VulnHub

Hackers are taking advantage of a serious vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, which allows them to steal machine keys. This means that even if the affected servers are patched, attackers can still maintain access to these systems. The flaw is critical, and its exploitation poses a significant risk to organizations using SharePoint, potentially leading to unauthorized access to sensitive information. Companies using SharePoint should take immediate action to secure their systems and monitor for any suspicious activity. The ongoing exploitation of this vulnerability highlights the need for vigilance in securing enterprise software against such threats.

A serious vulnerability in Microsoft SharePoint Server, identified as CVE-2026-50522, is currently being exploited in the wild. This flaw, which has a CVSS score of 9.8, allows attackers to execute arbitrary code on affected systems through deserialization of untrusted data. The vulnerability was patched by Microsoft during its July 2026 Patch Tuesday update but has since been targeted by malicious actors. Organizations using SharePoint need to prioritize applying the latest security updates to protect against potential unauthorized access and exploitation. It's crucial for administrators to stay vigilant and monitor their systems for any signs of compromise.

Cybercriminals are exploiting a serious vulnerability in Palo Alto Networks' PAN-OS to gain access and deploy Qilin ransomware, also known as Agenda. This vulnerability, identified as CVE-2026-0257, has a CVSS score of 7.8 and allows attackers to bypass authentication on both the portal and gateway. Arctic Wolf Labs reported multiple incidents in June 2026 where this flaw was used to infiltrate systems. Although the vulnerability has been patched, organizations need to ensure their systems are updated to prevent potential attacks. The Qilin ransomware can lead to significant data loss and operational disruption, emphasizing the need for vigilance in cybersecurity practices.

Rockwell Automation has identified a vulnerability in its 1734 POINT I/O module that could lead to a denial-of-service condition. Specifically, attackers can exploit this issue by sending specially crafted CIP messages, causing the module to fail and requiring a restart for recovery. The affected version is 3.023 of the 1734 POINT I/O module, which is used in critical manufacturing sectors worldwide. While there are no reports of active exploitation at this time, organizations using this equipment are urged to take precautions. Rockwell recommends migrating to a newer version, specifically 5034-OB8, or following their security best practices to mitigate risks.

Tycon Systems' TPDIN-Monitor-WEB2 has critical vulnerabilities that could allow attackers to bypass authentication and access sensitive controls of connected infrastructure. Specifically, the version 2.3.9 is affected by an authentication bypass flaw that enables unauthorized users to gain full administrative access by submitting empty login credentials. Additionally, another flaw reveals system credentials in cleartext, which could facilitate further network compromises. Users of this device are advised to contact Tycon Systems for updates and to ensure their systems are secure. These vulnerabilities pose serious risks, not only to data security but also to physical safety, as attackers could manipulate equipment remotely.

Siemens has identified multiple vulnerabilities in its SIDIS Secured SmartPlug, particularly affecting versions prior to 7.26.0310. The vulnerabilities stem from components like OpenSSL and OpenSSH, leading to severe security risks including improper message integrity enforcement and various buffer overflow issues. These flaws could allow attackers to exploit the system for arbitrary code execution or denial of service. Siemens strongly recommends updating to the latest version to mitigate these risks. This situation is critical, especially for users in critical manufacturing sectors globally, as it exposes them to potential exploitation by malicious actors.

The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities Catalog by adding four vulnerabilities that are currently being exploited. The vulnerabilities include a stack-based buffer overflow in DD-WRT (CVE-2021-27137), a conflict in WordPress core that allows for SQL injection (CVE-2026-60137), and others affecting Langflow and WordPress core functionality. These vulnerabilities pose significant risks, especially to federal agencies, as they can lead to unauthorized control over systems. CISA's guidance emphasizes the need for swift action to remediate these vulnerabilities, encouraging all organizations to prioritize their management. Anyone aware of additional exploited vulnerabilities can submit them for consideration to be added to the catalog.

