VulnHub

Johnson Controls has reported significant vulnerabilities in its C-CURE 9000 and Victor application server software that could allow attackers to execute arbitrary code remotely. Specifically, versions of the C-CURE 9000 and Victor applications up to v2.90_v3.0 and Victor Web versions up to v7.1 are impacted. An attacker on an adjacent network could exploit these flaws to compromise physical security controls and access sensitive information. The vulnerabilities have been assigned high to critical severity scores, highlighting the urgency for affected users to take action. Johnson Controls recommends upgrading to the latest versions and implementing various security measures to mitigate risks.

Recent vulnerabilities have been discovered in Panduit's IntraVUE software, affecting versions 3.2.1a14 and earlier. These security flaws could allow attackers to manipulate industrial control devices remotely without needing physical access or specialized tools. Notably, one vulnerability involves the storage of passwords in plaintext, which could expose sensitive credentials via the API. Users are urged to upgrade to version 3.2.1a16 or later to mitigate these risks. With potential impacts on critical infrastructure sectors including manufacturing, energy, and water systems, the urgency for organizations to update their software is high to prevent exploitation.

Attackers are exploiting a serious authentication bypass vulnerability, identified as CVE-2026-16232, in Check Point's Security Management and Multi-Domain Security Management servers. These servers are crucial as they manage policy updates for Check Point's firewall products. The flaw allows unauthenticated individuals to acquire a login token, which they can then use to access the system with full administrative rights. This could enable them to make unauthorized changes to security policies and configurations. Check Point has confirmed that this vulnerability is actively being exploited, posing significant risks to organizations using their security management products.

Check Point has issued urgent security updates to address a serious authentication bypass vulnerability in SmartConsole, identified as CVE-2026-16232, which has a CVSS score of 9.3. This flaw affects both Security Management and Multi-Domain Security Management (MDSM) systems and is currently being exploited in the wild. The vulnerability allows attackers to bypass authentication, potentially granting them unauthorized access to critical management functions. Given the severity of this flaw, it's crucial for organizations using these systems to apply the updates as soon as possible to mitigate the risk of exploitation. Users should ensure they are running the latest versions to maintain the security of their environments.

Check Point has issued security updates to fix several vulnerabilities affecting its Security Management and Multi-Domain Management (MDSM) products. Among these is a serious flaw, identified as CVE-2026-16232, which has a CVSS score of 9.3 and allows attackers to bypass authentication in the SmartConsole login process. This vulnerability is particularly concerning as it is currently being exploited in the wild, meaning malicious actors can gain full administrative access to affected systems. Companies using Check Point's management products need to apply these updates promptly to protect their environments from unauthorized access. The timely response to this patch is crucial for maintaining security integrity.

A serious security vulnerability has been discovered in Windmill, an open-source developer platform, allowing attackers to access arbitrary server files without authentication. This flaw, identified as CVE-2026-29059, has a CVSS score of 7.5 and affects the 'get_log_file' endpoint of the platform. Specifically, the issue arises from how the filename parameter is handled, enabling unauthorized users to exploit path traversal techniques to read sensitive files on the server. Researchers at VulnCheck have reported that this vulnerability is currently being exploited in the wild, raising urgent concerns for developers and organizations using Windmill. Users are advised to take immediate action to secure their systems as the risk of unauthorized data access increases significantly during active exploitation.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. The vulnerabilities include CVE-2026-16232, which affects Check Point SmartConsole and involves improper authentication, and CVE-2026-50522, a deserialization issue in Microsoft SharePoint. These vulnerabilities are significant risks, especially for federal agencies, as they can allow attackers to gain total control over the affected systems. CISA's Binding Operational Directive (BOD) 26-04 mandates that federal agencies prioritize rapid remediation of such high-risk vulnerabilities. While this directive specifically applies to federal agencies, CISA encourages all organizations to adopt similar risk-based approaches to vulnerability management and remediation.

Attackers are actively exploiting a serious remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-50522. This vulnerability allows them to extract the IIS machine keys from on-premise SharePoint servers, enabling long-term access to the compromised systems. Following the release of public exploit code, researchers from WatchTowr reported successful attacks occurring just hours later. Companies using on-premise SharePoint installations need to be particularly vigilant, as the stolen machine keys can facilitate ongoing unauthorized access. It's crucial for organizations to patch this vulnerability promptly and take additional measures to secure their machine keys to prevent future exploitation.

A serious remote code execution (RCE) vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, is currently being exploited by attackers. This vulnerability has a CVSS score of 9.8, indicating its severity. It was patched during Microsoft's July 2026 Patch Tuesday, but following the release of public proof-of-concept (PoC) exploit code, researchers from watchTowr have observed active exploitation in the wild. Organizations using SharePoint need to ensure they have applied the latest updates to protect against potential breaches. The situation underscores the urgency for companies to stay current on security patches to mitigate risks associated with known vulnerabilities.