISA adds exploited Chrome V8 zero-day CVE-2026-87491 to KEV catalog
CVE-2026-87491
CISA has added CVE-2026-87491, an actively exploited out-of-bounds write zero-day in Google Chrome's V8 engine, to its KEV catalog.- Affects Google Chrome versions prior to 153.0.8010.36 on Windows, macOS, and Linux, plus Chromium-based browsers like Microsoft Edge and Opera that embed the vulnerable V8 engine.
- The flaw (CWE-787, out-of-bounds write in V8) lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page; CVSS 8.8.
- Exploitation requires no authentication — victims are lured via phishing links, compromised sites, or malicious ads into loading attacker-controlled JavaScript.
- Multiple China-linked actors (TA412/APT31, UTA0560, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket, Violet Typhoon) have used a shared exploit kit called BlueMoon, chaining CVE-2026-85046, CVE-2026-87491, and Windows kernel zero-day CVE-2026-85880 for sandbox escape and privilege escalation.
- BlueMoon attacks since August 28, 2026 have targeted NGOs, aerospace/defense, mining, manufacturing, government, and finance in the US, China, Indonesia, Singapore, Vietnam, and Hong Kong, delivering GRIMWEDGE, SUPERSTOMP, ShadowPad, and Rust-based loaders; CISA remediation deadline is September 23, 2026.
Citrix NetScaler zero-days CVE-2026-88771/88772 exploited; SAML flaw CVE-2026-88779 disclosed
CVE-2026-88771CVE-2026-88772CVE-2026-88779
Citrix confirmed and patched two actively exploited zero-day RCE vulnerabilities in NetScaler ADC and Gateway, with a third exploited SAML denial-of-service flaw disclosed days later.- Applies to customer-managed Citrix NetScaler ADC and NetScaler Gateway appliances; roughly 40,000-50,000 instances were internet-exposed at disclosure.
- CVE-2026-88771 (unauthenticated RCE, CVSS 9.5) and CVE-2026-88772 (DTLS pre-auth memory overflow, RCE or DoS) were exploited in the wild before disclosure; Citrix patched both in bulletin CTX697096 on September 27, 2026.
- CVE-2026-88779, a buffer overflow affecting SAML SP or IdP configurations (config contains add authentication samlAction or add authentication samlIdPProfile), causes DoS, is exploited in targeted attacks, and requires newer fixed builds (14.1-73.41, 13.1-64.28) than the September patches.
- Exploitation of CVE-2026-88772 began by early September 2026, hitting government, financial services, education, and legal/professional services organizations in North America and Europe; custom malware WHIPSHOT (PHP webshell) and SLAPSHOT (Python tunneler) were deployed with lateral movement and data exfiltration observed.
- The incident was dubbed "PitScaler"; researchers at watchTowr and Kevin Beaumont confirmed the flaws, and CISA added all three CVEs to its KEV catalog.
StyleSmuggler CVE-2026-75650: critical Magento/Adobe Commerce zero-day RCE actively exploited
CVE-2026-75650
A maximum-severity unauthenticated remote code execution zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4, 2026, three days before Adobe released a hotfix.- Affects Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3, and Magento Open Source 2.4.6–2.4.9; CVSS 10.0, added to CISA's KEV catalog.
- Exploitation grants unauthenticated attackers arbitrary code execution; active attacks began September 4, 2026, with multiple victim stores confirmed across campaigns.
- Attackers inject PHP code via style properties in Magento's template engine; the code executes when a 'Payment Transaction Failed Reminder' transactional email renders, with no authentication required.
- A Rust backdoor implant is installed at ~/.local/share/.gvfsd/gvfsd-user, masquerading as [kworker/u:8:0], fc-cache, or chronyd, with cron-based persistence and x86-64/arm64 support.
- C2 traffic is disguised as NTP: UDP port 123 beacons to 99.84.67.186 and 185.157.160.251 (ntp.timesync.to and related domains); Adobe hotfix VULN-39341 shipped September 7 via APSB26-146.
KEV: CVE-2025-25249 — Fortinet Multiple Products — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
CVE-2025-25249
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with C
📎 Coverage: nvd.nist.gov · 👁 via CISA KEVKEV: CVE-2025-39682 — Linux Kernel — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
CVE-2025-39682
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using inc
📎 Coverage: nvd.nist.gov · 👁 via CISA KEVKEV: CVE-2025-61624 — Fortinet Multiple Products — Fortinet Multiple Products Path Traversal Vulnerability
CVE-2025-61624
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Required action: Apply mitigations in accordance
📎 Coverage: nvd.nist.gov · 👁 via CISA KEVKEV: CVE-2026-0322 — Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Code Injection Vulnerability
CVE-2026-0322
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s
📎 Coverage: nvd.nist.gov · 👁 via CISA KEVKEV: CVE-2026-104286 — Fortinet FortiMail — Fortinet FortiMail Path Traversal Vulnerability
CVE-2026-104286
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Required action: Apply mitigations in accordance w
📎 Coverage: nvd.nist.gov · 👁 via CISA KEV↑ UPDATE | 🔥