Threat database

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]

A threat actor exploited a path traversal vulnerability in Samsung MagicINFO 9 Server (CVE-2025-4632) to gain access to endpoints. They deployed a rogue AnyDesk instance, created a local administrator account, and disabled Microsoft Defender protections. Instead of using a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant EDR telemetry, making the activity more detectable despite attempts at stealth.

CVE-2026-87902 is a critical unauthenticated remote code execution vulnerability in WordPress versions 4.7.0 through 7.1.1. It allows attackers to include arbitrary PHP files outside the active theme directories, potentially leading to code execution. The flaw was patched in WordPress 7.1.2 and backported to supported branches down to 4.7. Exploitation attempts began shortly after the patch release, with attackers writing malicious PHP files to disk to execute shell commands. Immediate updating to version 7.1.2 or later is strongly advised.

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows via phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attacks deployed CLEANGULP, a previously undocumented malware family with backdoor capabilities such as command execution, file operations, and beacon object file execution. The malware communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated use within the Chinese cyber espionage community during the vulnerability window.

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

CVE-2026-87886 is a high-severity insecure file permissions vulnerability in the Acronis Backup plugin for cPanel & WHM and the Backup extension for Plesk. This flaw allows local privilege escalation by enabling attackers to gain elevated privileges on affected systems. The vulnerability has been exploited in the wild in limited, targeted attacks against the cPanel plugin. Acronis has released patches to address this issue and urges users to update immediately.

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.