RCE

Adobe ColdFusion security bulletin APSB26-68 patches 11 CVEs across ColdFusion 2025 and 2023, including critical arbitrary file read/write vulnerabilities in the RDS module and a path traversal in the CKEditor file manager upload endpoint. When RDS is enabled with authentication disabled, attackers can use the simple length-prefixed RDS RPC protocol to read or write arbitrary files, achieving remote code execution as SYSTEM by deploying a CFML webshell. A separate unauthenticated path traversal in the CKEditor file manager allows file uploads to arbitrary directories, also executing as SYSTEM.

2026-07-027 minCanadian Centre for Cyber Securitycritical

A critical deserialization vulnerability (CVE-2026-45659) in Microsoft SharePoint Server is being actively exploited, enabling remote code execution by low-privileged attackers. The flaw affects SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition, with fixed versions available. CISA added this CVE to its KEV catalog on July 1, 2026, and the Canadian Cyber Centre urges immediate patching, especially for internet-exposed on-premises deployments.

2026-06-165 minPalo Alto Networkscritical

A critical vulnerability in the Google Cloud Vertex AI SDK for Python allows attackers to achieve cross-tenant Remote Code Execution (RCE) via bucket squatting. By predicting default staging bucket names and exploiting a lack of ownership verification, attackers can intercept model uploads and inject malicious pickle payloads, leading to the theft of highly privileged service account tokens.

WatchTowr Labs detailed the exploitation of CVE-2026-20253, a critical pre-authentication Remote Code Execution (RCE) vulnerability in Splunk Enterprise. By abusing unauthenticated PostgreSQL Sidecar Service endpoints and injecting connection string parameters, attackers can force the server to connect to an external database, write malicious files to the filesystem, and overwrite legitimate scripts to achieve arbitrary code execution.

2026-06-114 minCheck Pointcritical

Check Point Research discovered critical vulnerabilities in LangGraph's SQLite and Redis checkpointers that allow attackers to chain SQL injection with unsafe msgpack deserialization to achieve Remote Code Execution (RCE). The flaws occur when user-controlled input is passed to the getstatehistory() filter, enabling attackers to inject malicious serialized payloads that execute arbitrary OS commands upon deserialization.

2026-06-104 minCERT-EUcritical

A critical stack-based buffer overflow vulnerability (CVE-2026-41089, CVSS 9.8) in Windows Netlogon allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges on domain controllers via specially crafted packets. The vulnerability is actively being exploited in the wild, necessitating immediate patching of affected Windows Server environments.

2026-06-105 minCisco Taloscritical

Microsoft's June 2026 Patch Tuesday addresses 206 vulnerabilities, including 32 critical flaws primarily involving Remote Code Execution (RCE). Four critical vulnerabilities affecting the Remote Desktop Client, HTTP Protocol Stack, and Windows Graphics component are highlighted as more likely to be exploited, prompting immediate patching and the deployment of updated network intrusion rules.

2026-05-246 minSocketcritical

A massive supply chain attack compromised over 700 historical versions of Laravel Lang packages, injecting an RCE backdoor via Composer's autoloader. The backdoor delivers a sophisticated, cross-platform PHP information stealer designed to harvest cloud credentials, CI/CD secrets, browser data, and local configuration files.

2026-05-194 minAkamaicritical

CVE-2026-42945, dubbed 'NGINX Rift', is a critical heap buffer overflow vulnerability in the NGINX HTTP rewrite module (ngxhttprewrite_module). It allows unauthenticated attackers to cause a Denial of Service (DoS) or potentially achieve Remote Code Execution (RCE) by sending crafted HTTP requests to servers configured with specific rewrite directives containing unnamed PCRE captures and a question mark.

2026-05-134 minCisco Taloscritical

Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities, including 31 critical flaws, 16 of which are Remote Code Execution (RCE) vulnerabilities. While no active exploitation has been observed, critical flaws affect core services like Windows Netlogon, DNS Client, and Azure Managed Instances, prompting the release of Snort detection rules by Cisco Talos.

2026-05-134 minVaroniscritical

Varonis Threat Labs identified a Remote Code Execution (RCE) vulnerability in Azure Cosmos for PostgreSQL caused by improper input validation of the loglineprefix parameter within the Azure management API. By utilizing form feed and newline characters, attackers could bypass single-quote restrictions to inject arbitrary PostgreSQL configurations, such as archive_command, ultimately leading to arbitrary OS command execution on the underlying managed database node.

Kaspersky researchers discovered CVE-2025-68670, a pre-authentication Remote Code Execution (RCE) vulnerability in the xrdp server for Linux. The flaw stems from a stack buffer overflow in the xrdpwmparsedomaininformation function when processing specially crafted domain names during the Secure Settings Exchange phase, allowing an attacker to overwrite the return address and execute arbitrary code.

2026-05-133 minCISAhigh

CISA has added CVE-2026-39987, a Remote Code Execution (RCE) vulnerability in Marimo, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. Organizations are strongly urged to prioritize timely remediation to reduce their exposure to cyberattacks.

