CISA has ordered U.S. government agencies to patch their Citrix NetScaler appliances against an actively exploited remote code execution vulnerability by Saturday. [...]
KEV ✓ EPSS 0.87 CVE-2026-19489 CVE-2026-19490 CVE-2026-3055 CVE-2026-4368 CVE-2026-8452 Citrix veřejná správa US
ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang. [...]
Americká CISA upozornila na aktivní zneužívání zranitelnosti CVE-2026-33824 (CVSS 9,8) ve Windows Internet Key Exchange (IKE). Ke zneužití této zranitelnosti stačí na neaktualizovaný počítač se systémem Windows odeslat speciálně upravené síťové pakety přes UDP porty 500 nebo 4 500. Zranitelnost se týká podporovaných verzí Windows 10, Windows 11 a Windows Serveru. Microsoft opravu vydal již v dubnu, takže je nezbytné neprodleně aktualizovat. Pokud to z nějakého důvodu není možné, doporučuje se…
KEV ✓ EPSS 0.73 CVSS 9.8 CVE-2026-33824 Microsoft veřejná správa CZ US
A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"? Who can delete or change key things, or modify them in ways that might not be obvious (accidentally or on purpose). Yes, we trust our people, but if they've moved on to other roles or to other organizations, they change from "our people" to "used to be our people". Also, it's common to have too many admins. For instance, entry level support folks might need rights to change…
The FBI has disrupted infrastructure associated with a technical "quartermaster" that provided reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage activities. [...]
Rilevato lo sfruttamento attivo in rete di una vulnerabilità con gravità “critica” - già sanata dal vendor - relativa a Gitea, piattaforma collaborativa open source per la gestione del codice sorgente e lo sviluppo di applicazioni software.
KEV ✓ EPSS 0.87 CVE-2026-60004 Gitea veřejná správa IT CA US
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability…
KEV ✓ EPSS 0.84 CVE-2015-3246 CVE-2015-5287 CVE-2019-1068 CVE-2021-23758 CVE-2022-0995 CVE-2026-8452 Red Hat Microsoft Citrix veřejná správa US
CISA added CVE-2022-0995 to the Known Exploited Vulnerabilities catalog. Affected product: Linux Kernel. Remediation due date: 2026-09-09.
KEV ✓ EPSS 0.10 CVE-2022-0995 Linux Microsoft veřejná správa školství média US
The Australian Signals Directorate’s 2026 board priorities and frontier AI guidance show why speed alone won’t stop AI-era cyber threats.
A large distributed denial-of-service (DDoS) attack has disrupted Norway's shared government digital infrastructure since Monday, affecting services used by the public sector. [...]
Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments Original Publication August 25, 2026 Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity…
The Norwegian Digitalisation Agency said it was working with its IT partner to stabilize systems affected by a distributed denial-of-service attack, with some services gradually coming back online.
Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups. [...]
Serial number: AV26-042Date: January 21, 2026Updated: August 24, 2026 On January 20, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Update 1 On January 21, 2026, a proof of concept (PoC) for the vulnerability CVE-2026-21962 became publicly available. CVE-2026-21962 is a vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware which may allow a remote attacker to obtain unauthorized access.…
KEV ✓ EPSS 0.42 CVE-2026-21962 Oracle veřejná správa CA US
A breach at South Korea's government-backed startup platform exposed encrypted personal data after an encryption key was included in an API. Penta Security explains why encryption keys must be securely managed and kept separate from the data they protect. [...]
Classification: Critical, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 10.0, CVEs: CVE-2026-69836, Summary: Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
EPSS 0.02 CVSS 10.0 CVE-2026-69836 Microsoft veřejná správa FI IT US FR
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]
KEV ✓ EPSS 0.06 CVE-2026-3502 CVE-2026-72529 CVE-2026-72530 TrueConf veřejná správa US
În 2025, Directoratul și-a accelerat semnificativ și vizibil activitatea și rezultatele con...
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 5.3, CVEs: CVE-2026-27875, Summary: CISA released one Industrial Control Systems (ICS) Advisory. This advisory provides timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-26-232-01 Johnson Controls Simplex Incident Manager
EPSS 0.00 CVSS 5.8 CVE-2026-27875 Johnson Controls výroba a průmysl energetika doprava veřejná správa FI US
Serial Number: AV26-835Date: August 20, 2026 As of August 19, 2026, TrueConf is affected by a vulnerability in the following product: TrueConf Server 5.3.x versions prior to 5.3.9 5.4.x versions prior to 5.4.9 5.5.x versions prior to 5.5.5 On August 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72529 and CVE-2026-72530 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links…
KEV ✓ EPSS 0.02 CVE-2026-72529 CVE-2026-72530 TrueConf veřejná správa CA US
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.
