Cyble Tracks 1,641 Vulnerabilities, Including Critical IT and ICS Flaws
Summary
Cyble CRIL counted 1,641 vulnerabilities for March 4–10, 2026; 175 had public PoCs and 200 were critical under CVSS v3.1. The report highlights critical IT and ICS flaws, CISA KEV additions, and risks to Energy and Transportation.
Key points
- Cyble CRIL tracked 1,641 vulnerabilities for the week; 175 had public PoC exploits. The report says 200 were critical under CVSS v3.1 and 61 under CVSS v4.0.
- Highlighted IT flaws include Juniper Junos CVE-2026-21902, a reported unauthenticated authentication bypass and RCE; Cisco SD-WAN CVE-2026-20127, an authentication bypass; and pac4j-jwt CVE-2026-29000, which the report says enables token forgery.
- The report describes critical RCE flaws in Qwik (CVE-2026-27971) and IDC SFX satellite receivers (CVE-2026-29128), the latter involving hardcoded credentials.
- CISA issued nine ICS advisories covering 24 vulnerabilities, affecting vendors including Mitsubishi Electric, Hitachi Energy, Mobiliti, ePower, Everon, and Delta Electronics.
- Highlighted EV charging and industrial flaws include missing-authentication issues in Mobiliti and Everon and an ePower authentication bypass. The report says no vendor patch or response was available for Mobiliti, while some Labkotec hardware versions require replacement.
- The report notes CISA KEV additions including CVE-2021-22681 and CVE-2017-7921, describing them as legacy flaws with active exploitation.
- Energy and Transportation account for 50% of the ICS vulnerabilities discussed; the report says Energy appears in 62.5% of cases. Its recommendations include prioritizing exploitable flaws, strengthening access controls, segmenting IT and OT, and isolating or replacing unsupported systems.
Article Details
- Publisher
- Cyble Research & Intelligence Labs (CRIL)
- Report Period
- 2026-03-04 to 2026-03-10
- Scope
- Weekly vulnerability tracking, selected IT and ICS/OT vulnerabilities, and CISA KEV additions.
- Sample Size
- 1,641 vulnerabilities tracked.
- Key Statistics
- Cyble CRIL tracked 1,641 vulnerabilities between March 4 and March 10, 2026.
- 175 of the tracked vulnerabilities had publicly available PoC exploits.
- 200 vulnerabilities were rated critical under CVSS v3.1; 61 were rated critical under CVSS v4.0.
- CISA issued 9 ICS advisories covering 24 vulnerabilities.
- Energy appeared in 62.5% of ICS cases; Energy and Transportation together accounted for 50% of ICS vulnerabilities.
- Recommendations
- Prioritize vulnerabilities based on exploit availability and risk.
- Secure internet-facing assets and critical infrastructure endpoints.
- Implement strong authentication and access controls.
- Segment IT and OT environments to limit lateral movement.
- Replace or isolate unsupported and unpatched systems.
MITRE ATT&CK
T1021 · Remote ServicesThe report maps administrative access gained through Cisco SD-WAN authentication bypass, with potential traffic manipulation and lateral movement, to this technique.T1190 · Exploit Public-Facing ApplicationThe report maps exploitation of internet-exposed services for remote code execution and authentication bypass in affected products to this technique.T1203 · Exploitation for Client ExecutionThe report maps exploitation of unsafe deserialization in Qwik's server-side RPC mechanism to achieve backend remote code execution to this technique.T1550 · Use Alternate Authentication MaterialThe report maps forging pac4j-jwt authentication tokens to impersonate users, including administrators, to this technique.T1552 · Unsecured CredentialsThe report maps hardcoded or exposed credentials in devices, including IDC SFX Series Satellite Receivers, to this technique.
