Threats tagged 'cisa-kev'

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

UNC6240 (ShinyHunters) has resumed a mass exploitation campaign targeting Oracle PeopleSoft systems worldwide by exploiting CVE-2026-35273. The attacker bypassed web application firewall protections using URL encoding to access a vulnerable endpoint. Post-exploitation, multiple web shells, a trojanized backdoor (SIDEEYE), tunneling tools, and persistence agents were deployed. The actor conducted reconnaissance, credential theft, and prepared for data exfiltration, indicating potential extortion activities.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]

WordPress Core has a remote file inclusion vulnerability that allows unauthenticated attackers to include a chosen readable local PHP file outside the active theme directories. This can lead to remote code execution. The vulnerability has a high severity score of 8.1 and has been exploited in the wild. No specific affected versions or patch information is provided.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: sctp: prevent peer transport count overflow (CVE-2026-74469) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.

A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.