Siemens has reported a vulnerability in multiple versions of its IAM Client software, which could allow an authenticated local attacker to escalate their privileges. This unquoted search path vulnerability affects various Siemens products, including COMOS, Designcenter NX, and several Simcenter and Solid Edge applications. Siemens has rolled out updates for several affected versions and advises users to upgrade to the latest releases to mitigate the risk. For products that do not currently have fixes available, Siemens is recommending additional countermeasures. Organizations using these products should take immediate action to ensure their systems are secure, as this issue could potentially expose sensitive environments in critical industries such as manufacturing and energy.

Palo Alto Networks has issued an advisory regarding vulnerabilities in its PAN-OS software that affect the Siemens RUGGEDCOM APE1808, utilized in critical manufacturing sectors globally. The vulnerabilities include cross-site scripting, privilege escalation, and command injection, which could allow authenticated users to execute arbitrary commands or store malicious scripts. Users of the RUGGEDCOM APE1808 need to be particularly cautious, as these security flaws could lead to unauthorized access and potential exploitation of the device. Siemens recommends that affected customers consult with their support teams to obtain patches and implement security measures to protect their systems.

Rockwell Automation has reported a vulnerability affecting their 1718-AENTR and 1719-AENTR products, specifically version 3.011 of the Ex I/O series. This flaw can lead to a denial-of-service condition, where the device becomes overloaded due to improper handling of a UDP unicast network storm, resulting in loss of communication. Recovery from this issue requires a power cycle. Users worldwide are advised to upgrade to version 3.012 or later to mitigate this risk. For those unable to upgrade, Rockwell Automation recommends following their security best practices to minimize exposure. This vulnerability is significant as it impacts devices used in critical manufacturing sectors, raising concerns about operational stability and security.

Siemens has identified multiple vulnerabilities affecting its CADRA software, primarily linked to zlib and Foxit libraries. These vulnerabilities include issues like improper input validation and buffer overflows, which could allow attackers to disrupt service or exploit systems. Siemens is urging users to update to CADRA version V2511 or later to mitigate these risks. For systems that cannot be immediately updated, the company recommends specific countermeasures to reduce exposure until fixes are available. This situation is particularly critical for sectors such as chemical and energy, where security vulnerabilities can have serious implications.

Rockwell Automation has disclosed a significant vulnerability in its FactoryTalk Services Platform (FTSP) version 6.60, which could allow attackers to impersonate authorized users. This flaw arises from weak authentication practices, specifically the inability of the application to properly validate JSON Web Tokens (JWT). As a result, low-privilege users could exploit this vulnerability to gain unauthorized access to critical system configurations and permissions. Organizations using FTSP are urged to apply a specific patch (RAID 1158263) or the February 2026 Patch Roll-up to mitigate this risk. As of now, there have been no reports of active exploitation in the wild, but users are advised to follow best security practices to protect their systems.

Siemens has identified a significant security vulnerability in its Opcenter X software, specifically in versions prior to V2604. This flaw allows attackers to bypass authentication, enabling unauthorized access to the application and the ability to impersonate any user, including administrators. The vulnerability stems from improper validation of the algorithm in the JSON Web Token (JWT) header, which could lead to severe security breaches. Siemens has urged all users to upgrade to version V2604 or later to mitigate this risk. This incident is particularly alarming as it affects critical manufacturing infrastructures worldwide, emphasizing the need for timely software updates and robust cybersecurity practices.

A serious vulnerability in ServiceNow's AI Platform, identified as CVE-2026-6875, is being actively exploited by attackers. This flaw allows for unauthenticated remote code execution on self-hosted instances of the platform. Researchers from Searchlight Cyber disclosed the vulnerability on July 14, 2023, and ServiceNow promptly released patches for affected systems on the same day. However, reports indicate that attacks exploiting this flaw began shortly after, on July 17. Organizations using self-hosted ServiceNow instances need to apply the patches immediately to protect against potential breaches, as the vulnerability poses a significant risk to their data and operations.