CISA cyber & ICS and DC3 (DoD Cyber Crime Center / DCISE) threat products relevant to the DIB — each read by dex into a categorized card: the gist, why it matters, who's affected, and what to do.
Vulnerability
CISA
2026-10-15
Thermo Fisher Torrent Suite Software <=5.18 has a path traversal flaw allowing authenticated attackers to read arbitrary files.
A path traversal vulnerability (CVE-2026-107777) in Thermo Fisher Torrent Suite Software <=5.18 allows an authenticated attacker to read arbitrary files on the Torrent Server. Thermo Fisher has released a fix and recommends updating to version 5.22 or later.
AFFECTEDThermo Fisher Torrent Suite Software
▸ DO Update Thermo Fisher Torrent Suite Software to version 5.22 or later immediately.
#patch-available#vulnerability
Vulnerability
CISA
2026-10-15
J4Care dcm4che vulnerabilities allow attackers to delete medical images, expose patient data, and cause denial-of-service.
Successful exploitation of CVE-2026-97851 and related flaws in J4Care dcm4chee-arc-light 5.35.1 enables deletion of stored medical images, disclosure of patient information, injection of forged studies, and denial-of-service. Healthcare and public health sectors are impacted worldwide.
AFFECTEDJ4Care dcm4chee-arc-light 5.35.1
▸ DO Apply the J4Care release fix immediately and verify affected systems are patched.
#vulnerability#healthcare#patch-available
Vulnerability
CISA ICS
2026-10-15
Critical vulnerabilities in Guangzhou Juan IoT Technology EseeCloud allow attackers to gain control of IP cameras via hard-coded credentials and improper attribute modification.
Successful exploitation of CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664 in EseeCloud App <=4.9.6 and Firmware <=4.9.86.0 enables attackers to take control of affected IP cameras. The vendor has not responded to CISA coordination attempts, and users must contact the vendor for support.
AFFECTEDGuangzhou Juan IoT Technology EseeCloud AppGuangzhou Juan IoT Technology EseeCloud Firmware
▸ DO Patch EseeCloud App and Firmware to versions above 4.9.6 and 4.9.86.0 respectively, or isolate affected devices from the network.
#vulnerability#patch-available#critical-infrastructure#iot
Vulnerability
CISA ICS
2026-10-15
Eclipse Milo versions 1.0.0 through 1.1.4 contain critical authorization flaws allowing credential theft and data deletion.
Successful exploitation of CVE-2026-62927 and related vulnerabilities in Eclipse Milo allows attackers to execute denied methods, recover user credentials, and delete protected data. The flaws stem from incorrect authorization and missing resource release in the Call service dispatch.
AFFECTEDEclipse Milo
▸ DO Upgrade Eclipse Milo to a patched version immediately and review access controls for affected systems.
#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-10-15
CISA Malcolm <=v26.08.0 contains multiple critical vulnerabilities including authentication bypasses and SSRF.
CISA Malcolm versions <=v26.08.0 are affected by six critical vulnerabilities (CVE-2026-107334 through CVE-2026-107362) including authentication bypasses, SSRF, and CSRF. These flaws impact critical infrastructure sectors like energy, IT, and water systems, allowing unauthenticated access to backend services.
AFFECTEDCISA Malcolm
▸ DO Upgrade CISA Malcolm to version >v26.08.0 immediately and verify authentication controls on Arkime backend proxies.
#rce#vulnerability#patch-available#critical-infrastructure#authentication-bypass#ssrf
Vulnerability
CISA
2026-10-15
CISA added CVE-2026-21589 to the KEV Catalog for an Atlassian vulnerability allowing external access to files or directories.
CISA has added CVE-2026-21589 to the Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation of an Atlassian vulnerability that allows external parties to access files or directories. This poses significant risks to federal and private sector organizations using Atlassian products, especially those with publicly exposed assets.
AFFECTEDAtlassian
▸ DO Prioritize patching CVE-2026-21589 on all Atlassian products and verify no external access to files or directories exists.
#vulnerability#patch-available#exploited-in-wild
Vulnerability
RCE
CISA
2026-10-14
CISA added four known exploited vulnerabilities to its KEV Catalog, including two in Palo Alto Networks PAN-OS and two in Ahsay AhsayCBS.