2026-05-134 minCisco Taloscritical

Microsoft's April 2026 Patch Tuesday addresses 165 vulnerabilities, including 8 critical flaws and one actively exploited zero-day vulnerability in Microsoft Office SharePoint (CVE-2026-32201). The update resolves critical Remote Code Execution (RCE) vulnerabilities across various components such as the Remote Desktop Client, Microsoft Office, Windows IKE, Active Directory, and TCP/IP.

2026-05-135 minSophoscritical

A zero-day vulnerability in Adobe Reader is being actively exploited in targeted attacks against the Russian oil and gas sector. Threat actors are utilizing malicious PDF files embedded with obfuscated JavaScript to execute privileged APIs, enabling sensitive data theft and potential remote code execution.

2026-05-133 minCanadian Centre for Cyber Securitycritical

The Canadian Centre for Cyber Security released a daily digest highlighting vulnerabilities across HPE, CUPS, and GitLab products. Most notably, CUPS versions 2.4.16 and prior suffer from a critical remote unauthenticated RCE-to-root chain (CVE-2026-34990, CVE-2026-34980), requiring immediate mitigation and patching to prevent system compromise.

Security researchers discovered a pre-authenticated Remote Code Execution (RCE) chain in Progress ShareFile Storage Zone Controller. By chaining an Execution After Redirect (EAR) authentication bypass (CVE-2026-2699) with an arbitrary file upload vulnerability (CVE-2026-2701), attackers can reconfigure the storage repository to the webroot and extract an ASPX webshell, achieving full system compromise.

2026-05-133 minNCSCcritical

The NCSC has issued an urgent alert regarding CVE-2025-53521, an actively exploited, unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM). Organizations are strongly advised to investigate for compromise using vendor-provided indicators, apply updates immediately, and potentially rebuild affected systems if evidence of compromise is found.

2026-05-134 minAkamaicritical

A critical unauthenticated remote code execution vulnerability (APSB25-94) in Magento Open Source and Adobe Commerce allows attackers to upload polyglot files containing PHP code. By exploiting the REST API's cart item custom options, attackers can bypass basic image validation to deploy web shells and execute arbitrary code on the server.

2026-05-133 minCISAcritical

CISA has added CVE-2025-53521, a Remote Code Execution vulnerability affecting F5 BIG-IP, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. All organizations are strongly urged to prioritize timely remediation to reduce exposure to cyberattacks.

2026-05-133 minCERT-EUcritical

CERT-EU issued an urgent security advisory regarding CVE-2026-20963, a critical unauthenticated remote code execution vulnerability in Microsoft SharePoint caused by the deserialization of untrusted data. The flaw is actively being exploited in the wild, prompting strong recommendations to immediately patch internet-facing servers, enable AMSI, and rotate ASP.NET machine keys.

2026-05-133 minSophoscritical

Oracle has disclosed a critical, unauthenticated remote code execution vulnerability (CVE-2026-21992, CVSS 9.8) affecting Oracle Identity Manager and Oracle Web Services Manager. The flaw allows attackers to gain network access via HTTP due to a lack of network-level authentication, though no active exploitation has been observed yet.

2026-05-134 minZscaler ThreatLabzcritical

Cisco Secure Firewall Management Center (FMC) is actively being targeted by unauthenticated attackers exploiting CVE-2026-20131, a critical insecure deserialization vulnerability. Exploitation grants root access, enabling attackers to completely compromise the firewall management platform, alter security policies, and pivot into the internal network.

2026-05-134 minCERT-EUcritical

Ivanti has released a security advisory addressing two critical code injection vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Endpoint Manager Mobile (EPMM) that allow unauthenticated remote code execution. At least one of these flaws is currently being exploited in the wild, prompting urgent recommendations to secure forensic evidence and apply available hotfixes.

2026-05-135 minCheck Pointcritical

Check Point Research discovered critical vulnerabilities in Anthropic's Claude Code CLI that enable Remote Code Execution (RCE) and API token exfiltration. By injecting malicious configurations into project files like .claude/settings.json and .mcp.json, attackers could execute arbitrary commands and steal API keys when a developer opens a compromised repository, leading to potential supply chain attacks and unauthorized access to shared Claude Workspaces.

2026-05-133 minCanadian Centre for Cyber Securitycritical

A critical pre-authentication remote code execution vulnerability (CVE-2026-1731) in BeyondTrust Remote Support and Privileged Remote Access is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary OS commands, necessitating immediate patching or isolation of self-hosted instances.

2026-05-133 minCanadian Centre for Cyber Securitycritical

The Canadian Centre for Cyber Security has issued an alert regarding multiple high-severity vulnerabilities in n8n workflow automation software. These flaws, including improper input validation and code injection, can be chained by unauthenticated attackers to achieve remote code execution, with public Proof-of-Concept exploits already available.