Welcome to this week’s edition of the Threat Source newsletter. Hello friend. I’m Mick. This is my first Threat Source newsletter, so I should probably introduce myself before I start telling you all the things I think you should be paying attention to. With assistance from an unnamed LLM, my bio reads like this: Mick Baccio is a globally recognized security strategist with a career spanning offensive operations, threat intelligence, and national-level incident response. He currently advises…
A joint cybersecurity advisory released by multiple U.S. government agencies warns that threat actors are using AI-generated exploitation scripts to target exposed Siemens S7 Series PLCs across critical infrastructure sectors.Key TakeawaysUnattributed threat actors are exploiting known weaknesses and unnecessary internet exposure to conduct reconnaissance and possible pre-positioning for future disruptive attacks against Siemens S7 Series PLCs.The attackers are leveraging AI to build and refine…
Siemens veřejná správa energetika vodárenství výroba a průmysl US
Written by: Gabby Roncone, Wesley Shields Overview Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. Examples of these techniques can be found in our previous blog on UNC6293’s phishing operations. We now track an…
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. [...]
KEV ✓ EPSS 0.16 CVE-2026-64849 MLflow veřejná správa US CA
Multiple vulnerabilities in T-Systems Products Thu, 08/20/2026 - 12:11 Aviso Affected Resources The following products in the TAO 2.0 suite, in versions prior to 2602.00, are affected:Conecta: versions prior to 2605.0.0;STA: versions prior to 2605.0.0 and 2605.0.1. Description INCIBE has coordinated the disclosure of four vulnerabilities—two high-severity and two medium-severity—that affect several products in the TAO 2.0 suite, a management platform for public administration. The…
CVSS 8.7 CVE-2026-18224 CVE-2026-18225 CVE-2026-18226 CVE-2026-18227 T-Systems veřejná správa ES
U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. [...]
Siemens veřejná správa energetika vodárenství výroba a průmysl US
The U.S. has charged 17 Iranians, alleged members of a hacking-for-hire company called Mabna Institute, involved in years-long operations that stole data from American organizations. [...]
Latvia’s road traffic agency confirmed that hackers stole data connected to about two-thirds of the country’s population in a major cyberattack that has prompted calls for senior officials to resign.
The Justice Department accused 17 alleged hackers with ties to the Iranian government of breaching email accounts at U.S. government agencies and stealing intellectual property from dozens of universities.
The FBI said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. [...]
The Cybersecurity and Infrastructure Security Agency (CISA) and FBI updated an advisory on the group initially released in March 2025 — writing that as of April 2026, Medusa actors have hit more than 500 victims. CISA previously said 300 victims, many of which are in critical infrastructure sectors, were attacked as of 2025.
The affected ministries — one responsible for urban development, construction and housing, and the other for mobility, transport, climate protection and the environment — have been isolated from government networks since Friday as a precaution.
You can’t patch everything. So what do you fix first? Findings in Q2 2026 have changed traditional answers.The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive…
CVSS 7.0 Microsoft veřejná správa finance zdravotnictví výroba a průmysl US
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability CVE-2026-65400 Apple macOS Improper Authentication Vulnerability These types of vulnerabilities are a frequent attack vector…
KEV ✓ · ransomware EPSS 0.73 CVE-2026-33824 CVE-2026-55040 CVE-2026-59310 CVE-2026-65400 Microsoft Broadcom Apple veřejná správa US
CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller. The patch is the easy part. The lesson is standing privilege, implicit trust, and treating PKI as the Tier 0 identity infrastructure it has always been. [...]
EPSS 0.02 CVE-2026-54121 veřejná správa US
For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were encrypted but stated that no data theft was detected during the incident. MyDr, Poland’s primary…
KEV ✓ EPSS 0.25 CVSS 9.8 CVE-2026-53413 CVE-2026-65400 CVE-2026-68820 CVE-2026-71362 Microsoft Apple Adobe Zoom veřejná správa zdravotnictví obrana energetika IL
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive…
KEV ✓ EPSS 0.17 CVE-2025-62593 Ray-Project veřejná správa US
Prin proiectul PNRR 184 „Crearea de noi competențe de securitate cibernetică pentru societat...
