#Network Security
All CosmicBytez Labs articles tagged #Network Security, across news, security advisories, how-to guides, and projects.
- News
Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles
UTA0576 chained CVE-2026-104935 with two more flaws for root-level RCE on patched Ivanti Connect Secure VPNs after a July fix missed the full bypass.
- News
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures
doxx.net raised a $38M Series A led by a16z to launch ADN, a platform designed to stop AI agents from reaching unsafe destinations.
- Security
Critical Stack Overflow in FAST FAC1200R Routers Has Public Exploit
CVE-2026-101037 lets remote attackers crash or hijack FAST FAC1200R routers via the devdiscover service; a public exploit exists and no patch is available.
- HOWTO
Nmap for Network Asset Discovery and Security Auditing
Find every live host, open port, and service on your network before an attacker does. A practical walkthrough of Nmap scan types, service detection, NSE...
- Security
CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
An unauthenticated SSH workflow-bypass in MikroTik RouterOS chains with CVE-2026-86060 for full router takeover; CISA added it to KEV on Sept 25.
- News
InfraTrust Report Warns Network Management Systems Under Attack
Eclypsium's InfraTrust Pulse finds 158 advisories across 17 vendors as attackers target network management consoles before or at disclosure.
- HOWTO
Packet Analysis with Wireshark and tshark: A Practical Guide
Capture, filter, and triage network traffic like an analyst. Learn Wireshark display filters, tshark for headless captures, and how to spot common attack...
- Security
CVE-2026-94083 & CVE-2026-94084: Suricata DoH2/HTTP2 Flaws Let Attackers Crash IDS/IPS
Suricata 8.0.7 fixes two CVSS 9.4 unauthenticated crash bugs in its DoH2 and HTTP/2 parsers that can blind network monitoring. Upgrade now.
- News
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco patches CVE-2026-76460, a CVSS 10.0 ISE auth bypass exploited in the wild; CISA gives federal agencies until Sept. 19 to patch.
- News
Thai Broadband Provider Hacked via Fortinet Vulnerability
Hunt.io found 298 staged attack tools tied to a CVE-2024-21762 FortiGate SSL-VPN exploit used to breach Thai ISP 3BB and target RADIUS credentials.
- Security
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Secure Email Gateway has a critical, unauthenticated SQL injection (CVSS 9.8) enabling root code execution. CISA KEV-listed as actively exploited.
- News
Dutch NCSC Warns Check Point VPN Flaw Exploitation Is Imminent
The Dutch NCSC warns exploitation is imminent for two critical Check Point VPN flaws enabling RCE on Security Gateways and Management Servers.
- Security
CVE-2026-86060: MikroTik RouterOS SSH Privilege Escalation
Unauthenticated attackers can escalate to full admin control on MikroTik RouterOS via a crafted SSH username; CISA lists it as actively exploited.
- News
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
CERT Polska warns of active attacks gaining full admin control of internet-facing MikroTik RouterOS devices via SSH with no authentication needed.
- News
Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks
SonicWall confirms active exploitation of two chained SMA 1000 zero-days — a pre-auth SSRF (CVSS 10.0) and post-auth command injection.
- Security
CVE-2026-78211: Critical OS Command Injection in 4MOSAn GCB Doctor
A CVSS 9.8 critical unauthenticated RCE vulnerability in 4MOSAn GCB Doctor exposes systems to full OS command injection via an unremoved ADOdb test page.
- Security
CVE-2026-77946: TRENDnet TEW-821DAP Critical Stack Buffer Overflow
CVSS 10.0 RCE flaw in TRENDnet TEW-821DAP firmware lets attackers exploit NTP config with no patch available.
- Security
CVE-2026-19961: Critical Buffer Overflow in Edimax EW-7478APC Wireless Router
A CVSS 9.9 buffer overflow in the Edimax EW-7478APC 1.04 allows unauthenticated remote code execution via the formWlSiteSurvey endpoint.
- Security
CVE-2026-19977: EFM ipTIME A3004T Authentication Bypass — CVSS 10.0
Critical auth bypass (CVSS 10.0) in EFM ipTIME A3004T routers lets unauthenticated attackers gain full admin access via session URL manipulation.
- Security
CVE-2026-19348: Critical Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater
A CVSS 9.8 critical command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater allows unauthenticated remote attackers to execute...
- Security
CVE-2026-66747: Zbtlink Routers Ship ENDLESSDOORS Firmware Backdoor (CVSS 9.8)
Every published Zbtlink router firmware build contains ENDLESSDOORS — an embedded root-level remote control implant disguised as a Linux kernel worker...
- News
TP-Link Patches 15 Omada ZTP Flaws That Could Let Attackers Breach Networks
TP-Link has released patches for 15 vulnerabilities in the zero-touch provisioning mechanism of its Omada network ecosystem. Chained with two previously...
- News
The Network Has Become the Control Plane for AI Security
As AI agents, copilots, and LLM-powered applications proliferate across enterprise environments, traditional packet-inspection firewalls are blind to the...
- News
Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Arista Networks has released an emergency patch for a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator deployments that...
