Topic
A status marking a vulnerability as already being exploited by attackers in real-world attacks, often prompting urgent patches and advisories.
Attackers made 1,423 attempts against Previdian honeypots since September 19 to exploit Langflow CVE-2026-105740 (CVSS 9.9, versions before 1.9.0). In one sequence they got the required login with a common username and password, Previdian said.
Reality
CERT Polska's breakdown of the September RouterOS compromises names two bugs, CVE-2026-67279 and CVE-2026-86060, and the forum logs that match the chain start on September 2, a day before MikroTik shipped fixes.
Reality
Check Point says a handful of its customers have already been attacked through the Security Management Server, and F5 confirmed exploitation of BIG-IP APM when it disclosed the bug on September 22.
Reality
Cisco says CVE-2026-76460 is under active exploitation. It scores 10.0, needs no credentials, and puts an unauthenticated attacker past the web management interface of an Identity Services Engine appliance.
Reality
CVE-2026-27540 lets an unauthenticated POST save a PHP file, and 2.0.3.2 closes that write. Whether a file that already landed can run is a separate question, decided by how the server treats the upload directory.
Reality
JPCERT/CC's 2026-03-30 alert asks BIG-IP APM operators to apply the fix and then check whether the box was already compromised, because F5 now rates its October denial-of-service bug as unauthenticated code execution under attack.
Reality