cyber.hendryadrian.com
Security Report · cyble.com

Cyble Weekly Report Tracks 1,960 Vulnerabilities, Including PoC Exploits and Critical ICS Flaws

· Original article ↗

Summary

Cyble’s weekly report tracked 1,960 vulnerabilities, including 248 with public PoC exploits. It also covered CISA KEV additions, critical enterprise and ICS flaws, unpatched advisories, and remediation recommendations.

Key points

  • The report tracked 1,960 vulnerabilities; 248 had public proof-of-concept exploits, and at least five were discussed in underground forums.
  • It rated 214 vulnerabilities critical under CVSS v3.1 and 57 critical under CVSS v4.0.
  • CISA added four vulnerabilities to its KEV catalog; the report says CVE-2025-53521 affecting F5 BIG-IP APM was reclassified as remote code execution after evidence of active exploitation.
  • Highlighted enterprise flaws included CVE-2026-32917 in OpenClaw, CVE-2026-4747 in FreeBSD, and CVE-2026-31883 in FreeRDP.
  • Seven CISA ICS advisories covered 10 vulnerabilities, including critical flaws affecting Pharos Controls, Schneider Electric, WAGO, and PTC; some cited issues were unpatched.
  • The report recommends prioritizing PoC-backed flaws, patching critical and exposed systems, segmenting IT and OT networks, and applying compensating controls for unpatched ICS vulnerabilities.

Article Details

Publisher
Cyble Research & Intelligence Labs (CRIL)
Report Period
One-week reporting period; exact dates not stated
Scope
Vulnerability disclosures and exploitation trends affecting enterprise, cloud, and industrial control systems
Sample Size
1,960 vulnerabilities tracked during the reporting period
Key Statistics
  • 248 tracked vulnerabilities had publicly available proof-of-concept exploits.
  • At least 5 vulnerabilities were actively discussed in underground forums.
  • CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities catalog.
  • CISA issued 7 ICS advisories covering 10 vulnerabilities.
  • 214 vulnerabilities were rated critical under CVSS v3.1 and 57 under CVSS v4.0.
Recommendations
  • Prioritize vulnerabilities based on exploit availability and operational impact.
  • Patch critical enterprise systems and externally exposed services immediately.
  • Harden remote access and RDP environments.
  • Segment IT and OT networks to limit lateral movement.
  • Apply compensating controls for unpatched ICS vulnerabilities.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe report associates command injection in OpenClaw’s iMessage attachment staging workflow with attackers injecting and running commands on remote systems.T1068 · Exploitation for Privilege EscalationThe report states that the FreeBSD stack-based overflow can enable remote code execution with kernel-level privileges.T1190 · Exploit Public-Facing ApplicationThe report describes SQL injection in Django applications using PostGIS RasterField lookups and maps it to exploitation of a public-facing application.T1203 · Exploitation for Client ExecutionThe report maps buffer overflow and use-after-free flaws in FreeBSD, FreeRDP, and other products to exploitation for remote code execution.T1557 · Adversary-in-the-MiddleThe report says a malicious RDP server or a man-in-the-middle attacker can exploit the FreeRDP audio decoding heap overflow against clients.

