Vulnerabilities & Patching
The Shadowserver Foundation has confirmed at least 274 internet-facing Zimbra servers compromised through CVE-2026-73570, the code-injection flaw Synacor patched in ZCS v10.1.20 on July 20. Here is how defenders should triage patching and hunt for signs of compromise.
Vulnerabilities & Patching
CISA added CVE-2026-21962, a maximum-severity Oracle HTTP Server and WebLogic Proxy Plug-in flaw, to its Known Exploited Vulnerabilities catalog with a three-day federal deadline. Oracle shipped the fix in January 2026, but unauthenticated HTTP exploitation has run for months. Patch and hunt now.
Vulnerabilities & Patching
Red Hat and the Keycloak project have patched CVE-2026-18963, a CVSS 9.1 flaw in the reset-credentials flow that let an unauthenticated attacker reset any user's password and seize the account, administrators included. Fixed in Keycloak 26.7.2, 26.6.6, and 26.4.15.
Vulnerabilities & Patching
Microsoft's advisory for CVE-2026-69836, a CVSS 10.0 Entra ID RCE, initially flagged the flaw as exploited in the wild, then reversed that on August 21. Microsoft fixed the service on its own infrastructure and says no customer action is required.
Vulnerabilities & Patching
The Hacker News reported watchTowr's findings on GitLab CVE-2026-19478, a CVSS 9.4 code injection flaw under active exploitation within days of disclosure. watchTowr remains the single primary source. The unauthenticated GraphQL bug hits unpatched self-managed instances. Patch now.
Vulnerabilities & Patching
A critical Elementor Pro flaw, CVE-2026-32475, lets unauthenticated visitors slip a PHP file past the Forms upload check and run code on the server. It is the second WordPress-plugin RCE disclosed in three days. Update to 4.2.2.
Vulnerabilities & Patching
Threat actors began exploiting GitLab CVE-2026-19478 roughly two to three days after disclosure, according to watchTowr. The critical, unauthenticated GraphQL flaw lets attackers modify or delete public projects and user data on unpatched self-managed instances. Fixed builds shipped August 17.
Vulnerabilities & Patching
Cloud Software Group patched CVE-2026-19490, a critical authentication bypass in NetScaler ADC and Gateway rated CVSS 9.3 and reachable by an unauthenticated attacker over the network. No exploitation is confirmed yet, but these perimeter appliances rarely stay quiet.
Vulnerabilities & Patching
CISA added four actively exploited flaws to its KEV catalog: Apple macOS (CVE-2026-65400, CVSS 9.8), Microsoft SharePoint, VMware vCenter, and Microsoft IKE. Two are internet-facing remote code execution bugs used to plant backdoors and ransomware. Federal patch deadline: August 21.
Vulnerabilities & Patching
CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited Vulnerabilities catalog and set an unusual three-day patch deadline for federal agencies. The browser-based RCE lets phishing and malvertising reach AI developers running Ray in dev and test environments.