VulnHub

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that these flaws are being actively targeted by attackers. A significant vulnerability is CVE-2026-83548, which has a CVSS score of 10.0 and pertains to a server-side request forgery vulnerability in SonicWall SMA 1000 Appliances. This flaw could allow remote, unauthenticated attackers to exploit the system, potentially leading to unauthorized access or manipulation of data. Organizations using affected versions of SonicWall appliances should prioritize addressing this vulnerability to protect their systems from exploitation. The inclusion of these vulnerabilities in CISA's catalog serves as a warning for companies to review their security measures and ensure they are not vulnerable to these attacks.

CISA has recently added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that these flaws are currently being actively exploited by cybercriminals. The vulnerabilities include SQL Injection in Sangoma Switchvox (CVE-2026-9586), HTTP Request/Response Smuggling in Kludex Starlette (CVE-2026-48710), and OS Command Injection in Kestra OSS (CVE-2026-49869), among others. These vulnerabilities pose significant risks, particularly to federal agencies, as they could allow attackers to gain full control of affected systems. CISA's Binding Operational Directive 26-04 urges federal agencies to prioritize the rapid remediation of these high-risk vulnerabilities, but CISA also encourages all organizations to adopt a similar risk-based approach. Organizations are advised to monitor the KEV Catalog for updates and to submit any known exploited vulnerabilities not currently listed for consideration.

SonicWall has issued security updates to fix two serious vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series VPN appliances. These flaws, identified as CVE-2026-83548 and another not specified in the article, have already been exploited in zero-day attacks. The first vulnerability, CVE-2026-83548, has a maximum severity score of 10.0 and allows attackers to execute server-side request forgery (SSRF) attacks before authentication. This means that unauthorized users could potentially access sensitive internal resources. Organizations using these VPN appliances are urged to apply the updates immediately to protect their systems from potential exploitation.

Forescout Research - Vedere Labs has successfully adapted a pre-authentication remote code execution (RCE) exploit from one model of WAGO programmable logic controller (PLC) to another, using Anthropic's Claude AI to assist in the process. This exploit targets CVE-2021-31886, which involves a stack-based buffer overflow in the Nucleus FTP server when processing the USER command. The researchers were able to execute attacker-supplied ARM shellcode on actual hardware, demonstrating the potential risks associated with this vulnerability. Companies using affected WAGO PLCs need to be aware of this exploit as it poses a significant risk of unauthorized access and control of their systems. This incident serves as a reminder of the vulnerabilities that can exist in industrial control systems and the need for robust security measures.

A serious vulnerability in Sangoma Switchvox, an enterprise VoIP platform, is being actively exploited by attackers. The flaw, identified as CVE-2026-9586, has a CVSS score of 9.3 and allows unauthenticated remote code execution via SQL injection. This means that attackers can execute arbitrary code on affected systems without needing any credentials. Specifically, the vulnerability affects Sangoma Switchvox SMB Edition version 8.3 (build 104997). Organizations using this version should take immediate action to secure their systems, as the exploitation of this vulnerability poses significant risks, including unauthorized access and control over sensitive communications.

SonicWall has issued a warning about two serious vulnerabilities in its SMA1000 series, identified as CVE-2026-83549 and CVE-2026-83548. These vulnerabilities allow attackers to execute code remotely without authentication, posing a significant risk to users of these devices. The potential for chaining these vulnerabilities means that attackers could exploit them together for even greater impact. This situation is particularly concerning for organizations that rely on SonicWall's SMA1000 for secure remote access, as the flaws could lead to unauthorized access to sensitive systems. Users are urged to take immediate action to protect their installations against potential exploitation.

A serious vulnerability in JFrog Artifactory, identified as CVE-2026-82329, has been actively exploited by attackers just days after it was publicly disclosed. This flaw, which has a CVSS score of 9.8, allows for authentication bypass, potentially granting unauthorized administrative access to users. Organizations using JFrog Artifactory are at risk, as attackers can mint admin tokens and gain control over the system. The urgency of addressing this vulnerability is underscored by its exploitation in the wild, prompting immediate action from affected users to secure their installations and prevent unauthorized access.

A significant vulnerability, identified as CVE-2026-0768, has been discovered in Langflow, allowing unauthenticated attackers to execute arbitrary Python code remotely. This flaw poses a serious risk as it can be exploited without any authentication, potentially giving hackers full control over affected systems. Organizations using Langflow should be particularly vigilant, as the vulnerability is reportedly being actively exploited in the wild. Users and companies must prioritize patching their systems to mitigate the risk of attack. The broader implications of this vulnerability could lead to data breaches or unauthorized system access, making it crucial for stakeholders to address this issue promptly.

Rockwell Automation has identified several vulnerabilities in its RSLinx Classic software, specifically affecting versions 4.50 and earlier. These vulnerabilities can be exploited by attackers to cause denial-of-service (DoS) conditions, leading the software to crash and requiring a restart to recover. The vulnerabilities stem from issues related to malformed packets and insufficient data length validation. Users of the affected software are urged to upgrade to version 4.60, where these vulnerabilities have been patched. If users cannot upgrade, they should follow Rockwell Automation's security best practices to mitigate risks.

Rockwell Automation has reported two significant vulnerabilities in its Historian Machine Edition software, affecting Series B version 5.202 and Series C version 7.101. The first vulnerability (CVE-2025-12768) could allow an attacker with low-level access to execute remote code on the device, while the second vulnerability (CVE-2026-12661) could lead to a denial-of-service condition, potentially crashing the device. These vulnerabilities pose risks to critical sectors, including chemical manufacturing, healthcare, and water systems, highlighting the need for organizations to secure their systems. Users are advised to follow Rockwell Automation's security best practices and consider upgrading their software to mitigate these risks.

Rockwell Automation's FactoryTalk Activation Manager, specifically versions V5.02 and earlier, has a serious privilege escalation vulnerability (CVE-2026-16675). This flaw allows authenticated attackers with Windows credentials to gain SYSTEM-level access by hijacking console windows that appear during installation or repair processes. This could potentially give attackers full control over files and system resources. Users are urged to update to version V5.03 to mitigate this risk. For those unable to upgrade, implementing Rockwell Automation's security best practices is recommended to reduce exposure. The vulnerability affects critical manufacturing sectors globally, emphasizing the need for organizations to prioritize cybersecurity in their operational technology environments.

Rockwell Automation has identified a significant vulnerability affecting several of its control systems, including ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, and Compact GuardLogix. The vulnerability, cataloged as CVE-2021-42260, can lead to a denial of service if maliciously crafted data is sent to these devices, potentially resulting in a major nonrecoverable fault. Users of affected versions, specifically those below firmware versions 34.015, 35.014, 36.013, and 37.011, are urged to update their systems to mitigate the risk. Rockwell Automation recommends applying the latest firmware updates to ensure the security and reliability of these critical manufacturing systems. While there are currently no reports of this vulnerability being actively exploited, organizations should remain vigilant and follow best practices for cybersecurity.

Rockwell Automation has reported a vulnerability affecting several versions of its Logix Platform, including ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380. This vulnerability, identified as CVE-2026-9637, stems from improper input length validation during CIP message processing, which can lead to a denial-of-service condition. Affected devices may experience a major nonrecoverable fault, necessitating a power cycle to restore functionality. Users are urged to update their firmware to version V37.011 or higher, or to the latest versions available for their specific product lines to mitigate the risk. This vulnerability poses a significant threat to critical manufacturing sectors worldwide, highlighting the importance of maintaining updated security measures in industrial control systems.