#Active Exploitation
All CosmicBytez Labs articles tagged #Active Exploitation, across news, security advisories, how-to guides, and projects.
- News
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
A maximum-severity SSRF flaw (CVE-2026-102255, CVSS 10.0) in SonicWall SMA 1000 appliances is under active attack days after patching.
- News
Ninja Forms and WPC Product Bundles Flaws Exploited to Backdoor WordPress Sites
Attackers are chaining stored XSS bugs in Ninja Forms and WPC Product Bundles for WooCommerce to plant hidden admins and backdoors on 530,000+ sites.
- News
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Arista disclosed CVE-2026-93952, a CVSS 10.0 pre-auth privilege escalation in VeloCloud Orchestrator, already under active exploitation.
- News
Elementor Pro Flaw Exploited to Hack WordPress Sites, 190K+ Attempts Blocked
A critical arbitrary file upload bug in Elementor Pro (CVE-2026-32475) is under active exploitation, with Defiant blocking 190,000+ attack attempts.
- News
Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks
SonicWall confirms active exploitation of two chained SMA 1000 zero-days — a pre-auth SSRF (CVSS 10.0) and post-auth command injection.
- News
Hackers Exploit Sangoma Switchvox Flaw to Deploy Reverse Shells
A critical unauthenticated SQL injection in Sangoma Switchvox is under active exploitation, dropping reverse shells on roughly 4,000 exposed PBXs.
- News
Microsoft Entra ID CVSS 10.0 Flaw Exploited in Wild, Allows Remote Code Execution
Microsoft warns of a CVSS 10.0 RCE flaw in Entra ID (CVE-2026-69836) exploited in the wild. No customer action required — Microsoft patched it server-side.
- News
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CVE-2026-73570, a CVSS 8.9 command injection flaw in Zimbra Collaboration, is actively exploited in the wild for unauthenticated RCE via SNMP.
- News
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
CISA added a critical Ray framework flaw to its KEV catalog. The vulnerability enables browser-based RCE in AI/ML distributed computing workloads.
- News
Hackers Exploit macOS Screen Sharing Flaw to Deploy Monero Miner
Netherlands NCSC warns hackers are actively exploiting a macOS authentication bypass in Screen Sharing after public exploit code emerged, deploying Monero...
- News
Hackers Exploiting Unpatched GeoServer Zero-Day With SQL Injection to RCE
Active exploitation attempts targeting an unpatched GeoServer zero-day began within hours of public disclosure. No patch available — restrict access now.
- News
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 5, 2026 — a critical Langflow RCE, an Apache Tomcat encryption...
- News
Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Arista Networks has released an emergency patch for a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator deployments that...
- News
Hackers Target US Firms in FastJson RCE Zero-Day Attacks
Threat actors are actively exploiting an unpatched remote code execution vulnerability in Alibaba's FastJson Java library, targeting US enterprises with...
- News
Fastjson 1.x RCE Actively Exploited With No Patch Available
Attackers are actively exploiting CVE-2026-16723, a critical remote code execution flaw in Alibaba's Fastjson 1.x library affecting Spring Boot...
- News
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
A high-severity path traversal vulnerability in the open-source developer platform Windmill (CVE-2026-29059, CVSS 7.5) is under active exploitation,...
- News
Hackers Exploit Critical Auth Bypass in Official Gitea Docker Image
Attackers are actively exploiting a critical authentication bypass in the official Gitea Docker image, allowing unauthenticated users to impersonate any...
- News
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA has added a high-severity Microsoft SharePoint Server remote code execution vulnerability to its Known Exploited Vulnerabilities catalog following...
- News
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts
A critical pre-authentication remote code execution flaw in Progress Kemp LoadMaster (CVE-2026-8037, CVSS 9.6) is under active exploitation attempts,...
- News
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
A critical CVSS 9.8 authentication bypass vulnerability in Oracle E-Business Suite's Payments module is being actively exploited in the wild, according to...
- Security
CVE-2026-35273: Critical Oracle PeopleSoft RCE Exploited in the Wild
A CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is being actively exploited, with threat...
- News
Path Traversal Flaw in AI Dev Platform Langflow Exploited in Attacks
Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in Langflow, to write arbitrary files on exposed servers....
- News
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
Cisco has disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability in Catalyst SD-WAN Manager with a CVSS score of 7.8. No patch is…
- News
Critical Windows Netlogon RCE Flaw Now Exploited in Attacks
Belgium's national cybersecurity authority (CCB) has issued an urgent warning that threat actors are actively exploiting a recently patched critical Windows…
- News
Palo Alto GlobalProtect VPN Auth Bypass Flaw Now Exploited in Attacks
Palo Alto Networks warns that CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect, is under active exploitation by hackers attempting...
