Publisher
cisa.gov
Newest story built on cisa.gov reporting: CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities list (October 16, 2026). cisa.gov reporting informs the Security desk, most often on Known Exploited Vulnerabilities catalog, ICS and OT Security, and Vulnerability Management. At least 60 of our current stories draw on it.
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
Perspective Coverage
3 publishersReality
Integrity Technology Group, a government-linked Chinese firm, enables China-linked hackers to breach US and foreign networks, ten agencies said. The advisory treats the firm and its crews as one set of actors, so a single hunt can span sectors.
Perspective Coverage
14 publishersReality
CISA lists six CVEs in Grid Protection Alliance's openPDC and openHistorian, all six affecting the openPDC Docker image. Every affected range in the advisory ends below openPDC 2.9.482 and openHistorian 2.8.585, so those builds are the minimum versions energy operators should upgrade to.
Reality
CISA says seven CVEs in Red Lion N-Tron 700 Series switches on firmware 3.11.0 or earlier can give an attacker administrative access. On any switch still waiting for firmware 3.11.1, a script that keeps requesting one URL can also hold it in a reboot loop.
Reality
Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
4 publishersReality
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishersReality
Suspected Cl0p operators chain a FlexPLM WSDL disclosure to CVE-2026-12569 for unauthenticated code execution. No encryption stage means ransomware-tuned detections stay silent.
Perspective Coverage
7 publishersReality
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
Perspective Coverage
11 publishersReality
Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.
Perspective Coverage
21 publishersReality
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
10 publishersReality
CVE-2026-58704 is a logic error in the cellular modem that lets an attacker within radio range, already holding basic privileges on the handset, escalate with no user interaction. It is one of 110 fixes in September's Pixel bulletin.
Perspective Coverage
6 publishersReality
CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
Perspective Coverage
10 publishersReality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.
Perspective Coverage
13 publishersReality
CISA and six partner agencies updated AA26-097A on July 22, extending the vendor scope beyond Rockwell and adding detection guidance for tampered reusable code modules.
Reality
Hitachi Energy will not patch six flaws Dragos reported in end-of-life RTU500 CMU firmware, and says releases up to 11.x are likely affected. Energy operators still on those versions have to upgrade to supported firmware or isolate the units.
Reality
CISA says two flaws in Johnson Controls EasyIO FG firmware 2.0b52 and earlier can give an attacker full access to the device. The agency rates both as hard to exploit and not remotely reachable, so the risk is with whoever can already get onto the unit's network.
Reality
Hitachi Energy says SOI versions 2.0.0 through 2.2.0 carry CVE-2026-34197, a remote code execution flaw in their bundled Apache ActiveMQ component. CISA's scoring as of 28 September records no exploitation, so operators have time to find SOI hosts and fix them on a planned schedule.
Reality
DIVD, the Dutch volunteer disclosure group, was breached through two chained zero-days in its own Zammad helpdesk that took an attacker to root in seconds. Zammad claims over 2,000 customers, and DIVD wants every older install upgraded to version 7 or taken offline.
Perspective Coverage
9 publishersReality
Security · September 30, 2026 · Confirmed3 publishers
Security · September 30, 2026 · Confirmed12 publishers
Security · October 1, 2026 · One report1 publisher
Security · October 1, 2026 · One report1 publisher
Security · October 1, 2026 · One report1 publisher
Security · October 1, 2026 · One report1 publisher
Security · October 1, 2026 · One report1 publisher
Security · September 29, 2026 · One report1 publisher
Security · September 29, 2026 · One report1 publisher
Security · September 29, 2026 · One report1 publisher
Security · September 29, 2026 · One report1 publisher
Security · September 29, 2026 · One report1 publisher
Security · August 18, 2026 · Confirmed4 publishers
Security · August 18, 2026 · Confirmed5 publishers
Security · August 18, 2026 · Confirmed7 publishers
Security · August 19, 2026 · Confirmed2 publishers
Security · August 20, 2026 · Confirmed4 publishers
Security · August 25, 2026 · Confirmed5 publishers
Security · August 26, 2026 · Confirmed7 publishers
Security · August 28, 2026 · Confirmed7 publishers
Security · August 29, 2026 · Confirmed4 publishers
Security · September 3, 2026 · Confirmed5 publishers
Security · September 6, 2026 · Confirmed2 publishers
Security · September 8, 2026 · Confirmed8 publishers
Security · September 10, 2026 · Confirmed4 publishers
Security · September 16, 2026 · Confirmed4 publishers
Security · September 16, 2026 · Confirmed5 publishers
Security · September 24, 2026 · One report1 publisher
Security · September 24, 2026 · One report1 publisher
Security · September 23, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Security · September 22, 2026 · One report1 publisher
Security · September 22, 2026 · One report1 publisher
Security · September 22, 2026 · One report1 publisher
Security · September 22, 2026 · One report1 publisher
Security · September 22, 2026 · One report1 publisher
Security · September 22, 2026 · One report1 publisher
Security · September 21, 2026 · Confirmed5 publishers
Security · September 21, 2026 · One report1 publisher
Security · September 20, 2026 · One report1 publisher