- News
Check Point Patches SmartConsole Zero-Day Exploited in Attacks
Check Point Software has patched an actively exploited zero-day vulnerability in its SmartConsole GUI admin panel. The flaw allowed attackers to...
- Security
CVE-2026-16232: Check Point SmartConsole Improper Authentication
A critical improper authentication flaw in Check Point SmartConsole allows unauthenticated remote attackers to steal login tokens and gain full admin...
- News
SonicWall SMA1000 Flaws Exploited as Zero-Days to Push Custom Malware
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks before patches were available, allowing threat...
- News
Inc Ransomware Exploits Chained SonicWall SMA Zero-Days for Root Access
The Inc ransomware group is actively exploiting two chained zero-day vulnerabilities in SonicWall Secure Mobile Access appliances. When combined, the...
- Security
CVE-2026-51380: Tenda AC10 v3 Buffer Overflow Enables DoS and Remote Code Execution
A critical CVSS 9.8 buffer overflow vulnerability in Tenda AC10 v3 firmware V03.03.16.09 allows remote attackers to cause permanent denial of service or...
- News
SonicWall Warns of Two Zero-Day Exploits Targeting SMA1000 — Patch Immediately
SonicWall has issued an urgent advisory warning of two zero-day vulnerabilities in its SMA1000 appliances — CVE-2026-15409 and CVE-2026-15410 — that can...
- News
SonicWall Warns of SMA1000 Flaws Exploited in Zero-Day Attacks, Patch Now
SonicWall has issued an urgent advisory warning that two vulnerabilities in its SMA 1000 series secure remote access appliances are being actively...
- News
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Cisco Talos researchers have identified new LONGLEASH malware deployed by Chinese APT group UAT-7810 to expand its Operational Relay Box network,...
- Security
UniFi Connect Critical RCE via Command Injection CVE-2026-50746
A maximum-severity command injection vulnerability in Ubiquiti's UniFi Connect Application allows any network-accessible attacker to execute arbitrary OS...
- News
Hackers Exploit Cisco SD-WAN Zero-Day for Root Access at Telecom Provider
Mandiant has detailed an incident in which threat actors exploited a Cisco SD-WAN zero-day vulnerability to gain the highest possible access level at a...
- HOWTO
Deploy OpenCanary to Catch Attackers Inside Your Network
Set up OpenCanary honeypot services on a Raspberry Pi or VM to detect lateral movement, credential stuffing, and unauthorized access before attackers...
- Security
CVE-2026-47369: UniFi OS Privilege Escalation via Improper Input Validation
A critical CVSS 9.9 privilege escalation vulnerability in Ubiquiti UniFi OS allows a low-privileged network attacker to escalate privileges within UniFi...
- Security
CVE-2026-47370: UniFi OS Command Injection via Improper Input Validation
A critical CVSS 9.9 command injection vulnerability in Ubiquiti UniFi OS allows a low-privileged network attacker to execute arbitrary commands within...
- News
Cisco Customers Encounter Another SD-WAN Zero-Day Under Attack
A seventh actively exploited zero-day in Cisco SD-WAN products this year — CVE-2026-20245 — is under attack with no patch yet available from Cisco.
- News
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
Cisco has disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability in Catalyst SD-WAN Manager with a CVSS score of 7.8. No patch is…
- News
Cisco Warns of Unpatched SD-WAN Zero-Day Exploited in Attacks
Cisco has issued an emergency warning about an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) that enables root…
- Security
CVE-2026-35906: T3 Technology CPE Unauthenticated Root RCE via Debug CGI
An undocumented debug CGI endpoint in T3 Technology CPE devices (T625Pro v1.0.07, T6825G v1.0.03) allows unauthenticated remote attackers to execute arbitrary…
- Security
CVE-2026-6274: Critical Authentication Bypass in DTS Redline WR3200 Router
A critical authentication bypass vulnerability in the DTS Electronics Redline WR3200 router allows unauthenticated attackers to access functionality protected…
- Security
CVE-2026-49186: Critical MQTT Broker Wildcard ACL Bypass
A critical CVSS 9.8 vulnerability in a local MQTT broker fails to enforce topic-level ACLs, allowing any client to use wildcard characters to enumerate hidden…
- News
Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches
A stack-based buffer overflow flaw in HP OfficeConnect VoIP phones can be exploited remotely to achieve code execution, potentially allowing attackers to…
- News
Ubiquiti Patches Three Max-Severity UniFi OS Vulnerabilities
Ubiquiti has released security updates fixing three CVSS 10.0 vulnerabilities in UniFi OS that allow unauthenticated remote attackers to fully compromise...
- News
'Underminr' Vulnerability Lets Attackers Hide Malicious
A newly disclosed vulnerability dubbed 'Underminr' affects approximately 88 million domains and enables attackers to bypass DNS filtering tools while...
- Security
UniFi OS Command Injection via Improper Input Validation
A CVSS 9.1 command injection vulnerability in UniFi OS devices allows a network-adjacent attacker with high privileges to execute arbitrary commands on...
- Security
UniFi OS Improper Access Control — Unauthorized System
A CVSS 10.0 improper access control flaw in UniFi OS allows any network-accessible attacker to make unauthorized changes to the underlying system with no...