CISA has added four new vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation. The new entries include CVE-2026-0322 and CVE-2026-76519 in Palo Alto Networks PAN-OS, and CVE-2026-105133 and CVE-2026-105134 in Ahsay AhsayCBS, which pose significant risks to federal and private sector organizations.
AFFECTEDPalo Alto Networks PAN-OSAhsay AhsayCBS
▸ DO Prioritize patching Palo Alto Networks PAN-OS and Ahsay AhsayCBS systems on publicly exposed assets.
#rce#vulnerability#patch-available#exploited-in-wild
Vulnerability
CISA ICS
2026-10-13
Swann Communications SWIFI-SE2KIC firmware <=2.0.22 has unauthenticated video access flaws.
Successful exploitation of CVE-2026-107605, CVE-2026-107606, and CVE-2026-107607 allows attackers to view live video feeds without authentication on the local network. DIBs using these cameras must patch or apply interim mitigations to prevent unauthorized surveillance.
AFFECTEDSwann Communications SWIFI-SE2KIC
▸ DO Update Swann Communications SWIFI-SE2KIC firmware to version 2.0.23 or later, or isolate devices behind a secured router and firewall.
#vulnerability#patch-available#mitigations
Vulnerability
RCE
CISA ICS
2026-10-13
Ignition Software privilege escalation flaw requires immediate patching for critical infrastructure sectors.
A vulnerability in Inductive Automation Ignition Software allows authenticated low-level users to escalate privileges to higher levels, enabling arbitrary code execution. Affected versions include Ignition >=8.1.0|<=8.1.54 and >=8.3.0|<=8.3.8, impacting critical manufacturing, energy, and IT sectors.
AFFECTEDInductive Automation Ignition
▸ DO Update Ignition Software to version 8.3.9 or 8.1.55 immediately.
#rce#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA
2026-10-13
CISA urges immediate patching of Ivanti Connect Secure due to a newly exploited zero-day authentication bypass vulnerability.
CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog. This zero-day allows remote, unauthenticated command execution, enabling credential theft and data exfiltration in Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
AFFECTEDIvanti Connect Secure
▸ DO Immediately update Ivanti Connect Secure to the latest version and review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for deployment-specific patching guidance.
#rce#vulnerability#exploited-in-wild#patch-available#credential-theft#data-exposure
Vulnerability
RCE
CISA
2026-10-13
CISA added two actively exploited vulnerabilities to its KEV Catalog, requiring rapid remediation under BOD 26-04.
CISA has added CVE-2026-96951 (Microsoft Windows Command Injection) and CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass) to the Known Exploited Vulnerabilities (KEV) Catalog. Under Binding Operational Directive 26-04, federal agencies must prioritize rapid remediation of high-risk KEV vulnerabilities that grant total control of an asset post-exploitation.
AFFECTEDMicrosoft WindowsIvanti Connect Secure
▸ DO Prioritize patching CVE-2026-96951 and CVE-2026-104935 on publicly exposed assets immediately.
#rce#vulnerability#patch-available#mitigations#dib-sector
Vulnerability
RCE
CISA ICS
2026-10-08
Satel Netco Design versions prior to v2.1.7 have a stored cross-site scripting vulnerability allowing script execution in user browsers.
A stored cross-site scripting (XSS) vulnerability exists in Satel Netco Design versions prior to v2.1.7, enabling authenticated users with Network Operator privileges to inject and execute arbitrary scripts in other users' browsers. Exploitation could lead to arbitrary code execution, file enumeration, and system resource consumption.
AFFECTEDSatel Netco Design
▸ DO Update Satel Netco Design to version 2.1.7 or later immediately.
#rce#vulnerability#patch-available#web-app
Vulnerability
CISA ICS
2026-10-08
Red Lion Controls N-Tron 700 Series switches have critical vulnerabilities allowing administrative access and continuous reboots.
Successful exploitation of these vulnerabilities allows a malicious user to gain administrative access, view/edit/upload configuration files, and cause continuous reboots by navigating to a specific URL. The affected devices are Red Lion Controls N-Tron 700 Series with Firmware <= 3.11.0 and Bootloader <= 2.0.6.1.
AFFECTEDRed Lion Controls N-Tron 700 Series
▸ DO Patch Red Lion Controls N-Tron 700 Series devices to Firmware 3.11.1 and Bootloader 2.0.6.2 immediately.
