Topic
Topic tracking vulnerabilities under active exploitation, CISA's KEV catalog additions, and mandated federal remediation deadlines.
PaperCut's 27 August 2026 advisory of in-the-wild exploitation hid a pre-auth RCE chain whose first patch, 26.0.4, watchTowr defeated within a day. Operators who patched once and stopped tracking the CVEs may still be reachable without credentials.
Reality
VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.
Perspective Coverage
4 publishersReality
F5 and Cisco say attackers are exploiting flaws in BIG-IP APM and ISE, two of the three security products in Canada's September 2026 Cyber Centre alerts. Three alerts are too few to show a trend in attacker targeting, but the two exploited products need fixed software now.
Reality
Attackers are chaining three self-hosted JFrog Artifactory flaws, one rated CVSS 9.8, to mint administrator tokens in under five minutes. Because every build resolves its packages through that one repository, it is as efficient to attack as to run.
Reality
Canada's Cyber Centre says attackers are exploiting CVE-2026-48842, a no-login SQL injection in Roundcube's virtuser_query plugin rated 8.1. Only unpatched servers running that plugin are exposed, and Shadowserver flags 10 vulnerable hosts out of more than 523,000 online.
Perspective Coverage
4 publishersReality
CVE-2026-5430 lets a token signed with an algorithm WSO2 does not support pass authentication as an administrator. watchTowr says tokens with administrator privileges baked in reached its honeypots on September 13.
Reality
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
Reality
Arista says the pre-authentication flaw is already being used against on-premises orchestrators that issue certificates to their Edge devices, and the fixed build an operator needs may not exist for their release train yet.
Perspective Coverage
4 publishersReality
CVE-2026-76461 is one of three flaws confirmed under active attack in a single week. Revolut's customer records left by a different route, a request sent from an email address on a government agency's own domain.
Reality
Cisco and CISA confirm CVE-2026-76460 is being exploited in the wild. The flaw sits in the ISE and ISE-PIC management API, scores 10.0, and affects vulnerable releases whatever optional features are turned on.
Reality
Fortinet switched off FortiCloud SSO worldwide on January 26 and turned it back on the next day with server-side changes. Devices already fully patched against the two 2025 SAML bypasses were compromised anyway.
Reality
ConnectWise fixed CVE-2026-84869 in ScreenConnect 26.6.5 after Huntress traced a modified client dropping four VBScript files onto machines it held active sessions with. CISA gave federal agencies three days.
Reality
CVE-2026-63077 was in CISA's KEV catalog on August 5. JetBrains dates the intrusion into its own Cadence environment from August 8 to August 24, and every secret that touched the service now needs rotating.
Reality
PaperCut shipped emergency fixes for CVE-2026-81578 and CVE-2026-82078 on Thursday and Friday, and by the weekend Defused was watching honeypot intruders bypass authentication and read database tables instead of running code.
Reality
CVE-2026-33824 gives unauthenticated attackers SYSTEM on Windows hosts answering IKEv2 on UDP/500 or 4500, and exploitation is confirmed. The fix shipped in April 2026.
Reality