- Security
CVE-2026-34909 — UniFi OS Path Traversal Leading to Account
A CVSS 10.0 path traversal vulnerability in UniFi OS allows an unauthenticated network attacker to read arbitrary files, including sensitive account files...
- Security
CVE-2026-34910 — UniFi OS Unauthenticated Command Injection
A CVSS 10.0 command injection vulnerability in UniFi OS allows any network-accessible attacker with no credentials to execute arbitrary OS commands,...
- News
Hackers Bypass SonicWall VPN MFA Due to Incomplete Patching
Threat actors brute-forced credentials and bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances to deploy ransomware tools,...
- Project
Pi-hole v6 + Unbound: Network-Wide DNS Sinkhole with Recursive Resolution
Deploy Pi-hole v6 as a network-wide DNS sinkhole backed by Unbound as a self-hosted recursive resolver — eliminating ads, trackers, and malware domains...
- News
Cisco Catalyst SD-WAN Controller Auth Bypass Actively
Cisco has patched a maximum-severity authentication bypass flaw in its Catalyst SD-WAN Controller that has already been exploited in limited attacks....
- News
Cisco Patches Another SD-WAN Zero-Day, the Sixth Exploited
Cisco has patched CVE-2026-20182, a zero-day in Catalyst SD-WAN Manager that has been actively exploited in targeted attacks by sophisticated threat actor...
- News
Cisco Zero-Day Under Ongoing Attack by Persistent Threat
The threat group UAT-8616 is actively exploiting a new Cisco SD-WAN zero-day and has been linked to multiple prior Cisco firewall and SD-WAN vulnerability...
- News
Fortinet Warns of Critical RCE Flaws in FortiSandbox and FortiAuthenticator
Fortinet has released emergency security patches for two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to...
- Security
CVE-2026-7154: Totolink A8000RU OS Command Injection via CGI Handler
A critical unauthenticated OS command injection vulnerability in the Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote attackers to...
- HOWTO
Network Traffic Analysis with Zeek: From Deployment to Threat Detection
Deploy Zeek (formerly Bro) on Linux to passively monitor network traffic, generate structured logs, write detection scripts, and forward data to your SIEM...
- HOWTO
Suricata IDS/IPS Deployment: From Install to Active Threat
Deploy Suricata as a full-featured Network Intrusion Detection and Prevention System on Ubuntu. Covers installation, interface capture, Emerging Threats...
- News
Citrix NetScaler CVE-2026-3055 (CVSS 9.3) Under Active
Security researchers at Defused Cyber and watchTowr have detected active reconnaissance targeting CVE-2026-3055, a critical CVSS 9.3 memory overread flaw...
- Security
CVE-2025-53521: F5 BIG-IP APM Remote Code Execution — CISA
A critical unauthenticated RCE vulnerability in F5 BIG-IP APM is being actively exploited in the wild. Malicious traffic targeting access policy virtual...
- News
Critical Unpatched GNU Telnetd Flaw (CVE-2026-32746)
Researchers have disclosed a critical unauthenticated remote code execution vulnerability in the GNU InetUtils telnet daemon (telnetd). CVE-2026-32746...
- Checklist
Network Security Audit Checklist
Systematic audit checklist for network infrastructure security — firewall rules, segmentation, VPN configuration, DNS security, wireless security, and...
- Security
CISA Issues Emergency Directive as Cisco SD-WAN Zero-Day
A maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) has been actively exploited by threat actor UAT-8616 since...
- HOWTO
FortiGate Security Hardening: Best Practices for Enterprise
Complete FortiGate hardening guide covering admin access lockdown, firmware management, interface hardening, DNS/NTP security, certificate management,...
- HOWTO
FortiGate IPsec VPN: Site-to-Site with Azure
Configure IPsec site-to-site VPN between FortiGate firewall and Azure VPN Gateway. Covers IKE configuration, routing, BGP, and high availability.
- HOWTO
FortiGate SSL VPN Setup: Secure Remote Access Configuration
Configure FortiGate SSL VPN for secure remote user access. Covers portal setup, user authentication, firewall policies, and FortiClient configuration.
- HOWTO
Kubernetes Network Policies: Microsegmentation Guide
Implement network microsegmentation in Kubernetes with Network Policies. Covers default deny, allow rules, namespace isolation, egress policies, and debugging.
- Project
FortiGate SD-WAN Deployment
Deploy enterprise SD-WAN with FortiGate featuring dual ISP failover, performance SLAs, application steering, and Zero Trust architecture integration.
- Project
Network Traffic Analysis with Zeek and Suricata
Deploy a network monitoring stack combining Zeek for protocol analysis and Suricata for intrusion detection, with ELK integration for visualization and...
- HOWTO
Python for Security Automation: Essential Scripting
Learn Python security scripting fundamentals including network scanning, log parsing, hash analysis, API integration, and automated threat detection for...
- HOWTO
Pi-hole DNS Security: Block Ads, Trackers, and Malware
Deploy Pi-hole for network-wide ad blocking and DNS security. Includes setup, configuration, upstream DNS options, and integration with encrypted DNS.