Zero-Day Vulnerabilities

Exploited
Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day

September 27, 2026

Botnets & C2, Malware & Exploits, Zero-Day Vulnerabilities, Threat Intelligence

Citrix confirmed two critical NetScaler zero-days were exploited before patches were available, with attackers able to remotely execute code. Citrix confirmed that two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The…
Security Affairs
Exploited
Citrix confirms two NetScaler RCE zero-days exploited in attacks

September 27, 2026

Global Cyber Attacks, Global Cyber Security, Malware & Exploits, Zero-Day Vulnerabilities, Threat Intelligence

Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws.
BleepingComputer
Exploited
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

September 27, 2026

Global Cyber Attacks, Global Cyber Security, Malware & Exploits, Zero-Day Vulnerabilities, Threat Intelligence

Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution have been exploited in the wild, Citrix confirmed on September 27. It released fixes for both, along with six other flaws. One of the two affects every deployment on an affected version, including those in the default configuration. The bulletin…
The Hacker News
Exploited
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

September 26, 2026

Enterprise & Cloud Security, Global Cyber Attacks, Global Cyber Security, Malware & Exploits, Microsoft Security, Zero-Day Vulnerabilities, Threat Intelligence

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows – CVE-2026-65660 (CVSS score: 8.8) – A code injection vulnerability in Microsoft Office SharePoint…
The Hacker News
Exploited
U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

September 26, 2026

Botnets & C2, Malware & Exploits, Zero-Day Vulnerabilities, Threat Intelligence

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-87902 allows an unauthenticated attacker to make the get_page_template() function include a…
Security Affairs
Exploited
Kiteworks urges 6-hour server shutdown over potential zero-day attacks

September 25, 2026

Global Cyber Attacks, Global Cyber Security, Zero-Day Vulnerabilities, Threat Intelligence

Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack.
BleepingComputer
Exploited
U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog

September 25, 2026

Botnets & C2, Enterprise & Cloud Security, Malware & Exploits, Microsoft Security, Zero-Day Vulnerabilities, Threat Intelligence

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft SharePoint and Mikrotik RouterOS flaws flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-65660 is a code-injection vulnerability in Microsoft SharePoint Server that allows an authenticated, low-privileged attacker…
Security Affairs
Exploited
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

September 25, 2026

Global Cyber Attacks, Global Cyber Security, Malware & Exploits, Zero-Day Vulnerabilities, Threat Intelligence

The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The issue stems from a preg_replace()…
The Hacker News
Exploited
Someone’s attacking a critical 0-day RCE in F5 BIG-IP APM

September 23, 2026

UK Cyber Attacks, Zero-Day Vulnerabilities, UK Cyber Security News, Threat Intelligence

Good news: there’s a patch. Bad news: both CISA and F5 warn that it’s under active exploitation…
The Register
Exploited
DarkMe RAT trades zero-days for plain phishing emails

September 23, 2026

Malware & Exploits, Phishing & Scams, Zero-Day Vulnerabilities, Threat Intelligence

DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of leveraging zero-day exploits, attackers are betting on a simple email to convince targets to run it on…
Help Net Security
Exploited
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

September 23, 2026

Enterprise & Cloud Security, Global Cyber Attacks, Global Cyber Security, Identity & Access Management, Malware & Exploits, Zero-Day Vulnerabilities, Threat Intelligence

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 disclosed it in an advisory on September…
The Hacker News
Exploited
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

September 23, 2026

Enterprise & Cloud Security, Global Cyber Attacks, Global Cyber Security, Microsoft Security, Nation-State Threats, Zero-Day Vulnerabilities, Threat Intelligence

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break…
The Hacker News

Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day

Citrix confirms two NetScaler RCE zero-days exploited in attacks

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

Kiteworks urges 6-hour server shutdown over potential zero-day attacks

U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Someone’s attacking a critical 0-day RCE in F5 BIG-IP APM

DarkMe RAT trades zero-days for plain phishing emails

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Stay ahead in Cyber Security.

Your basket (items: 0)