VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being exploited by attackers. The first vulnerability, CVE-2025-68686, affects Fortinet's FortiOS, allowing unauthorized access to sensitive information. The second, CVE-2026-16812, impacts Arista's VeloCloud Orchestrator, enabling command injection attacks on the on-premises operating system. These vulnerabilities pose serious risks, particularly to federal agencies, which are urged to prioritize their remediation under Binding Operational Directive 26-04. While the directive specifically targets federal civilian agencies, CISA recommends that all organizations adopt similar risk-based approaches to vulnerability management to protect against these threats.

Researchers have identified a serious security vulnerability in GitLab that allows remote code execution (RCE) through a combination of two bugs in the Oj JSON parser, which is used in Ruby. This issue affects authenticated users on unpatched versions of GitLab and can be exploited via Jupyter notebook diffs. The exploit, published by Depthfirst researchers on July 24, demonstrates how attackers could potentially execute arbitrary commands on the affected systems. Users of GitLab should prioritize applying the necessary patches to protect their installations from this vulnerability, as it poses a significant risk to data integrity and security.

Security researchers have released exploit code for a vulnerability in GitLab that allows authenticated users to execute commands as the 'git' user on certain self-managed servers. This flaw affects GitLab version 18.11.3 and earlier, which had a patch issued on June 10, 2023. If a user can push to a project, they can exploit the vulnerability by committing a specially crafted Jupyter notebook. This action reveals sensitive heap memory data, enabling unauthorized command execution. Organizations using vulnerable versions of GitLab should prioritize applying the patch to prevent potential abuse of this exploit, especially in environments where multiple users have access to project repositories.

A Russian espionage group known as Laundry Bear has been exploiting a zero-day vulnerability in Zimbra for five months before it was patched in July 2025. Despite the patch, the group continues to target vulnerable systems to steal sensitive data from Western countries. This ongoing activity raises concerns about the security of email platforms and the potential for data breaches that could affect numerous organizations. As companies rely on these systems for communication, the implications of such attacks could be significant, leading to unauthorized access to confidential information. Organizations using Zimbra should prioritize updating their systems to protect against this threat.

A Russian espionage group has exploited a zero-day vulnerability in Zimbra, an open-source email collaboration platform, to access sensitive email communications and two-factor authentication (2FA) codes. This attack has primarily targeted organizations using Zimbra, which could jeopardize user accounts and confidential information. The exploitation allows attackers to bypass security measures, making it easier for them to infiltrate systems and gather intelligence. Researchers emphasize the urgency for organizations to patch their Zimbra installations to prevent unauthorized access and data breaches. This incident underscores the need for heightened vigilance among users and IT departments regarding software vulnerabilities.

Weintek's cMT3092X human-machine interface (HMI) has several security vulnerabilities that could allow unauthorized users to escalate their privileges or access sensitive user credentials. The affected firmware versions include those below 20210218 and EasyWeb versions prior to 2.1.20. Notably, vulnerabilities include reliance on unvalidated cookies, incorrect permission assignments, and the storage of passwords in plaintext. Weintek has issued a patch, cmt_typeB_20260316_007, which upgrades EasyWeb to version 2.3.17 to address these issues. Users are urged to apply this patch immediately to protect their systems.

Check Point has issued security updates to fix several vulnerabilities affecting its Security Management and Multi-Domain Management (MDSM) products. Among these is a serious flaw, identified as CVE-2026-16232, which has a CVSS score of 9.3 and allows attackers to bypass authentication in the SmartConsole login process. This vulnerability is particularly concerning as it is currently being exploited in the wild, meaning malicious actors can gain full administrative access to affected systems. Companies using Check Point's management products need to apply these updates promptly to protect their environments from unauthorized access. The timely response to this patch is crucial for maintaining security integrity.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. The vulnerabilities include CVE-2026-16232, which affects Check Point SmartConsole and involves improper authentication, and CVE-2026-50522, a deserialization issue in Microsoft SharePoint. These vulnerabilities are significant risks, especially for federal agencies, as they can allow attackers to gain total control over the affected systems. CISA's Binding Operational Directive (BOD) 26-04 mandates that federal agencies prioritize rapid remediation of such high-risk vulnerabilities. While this directive specifically applies to federal agencies, CISA encourages all organizations to adopt similar risk-based approaches to vulnerability management and remediation.

Attackers are actively exploiting a serious remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-50522. This vulnerability allows them to extract the IIS machine keys from on-premise SharePoint servers, enabling long-term access to the compromised systems. Following the release of public exploit code, researchers from WatchTowr reported successful attacks occurring just hours later. Companies using on-premise SharePoint installations need to be particularly vigilant, as the stolen machine keys can facilitate ongoing unauthorized access. It's crucial for organizations to patch this vulnerability promptly and take additional measures to secure their machine keys to prevent future exploitation.

A serious remote code execution (RCE) vulnerability in Microsoft SharePoint, identified as CVE-2026-50522, is currently being exploited by attackers. This vulnerability has a CVSS score of 9.8, indicating its severity. It was patched during Microsoft's July 2026 Patch Tuesday, but following the release of public proof-of-concept (PoC) exploit code, researchers from watchTowr have observed active exploitation in the wild. Organizations using SharePoint need to ensure they have applied the latest updates to protect against potential breaches. The situation underscores the urgency for companies to stay current on security patches to mitigate risks associated with known vulnerabilities.

Zimbra has released version 10.1.20 to address nine security vulnerabilities, including a significant command injection flaw in its SNMP monitoring feature. This critical vulnerability allows attackers to execute arbitrary commands on systems where SNMP notifications are enabled, posing a serious risk to affected users. Organizations using Zimbra should prioritize updating to this latest version to mitigate the risk of exploitation. The patch not only fixes this critical issue but also addresses other security flaws that could potentially be leveraged by malicious actors. Keeping software up to date is essential to maintaining security and protecting sensitive data.