VulnHub

CISA has added a new vulnerability, CVE-2025-62593, related to code injection in the Ray-Project, to its Known Exploited Vulnerabilities Catalog. This vulnerability is currently being exploited, posing a significant risk to federal agencies and potentially impacting organizations that utilize the Ray framework. Under the Binding Operational Directive 26-04, federal agencies are required to prioritize fixing high-risk vulnerabilities, like this one, especially on systems that could give attackers complete control post-exploitation. CISA encourages all organizations, not just federal ones, to adopt similar risk-based vulnerability management practices to enhance their security posture. If anyone is aware of other exploited vulnerabilities not listed in the catalog, they can submit them for consideration through CISA's nomination form.

A serious vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, has been actively exploited just three days after its disclosure. This flaw allows attackers to execute arbitrary code, which can compromise internal components of the affected systems. Organizations using SAP Commerce Cloud should be particularly vigilant, as the rapid exploitation indicates a high level of risk. The urgency for companies to patch their systems is critical to prevent unauthorized access and potential data breaches. Users and administrators need to prioritize updates to safeguard their environments against this vulnerability.

A serious vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, is currently being exploited by attackers. This flaw, which has a maximum severity score of 10.0, arises from insufficient authorization checks and poor input validation. Just days after SAP issued a patch, reports of active exploitation began to surface. This puts organizations using SAP Commerce Cloud at risk, as attackers could potentially gain unauthorized access to sensitive information or systems. Companies should prioritize applying the latest updates from SAP to protect their environments from these attacks.

A serious security vulnerability in SAP Commerce Cloud, identified as CVE-2026-58231, is currently being exploited by attackers. This vulnerability has a maximum severity rating of 10.0 on the CVSS scale and stems from inadequate authorization checks and input validation. As a result, unauthorized users can take advantage of a default authentication client to execute malicious actions. The risk here is significant, as it could lead to unauthorized access to sensitive data or system controls within affected environments. Companies using SAP Commerce Cloud should take immediate action to secure their systems against this vulnerability.

GeoServer is currently facing a serious security issue due to an unpatched zero-day vulnerability that allows for SQL injection and potentially remote code execution (RCE). This flaw has already attracted the attention of attackers who are probing exposed systems, raising concerns for organizations using this open-source geospatial platform. A security researcher named q1uf3ng disclosed the vulnerability, but as of now, there is no available patch to fix it. Companies running GeoServer should immediately assess their systems for exposure to this vulnerability and take steps to secure their installations. The urgency of the situation is heightened by the active exploitation attempts underway, making it crucial for users to act quickly to protect their data.

A recently patched vulnerability in SAP Commerce Cloud, classified as a maximum-severity remote code execution flaw, is now being actively targeted by attackers. The flaw was fixed just three days ago, and threat intelligence firm Defused has reported that cybercriminals are already exploiting it. This vulnerability puts users of SAP Commerce Cloud at risk, as it allows unauthorized code execution, potentially leading to data breaches or service disruptions. Companies using this platform need to ensure they apply the latest security updates to protect their systems. The urgency of the situation is underscored by the rapid exploitation following the announcement of the patch, making swift action essential for affected organizations.

A significant vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040, is being actively exploited by attackers. This flaw, which allows for the bypassing of authentication and the impersonation of users, can lead to unauthorized access to files and the ability to alter data. Microsoft issued a patch for this vulnerability during its July 2026 Patch Tuesday updates, but the release of proof-of-concept exploit code by Rapid7 has prompted immediate exploitation in the wild. Organizations using SharePoint should prioritize applying the provided security updates to protect against potential data breaches and unauthorized modifications. The situation highlights the ongoing risks associated with unpatched vulnerabilities, especially when exploit tools become publicly available.

A serious vulnerability has been identified in Johnson Controls' Metasys building automation system, affecting versions 12, 13, 14, and 15. This flaw allows a low-privilege user to inject malicious code into the Metasys user interface via a specially crafted URL. This can enable session hijacking, where attackers could gain unauthorized access to the system as other users, including administrators. Organizations using these affected versions should take immediate action to apply the latest patches or upgrade to version 16.0, which is not impacted by this vulnerability. Without prompt remediation, the risk of exploitation could pose significant security threats to critical infrastructure sectors worldwide, including manufacturing and transportation.

Siemens has identified a serious vulnerability in its Siveillance Video Management Servers that could allow attackers to execute arbitrary code remotely. This flaw, classified as CVE-2026-3014, affects several versions of the software, specifically Siveillance Video V2023 R3 versions prior to 23.3.27, V2024 R1 versions before 24.1.16, and V2025 versions below 25.1.15. Siemens urges users to update their systems to the latest versions to mitigate the risk. The vulnerability poses a significant threat to critical infrastructure sectors, including manufacturing and communications, making it crucial for organizations using these systems to act promptly. Users are also advised to enhance their network security measures to protect against potential exploitation.

A serious security vulnerability has been discovered in the Haiwell IoT Cloud HMI Gateway, specifically in version 3.40.1.12. This flaw allows attackers to inject and execute arbitrary operating system commands with root privileges, posing a significant risk to critical infrastructure sectors like energy and water management. The vulnerability stems from improper input handling in the Net Check feature, which fails to sanitize user inputs effectively. Although no active exploitation has been reported yet, organizations using this product should take immediate action to mitigate potential risks. Haiwell has released a patch (version Scada-v3.50.1.19) to address this issue, which users are urged to implement as soon as possible.

A serious vulnerability in SharePoint, identified as CVE-2026-55040, is currently being exploited by attackers following the release of a public proof-of-concept on August 12. This flaw, which has a CVSS score of 9.1, allows unauthenticated users to impersonate SharePoint administrators, posing a significant risk to organizations using this platform. The vulnerability was patched in July, but the rapid exploitation indicates that many systems may still be vulnerable. Companies using SharePoint need to prioritize applying the latest security updates to protect their environments from unauthorized access. The situation underscores the importance of timely patch management in preventing exploitation.

A new zero-day exploit called 'ShieldBreak' has been released by Nightmare Eclipse, targeting Microsoft Defender. This vulnerability grants attackers SYSTEM privileges, potentially allowing them to take full control of affected systems. Users and organizations running Microsoft Defender should be particularly vigilant, especially since this exploit emerged shortly after the August 2026 Patch Tuesday updates. The existence of such a vulnerability is concerning as it can lead to significant security breaches if not addressed promptly. Companies need to ensure their systems are up to date and monitor for any unusual activity that could indicate exploitation.