#vulnerability#patch-available#ot
Vulnerability
RCE
CISA ICS
2026-10-08
Grid Protection Alliance openPDC and openHistorian versions below 2.9.482 and 2.8.585 are vulnerable to multiple critical flaws including deserialization and SSRF.
Grid Protection Alliance openPDC and openHistorian software versions below 2.9.482 and 2.8.585 are affected by five critical vulnerabilities, including deserialization of untrusted data, missing authentication for critical functions, and server-side request forgery. These flaws could allow remote code execution and unauthorized access, posing a severe risk to energy sector infrastructure.
AFFECTEDGrid Protection Alliance openPDCGrid Protection Alliance openHistorian
▸ DO Upgrade openPDC to version 2.9.482 or higher and openHistorian to version 2.8.585 or higher immediately.
#rce#vulnerability#patch-available#ot#energy
Nation-state
RCE
CISA
2026-10-08
Chinese government-linked actors use automated and hands-on tools to steal data from critical infrastructure.
Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.
AFFECTEDMicrosoft Exchange serversVPN software
▸ DO Disable unused services and ports, sanitize web application inputs, implement multifactor authentication, and apply timely patches.
#rce#state-sponsored#exploited-in-wild#mitigations#dib-sector
Vulnerability
RCE
CISA ICS
2026-10-06
Critical buffer overflow in Savannah lwIP SMTP client 2.2.1 allows remote code execution.
A buffer overflow vulnerability (CVE-2026-15340) in Savannah lwIP SMTP client 2.2.1 enables remote code execution and device crashes. Affected sectors include energy, water, and wastewater systems.
AFFECTEDSavannah lwIP SMTP client 2.2.1
▸ DO Patch Savannah lwIP SMTP client 2.2.1 to version 2.2.2 or apply patch_125_smtp_txbuf.diff immediately.
#rce#vulnerability#patch-available#critical#energy#water
Vulnerability
CISA ICS
2026-10-06
Johnson Controls EasyIO FG firmware <=2.0b52 has critical vulnerabilities allowing full unauthorized device access.
Successful exploitation of CVE-2026-27872 and CVE-2026-27873 in Johnson Controls EasyIO FG firmware allows attackers to gain full unauthorized access via hard-coded credentials and improper privilege management. The product is End-of-Life with no patches available, requiring immediate operational mitigation.
AFFECTEDJohnson Controls EasyIO FG
▸ DO Identify and isolate any deployed Johnson Controls EasyIO FG devices and implement compensating controls such as network segmentation and strict access restrictions.
#vulnerability#patch-available#ot#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-10-06
Hitachi Energy SOI products with Apache ActiveMQ versions 2.0.0 to 2.2.0 have a critical RCE vulnerability.
A remote code execution vulnerability (CVE-2026-34197) exists in the Apache ActiveMQ component of Hitachi Energy SOI products. An authenticated attacker can exploit improper input validation and code injection to execute arbitrary code, compromising confidentiality, integrity, and availability.
AFFECTEDHitachi Energy SOI
▸ DO Apply the vendor's recommended immediate actions to patch or mitigate CVE-2026-34197.
#rce#vulnerability#patch-available#critical-infrastructure#energy
Vulnerability
RCE
CISA ICS
2026-10-06
Hitachi Energy RTU500 end-of-life firmware versions 11.x and prior are affected by legacy security vulnerabilities.
Dragos reported security findings in Hitachi Energy RTU500 CMU firmware versions 9.x and prior, which are end-of-life and no longer receive security updates. While currently supported versions are unaffected, legacy versions lack modern security controls and are at risk.
AFFECTEDHitachi Energy RTU500
▸ DO Upgrade to a currently supported RTU500 firmware version and implement defense-in-depth measures.
#rce#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-10-06
Hitachi Energy REB500 products have open-source vulnerabilities allowing DoS attacks via crafted IEC 61850 messages.
Hitachi Energy REB500 versions 8.3.3.1 and prior are affected by CVE-2024-8176 and CVE-2025-59375, which exploit the libexpat library to cause denial of service or memory corruption. These vulnerabilities can be triggered by authenticated users with local access sending crafted IEC 61850 messages.
AFFECTEDHitachi Energy REB500
▸ DO Update REB500 to version 8.3.4.0 immediately.
