Network-Appliance
CVE-2026-58658: GPUStack Worker Ports Leaked LLM Prompts and Completions With No Authentication
GPUStack, an open-source GPU cluster manager for vLLM/SGLang/TensorRT-LLM inference, shipped worker debug and log-streaming endpoints with zero authentication — letting anyone who can reach the worker port read live prompts, completions, and memory profiles.
CVE-2026-15409 & CVE-2026-15410: SonicWall SMA1000 Zero-Days Chained for Unauthenticated RCE, CISA Deadline July 17
Two SonicWall SMA1000 zero-days — a CVSS 10.0 SSRF and a post-auth code injection flaw — are being chained in the wild for unauthenticated remote code execution. CISA KEV deadline is July 17, 2026.
Six U-Boot Flaws Let Malicious Firmware Images Execute Code Before Signature Verification Ever Runs
Binarly found six bugs in U-Boot's FIT image parser — two lead to code execution, four to denial of service — and all six trigger while the bootloader is still reading an untrusted image, before it checks the signature that's supposed to protect it.
Progress Tells ShareFile Customers to Power Down Storage Zone Controllers Over 'Credible' Threat
Progress Software is telling on-prem ShareFile Storage Zone Controller admins to physically shut down their Windows servers over an unnamed 'credible external security threat' — no CVE, no patch, no explanation.
Zimbra Patches Classic Web Client Stored XSS Reported by Google TAG
Zimbra shipped 10.1.19 to fix an unauthenticated stored XSS in the Classic Web Client, reachable by simply opening a crafted email — no CVE assigned yet, reported by Google's Threat Analysis Group.
Ubiquiti's Bulletin 066: A CVSS 10.0 in UniFi Connect Leads 25 Flaws Across the Whole UniFi Line
Ubiquiti Security Advisory Bulletin 066 discloses 25 vulnerabilities across UniFi Connect, Talk, Access, Protect, and UniFi OS — headlined by CVE-2026-50746, a CVSS 10.0 unauthenticated command injection reachable on ~100,000 internet-facing endpoints.
CVE-2026-11405: Undocumented Admin Backdoor in Tenda Router Firmware, No Patch Available
CERT/CC disclosed a hardcoded backdoor password mechanism in Tenda router firmware that grants full admin access regardless of the real password — Tenda has not responded to coordination attempts since May, and there is no patch.
SimpleHelp OIDC Auth Bypass (CVE-2026-48558) Under Active Exploitation, Deploying Djinn Stealer Against Dev Credentials
A critical unsigned-token flaw in SimpleHelp RMM's OIDC login is being exploited to plant a cross-platform infostealer that hunts for cloud, source-control, and AI-assistant credentials.
Adobe ColdFusion APSB26-68: Six CVSS 10.0 Flaws, and Exploitation Started Within Hours
Adobe's APSB26-68 bulletin patches 11 ColdFusion flaws — six rated CVSS 10.0 — including a Remote Development Services path-traversal bug (CVE-2026-48282) that attackers began probing within hours of disclosure.
CVE-2026-8451: A New CitrixBleed-Pattern Memory Overread Is Already Under Active Exploitation
Citrix patched CVE-2026-8451, a pre-auth memory overread in NetScaler's SAML IdP parser that leaks session tokens — and attackers were already exploiting it within 24 hours of disclosure.
CVE-2026-8037: Pre-Auth Root RCE in Progress Kemp LoadMaster Now Under Active Exploitation
CVE-2026-8037, a CVSS 9.8 uninitialized-heap flaw in Progress Kemp LoadMaster's escape_quotes() function, lets unauthenticated attackers run root commands on the load balancer's management API. eSentire observed exploitation attempts starting June 29.
Ubiquiti UniFi OS Server Triple-CVE Chain Enables Unauthenticated Root RCE
Three max-severity CVEs (2026-34908/09/10) in UniFi OS Server chain from an Nginx auth bypass to root command injection — CISA added all three to KEV on June 23 amid Mirai/Gaafgyt botnet exploitation.
Squidbleed: 29-Year-Old Heap Over-Read in Squid Proxy Leaks Cleartext HTTP Traffic (CVE-2026-47729)
A Heartbleed-style heap buffer over-read in Squid's FTP gateway, tracing to a 1997 commit, lets trusted proxy users drain other users' cleartext HTTP requests including credentials, cookies, and session tokens.
Arista EOS CVE-2026-7473: Tunnel Decap Flaw Bypasses Segmentation — and Arista Won't Patch It
CVE-2026-7473 lets an unauthenticated attacker push arbitrary tunneled traffic through Arista data-center switches that decapsulate it without checking the protocol. Exploited in the wild, on CISA's KEV list with a deadline of today — and Arista has confirmed no patch is coming.
Anatomy of the Interlock Campaign: How a ClickFix Gang Learned to Burn Firewall Zero-Days
For a year, the surest way to get hit by Interlock was to paste a command into your own Run dialog. On January 26, 2026, the group stopped waiting for users to make mistakes and started exploiting a pre-auth, root-level Cisco firewall zero-day instead. The same crew now runs both ends of the sophistication ladder — and that should change how you model initial access.
The Edge Device Audit: Turn CISA's BOD 26-02 Into a Playbook You Can Actually Run
CISA's BOD 26-02 just handed every infrastructure team a free edge-device audit checklist. Here is how to run it on your own network — inventory, version, exposure, and end-of-support triage — before an attacker runs theirs.
F5 BIG-IP APM Flaw Silently Upgraded from DoS to RCE — Now Actively Exploited
A five-month-old F5 BIG-IP APM bug just got reclassified from denial-of-service to pre-auth RCE. Attackers didn't wait for the memo.
Your Firewall Is the Foothold: Q1 2026's Edge Device Exploitation Epidemic
Three months into 2026, edge devices are the dominant entry point for attackers. A deep dive into the FortiGate SSO bypass and Ivanti EPMM RCE chains, and why this pattern shows no signs of stopping.
Cisco FMC Zero-Day Exploited by Interlock Ransomware for 36 Days Before Disclosure
CVE-2026-20131 scores a perfect CVSS 10.0. Interlock ransomware had 36 days of free rein before Cisco went public.