VulnHub

A serious vulnerability has been identified in Rockwell Automation's FactoryTalk DataMosaix Private Cloud software, affecting versions up to 8.02. This flaw, classified as CVE-2026-9292, allows authenticated attackers to inject malicious scripts into the server due to improper handling of user input. If exploited, this could lead to account takeovers, credential theft, or redirection to harmful websites when other users access the compromised pages. Rockwell Automation recommends that users upgrade to version 8.03 or later to mitigate the risk. For those unable to upgrade, following security best practices outlined by Rockwell is advised. Although there have been no reports of active exploitation of this vulnerability, organizations are urged to enhance their security measures to protect against potential threats.

Rockwell Automation has reported a vulnerability affecting their 1756-EN2, 1756-EN3, and 1756-ENBT communication modules. Specifically, versions 1756-EN3 and 1756-EN2 up to V12.001, and 1756-ENBT V6.006 are susceptible to a denial-of-service attack due to improper validation of connection packets. An attacker on the same network could exploit this issue by sending malicious packets that disrupt device connections, although these connections can recover immediately. This vulnerability is particularly concerning for industries relying on critical manufacturing infrastructure, as it could lead to significant operational disruptions. Users are advised to update their devices to version 12.002 to mitigate this risk.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog due to evidence that they are being actively exploited. The vulnerabilities include two related to Fortinet's FortiSandbox, identified as CVE-2026-25089 and CVE-2026-39808, both of which are OS command injection flaws. The third vulnerability, CVE-2026-58644, affects Microsoft SharePoint and involves the deserialization of untrusted data. These vulnerabilities present serious risks, especially to federal agencies, which are urged to prioritize their remediation as mandated by CISA’s Binding Operational Directive 26-04. While this directive applies specifically to federal civilian agencies, CISA encourages all organizations to adopt similar practices for managing vulnerabilities. Organizations are also invited to report any exploited vulnerabilities not currently listed in the KEV Catalog.

Rockwell Automation's Arena software has several critical vulnerabilities that could allow attackers to execute arbitrary code. These vulnerabilities affect versions up to V17.00.00 and include issues in components like model.exe, expmt.exe, linker.exe, and siman.exe. The problems arise from improper validation of user-supplied data, leading to out-of-bounds writes. Users are urged to update to version V17.00.01 to mitigate the risks. This situation is particularly concerning for sectors involved in critical manufacturing, as the software is used worldwide. No active exploitation of these vulnerabilities has been reported yet, but organizations should remain vigilant.

AutomationDirect's Productivity Suite has several critical vulnerabilities that could be exploited by attackers with local or physical access. These vulnerabilities, affecting versions up to 4.6.2.2, include out-of-bounds writes and reads, which could lead to memory corruption, information disclosure, and system instability. Users are strongly advised to update to version 4.7.0.47 or later to mitigate these risks. In the meantime, AutomationDirect recommends several compensating controls, such as disconnecting affected workstations from external networks and restricting access to authorized personnel only. The vulnerabilities affect critical manufacturing sectors worldwide, emphasizing the need for immediate attention from users of the software.

A vulnerability has been identified in NASA's Core Flight System (cFS) Health & Safety (HS) Application, specifically affecting versions prior to 7.0.1. This flaw allows attackers to cause the application to crash when processing certain telemetry requests, resulting in a denial-of-service condition. The vulnerability, categorized as CVE-2026-15352, poses a risk to critical infrastructure, particularly in the transportation sector, as the application is used globally. Users are urged to update to version 7.0.1 to mitigate this risk. While there have been no reports of the vulnerability being actively exploited in the wild, organizations are advised to take precautionary measures to secure their systems against potential attacks.

Zoom has identified and patched a serious vulnerability in its Windows applications, labeled CVE-2026-53412, which carries a CVSS score of 9.8. This flaw allows attackers to take control of user accounts without needing any authentication, posing a significant risk to users of older versions of the Workplace and Windows VDI Client. The vulnerability primarily affects organizations using these outdated versions, making it essential for them to update promptly. The potential for account takeover could lead to unauthorized access to sensitive information, making this a critical security issue for affected users. Zoom's quick response to fix this vulnerability is crucial to protect its user base from potential exploitation.