#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-10-06
Hitachi Energy Asset Suite versions 9.9.0 and prior have unauthenticated servlet access flaws risking confidentiality, integrity, and availability.
Hitachi Energy has identified unauthenticated servlet access vulnerabilities in Asset Suite versions 9.9.0 and prior, allowing configuration file uploads and information disclosure. These flaws can be exploited to compromise the confidentiality, integrity, and availability of the product.
AFFECTEDHitachi Energy Asset Suite
▸ DO Upgrade to Asset Suite 9.9.1 when available or disable the HTTPPublishAdapterTestServlet.
#vulnerability#patch-available#energy
Vulnerability
CISA
2026-10-02
CISA added two Zammad vulnerabilities to the KEV Catalog due to active exploitation.
CISA has added CVE-2026-102489 (Zammad session fixation) and CVE-2026-102490 (Zammad improper privilege management) to the Known Exploited Vulnerabilities Catalog. These vulnerabilities allow total control of an asset post-exploitation and are frequent attack vectors for malicious actors.
AFFECTEDZammad
▸ DO Patch Zammad immediately on publicly exposed assets and verify system compromise before patching.
#vulnerability#exploited-in-wild#patch-available
Vulnerability
CISA ICS
2026-10-01
Monta monta.app charging stations have critical authentication flaws allowing unauthorized administrative control and DoS attacks.
Successful exploitation of CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, and CVE-2026-93474 in Monta monta.app enables attackers to impersonate charging stations, escalate privileges, and disrupt energy infrastructure. The vulnerabilities stem from missing authentication, improper rate limiting, insufficient session expiration, and unprotected credentials.
AFFECTEDMonta monta.app
▸ DO Patch Monta monta.app charging stations immediately and monitor for unauthorized WebSocket connections.
#vulnerability#patch-available#ot#energy
Vulnerability
CISA ICS
2026-10-01
Meari IoT Cloud Platform OpenAPI Service has critical authorization flaws allowing unauthorized device manipulation and data access.
Successful exploitation of CVE-2026-101104 and CVE-2026-96613 in the Meari IoT Cloud Platform OpenAPI Service enables attackers to alter device configurations, trigger unauthorized behaviors, and access sensitive credentials and network data. Meari has not released a fix and did not respond to CISA coordination attempts.
AFFECTEDMeari IoT Cloud Platform OpenAPI Service
▸ DO Review and patch Meari IoT Cloud Platform OpenAPI Service deployments; monitor for unauthorized device configuration changes.
#vulnerability#patch-available#mitigations
Vulnerability
CISA ICS
2026-10-01
Johnson Controls EasyIO Neo Series EC and CW Controllers have a critical vulnerability allowing unauthorized access to sensitive information.
A vulnerability (CVE-2026-64892) in Johnson Controls EasyIO Neo Series EC and CW Controllers allows attackers to gain access to sensitive information, which could be used for further attacks. These programmable edge controllers are used in building automation for HVAC, lighting, and energy management.
AFFECTEDJohnson Controls EasyIO Neo Series EC Controllers V3.3b63Johnson Controls EasyIO Neo Series EC Controllers V3.3b62Johnson Controls EasyIO Neo Series CW Controllers V3.3b25Johnson Controls EasyIO Neo Series CW Controllers V3.3b24
▸ DO Patch Johnson Controls EasyIO Neo Series EC and CW Controllers to version V3.3b63 or higher for EC and V3.3b25 or higher for CW.
#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-10-01
Johnson Controls EasyIO Neo controllers have a cleartext transmission flaw allowing interception of credentials and session data.
A vulnerability in Johnson Controls EasyIO Neo Series EC and CW Controllers allows attackers to intercept and read sensitive information, including credentials and session data, transmitted in cleartext. Affected versions include V3.3b62, V3.3b63, V3.3b24, and V3.3b25, impacting critical infrastructure sectors like commercial facilities and energy.
AFFECTEDJohnson Controls EasyIO Neo Series EC Controllers V3.3b62Johnson Controls EasyIO Neo Series EC Controllers V3.3b63Johnson Controls EasyIO Neo Series CW Controllers V3.3b24Johnson Controls EasyIO Neo Series CW Controllers V3.3b25
▸ DO Patch Johnson Controls EasyIO Neo controllers to versions that mitigate CVE-2026-64893 and review network configurations to ensure sensitive data is not transmitted in cleartext.
