GoKawiil
Tech News
Security firm Defused says it detected threat actors scanning for systems vulnerable to CVE-2026-101767, an unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that can lead to remote code execution. Oracle patched the issue in its October 20 Critical Patch Update, and Shadowserver currently tracks over 670 internet-exposed EBS instances, mostly in the US.
GitLab has released patches for CVE-2026-110264, a critical integer overflow vulnerability in its Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. The flaw, reported by researcher 'joaxcar' via HackerOne, has been fixed in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on patched internal builds are already protected, but self-managed installations must upgrade immediately.
Ivanti has issued an urgent patch advisory for CVE-2026-104935, a high-severity authentication bypass flaw in its Connect Secure VPN gateway that is being actively exploited. The vulnerability, discovered by Volexity, affects multiple recent ICS versions and lets unauthenticated attackers run arbitrary commands without user interaction. Shadowserver reports more than 5,500 ICS instances currently exposed online.
SonicWall issued hotfixes for CVE-2026-102255, a maximum-severity server-side request forgery flaw in the Appliance WorkPlace interface of its SMA1000 6210, 7210, and 8200v gateways. The company says an unauthenticated attacker could exploit the flaw via an unintended access path to make the appliance issue requests on their behalf and reach internal functionality, though it has found no evidence of active exploitation.
Microsoft reports that attackers have been actively exploiting a critical unauthenticated command-injection vulnerability in the Zimbra Collaboration Suite, tracked as CVE-2026-73570, to access and exfiltrate email and credential data. Synacor patched the flaw on July 20 but did not publicly disclose it for over three weeks, and the Shadowserver Foundation found 274 compromised instances among roughly 10,000 servers still running the software. Microsoft observed attackers scanning for vulnerable servers, confirming exploitation, then deploying web shells, reverse shells, and persistence tools before accessing and archiving mailbox data for transfer.
The Canadian Centre for Cyber Security has updated its May advisory to warn that CVE-2026-48842, a pre-authenticated SQL injection bug in Roundcube Webmail's virtuser_query plugin, is now being exploited in the wild. Roundcube patched the flaw in May with versions 1.6.16 and 1.7.1, but Shadowserver still counts over 523,000 internet-exposed Roundcube instances, with no clear data on how many remain unpatched.
ConnectWise disclosed a new security flaw in its ScreenConnect remote access platform affecting file transfer behavior in both cloud and on-premises deployments. The vulnerability has no CVE identifier yet and no official patch, though the company says a fix is coming later this week. In the meantime, ConnectWise published manual mitigation steps requiring administrators to disable file transfer permissions across user roles.
N-able released N-central 2026.3 Hotfix 4 on Saturday to fix CVE-2026-86218, a maximum-severity remote code execution bug that lets unauthenticated attackers run code on unpatched, internet-exposed servers. Shadowserver counts nearly 1,500 exposed N-central instances, mostly in the US and Europe, while security firm Huntress suspects the flaw, along with two related authentication-bypass bugs, may already have been exploited as a zero-day in at least one customer breach.
SonicWall has warned that attackers are chaining two newly discovered vulnerabilities in its SMA1000 secure remote access appliances to execute code remotely. One flaw is a maximum-severity command injection issue in the WorkPlace interface caused by an SSRF weakness, while the second lets an authenticated admin run arbitrary OS commands via the Management Console. The bugs affect the SMA1000 6210, 7210, and 8200v models, with over 400 exposed devices currently visible online.
Shadowserver reports over 8,300 internet-facing Gitea instances remain unpatched against CVE-2026-60004, a critical code injection bug already being exploited in the wild. The flaw lets an attacker with repository write access run arbitrary shell commands as the Gitea service account, and since Gitea allows open self-registration by default, unauthenticated users can create an account and repository to gain that access. Gitea patched the issue in version 1.27.1 on July 27, and CISA has added it to its known exploited vulnerabilities list, giving federal agencies just three days to remediate.
CISA has added CVE-2026-8452, a memory overflow bug in Citrix NetScaler ADC and Gateway appliances, to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to patch by August 29. Originally described by Citrix as only enabling denial-of-service, researchers at watchTowr later demonstrated it can be exploited for root-level remote code execution, and reports indicate attackers are already deploying web shells on unpatched systems.
Shadowserver identified 274 Zimbra Collaboration Suite instances already breached through exploitation of CVE-2026-73570, a command injection flaw in the SNMP monitoring component that allows unauthenticated remote code execution. Synacor patched the bug in ZCS 10.1.20 on July 20, but Shadowserver still counts over 8,200 unpatched instances exposed online, though not all are necessarily exploitable due to non-default configuration requirements.