Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 43 results
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched in hosted VCO versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+. On-prem customers must apply updates manually.
criticalbug_reportVulnerabilityMultiple critical vulnerabilities in Juniper Junos OS require urgent patching
Juniper Networks Junos OS - specific affected versions not disclosed in available advisory. All organizations running Junos OS on network devices should assume potential exposure until vendor guidance is reviewed.
criticalbug_reportVulnerabilityHPE ClearPass Policy Manager RCE and admin access flaws require patching
HPE Networking ClearPass Policy Manager - specific affected versions not disclosed in available information. Product is a network access control (NAC) solution used for policy management and authentication.
criticalbug_reportVulnerabilityHPE AOS-Switch auth bypass and buffer overflow require immediate patching
HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass under active exploitation
Cisco Catalyst SD-WAN Manager (specific versions not disclosed in source). Vulnerability allows unauthenticated remote attackers to gain administrative API access.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
criticalbug_reportVulnerabilityCisco SD-WAN Manager zero-day exploited: auth bypass grants admin API access
Cisco Catalyst SD-WAN Manager, all configurations. Affected versions: all releases prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Releases earlier than 20.9 require migration.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager zero-day exploited for admin escalation
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration.
highbug_reportVulnerabilityDas U-Boot out-of-bounds write allows code execution via fragmented IP
Das U-Boot versions 2009.08 through 2026.07 (pre-fix) when compiled with CONFIG_IP_DEFRAG=y. Das U-Boot is a widely-deployed open-source bootloader used in embedded systems, IoT devices, and network equipment.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH chain grants unauthenticated admin access
MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2. Affects devices with SSH service exposed to untrusted networks or the Internet. Default home configurations are not exposed, but custom firewall rules may create exposure.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator zero-day CVE-2026-93952 exploited in wild
Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based authentication enabled. Hosted deployments running VCO versions below 5.2.3.16 (5.x branch), below 6.4.2.8 (6.x branch), 6.1.3.7 and below, and 7.0.0.2 and below are vulne…
highbug_reportVulnerabilityVMware VeloCloud Orchestrator input validation flaw requires patching
VMware VeloCloud Orchestrator - specific affected versions not disclosed in advisory. VeloCloud Orchestrator is a centralized management platform for SD-WAN deployments.
criticalbug_reportVulnerabilityMikroTik RouterOS pre-auth RCE chain enables full device takeover
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All unpatched RouterOS devices with SSH enabled are vulnerable to unauthenticated remote takeover when CVE-2026-67279 and CVE-2026-86060 are chained together.
criticalbug_reportVulnerabilityCVSS 10.0 VeloCloud Orchestrator flaw actively exploited in wild
Arista VeloCloud Orchestrator (VCO) on-premises deployments using certificate-based Edge authentication. Affected versions: 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, 7.0.0.2 and earlier.
criticalbug_reportVulnerabilityHPE Aruba EdgeConnect SD-WAN auth bypass and RCE flaws require patching
HPE Aruba Networking EdgeConnect SD-WAN appliances. Specific affected versions not disclosed in available data. Vulnerabilities enable authentication bypass and remote code execution.
highbug_reportVulnerabilityMikroTik RouterOS exploit chain actively hijacks routers via SSH
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
highpublicGeopoliticalMikroTik Router Exploit Enables Unauthenticated Admin Access via SSH
The exploitation of MikroTik routers—widely deployed in small and medium enterprises, ISPs, and critical infrastructure across Europe and emerging markets—represents a significant supply chain vulnerability with potential strategic implications.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH vulnerabilities actively exploited (MikroTrick)
MikroTik RouterOS all versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH service exposed to the internet are at highest risk. Six vulnerabilities identified, two critical (CVE-2026-67276, CVE-2026-86060) enable full device tak…
criticalbug_reportVulnerabilityHPE patches critical RCE in ArubaOS-CX network switches (CVE-2026-73749)
ArubaOS-CX network operating system on HPE Aruba enterprise switches. Affected versions: 10.18.0001, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, 10.10.1180 and earlier.
criticalbug_reportVulnerabilityCisco patches critical RCE in Nexus 9000 switches and 7 IOS XR flaws
Cisco Silicon One-based Nexus 9000 switches (10 models including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, N9K-C9808) running NX-OS 10.3(1) through 10.6(3s).
highbug_reportVulnerabilityEvooo1Bot: Mirai-based botnet targets Linux gateways as SOCKS5 proxies
Internet-facing Linux gateway devices (routers, firewalls, edge appliances). Specific vendors and models not disclosed. Mirai-based malware with modular architecture targeting devices with weak credentials or known vulnerabilities.
highbug_reportVulnerabilityCisco ASA/FTD VPN flaw CVE-2026-20349 actively exploited for DoS
Cisco Secure Firewall ASA (versions 9.16, 9.18, 9.20, 9.22, 9.23, 9.24) and Threat Defense FTD (versions 7.0, 7.2, 7.4, 7.6, 7.7, 10.0) with Remote Access SSL VPN, IKEv2 Remote Access VPN with client services, or Zero Trust Network Access enabled.
criticalbug_reportVulnerabilityCisco patches 12 critical SD-WAN and IOS XE flaws, three rated 9.8+
Cisco Catalyst SD-WAN Software (all versions prior to 20.9, versions 20.9–26.1); Cisco IOS XE Software versions 17.9–26.1 running in autonomous or controller mode; Cisco Integrated Management Controller (IMC) web interface.
highbug_reportVulnerabilityCisco IOS/IOS XE vulnerabilities require immediate patching per CERT.BE
Cisco IOS and IOS XE platforms. Specific affected versions not provided in advisory. Multiple vulnerabilities of high severity impact network infrastructure devices including routers and switches running these operating systems.
highbug_reportVulnerabilityTP-Link patches 15 Omada ZTP flaws enabling network infiltration via RCE
TP-Link Omada network devices including Controllers, Gateways, Switches, Access Points, OLT platforms, Cloud services, and mobile applications (Omada, Omada Guard, TP-Link apps). Over 1,800 internet-accessible Omada controllers identified.
criticalbug_reportVulnerabilityOpenWrt DHCPv6 stack overflow allows unauthenticated remote root code execution
OpenWrt versions prior to 24.10.8 (24.10 branch) and 25.12.5 (25.12 branch). The vulnerability affects the odhcpd DHCPv6 service running as root on all devices with DHCPv6 enabled by default.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator command injection under active exploitation
Arista VeloCloud Orchestrator (VCO) on-premises versions: 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, and 7.0.x prior to 7.0.0.1. Hosted and dedicated VCO versions already patched.
criticalbug_reportVulnerabilityUbiquiti patches critical flaws in UniFi products, CVE-2026-50746 CVSS 10.0
Ubiquiti UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS. Specific vulnerable versions not provided in available data. CVE-2026-50746 rated CVSS 10.0 (critical).
highperson_alertThreat ActorUAT-7810 Deploys LONGLEASH Malware Against Network Infrastructure
UAT-7810 is a Chinese-linked threat actor focused on compromising internet-facing networking devices to expand their Operational Relay Box (ORB) network infrastructure.