#vulnerability#cleartext-transmission#credential-theft#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-10-01
CISA Malcolm advisory details critical cross-site scripting and injection flaws in CISA Malcolm affecting energy, IT, and water sectors.
CISA Malcolm is vulnerable to multiple severe flaws including cross-site scripting, OS command injection, and path traversal. These vulnerabilities allow unauthenticated attackers to execute arbitrary scripts and redirect users, impacting critical infrastructure sectors like energy, IT, and water.
AFFECTEDCISA Malcolm
▸ DO Review and patch CISA Malcolm systems immediately, especially in energy, IT, and water sectors.
#rce#vulnerability#cross-site-scripting#injection#critical-infrastructure#patch-available
Vulnerability
CISA
2026-10-01
CISA added CVE-2026-104286, a Fortinet FortiMail path traversal flaw, to the KEV Catalog due to active exploitation.
CISA has added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog. This flaw allows attackers to gain total control of the asset and is a frequent attack vector for malicious cyber actors.
AFFECTEDFortinet FortiMail
▸ DO Patch Fortinet FortiMail immediately and verify no compromise occurred before remediation.
#vulnerability#exploited-in-wild#patch-available#mitigations
Vulnerability
RCE
CISA ICS
2026-10-01
Armatura One systems have critical vulnerabilities allowing unauthorized access, code execution, and physical access control compromise.
Armatura LLC Armatura One versions below 4.7.2 and 4.6.1 are affected by multiple critical vulnerabilities including deserialization of untrusted data, hard-coded cryptographic keys, and hard-coded credentials. Successful exploitation could allow attackers to gain unauthorized database access, execute arbitrary code with highest privileges, or control physical access-control systems.
AFFECTEDArmatura One
▸ DO Upgrade Armatura One to version 4.7.2 or 4.6.1 immediately and review network segmentation for embedded Apache ActiveMQ services.
#rce#vulnerability#patch-available#critical-infrastructure#deserialization#hard-coded-credentials
Vulnerability
CISA ICS
2026-10-01
ABB Protection and Control IED Manager PCM600 <=2.14 has privilege escalation and path traversal flaws exploitable by local attackers.
Successful exploitation of CVE-2026-15952 and CVE-2026-15953 in ABB PCM600 allows attackers to escalate privileges or overwrite files. The Scheduler Service runs under LocalSystem with overly permissive local user group memberships, enabling local attackers with valid credentials to gain control.
AFFECTEDABB Protection and Control IED Manager PCM600
▸ DO Patch ABB PCM600 to version >2.14 or apply ABB's recommended workaround immediately.
#vulnerability#patch-available#ot
Vulnerability
CISA
2026-09-30
CISA added CVE-2026-76504, a Cisco Catalyst SD-WAN Manager hex encoding flaw, to the KEV Catalog due to active exploitation.
CISA has added CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities (KEV) Catalog. This flaw allows total control of an asset post-exploitation and is a frequent attack vector for malicious actors.
AFFECTEDCisco Catalyst SD-WAN Manager
▸ DO Patch Cisco Catalyst SD-WAN Manager immediately and verify remediation on publicly exposed assets.
#vulnerability#exploited-in-wild#patch-available#mitigations
Vulnerability
CISA ICS
2026-09-29
Viidure Dashcam Android App versions <=3.3.1.260403 have critical cloud storage misconfigurations and hard-coded credentials exposing user data and system files.
CISA reports that the Viidure Dashcam Android Application is affected by two vulnerabilities: a public-read cloud storage bucket exposing sensitive data and hard-coded credentials. Exploitation could allow attackers to access, modify, or delete critical system files, potentially compromising the entire platform. Viidure has not provided a fix and did not respond to CISA's coordination attempts.
AFFECTEDViidure Dashcam Android Application
▸ DO Update Viidure Dashcam Android Application to version >3.3.1.260403 or disable cloud storage access if no patch is available.
#vulnerability#data-exposure#mitigations
Vulnerability
RCE
CISA ICS
2026-09-29
VIVOTEK camera firmware has a critical remote code execution flaw allowing full system compromise.
A critical vulnerability in VIVOTEK camera firmware allows attackers to achieve remote command execution with root privileges, leading to full system compromise. Affected models include V Series, C Series, S Series, Dome, and others listed in the advisory.