- News
PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
Palo Alto Networks warns that CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect and Prisma Access, is being actively exploited by...
- News
Drupal: Critical SQL Injection Flaw Now Targeted in Attacks
Drupal is warning that hackers are actively attempting to exploit a 'highly critical' SQL injection vulnerability, CVE-2026-9082, announced earlier this...
- News
Microsoft Warns of Two Actively Exploited Defender
Microsoft has disclosed two Windows Defender vulnerabilities under active exploitation in the wild, including CVE-2026-41091 — a privilege escalation flaw...
- News
Trend Micro Warns of Apex One Zero-Day Exploited in the Wild
Trend Micro has patched an Apex One zero-day vulnerability actively exploited in attacks targeting Windows systems. The flaw, discovered in the company's...
- News
Microsoft Warns of New Defender Zero-Days Exploited in Attacks
Microsoft has issued emergency patches for two Windows Defender vulnerabilities that were actively exploited as zero-days before fixes were available....
- News
Funnel Builder Flaw Under Active Exploitation Enables
Attackers are actively exploiting a critical vulnerability in the Funnel Builder WordPress plugin to inject malicious JavaScript into WooCommerce checkout...
- News
Hackers Are Exploiting a Critical LiteLLM Pre-Auth SQLi Flaw
Threat actors are actively exploiting CVE-2026-42208, a critical pre-authentication SQL injection vulnerability in the LiteLLM open-source LLM gateway,...
- News
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure
A high-severity SSRF vulnerability in LMDeploy, a widely used open-source LLM deployment toolkit, was actively exploited in the wild less than 13 hours...
- News
Hackers Actively Exploiting Breeze Cache File Upload Bug in WordPress Attacks
Threat actors are mass-exploiting a critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin, uploading PHP webshells to...
- News
Actively Exploited Apache ActiveMQ Flaw Impacts 6,400
Shadowserver found over 6,400 Apache ActiveMQ servers exposed online and vulnerable to ongoing attacks exploiting a high-severity code injection...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- News
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables
A critical authentication bypass vulnerability in nginx-ui, a popular open-source web-based Nginx management interface, is being actively exploited to...
- News
Hackers Exploit Critical Flaw in Ninja Forms WordPress
Attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in the Ninja Forms File Uploads premium add-on for...
- News
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Fortinet has released emergency out-of-band patches for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that enables...
- News
New FortiClient EMS Flaw Exploited in Attacks, Emergency
Fortinet has released an emergency weekend security update for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that is...
- News
Critical Citrix NetScaler Memory Flaw Actively Exploited in Attacks
Hackers are actively exploiting a critical memory overread vulnerability tracked as CVE-2026-3055 in Citrix NetScaler ADC and NetScaler Gateway appliances...
- News
Critical Fortinet FortiClient EMS Flaw Now Exploited in Attacks
Threat intelligence firm Defused confirms active in-the-wild exploitation of a critical vulnerability in Fortinet's FortiClient EMS platform....
- News
Hackers Now Exploit Critical F5 BIG-IP Flaw in Attacks
F5 has reclassified a BIG-IP APM vulnerability from denial-of-service to critical remote code execution, warning that attackers are actively exploiting...
- News
CISA: New Langflow Flaw Actively Exploited to Hijack AI
CISA has added CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in the Langflow AI framework, to its Known Exploited...
- News
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM
CISA has added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog after...
- News
Citrix NetScaler CVE-2026-3055 (CVSS 9.3) Under Active
Security researchers at Defused Cyber and watchTowr have detected active reconnaissance targeting CVE-2026-3055, a critical CVSS 9.3 memory overread flaw...
- Security
CVE-2025-53521: F5 BIG-IP APM Remote Code Execution — CISA
A critical unauthenticated RCE vulnerability in F5 BIG-IP APM is being actively exploited in the wild. Malicious traffic targeting access policy virtual...
- Security
CISA Adds Two Actively Exploited Roundcube Webmail Flaws to KEV
CISA has added two Roundcube Webmail vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2025-49113 (CVSS 9.9, deserialization RCE) and...
- Security
BeyondTrust Remote Support Pre-Authentication RCE Under
A critical pre-authentication OS command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access with CVSS 9.9 is being...
- Security
Google Chrome Use-After-Free Zero-Day Under Active
A high-severity use-after-free vulnerability in Chrome's CSS engine is being actively exploited in the wild. Google's first in-the-wild Chrome zero-day of...
- Security
Windows SmartScreen Bypass Under Active Exploitation
Actively exploited Windows Shell vulnerability bypasses SmartScreen protection, allowing malicious files to execute without security warnings. Patch...