critical2 sourcesCVE-2024-24919 CVE-2026-16232 +4
Check Point has pushed out emergency hotfixes to resolve a critical security flaw tracked as CVE-2026-93616 affecting its central management ecosystem. The vulnerability is classified as a directory traversal and arbitrary file upload issue carrying a CVSS score of 9.8. It allows unauthenticated threat actors to remotely upload and execute arbitrary scripts on impacted systems through low-complexity attack chains.
The flaw directly impacts central management infrastructure, which stores security policies, processes administrator modifications, and aggregates system logs across enterprise footprints. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent components.
Check Point confirmed that in-the-wild exploitation has already been observed against a small number of customers. The vendor rolled out the R82.20 Security Hotfix and incorporated fixes into the Jumbo Hotfix Accumulator for R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192). Administrators relying solely on standard LivePatch updates should note that LivePatch does not resolve this flaw.
For environments unable to immediately patch, Check Point recommends restricting network exposure by placing management servers behind firewalls and filtering TCP port 19009 access exclusively to trusted IP ranges. The vendor also advises configuring SmartConsole rules under Trusted Clients to enforce strict origin limits. CISA responded by cataloging CVE-2026-93616 in its Known Exploited Vulnerabilities list alongside CVE-2026-85102, an improper certificate validation vulnerability in Security Gateway and Spark appliances that is also facing active exploitation.
Read more → about Check Point Patches Critical Management Server Zero-Day Exploited in In-The-Wild Attackscritical4 sourcesCVE-2025-20337 CVE-2026-20176 +5
Cisco has issued an urgent security advisory addressing a maximum-severity zero-day vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) platforms. Tracked as CVE-2026-76460 with a CVSS score of 10.0, the flaw stems from insufficient authentication controls on an internal API endpoint.
Remote, unauthenticated attackers can exploit this weakness by transmitting specially crafted requests to the vulnerable API, successfully bypassing the web-based management interface. The issue impacts all installations across releases 3.0 through 3.5 regardless of system configuration.
Cisco confirmed active in-the-wild exploitation, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with an expedited remediation window. Because no software workarounds exist, administrators must deploy official patches, specifically versions 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4.
Successful exploitation can grant adversaries command execution with root privileges, allowing them to tamper with local forensics or delete local evidence. Consequently, security teams must inspect `access.log` files on all nodes for anomalous usernames while cross-referencing external firewall and egress network logs for suspicious outbound transfers. If signs of compromise are identified, Cisco strongly advises re-imaging impacted nodes and restoring configurations from known good backups.
Alongside this zero-day, Cisco rolled out fixes for several other critical vulnerabilities affecting ISE, including a secondary authentication bypass designated as CVE-2026-76423.
Read more → about Active Zero-Day in Cisco ISE Enables Full Authentication Bypass via Flawed API Endpointcritical5 sourcesCVE-2025-40602 CVE-2026-15409 +3
SonicWall has alerted administrators to active zero-day exploitation targeting its SMA 1000 series remote access appliances. Threat actors are chaining two distinct vulnerabilities to achieve remote code execution from an unauthenticated posture.
The initial access vector leverages `CVE-2026-83548`, a maximum-severity (CVSS 10.0) pre-authentication server-side request forgery (SSRF) flaw in the SMA 1000 Appliance WorkPlace interface caused by an alternate access path. Attackers then pair this with `CVE-2026-83549`, a post-authentication OS command injection issue carrying a CVSS score of 7.8 located within the Appliance Management Console (AMC).
When chained, an unauthenticated attacker can manipulate internal functionality to execute arbitrary operating system commands with administrative privileges on the target device. The vulnerable hardware and virtual models include the SMA 1000 series 6210, 7210, and 8200v running firmware versions `12.4.3-03453`, `12.5.0-02835`, or earlier releases.
SonicWall confirmed that SonicWall firewalls with SSL-VPN enabled and the SMA 100 series product line remain unaffected by these vulnerabilities. Remediation requires deploying hotfix versions `12.4.3-03526` and `12.5.0-02952` or upgrading to higher releases immediately.
According to data from Shadowserver, more than 400 SMA 1000 appliances remain publicly exposed to the internet. If indicators of compromise are discovered, the vendor instructs administrators to completely re-image physical units or redeploy virtual instances, rotate all user and administrator credentials, and reset TOTP tokens.
Read more → about SonicWall SMA 1000 Zero-Day Chain Exploited in Remote Code Execution Attackscritical4 sourcesCVE-2023-27350 CVE-2023-27351 +2
PaperCut Software has issued an urgent advisory warning of zero-day exploitation against its PaperCut NG and PaperCut MF print management software. The attacks target internet-exposed Application Servers across all versions of the software. Threat actors are chaining two distinct vulnerabilities: `CVE-2026-81578`, an improper access control flaw in the web management interface, and `CVE-2026-82078`, an unsafe dynamic class loading issue in the database connection utilities. Together, these flaws allow unauthenticated remote attackers to modify system configurations and execute arbitrary Java bytecode. Security researchers at Huntress observed limited in-the-wild exploitation involving base64-encoded reconnaissance commands, such as `whoami` and `ver`, spawned from the primary application process `pc-app.exe`. PaperCut initially released a fix based on telemetry from an impacted university customer, but subsequently published an updated Emergency Patch (Release 2) following collaborative analysis with Huntress and watchTowr. The vendor strongly urges administrators to immediately restrict web interface access using network access controls or firewalls. Key indicators of compromise include missing or truncated `server.log` files and specific log entries such as `ERROR No suitable driver found for jdbc:no:x` or `ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST`. Administrators are instructed to apply Release 2 immediately, even if the initial emergency patch was already deployed.
Read more → about Active Zero-Day Attacks Chain Auth Bypass and Dynamic Class Loading in PaperCut NG/MF