CISA Known Exploited Vulnerabilities

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

CVE-2020-35730 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows attackers to send plain text emails containing JavaScript in a link reference element, which is improperly handled by the linkref_addinindex function in rcube_string_replacer.php. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2016-0165 is a high-severity privilege escalation vulnerability in Microsoft Win32k. It allows an attacker to gain elevated privileges on affected systems. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2016-9079 is a critical use-after-free vulnerability in the SVG Animation component affecting Mozilla Firefox, Firefox ESR, and Thunderbird. It specifically impacts Firefox and Tor Browser users on Windows. The vulnerability was actively exploited in the wild. Mozilla addressed this issue with fixes released in Firefox 50.0.2, Firefox ESR 45.5.1, and Thunderbird 45.5.1.

CVE-2020-12641 is a remote code execution vulnerability in Roundcube Webmail. It allows attackers to execute arbitrary code by injecting shell metacharacters into configuration settings related to im_convert_path or im_identify_path. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2021-44026 is a high severity SQL injection vulnerability in Roundcube Webmail that affects the search functionality. This vulnerability allows attackers to inject malicious SQL queries via the search or search_params parameters. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

This report details IDS alerts from 2026-05-21 indicating reconnaissance activity targeting Fortigate VPN devices. Multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, associated with CVE-2023-27997, a heap-based buffer overflow vulnerability in Fortinet FortiOS and FortiProxy SSL-VPN. Additional IPs showed suspicious or test user-agent strings, suggesting scanning or probing behavior. No active exploitation or confirmed compromises were reported. The activity is assessed as low severity due to its reconnaissance nature without evidence of exploitation.