Signal
27 articles covering "zero-day"
Arista patched a maximum-severity command injection flaw in VeloCloud Orchestrator that attackers were already exploiting; CISA gave federal agencies until July 30 to fix it.
CVE-2026-15409 and CVE-2026-15410 were exploited together against SMA1000 appliances before patches shipped, CISA says.
A perfect-score authentication bypass in SimpleHelp's OIDC login is being exploited in the wild to deploy TaskWeaver and Djinn Stealer, prompting CISA to give federal agencies until July 2 to patch.
CVE-2026-35273, a CVSS 9.8 missing-authentication flaw in Oracle PeopleSoft PeopleTools, was exploited as a zero-day by UNC6240 before Oracle shipped mitigations and CISA set a June 15 federal deadline.
Cisco says CVE-2026-20245, a 7.8-rated command-injection flaw in Catalyst SD-WAN Manager, is being exploited to gain root. No patch or workaround is available; Mandiant reported it.
Google's June 2026 Android update patches a Framework privilege-escalation zero-day under limited, targeted exploitation. CISA added it to the KEV catalog with a June 5 federal deadline.
Arctic Wolf found attackers abusing a critical 9.8-CVSS FortiClient EMS authentication bypass to silently push EKZ Infostealer to every managed endpoint via legitimate VPN scripting workflows.
A directory traversal flaw in Trend Micro Apex One lets an attacker with admin server access inject malicious code into managed endpoints. CISA added it to KEV on May 21 with a June 4 federal deadline.
Google's Threat Intelligence Group says a cybercrime group built a zero-day exploit using AI, marking the first confirmed case of adversaries weaponizing an LLM to discover and exploit a previously unknown vulnerability.
A researcher named Chaotic Eclipse released a working exploit for an unpatched Windows privilege escalation flaw in the Cloud Filter driver, confirmed to grant SYSTEM access on fully patched Windows 11.
DEVCORE took the top prize with $505,000 and 50.5 points after three days at OffensiveCon, where 47 unique zero-days in Windows, Exchange, VMware, and AI tools earned researchers $1,298,250.
Microsoft has disclosed an actively exploited cross-site scripting flaw in on-premises Exchange Server's Outlook Web Access. No patch has shipped; CISA gave federal agencies until May 29 to apply mitigations.