Zero-Day

vulnerabilities 2026-11-13
Check Point Gaia CVE-2026-123039: DynamicCLI Root Zero-Day Chained With PHP2Shell to Backdoor Gateways and Wipe ESXi
Attackers used PHP2Shell against Check Point Mobile Access portals, then an unauthenticated root socket in Gaia's DynamicCLI daemon (CVE-2026-123039), to backdoor gateways and wipe VMware ESXi hosts. Install the November Jumbo Hotfix and hunt for compromise.
active-exploitation zero-day network-appliance privilege-escalation backdoor vpn
vulnerabilities 2026-11-12
N-able N-central Under Siege: 4EverAble2Shell and Agent2Shell Bypass Hotfix 2 Days After the Able2Shell Zero-Day Dump
A researcher's Able2Shell dump of 33 alleged N-central zero-days forced N-able to take its hosted RMM cloud offline; new 4EverAble2Shell (root RCE) and Agent2Shell (SYSTEM on managed Windows endpoints) chains reportedly defeat the November 10 Hotfix 2.
zero-day active-exploitation rce privilege-escalation authentication-bypass supply-chain
vulnerabilities 2026-11-11
Xen Orchestra VSA-2026-062: Empty-Object Cookie Auth Bypass Exploited to Take Over XCP-ng Pools
Vates warns that a critical Xen Orchestra auth bypass, triggered by a single crafted cookie, is being exploited to gain admin access and root on managed XCP-ng hosts.
active-exploitation authentication-bypass virtualization xen zero-day
vulnerabilities 2026-11-05 Critical
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
zero-day active-exploitation network-appliance cisa-kev rce memory-corruption
vulnerabilities 2026-11-03 High
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
ivanti vpn zero-day privilege-escalation network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-29
Cisco ASA and FTD Second SSL VPN Zero-Day Since August: CVE-2026-76418 Reloads Firewalls via Secondary Authentication Logic Flaw
Cisco patched CVE-2026-76418, an actively exploited unauthenticated flaw in ASA and FTD Remote Access SSL VPN that lets attackers force firewall reloads when secondary authentication is configured.
active-exploitation zero-day network-appliance vpn denial-of-service
vulnerabilities 2026-10-24
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Exploited in the Wild, Third VCO Zero-Day in Four Months
CISA added Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 (CVSS 9.9) to KEV; any authenticated user can escalate to operator-level superuser on on-prem deployments.
zero-day active-exploitation cisa-kev network-appliance privilege-escalation sd-wan
vulnerabilities 2026-10-22
Two CVSS 9.0 Linux KSMBD RCE Flaws Hit a Public Mailing List Before Any Kernel Fix Existed
Trend Micro ZDI reports for two CVSS 9.0 KSMBD flaws, one pre-authentication, were mistakenly posted to the public Linux kernel list with no mainline fix and no CVE assigned.
linux-kernel linux rce smb zero-day disclosure
vulnerabilities 2026-10-21 Critical
PHP2Shell: Leaked CVE-2026-109618 and CVE-2026-109619 Give Unauthenticated RCE in the PHP Engine
Two CVSS 9.2 flaws in the PHP engine leaked ahead of coordinated disclosure; PHP shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as exploit attempts appeared.
rce php zero-day active-exploitation web-server memory-corruption
vulnerabilities 2026-10-20
Unpatched Broadcom WPS Flaw Gives Radio-Range Root on ISP Gateways, No Password Required
Researcher Quentin Kaiser showed at Hexacon that Broadcom's proprietary Wi-Fi Protected Setup code can be corrupted by crafted packets, giving an attacker in radio range root code execution on home gateways with no Wi-Fi password. No CVE has been assigned.
network-appliance rce unpatched firmware wireless zero-day
deep-dives 2026-10-18
Patching Is Not Eviction: What Ivanti, BeyondTrust, and NetScaler Teach Us About Post-Patch Compromise
Three edge-appliance zero-days in six weeks, three different persistence models, and one shared lesson: the patch closes the door but doesn't remove whoever is already inside. A practical playbook for compromise assessment after you upgrade.
