Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 543 results
criticalbug_reportVulnerabilityCitrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspected
Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS).
criticalperson_alertThreat ActorWarlock exploits SharePoint flaws to deploy ransomware in Iberia
Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…
criticalbug_reportVulnerabilityGitLab AI Gateway RCE flaw (CVE-2026-90970) affects self-hosted instances
GitLab AI Gateway versions 18.1.6 through 19.4.0 on self-hosted deployments. Authenticated users with Duo Agent Platform access can exploit. GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways are NOT affected.
criticalbug_reportVulnerabilityDell CSM critical flaws allow unauthenticated admin access on Kubernetes
Dell Container Storage Modules (CSM) all versions prior to 1.17.0. Fixed in version 1.18.0. Affects csm-authorization-storage gRPC server, authorization proxy, tenant service, ContainerStorageModule Custom Resource reconciler, CSM Authorization modul…
criticalbug_reportVulnerabilityGitLab AI Gateway critical RCE allows arbitrary command execution
GitLab AI Gateway service. Specific affected versions not disclosed in available information. Impacts organizations running GitLab instances with AI Gateway enabled.
criticalbug_reportVulnerabilityDell CSM Authorization flaws allow unauthenticated admin takeover
Dell Container Storage Modules (CSM) Authorization module, versions prior to 1.18.0. Affects environments integrating Dell PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT storage arrays with Kubernetes.
criticalbug_reportVulnerabilityFortiMail vulnerability under active exploitation, immediate patching required
Fortinet FortiMail email security appliances. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or not publicly disclosed.
criticalbug_reportVulnerabilityFortinet FortiMail zero-day CVE-2026-104286 exploited for file writes
Fortinet FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Unauthenticated remote attackers can write arbitrary files via path traversal and null byte injection flaws in HTTP/HTTPS handlers.
criticalbug_reportVulnerabilityFortinet FortiMail critical RCE (CVE-2026-104286) exploited in the wild
Fortinet FortiMail appliances. Specific affected versions not disclosed in available information. Vulnerability enables remote code execution or command execution on vulnerable devices.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day exploited in Finland before patches released
Citrix NetScaler ADC and Gateway versions 13.1 and 14.1 (including FIPS and NDcPP variants) released before September 27, 2026 patches. Internet-facing instances at highest risk.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack in Finland
Citrix NetScaler ADC and NetScaler Gateway (all unpatched versions). Eight CVEs (CVE-2026-88771 through CVE-2026-88778) with CVSS 4.0 scores 7.0–9.5 (High to Critical).
criticalbug_reportVulnerabilityKiteworks patches critical code injection flaw in Email Protection Gateway
Kiteworks Email Protection Gateway (EPG) all versions before 9.4.1. EPG is part of the Kiteworks Private Content Network used by thousands of global corporations and government agencies with over 100 million end-users.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass under active exploitation
Cisco Catalyst SD-WAN Manager (specific versions not disclosed in source). Vulnerability allows unauthenticated remote attackers to gain administrative API access.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass exploited in the wild
Cisco Catalyst SD-WAN Manager, all vulnerable versions prior to patched releases. The vulnerability (CVE-2026-76504) affects the API authentication mechanism due to improper URI encoding handling in HTTP requests.
criticalpublicGeopoliticalPentagon DMDC breach exposes 3M military personnel records
The breach of the Defense Manpower Data Center represents a significant compromise of U.S. military human capital data, affecting nearly 3 million service members over a nine-month period from October 2025 to July 2026.
criticalbug_reportVulnerabilityWatchGuard Fireware OS critical RCE flaw requires immediate patching
WatchGuard Fireware OS - specific versions not disclosed in available data. Affects WatchGuard firewall appliances running vulnerable Fireware OS versions.
criticalbug_reportVulnerabilityBitget confirms zero-day in third-party security product led to $387M theft
Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
criticalbug_reportVulnerabilityCisco SD-WAN Manager zero-day exploited: auth bypass grants admin API access
Cisco Catalyst SD-WAN Manager, all configurations. Affected versions: all releases prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Releases earlier than 20.9 require migration.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager zero-day exploited for admin escalation
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration.
criticalbug_reportVulnerabilityBitget crypto exchange breached via zero-day in security appliances
Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities.
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772: Pre-auth RCE via DTLS overflow exploited
Citrix NetScaler ADC and NetScaler Gateway (vulnerable versions not specified in advisory). Affects the NetScaler Packet Processing Engine (NSPPE) DTLS protocol handler. Pre-authentication attack surface.
criticalbug_reportVulnerabilityCritical XSS vulnerability in Rancher Kubernetes platform requires patching
Rancher Kubernetes management platform. Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88772 exploited for web shells, root access
Citrix NetScaler ADC and Gateway appliances with DTLS enabled. CVE-2026-88772 is a memory overflow vulnerability leading to remote code execution. CVE-2026-88771 (unauthenticated RCE) also disclosed alongside it.
criticalbug_reportVulnerabilityWatchGuard RCE vulnerabilities require immediate patching per CERT.BE
WatchGuard products (specific models and versions not disclosed in available information). Two remote code execution vulnerabilities identified.
criticalbug_reportVulnerabilityKiteworks patches critical flaw found during precautionary shutdown
Kiteworks secure file transfer platform; specific versions not disclosed. Vulnerability confined to a capability enabled for less than 1% of customer base. Other Kiteworks products unaffected.
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
criticalperson_alertThreat ActorJadePuffer Ransomware Targets Azure Tenants with Agentic AI Attacks
JadePuffer (tracked by Microsoft as Storm-3168) is a ransomware operator that emerged in July 2026, specializing in agent-driven attacks against cloud infrastructure.
criticalbug_reportVulnerabilityCitrix NetScaler zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.