VulnHub

Siemens has identified a vulnerability known as 'Copy Fail' affecting various versions of its SIPLUS and SIMATIC products, specifically linked to CVE-2026-31431. This vulnerability can impact multiple devices, including the SIMATIC HMI series and the AX Runtime Core across different platforms. Siemens is urging users to upgrade to the latest versions of the affected products to mitigate potential risks. For products that do not yet have a fix available, Siemens is providing specific countermeasures. This situation is important as it affects numerous industrial control systems, which could pose operational risks if not addressed promptly.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that ransomware gangs are actively exploiting a serious vulnerability in VMware vCenter, which was patched back in July. This flaw allows attackers to execute remote code, posing a significant risk to organizations using affected versions of the software. Companies that have not yet applied the security patch are particularly vulnerable to these attacks. The involvement of ransomware groups in exploiting this vulnerability raises alarms about potential data breaches and financial losses. Organizations are urged to prioritize the application of the necessary updates to safeguard their systems against these ongoing attacks.

Broadcom has issued security updates to address two vulnerabilities in VMware Workstation and VMware Fusion, one of which is particularly severe. This critical vulnerability, identified as CVE-2026-59346, has a CVSS score of 9.3 and involves an integer-overflow issue. If exploited by a local attacker with elevated privileges, this flaw could allow them to execute arbitrary code on the host system. This poses a significant risk to users of these virtualization products, as it could lead to unauthorized access and control over the host machine. Users are urged to apply the updates promptly to mitigate this risk.

VMware has released updates for its Workstation and Fusion products to address a serious vulnerability that could be exploited by attackers with administrative access to a virtual machine. This flaw allows them to execute code on the host system, which poses a significant risk to users and organizations relying on these virtualization tools. The vulnerability underscores the necessity of keeping software up to date, especially in environments where virtual machines are used extensively. Users are strongly advised to apply the latest patches to safeguard their systems from potential attacks. Without these updates, systems could be left vulnerable to exploitation, compromising the security and integrity of the host environment.

A cyber espionage group linked to China, known as Fire Ant, has broadened its operations to target Cisco IOS XR routers, TACACS servers, and Linux management hosts. This escalation follows a previous focus on VMware hypervisors. The group aims to steal credentials and disable security logs, which could severely compromise the integrity of high-value networks. Sygnia, the incident response firm that investigated the incidents, emphasizes the significance of these vulnerabilities given the critical role these systems play in network management and authentication. Organizations using these technologies should be vigilant and take immediate steps to secure their infrastructures.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified four critical vulnerabilities that are currently being exploited in the wild, adding them to its Known Exploited Vulnerabilities (KEV) catalog. Among these is CVE-2026-65400, a serious authentication flaw in Apple macOS that could allow unauthorized access. Other vulnerabilities affect Microsoft SharePoint, VMware vCenter, and Microsoft IKE, all of which pose significant risks to organizations using these platforms. With a CVSS score of 9.8 for CVE-2026-65400, it’s crucial for users and companies to act quickly to mitigate these risks. The exploitation of these vulnerabilities could lead to severe data breaches or unauthorized access, making it essential for affected parties to stay informed and apply necessary updates and patches.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities catalog, specifically targeting flaws in Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE. One notable vulnerability, CVE-2026-33824, relates to the Windows Internet Key Exchange (IKE) Service Extensions and poses a risk of remote code execution. These vulnerabilities could allow attackers to exploit systems running the affected software, potentially leading to unauthorized access or data breaches. It's crucial for users and organizations utilizing these platforms to take immediate action to mitigate the risks associated with these vulnerabilities. Keeping software updated and applying any available patches is essential to protect against potential exploitation.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being targeted by cybercriminals. The vulnerabilities include a double free flaw in Microsoft Internet Key Exchange (CVE-2026-33824), a weak authentication issue in Microsoft SharePoint (CVE-2026-55040), a path traversal vulnerability in Broadcom's VMware vCenter (CVE-2026-59310), and an improper authentication vulnerability in Apple macOS (CVE-2026-65400). These vulnerabilities pose significant risks, especially for federal agencies, which are required to prioritize their remediation under Binding Operational Directive 26-04. Although this directive specifically targets federal agencies, CISA encourages all organizations to adopt similar practices to enhance their security posture against these threats.

Cybersecurity researchers have identified a new security threat linked to a suspected China-nexus advanced persistent threat group. The group is exploiting a serious vulnerability in Broadcom's VMware vCenter, known as CVE-2026-59310, which has a CVSS score of 9.8, indicating its severity. This directory-traversal flaw allows attackers to execute arbitrary code on affected systems. Recent reports show that the attackers are deploying Babuk-derived ransomware during these exploits, raising concerns for organizations using VMware vCenter. Companies that rely on this software need to act quickly to secure their environments and protect sensitive data from potential ransomware attacks.

A serious vulnerability in VMware's vCenter software has been identified, tracked as CVE-2026-59310. This directory traversal flaw allows remote attackers to execute arbitrary code on affected systems, posing a significant risk to users. Organizations that rely on vCenter for managing virtualized environments should prioritize addressing this issue. The potential for exploitation means that attackers could gain control over systems, leading to data breaches or other malicious activities. It's crucial for companies to apply any available patches or updates to safeguard their infrastructure.

A new vulnerability in VMware vCenter has been identified and is currently being exploited by an unspecified advanced persistent threat (APT) group. This group has targeted 361 unique IP addresses across 47 countries, indicating a widespread impact. The flaw poses significant risks to organizations using VMware vCenter, as it could allow attackers to gain unauthorized access and control over critical systems. Given the number of affected systems, companies using VMware products need to assess their exposure and take immediate action to secure their environments. The urgency of addressing this vulnerability cannot be overstated, as ongoing attacks are already in progress.

Recent research from QUIRSO reveals that attackers are exploiting a severe vulnerability in Broadcom's VMware vCenter, identified as CVE-2026-59310, which has a CVSS score of 9.8. This directory-traversal flaw allows malicious users with network access to execute arbitrary code on the server, creating a significant risk for organizations using this software. The vulnerability is particularly concerning because it enables persistent remote access, potentially compromising sensitive systems. VMware has issued patches to address this flaw, but organizations must act quickly to implement them to protect against active exploitation. This incident serves as a reminder of the importance of timely updates in cybersecurity management.

Broadcom has issued security updates to fix several vulnerabilities affecting VMware products, including ESX, vCenter, Workstation, and Fusion. Among these, three flaws are deemed critical, with CVE-2026-59309 being the most severe, rated at 9.8 on the CVSS scale. This particular flaw allows attackers with network access to VMware vCenter to bypass authentication, potentially leading to unauthorized access. Other vulnerabilities could enable code execution and VM escape, which poses significant risks for virtualized environments. Organizations using these VMware products should prioritize applying the updates to safeguard against potential exploits.

Broadcom has addressed a serious vulnerability in VMware ESXi that could allow attackers to execute code on a host machine from a compromised virtual machine. This flaw, identified as CVE-2026-47876, has a high severity rating of 9.3 on the CVSS scale, indicating a significant risk. Alongside this critical issue, Broadcom released patches for four other vulnerabilities affecting VMware's ESXi, vCenter, Workstation, and Fusion products, three of which are also classified as critical. Companies using these systems should prioritize applying the patches to safeguard their environments, as the potential for exploitation could lead to severe data breaches or system compromises.