BeyondTrust says suspected China-linked actor ARMORY CASTLE exploited CVE-2026-102764 in Remote Support appliances. The article details the attack and recommends patching affected self-hosted systems and investigating appliances exposed while vulnerable.
CVE-2026-99999 (PwnEscape) lets guest-controlled packets disclose host memory and may enable host compromise. Root execution was demonstrated only in researchers’ lab; update and reboot affected host kernels.
Cisco says attackers are exploiting CVE-2026-76519, a flaw that can give unauthenticated attackers root access to vulnerable Secure Email Gateway appliances. Cisco has issued fixes and recommends updating and checking for compromise.
Palo Alto Networks says CVE-2026-0322 is being exploited against PAN-OS management interfaces. The authenticated code-injection flaw can grant root access; affected organizations should upgrade and restrict management access.
Volexity traced active exploitation of Ivanti Connect Secure CVE-2026-104935, chained with a separate privilege-escalation zero-day. The observed actor reached root access and targeted credentials and Active Directory data; Ivanti has issued fixes for CVE-2026-104935.
Microsoft patched actively exploited CVE-2026-96951, which lets attackers bypass Windows Mark of the Web protections after tricking a user into opening crafted content. Updates are available; CISA added the flaw to its KEV catalog.
GitLab patched CVE-2026-97229, a CVSS 10.0 integer-overflow flaw that could enable unauthenticated remote code execution in vulnerable self-managed CE and EE installations. No real-world exploitation has been confirmed.
The open-source Cribl Pack uses keyed, type-labeled tokens to pseudonymize sensitive log values before they reach Detect, preserving correlation while warning that tokenization can disrupt IOC matching and other lookups.
Citrix disclosed CVE-2026-107406, a critical memory overflow in NetScaler ADC and Gateway that could enable unauthenticated code execution or denial of service on affected SAML-configured appliances. It recommends upgrading to patched builds.