CCISAabout 2 months ago9 min▣LLM reportcritical CISA published an ICS advisory disclosing eleven vulnerabilities in the Ebyte NE2-D11 industrial gateway device running firmware FW-9167-0-11. Three CVEs are rated CVSS 9.8 Critical, covering missing authentication, client-side authentication bypass, and cleartext MQTT credential transmission. No patch is available; the vendor acknowledged the reports but has not provided remediation. Attackers can exploit these flaws remotely without authentication to gain administrative control, intercept credentials, hijack sessions, and disrupt device operation.
CCISAabout 2 months ago11 min▣LLM reporthigh CISA conducted simultaneous red team assessments at two critical infrastructure organizations using similar tradecraft. The red team achieved full domain compromise at both organizations by exploiting ADCS misconfigurations, excessive Machine Account Quota settings, cleartext credentials, and overly permissive Entra ID application permissions. Organization A failed to detect the activity due to untuned EDR alerts and organizational silos, while Organization B rapidly triaged and isolated compromised systems. Both organizations lacked Conditional Access policies for workload identities and mature processes for revoking compromised cloud tokens.
CCISAabout 2 months ago5 min▣LLM reporthigh CISA has added CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. Federal agencies are mandated to remediate this under BOD 26-04, while CISA advises all organizations to prioritize patching. The vulnerability poses significant risks to exposed assets.
CCISAabout 2 months ago6 min▣LLM reportcritical CISA added CVE-2026-73570, an OS Command Injection vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed active exploitation. The vulnerability allows attackers to execute arbitrary OS commands on affected hosts. BOD 26-04 requires FCEB agencies to remediate KEV-listed vulnerabilities on exposed assets and to investigate whether systems were compromised prior to patching.
CCISAabout 2 months ago6 min▣LLM reportmedium Johnson Controls Simplex Incident Manager versions V2.01 and earlier are vulnerable to cleartext storage of sensitive information in memory (CVE-2026-27875). A local attacker with low privileges can extract user credentials and authentication tokens from system memory using memory-dumping tools, potentially leading to unauthorized access to the application and connected systems.
CCISAabout 2 months ago5 min▣LLM reporthigh CISA added two actively exploited TrueConf Server vulnerabilities to the KEV Catalog: CVE-2026-72529 (missing authentication for critical function) and CVE-2026-72530 (code injection). Federal agencies are required by BOD 26-04 to remediate these on publicly exposed assets. CISA recommends all organizations prioritize patching these vulnerabilities.
CCISAabout 2 months ago6 min▣LLM reporthigh CISA added CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability affecting MLflow Server, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The article provides no technical detail on the exploitation method, affected versions, or observed attacker infrastructure, and instead focuses on remediation obligations under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.
CCISAabout 2 months ago6 min▣LLM reporthigh Threat actors are actively targeting Siemens S7 Series PLCs using AI-generated exploitation scripts and open-source libraries like snap7.dll. The actors use Internet scanning to find exposed PLCs and masquerade their tools as legitimate monitoring software to conduct reconnaissance and prepare for operational effects. Organizations should patch, segment, and monitor S7comm traffic on TCP port 102 to defend against this activity.
CCISAabout 2 months ago6 min▣LLM reporthigh CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerabilities span Microsoft IKE Service Extensions (double free), Microsoft SharePoint (weak authentication), Broadcom VMware vCenter (path traversal), and Apple macOS (improper authentication). BOD 26-04 requires FCEB agencies to remediate KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation and to check for prior compromise.
CCISAabout 2 months ago8 min▣LLM reporthigh CISA disclosed six vulnerabilities in the CISA Malcolm network traffic analysis tool suite. The most severe is CVE-2026-55676 (CVSS 8.8), which allows authenticated users with the upload-only role to upload and execute arbitrary PHP code. Two RBAC bypass vulnerabilities (CVE-2026-63177 and CVE-2026-19670) exploit discrepancies between Nginx routing and the Lua RBAC layer's URI normalization. Two denial-of-service vulnerabilities (CVE-2026-63133 and CVE-2026-19671) exploit resource exhaustion during archive extraction. Patches are available across versions 26.06.1, 26.07.0, and 26.08.0.
CCISAabout 2 months ago5 min▣LLM reporthigh Siemens Simcenter Nastran and Simcenter Femap versions prior to V2606 are affected by a stack-based buffer overflow vulnerability (CVE-2026-59086). The flaw allows remote code execution in the context of the current process when a user is tricked into running an impacted application binary with a malicious string argument. Siemens has released updates and recommends updating to V2606 or later.