CVE
CVE-2017-7921Hikvision · Ds-2cd2032-i firmware; Hikvision · Ds-2cd2112-i firmware; +56 moreCISA expanded its KEV catalog with legacy and actively exploited vulnerabilities (e.g., CVE-2021-22681, CVE-2017-7921), underscoring persistent real-world exploitation.CVE-2021-22681Rockwellautomation · Factorytalk services platform; Rockwellautomation · Rslogix 5000; +1 moreCISA expanded its KEV catalog with legacy and actively exploited vulnerabilities (e.g., CVE-2021-22681, CVE-2017-7921), underscoring persistent real-world exploitation.CVE-2026-1775Labkotec · LID-3300IP; Labkotec · LID-3300IP Type 2CVE-2026-1775 — Labkotec LID-3300IP (Critical) CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerTop critical IT flaws include CVE-2026-21902 (Juniper Junos RCE/auth bypass), CVE-2026-20127 (Cisco SDâWAN auth bypass), and CVE-2026-29000 (pac4jâjwt token forgery).CVE-2026-21902Juniper Networks · Junos OS EvolvedTop critical IT flaws include CVE-2026-21902 (Juniper Junos RCE/auth bypass), CVE-2026-20127 (Cisco SDâWAN auth bypass), and CVE-2026-29000 (pac4jâjwt token forgery).CVE-2026-22552ePower · epower.ie[CVE] Tracked vulnerability identifiers cited in the report – CVE-2026-21902, CVE-2026-20127, and other CVEs such as CVE-2026-26051 and CVE-2026-22552 (and additional CVEs referenced throughout).CVE-2026-26051Mobiliti · e-mobi.hu[CVE] Tracked vulnerability identifiers cited in the report – CVE-2026-21902, CVE-2026-20127, and other CVEs such as CVE-2026-26051 and CVE-2026-22552 (and additional CVEs referenced throughout).CVE-2026-26288Everon · api.everon.ioCVE-2026-26288 — Everon Platform (Critical) CVE-2026-27971QwikDev · qwikCVE-2026-27971 — Qwik Framework (Critical) CVE-2026-29000pac4j · pac4j-jwtTop critical IT flaws include CVE-2026-21902 (Juniper Junos RCE/auth bypass), CVE-2026-20127 (Cisco SDâWAN auth bypass), and CVE-2026-29000 (pac4jâjwt token forgery).CVE-2026-29128International Datacasting Corporation · SFX2100 Satellite ReceiverCVE-2026-29128 — IDC SFX Satellite Receivers (Critical)
Vendors
CiscoHigh-impact issues include authentication bypasses and remote code execution in Juniper Junos, Cisco SDâWAN, pac4jâjwt, Qwik, IDC SFX, and several EV charging platforms, disproportionately impacting Energy andDelta ElectronicsMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.ePowerMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.EveronMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.HikvisionCVE-2017-7921 — Hikvision authentication bypass vulnerability still actively exploited years after disclosure Hitachi EnergyMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.Juniper NetworksHigh-impact issues include authentication bypasses and remote code execution in Juniper Junos, Cisco SDâWAN, pac4jâjwt, Qwik, IDC SFX, and several EV charging platforms, disproportionately impacting Energy andLabkotecMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.Mitsubishi ElectricMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.MobilitiMultiple critical ICS/OT advisories (9 advisories covering 24 vulns) affect vendors such as Mobiliti, ePower, Everon, Labkotec, Mitsubishi Electric, Hitachi Energy, and Delta Electronics.Rockwell AutomationCVE-2021-22681 — Rockwell Automation credential exposure vulnerability enabling unauthorized OT access
Products
Cisco SD-WANCritical Juniper, Cisco SD-WAN, and EV charging infrastructure vulnerabilities surfaced on underground forums, while ICS flaws impacted Energy and Transportation sectors.ePower EV charging systemsCVE-2026-22552 is a critical authentication bypass vulnerability affecting ePower EV charging systems.Everon PlatformCVE-2026-26288 — Everon Platform (Critical) IDC SFX Series Satellite Receiverscommand execution; (‘hardcoded credentials and unauthenticated remote code execution in IDC SFX Series Satellite Receivers.’)Juniper Junos OS EvolvedCVE-2026-21902 is a critical authentication bypass and remote code execution vulnerability in Juniper Junos OS Evolved.Labkotec LID-3300IPCVE-2026-1775 — Labkotec LID-3300IP (Critical) Mobiliti EV charging platformCVE-2026-26051 — Mobiliti EV Charging Platform (Critical)