The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. [...]
Tenable’s Research Special Operations (RSO) team has been tracking a cluster of agentic AI threat activity since late July 2026. The Taiwan autonomous AI cyber attack confirmed what the cluster data already showed: near-autonomous offensive AI has crossed from theoretical risk to operational reality.Key TakeawaysTaiwan's Ministry of Digital Affairs confirmed a near-autonomous AI cyber attack in July 2026 in which autonomous agents mapped 21 connected government systems, compromised 85 accounts,…
KEV ✓ · ransomware EPSS 1.00 CVE-2025-3248 GitBook veřejná správa energetika US
București, 14 august 2026 În urma aprobării de către Consiliul Suprem de Apărare a Țări...
Ministarstvo pravosuđa, uprave i digitalne transformacije upozorava građane na lažne poruke kojima se pokušava stvoriti dojam da se protiv primatelja vodi kazneni ili sudski postupak. “Trenutno se šire lažne poruke koje građani zaprimaju putem e-pošte. U privitku poruka nalaze se dokumenti koji izgledom pokušavaju djelovati službeno, pri čemu se koriste grbovi i logotipi različitih institucija, među ostalim i Ministarstva pravosuđa, uprave i digitalne transformacije. Građanima savjetujemo da ne…
Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023, CoolClient has continued to…
Národný bezpečnostný úrad varuje pred významnou kybernetickou hrozbou spojenou s používaním viacerých typov cestných rýchlomerov s kamerou. Bezpečnostná analýza identifikovala viaceré riziká a dotknutým subjektom odporúča predmetné produkty vo svojej infraštruktúre identifikovať. Národný bezpečnostný úrad podľa § 5 ods. 1 písm. q) v spojení s § 27 ods. 1 písm. a) a ods. 2 zákona... The post Varovanie pred rizikami cestných meradiel appeared first on SK-CERT.
Number: AL26-018Date: August 13, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian…
KEV ✓ EPSS 0.02 CVE-2026-20349 Cisco veřejná správa CA RO IT FR US
View CSAF Summary Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access. The following versions of Johnson Controls Metasys are affected: Metasys 12 vers:all/* (CVE-2026-34491) Metasys 13 vers:all/* (CVE-2026-34491) Metasys 14 Metasys 15 CVSS Vendor…
EPSS 0.00 CVSS 8.0 CVE-2026-34491 Johnson Controls energetika výroba a průmysl veřejná správa doprava US
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources. The following versions of Johnson Controls Inc. Airwall are affected: Airwall <=4.0.4 (CVE-2026-64887, CVE-2026-34492) CVSS Vendor Equipment Vulnerabilities v3 6.8 Johnson Controls Inc. Johnson Controls Inc. Airwall Use of…
EPSS 0.00 CVSS 6.8 CVE-2026-34492 CVE-2026-64887 Johnson Controls výroba a průmysl veřejná správa energetika doprava US
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet riasztást ad ki a Windows kernelt érintő, észak-koreai kötődésű Lazarus csoport által végrehajtott célzott kampánnyal kapcsolatban, amelyben trójai PDF nézők, fejlett in‑memory moduláris kártevők és több zero‑day/exploittal támogatott támadási lánc kerül alkalmazásra. A kampány részeként a támadók a Microsoft Windows AFD.sys illesztőprogram egy korábban nem publikált (0-day) use‑after‑free típusú […]
In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the attackers use for cyber…
Microsoft’s August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges. The August update is smaller than July’s record-breaking release, but it’s still among Microsoft’s largest Patch Tuesday batches. More importantly, it includes several flaws likely to attract attacker interest: a publicly disclosed Windows privilege escalation flaw with a proof-of…
EPSS 0.03 CVSS 9.8 CVE-2026-62832 CVE-2026-62893 Microsoft školství veřejná správa US
De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-47299 CVE-2026-57104 CVE-2026-65806 CVE-2026-6726 CVE-2026-6727 CVE-2026-70340 Microsoft finance veřejná správa FR
Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-65780 veřejná správa US
Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.
EPSS 0.01 CVE-2026-62814 veřejná správa US
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-62761 veřejná správa US
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-61920 veřejná správa US
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
EPSS 0.03 CVSS 7.5 CVE-2026-62893 Microsoft veřejná správa US
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-62820 veřejná správa US
Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.
EPSS 0.01 CVE-2026-62817 veřejná správa telekomunikace US
Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-62795 veřejná správa US