Zoom has addressed a serious security flaw in its Windows applications that could allow attackers to take over user accounts. This vulnerability, identified as CVE-2026-53412, has a high severity score of 9.8, indicating its potential impact. The flaw affects several Zoom products, including the Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. Users of these applications are at risk, making it crucial for them to apply the necessary updates. By patching this vulnerability, Zoom aims to protect its users from unauthorized access and potential misuse of their accounts.

Mozilla has rolled out updates for Firefox to fix two serious vulnerabilities that could be exploited by attackers. The flaws, identified as CVE-2026-15718 and CVE-2026-15719, involve issues with JavaScript: WebAssembly and site isolation in the DOM: Navigation component. Mozilla has warned users that exploit code for these vulnerabilities is already available publicly, increasing the urgency for users to update. It’s crucial for Firefox users to install these updates promptly to protect against potential attacks that could compromise their security and privacy. Keeping software up to date is a key defense against such risks.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The first, CVE-2023-4346, affects the KNX Protocol Connection Authorization Option 1, which has an overly restrictive account lockout mechanism, making it a target for attackers. The second, CVE-2026-46817, involves improper privilege management in Oracle E-Business Suite. These vulnerabilities pose significant risks, particularly to federal agencies, which are required by CISA's Binding Operational Directive 26-04 to prioritize rapid remediation of high-risk vulnerabilities. While this directive specifically applies to federal agencies, CISA encourages all organizations to adopt similar practices. Organizations that identify exploited vulnerabilities not listed in the KEV Catalog can submit them for potential inclusion.

SonicWall has reported that two zero-day vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances are currently being exploited. One of these vulnerabilities, identified as CVE-2026-15409, has a critical CVSS score of 10.0 and allows remote attackers to execute arbitrary commands through a server-side request forgery (SSRF). This means that attackers can potentially gain unauthorized access to sensitive systems. The exploitation of these vulnerabilities poses a significant risk to organizations using these appliances, as it could lead to severe security breaches. SonicWall's warning emphasizes the urgency for users to address these issues to protect their networks.

SonicWall has issued a warning about two vulnerabilities in its SMA1000 series, identified as CVE-2026-15409 and CVE-2026-15410. These flaws are being actively exploited by attackers in zero-day attacks, meaning they are being targeted before a fix has been widely implemented. As such, SonicWall is urging all users of the SMA1000 series to apply the newly released security updates to protect against these threats. Failure to patch could leave systems vulnerable to unauthorized access and potential data breaches. Users should prioritize this update to maintain the security of their networks.

SAP has issued critical updates in July 2026 to fix several vulnerabilities, including a serious flaw in the SAP NetWeaver Application Server ABAP, identified as CVE-2026-44747. This vulnerability has a CVSS score of 9.9 and involves an out-of-bounds write issue that could allow an authenticated attacker to exploit memory management errors. If successfully executed, this could lead to memory corruption, potentially enabling attackers to expose or modify sensitive data. Organizations using the affected SAP NetWeaver Application Server should prioritize these updates to protect their systems from possible exploitation. Timely patching is crucial to maintaining the integrity and confidentiality of their data.

SonicWall has identified two vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances, known as CVE-2026-15409 and CVE-2026-15410, which are currently being exploited by attackers. The company is urging its customers to upgrade to a fixed firmware version immediately and to check for signs of compromise on their systems. If any indicators of compromise are found, SonicWall recommends that organizations re-image their hardware or redeploy their virtual appliances, change all user and administrator passwords, and reset any Time-based One-Time Password (TOTP) tokens. This situation raises concerns for organizations relying on these appliances for secure remote access, as attackers could exploit these vulnerabilities to gain unauthorized access to sensitive information. Swift action is essential to mitigate potential risks.

ABB has identified multiple vulnerabilities in its T-MAC Plus version 4.0-24 software, which could allow attackers to exploit the system in various ways. These vulnerabilities include issues like file disclosure, broken access controls, cross-site scripting (XSS), and an insecure network protocol that could lead to denial-of-service attacks. Affected users are urged to update to version 4.0-25, which contains fixes for these issues. The vulnerabilities are considered serious, with CVSS scores ranging from 7.4 to 9.9, indicating that they pose significant risks to security. Companies using this software should prioritize applying the update to protect their systems from potential exploitation.