CVE

CVE-2025-49844redis · redisCVE-2025-49844 — Schneider Electric Plant iT/Brewmaxx (Critical)CVE-2025-53521F5 · BIG-IPCISA added 4 vulnerabilities to its KEV catalog, confirming active exploitation, including CVE-2025-53521 (F5 BIG-IP APM).CVE-2026-1207djangoproject · Django; Red Hat · Red Hat Ansible Automation Platform 2; +13 moreCVE-2026-1207 — Django (High)CVE-2026-2417Pharos Controls · Mosaic Show ControllerCVE-2026-2417 — Pharos Controls (Critical)CVE-2026-31883FreeRDP · FreeRDPTop tracked enterprise CVEs include CVE-2026-32917 (OpenClaw remote command injection), CVE-2026-4747 (FreeBSD stack overflow), and CVE-2026-31883 (FreeRDP heap overflow).CVE-2026-32917OpenClaw · OpenClawTop tracked enterprise CVEs include CVE-2026-32917 (OpenClaw remote command injection), CVE-2026-4747 (FreeBSD stack overflow), and CVE-2026-31883 (FreeRDP heap overflow).CVE-2026-3587WAGO · Industrial Managed Switch 852-1305; WAGO · Industrial Managed Switch 852-1305-000-001; +14 moreCVE-2026-3587 — WAGO Managed Switches (Critical)CVE-2026-4681PTC · FlexPLM; PTC · Windchill PDMLinkCVE-2026-4681 — PTC Windchill PDMLink (Critical)CVE-2026-4747FreeBSD · FreeBSDTop tracked enterprise CVEs include CVE-2026-32917 (OpenClaw remote command injection), CVE-2026-4747 (FreeBSD stack overflow), and CVE-2026-31883 (FreeRDP heap overflow).

Vendors

F5Critical flaws affecting enterprise and industrial systems (notably OpenClaw and F5 BIG-IP) and unpatched ICS advisories for vendors like Schneider Electric, WAGO, and PTC highlight rising risk across IT and OTPharos ControlsCISA issued 7 ICS advisories covering 10 vulnerabilities affecting vendors such as Schneider Electric, WAGO, PTC, and Pharos Controls—several rated critical and some unpatched.PTCOpenClaw and F5 BIG-IP) and unpatched ICS advisories for vendors like Schneider Electric, WAGO, and PTC highlight rising risk across IT and OT environments.Schneider Electricindustrial systems (notably OpenClaw and F5 BIG-IP) and unpatched ICS advisories for vendors like Schneider Electric, WAGO, and PTC highlight rising risk across IT and OT environments.WAGOsystems (notably OpenClaw and F5 BIG-IP) and unpatched ICS advisories for vendors like Schneider Electric, WAGO, and PTC highlight rising risk across IT and OT environments.

Products

BIG-IP APMCISA added 4 vulnerabilities to its KEV catalog, confirming active exploitation, including CVE-2025-53521 (F5 BIG-IP APM).Django[T1190 ] Exploit Public-Facing Application – SQL injection in Django PostGIS RasterField lookups enables attackers to execute malicious queries against backend databases (‘…SQL injection vulnerability in DjangoFreeBSDTop tracked enterprise CVEs include CVE-2026-32917 (OpenClaw remote command injection), CVE-2026-4747 (FreeBSD stack overflow), and CVE-2026-31883 (FreeRDP heap overflow).FreeRDPTop tracked enterprise CVEs include CVE-2026-32917 (OpenClaw remote command injection), CVE-2026-4747 (FreeBSD stack overflow), and CVE-2026-31883 (FreeRDP heap overflow).Grassroots DICOMGrassroots DICOM (High, Unpatched)Mosaic Show ControllerThis vulnerability involves missing authentication for critical functions in Mosaic Show Controller firmware.OpenClawCritical flaws affecting enterprise and industrial systems (notably OpenClaw and F5 BIG-IP) and unpatched ICS advisories for vendors like Schneider Electric, WAGO, and PTC highlight rising risk across IT and OTPlant iT/BrewmaxxCVE-2025-49844 — Schneider Electric Plant iT/Brewmaxx (Critical)PTC Windchill PDMLinkCVE-2026-4681 — PTC Windchill PDMLink (Critical)WAGO Managed SwitchesCVE-2026-3587 — WAGO Managed Switches (Critical)

Industries

Commercial FacilitiesCommercial Facilities appear in 70% of ICS vulnerabilitiesCommunicationsHealthcare, communications, and transportation sectors also face exposure.critical manufacturingCritical Manufacturing and Energy each account for 60%EnergyCritical Manufacturing and Energy each account for 60%HealthcareA memory management flaw in Grassroots DICOM impacts healthcare imaging systems, with no vendor patch available, increasing risk to medical infrastructure.TransportationHealthcare, communications, and transportation sectors also face exposure.

Related Articles