AFFECTEDVIVOTEK Camera Firmware
▸ DO Patch all affected VIVOTEK camera firmware immediately and verify the update.
#rce#vulnerability#patch-available#iot
Vulnerability
RCE
CISA ICS
2026-09-29
Toptech TMS7 and TopHAT have critical vulnerabilities allowing unauthenticated data access and code execution.
Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. Affected versions include TMS7 7.6.3 and TopHAT 7.6.3, impacting sectors like Energy, Chemical, and Transportation Systems.
AFFECTEDToptech TMS7TopHAT
▸ DO Patch Toptech TMS7 and TopHAT immediately to versions prior to 7.6.3 or apply vendor-provided mitigations.
#rce#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-09-29
MikroTik RouterOS versions below 7.24 have a critical integer underflow flaw allowing unauthenticated remote code execution or denial of service.
A critical integer underflow vulnerability (CVE-2026-84411) in MikroTik RouterOS web management service allows unauthenticated attackers to execute arbitrary code as root or cause denial of service via a single crafted HTTP request. Affected versions are RouterOS <7.24, impacting communications and IT sectors worldwide.
AFFECTEDMikroTik RouterOS
▸ DO Update MikroTik RouterOS to version 7.23 or later immediately.
#rce#vulnerability#patch-available#critical#remote-code-execution
Vulnerability
RCE
CISA ICS
2026-09-29
Lantronix G520 Series Cellular Gateway devices have critical vulnerabilities allowing arbitrary code execution with root privileges.
Successful exploitation of CVE-2026-84409 and CVE-2026-91191 in Lantronix G520 Series Cellular Gateway devices allows attackers to replace software and execute arbitrary code with root privileges. The vulnerabilities stem from improper neutralization of input during web page generation and improper verification of cryptographic signatures.
AFFECTEDLantronix G520 Series Cellular Gateway
▸ DO Patch Lantronix G520 Series Cellular Gateway devices immediately to mitigate CVE-2026-84409 and CVE-2026-91191.
#rce#vulnerability#patch-available#ot
Vulnerability
CISA
2026-09-29
CISA added CVE-2026-86950, an out-of-bounds write flaw in Apple products, to the KEV Catalog due to active exploitation.
CISA has added CVE-2026-86950, an out-of-bounds write vulnerability affecting multiple Apple products, to the Known Exploited Vulnerabilities (KEV) Catalog. This flaw is a frequent attack vector that can grant total control of an asset if exploited on publicly exposed systems.
AFFECTEDApple products
▸ DO Prioritize patching CVE-2026-86950 on all Apple products, especially those with publicly exposed assets.
#vulnerability#patch-available#exploited-in-wild
Vulnerability
CISA ICS
2026-09-29
Baicells Nova 430H eNodeBs are vulnerable to a DoS flaw that disrupts cellular signaling.
An unauthenticated device can send a malformed uplink message during connection setup to a Baicells Nova 430H eNodeB, causing a temporary service disruption. No fix is planned and Baicells has not engaged with CISA to mitigate this vulnerability.
AFFECTEDBaicells Nova 430H
▸ DO Patch affected Nova 430H eNodeBs or implement compensating controls to prevent malformed message injection.
#vulnerability#patch-available#ot
Vulnerability
RCE
CISA ICS
2026-09-29
Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 contains multiple critical vulnerabilities allowing full device compromise.
Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The affected firmware version is 3.3.2.4_build_2024-12-26.
AFFECTEDAnjvision YSSD-RTMP-H5
▸ DO Update Anjvision YSSD-RTMP-H5 firmware to a patched version immediately.
#rce#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA
2026-09-27
CISA warns of eight critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway, two of which are actively exploited.
CISA is amplifying Citrix's disclosure of eight new vulnerabilities (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler ADC and Gateway. CVE-2026-88771 and CVE-2026-88772 are critical zero-days enabling remote code execution and have been added to the KEV Catalog, with active exploitation confirmed globally.
AFFECTEDCitrix NetScaler ADCCitrix NetScaler Gateway
▸ DO Check for indicators of compromise before patching and review Citrix's security bulletin for CVE-2026-88771 through CVE-2026-88778.
#rce#vulnerability#exploited-in-wild#patch-available#mitigations