CCISAabout 2 months ago4 min▣LLM reporthigh CISA has added CVE-2025-62593, a code injection vulnerability in Ray-Project Ray, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerability poses significant risks to the federal enterprise and is a frequent attack vector for malicious cyber actors. BOD 26-04 requires FCEB agencies to prioritize rapid remediation of such vulnerabilities on publicly exposed assets that grant total control post-exploitation.
CCISA2 months ago6 min▣LLM reportmedium Siemens Desigo DXR and PXC building automation controllers contain a denial-of-service vulnerability (CVE-2026-59693) caused by improper handling of malformed BACnet packets. An attacker on the same network segment can send crafted packets that cause affected devices to stop responding to BACnet queries, requiring a manual reset or reboot. Siemens has released firmware updates for all affected product lines.
CCISA2 months ago7 min▣LLM reporthigh Siemens License Server (SLS) is affected by two vulnerabilities: a local privilege escalation via an insecure sudoers policy (CVE-2026-69108) and a remote path traversal allowing arbitrary file read (CVE-2026-69109). The privilege escalation could lead to full system compromise by enabling root-level command execution. The path traversal exposes arbitrary files to remote attackers without authentication. Siemens recommends updating to V5.1 or later for the sudoers fix and V5.3 or later for the path traversal fix.
CCISA2 months ago5 min▣LLM reporthigh Siemens Parasolid V38.0 and V38.1 are affected by an out-of-bounds read vulnerability (CVE-2026-64629) that is triggered when the application parses specially crafted X_T format files. The flaw allows an attacker to crash the application or execute arbitrary code with the privileges of the current process. Siemens has released fixed versions V38.0.235 and V38.1.230.
CCISA2 months ago7 min▣LLM reporthigh CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities span Cisco Secure Firewall ASA/FTD (heap inspection), Microsoft Windows AFD WinSock (use-after-free), and Metabase (SQL injection). Federal agencies are required to remediate these on publicly exposed assets under BOD 26-04, and CISA encourages all organizations to prioritize patching.
CCISA2 months ago6 min▣LLM reporthigh CISA ICS Medical Advisory ICSMA-26-223-02 discloses CVE-2026-18844, a hidden functionality vulnerability (CWE-912) in all versions of the Pulsetto Vagus Nerve Stimulator. The device firmware processes undocumented Bluetooth Low Energy commands that are sent without authentication or encryption and are never issued by the companion mobile application. An attacker within BLE range could exploit these commands to disable electrical safety mechanisms or alter stimulation parameters, creating a patient safety risk. The vendor has not responded to CISA coordination efforts.
CCISA2 months ago8 min▣LLM reportcritical CISA published an ICS advisory detailing three vulnerabilities in Johnson Controls C-CURE 9000 and Victor application server products. CVE-2026-21655 is a critical .NET deserialization flaw (CVSS 9.6) allowing unauthenticated adjacent-network attackers to achieve remote code execution on port 8999. CVE-2026-21653 is a critical SSRF in Victor Web enabling server-side request forgery against internal services. CVE-2026-34496 is a high-severity privilege issue allowing low-privilege Victor Web users to view unauthorized administrative pages. Vendor upgrades are available for all affected products.
CCISA2 months ago14 min▣LLM reportcritical Gunra is a Conti-derived ransomware-as-a-service that employs double extortion, encrypting victim data with ChaCha20 + RSA-4096 and threatening to publish exfiltrated data on a Tor-based leak site. The actors gain initial access primarily by exploiting authentication bypass vulnerabilities (CVE-2024-55591, CVE-2025-24472) in FortiOS and FortiProxy devices, then use Impacket libraries, Mimikatz, and credential dumping for lateral movement and privilege escalation. The ransomware targets both Windows and Linux environments, with the Linux variant containing a weak PRNG flaw that may allow file recovery without paying ransom.
CCISA2 months ago10 min▣LLM reporthigh CISA and ABB PSIRT published an advisory disclosing 13 MongoDB vulnerabilities affecting ABB Ability Zenon IIoT services that bundle MongoDB 4.2. The vulnerabilities span heap memory disclosure (CVE-2025-14847), denial of service via multiple vectors, IP whitelisting bypass, certificate validation failures, log injection, and local privilege escalation on Windows. No public exploitation has been reported. ABB recommends replacing the bundled MongoDB with a supported patched version or uninstalling IIoT Services if not required.
