cyber.hendryadrian.com
Security Report · cyble.com

Cyble Weekly Report Highlights Vulnerabilities Across AI, VMware and ICS

· Original article ↗

Summary

Cyble's weekly roundup tracks 1,452 vulnerabilities, including 222 with public PoCs and eight added to CISA's KEV catalog, and reviews critical flaws across enterprise, AI, EV charging and ICS environments with remediation guidance.

Key points

  • Cyble says it tracked 1,452 vulnerabilities last week; 222 had public PoC exploits, and at least seven were discussed in underground forums.
  • The report counts 128 critical vulnerabilities under CVSS v3.1 and 47 under CVSS v4.0; it says CISA added eight vulnerabilities to its KEV catalog.
  • Wazuh CVE-2026-25769 can allow attackers with access to a worker node to send malicious serialized payloads to the master node and execute code with root privileges.
  • Cisco FMC CVE-2026-20131 enables unauthenticated root-level code execution; the article says ransomware groups are reportedly exploiting it.
  • The report describes Kubernetes ingress-nginx CVE-2026-4342 as configuration injection that can lead to remote code execution and exposure of Kubernetes secrets, and VMware Aria CVE-2026-22721 as a privilege-escalation flaw.
  • The article says CISA issued 12 ICS advisories covering 150 vulnerabilities, including Festo/CODESYS issues involving buffer overflows, access-control flaws and missing authentication.
  • It also highlights vulnerabilities in EV charging platforms that may enable unauthorized administrative access and service disruption, and recommends prioritizing fixes, strengthening authentication and segmenting IT and OT networks.

Article Details

Publisher
Cyble Research & Intelligence Labs (CRIL)
Report Period
Weekly report; exact dates not specified
Scope
Vulnerabilities affecting enterprise, AI, cloud-native, EV charging, and industrial control systems
Sample Size
1,452 vulnerabilities tracked
Key Statistics
  • Cyble tracked 1,452 vulnerabilities during the reported week.
  • 222 vulnerabilities had publicly available proof-of-concept exploits.
  • At least 7 exploits were discussed in underground forums.
  • 128 vulnerabilities were rated critical under CVSS v3.1 and 47 under CVSS v4.0.
  • CISA added 8 vulnerabilities to KEV and issued 12 ICS advisories covering 150 vulnerabilities.
Recommendations
  • Prioritize vulnerabilities by exploit availability and severity.
  • Secure AI frameworks and development pipelines; harden Kubernetes and cloud-native environments.
  • Implement strong authentication and access controls, and segment IT and OT networks.
  • Address legacy ICS vulnerabilities and conduct continuous vulnerability assessments and penetration testing.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe report maps exploitation of vulnerabilities such as the VMware Aria privilege-escalation flaw to Exploitation for Privilege Escalation.T1078 · Valid AccountsThe report maps missing authentication and improper access controls in ICS and automation systems to Valid Accounts / Authentication Bypass.T1190 · Exploit Public-Facing ApplicationThe report maps exploitation of enterprise-facing systems, including Cisco FMC and Craft CMS, to Exploit Public-Facing Application.T1203 · Exploitation for Client ExecutionThe report maps remote code execution through deserialization and crafted payloads in services such as Wazuh and Langflow to Exploitation for Client Execution.T1499 · Endpoint Denial of ServiceThe report maps denial-of-service vulnerabilities in EV charging platforms to Endpoint Denial of Service.

CVE

CVE-2018-106123S-Smart · 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0CVE-2018-10612 — Festo/CODESYS (Critical) CVE-2021-30190Codesys · V2 web server; Wago · 750-8202 firmware; +26 moreCVE-2021-30190 — Festo/CODESYS (Critical) CVE-2025-32432craftcms · cmsCVE-2025-32432 — Craft CMS RCE vulnerability enabling full server takeover  CVE-2026-20131Cisco · Cisco Secure Firewall Management Center (FMC)Top disclosed flaws include CVE-2026-25769 (Wazuh deserialization RCE), CVE-2026-20131 (Cisco FMC unauthenticated RCE), CVE-2026-33309 (Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configurationCVE-2026-22721VMware · VMware Aria Operations; VMware · VMware Cloud Foundation; +2 more(Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configuration injection), and CVE-2026-22721 (VMware Aria privilege escalation).CVE-2026-25769wazuh · wazuhTop disclosed flaws include CVE-2026-25769 (Wazuh deserialization RCE), CVE-2026-20131 (Cisco FMC unauthenticated RCE), CVE-2026-33309 (Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configurationCVE-2026-33309langflow-ai · langflowinclude CVE-2026-25769 (Wazuh deserialization RCE), CVE-2026-20131 (Cisco FMC unauthenticated RCE), CVE-2026-33309 (Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configuration injection), andCVE-2026-4342Kubernetes · ingress-nginxRCE), CVE-2026-20131 (Cisco FMC unauthenticated RCE), CVE-2026-33309 (Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configuration injection), and CVE-2026-22721 (VMware Aria privilege