network-appliance zero-day incident-response detection-engineering cisa-kev infrastructure-hardening
vulnerabilities 2026-10-16 Critical
BeyondTrust Remote Support CVE-2026-102764: Unauthenticated File-Operation Zero-Day Exploited by China-Linked Armory Castle
A CVSS 4.0 9.3 unauthenticated flaw in self-hosted BeyondTrust Remote Support has been exploited since late August by a China-linked cluster Google tracks as Armory Castle; patch BT26-05-RS and assume compromise on exposed appliances.
zero-day active-exploitation cisa-kev remote-access apt network-appliance
vulnerabilities 2026-10-16
October Patch Tuesday Hits a Record ~1,400 CVEs; Windows Shell Mark-of-the-Web Zero-Day Exploited
Microsoft's largest Patch Tuesday yet fixes roughly 1,400 CVEs, including an actively exploited Windows Shell Mark-of-the-Web bypass and two publicly disclosed .NET-related zero-days.
microsoft patch-tuesday zero-day active-exploitation cisa-kev windows
vulnerabilities 2026-10-15
Palo Alto PAN-OS CVE-2026-0322: Management Interface Code Injection Gives Root on Firewalls, Exploited as Zero-Day
Palo Alto Networks patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker run code as root; limited exploitation observed and CISA has added it to KEV.
palo-alto pan-os zero-day active-exploitation cisa-kev rce network-appliance
vulnerabilities 2026-10-14 High
Ivanti Connect Secure CVE-2026-104935: Auth-Bypass Zero-Day Chained to Root by UTA0576, Added to CISA KEV
Ivanti patched an authentication-bypass-by-spoofing zero-day in Connect Secure that Volexity saw chained with a still-unpatched privilege escalation for root access. CISA added it to KEV with an October 16 deadline.
ivanti vpn zero-day authentication-bypass network-appliance active-exploitation cisa-kev
vulnerabilities 2026-10-05
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
active-exploitation cisa-kev zero-day network-appliance authentication-bypass vpn
vulnerabilities 2026-10-04
Zammad CVE-2026-102489 and CVE-2026-102490: Session Hijack to Root Chain Exploited in DIVD Breach
Two Zammad zero-days chain a session hijack into RCE and local root; DIVD says an autonomous AI agent used them to breach its network, CISA added both to KEV, and the root flaw reportedly has no patch.
zero-day active-exploitation cisa-kev rce privilege-escalation authentication-bypass
vulnerabilities 2026-10-01
FortiMail CVE-2026-104286: Unauthenticated Path Traversal Exploited as Zero-Day
Fortinet confirms in-the-wild exploitation of CVE-2026-104286, a CVSS 9.8 path traversal in FortiMail that lets unauthenticated attackers write arbitrary files. Patches are not yet released; CISA set a October 4 deadline.
fortinet zero-day active-exploitation cisa-kev rce network-appliance
vulnerabilities 2026-09-30
Cisco Catalyst SD-WAN Manager CVE-2026-76504: Unauthenticated Admin API Access Exploited
Cisco confirms in-the-wild exploitation of CVE-2026-76504, a CVSS 9.8 URL-encoding auth bypass that hands unauthenticated attackers admin API access on Catalyst SD-WAN Manager. No workaround; CISA added it to KEV.
cisco sd-wan zero-day active-exploitation cisa-kev authentication-bypass network-appliance
vulnerabilities 2026-09-27
CVE-2026-88771 & CVE-2026-88772: Unauthenticated RCE Zero-Days Hit Every NetScaler Deployment
Citrix confirms two NetScaler ADC/Gateway zero-days under active exploitation — one an unauthenticated command-execution bug present in every default configuration, the other a DTLS memory overflow enabled by default on VPN virtual servers.
active-exploitation cisa-kev network-appliance rce vpn zero-day