Vendors

CiscoNotable high-risk flaws include RCEs in Wazuh and Cisco FMC, a critical deserialization bug in Langflow, and widespread ICS/EV exposures now tracked in CISA’s KEV catalog.CTEKCritical EV charging platform flaws (IGL-Technologies eParking.fi, CTEK Chargeportal) enable unauthorized administrative access, service disruption, and large-scale denial-of-service attacks.FESTOCISA issued 12 ICS advisories covering 150 vulnerabilities affecting vendors such as Festo/CODESYS, Schneider Electric, Siemens, and Mitsubishi Electric, revealing systemic weaknesses like buffer overflows and missingIGL-TechnologiesCritical EV charging platform flaws (IGL-Technologies eParking.fi, CTEK Chargeportal) enable unauthorized administrative access, service disruption, and large-scale denial-of-service attacks.Mitsubishi Electric150 vulnerabilities affecting vendors such as Festo/CODESYS, Schneider Electric, Siemens, and Mitsubishi Electric, revealing systemic weaknesses like buffer overflows and missing authentication.Schneider ElectricCISA issued 12 ICS advisories covering 150 vulnerabilities affecting vendors such as Festo/CODESYS, Schneider Electric, Siemens, and Mitsubishi Electric, revealing systemic weaknesses like buffer overflows and missingSiemensICS advisories covering 150 vulnerabilities affecting vendors such as Festo/CODESYS, Schneider Electric, Siemens, and Mitsubishi Electric, revealing systemic weaknesses like buffer overflows and missing authentication.VMwareThis week’s intelligence highlights critical vulnerabilities across AI frameworks, VMware environments, Kubernetes, EV charging platforms, and industrial control systems that expand the global attack surface and

Products

Cisco Secure Firewall Management Center[Products/Services ] affected systems and vendors – Wazuh, Cisco Secure Firewall Management Center (FMC), Langflow, Kubernetes ingress-nginx, VMware Aria Operations (and other enterprise/AI/OT products).CODESYSCISA issued 12 ICS advisories covering 150 vulnerabilities affecting vendors such as Festo/CODESYS, Schneider Electric, Siemens, and Mitsubishi Electric, revealing systemic weaknesses like buffer overflows and missingCraft CMS] Exploit Public-Facing Application – Exploitation of enterprise-facing systems such as Cisco FMC and Craft CMS to gain remote code execution; quoted content: (‘…allowing unauthenticated attackers to executeCTEK ChargeportalCritical EV charging platform flaws (IGL-Technologies eParking.fi, CTEK Chargeportal) enable unauthorized administrative access, service disruption, and large-scale denial-of-service attacks.eParking.fiCritical EV charging platform flaws (IGL-Technologies eParking.fi, CTEK Chargeportal) enable unauthorized administrative access, service disruption, and large-scale denial-of-service attacks.Festo Automation SuiteFesto Automation Suite with CODESYS (Multiple Critical CVEs) Kubernetes ingress-nginx(Cisco FMC unauthenticated RCE), CVE-2026-33309 (Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configuration injection), and CVE-2026-22721 (VMware Aria privilege escalation).LangflowNotable high-risk flaws include RCEs in Wazuh and Cisco FMC, a critical deserialization bug in Langflow, and widespread ICS/EV exposures now tracked in CISA’s KEV catalog.VMware Aria Operations[Products/Services ] affected systems and vendors – Wazuh, Cisco Secure Firewall Management Center (FMC), Langflow, Kubernetes ingress-nginx, VMware Aria Operations (and other enterprise/AI/OT products).WazuhNotable high-risk flaws include RCEs in Wazuh and Cisco FMC, a critical deserialization bug in Langflow, and widespread ICS/EV exposures now tracked in CISA’s KEV catalog.

Industries

EnergyThe global deployment of EV infrastructure significantly amplifies the risk of coordinated attacks across energy and transportation ecosystems.Industrial automationCISA issued 12 ICS advisories covering 150 vulnerabilities, with a strong concentration in industrial automation platforms.TransportationThe global deployment of EV infrastructure significantly amplifies the risk of coordinated attacks across energy and transportation ecosystems.

Related Articles