VulnHub

Atlassian has disclosed a serious vulnerability, identified as CVE-2026-21589, affecting eight of its self-hosted Data Center products. This flaw allows unauthenticated attackers to read specific files from the web application root directory, provided they know the exact file names and paths. However, the attackers cannot enumerate the directory's contents, which limits their ability to exploit the vulnerability without prior knowledge of the file structure. Rated at 9.3 out of 10 on the severity scale, this issue impacts organizations using these products, potentially exposing sensitive information if not addressed promptly. Companies should prioritize patching their systems to mitigate this risk.

A serious security vulnerability in Rejetto's HTTP File Server (HFS), tracked as CVE-2026-61500, is currently being exploited by attackers. This flaw, which has a CVSS score of 9.3, arises from a weak pseudo-random number generator that allows for session forgery. Essentially, this means that an attacker can predict the session key, granting them unauthorized access to the server. The vulnerability poses a significant risk to users of HFS, as it can lead to remote code execution, allowing attackers to execute commands on the server. Organizations using this software need to take immediate action to protect their systems from potential exploitation.

Citrix has announced security updates for a serious vulnerability in its NetScaler ADC and Citrix NetScaler Gateway products, identified as CVE-2026-88779. This memory overflow flaw has a CVSS score of 8.7, indicating a high level of severity. Attackers are actively exploiting this zero-day vulnerability in targeted attacks, which can disrupt SAML (Security Assertion Markup Language) deployments, potentially knocking them offline. Users of these systems should prioritize applying the available security updates to mitigate the risk of exploitation. This incident underscores the need for organizations to stay vigilant about their cybersecurity practices, especially when using widely deployed network infrastructure.

Citrix has issued urgent updates to address a denial-of-service vulnerability in its NetScaler product, identified as CVE-2026-88779. This flaw has already been exploited in zero-day attacks, raising concerns about its potential for remote code execution as well. The vulnerability affects users of Citrix’s NetScaler, which is widely used for application delivery and load balancing. Companies using this system should prioritize applying the latest patches to protect their environments. The fast-tracked response from Citrix indicates the seriousness of the threat, as attackers are actively exploiting this vulnerability in the wild.

A 16-year-old security researcher discovered a significant vulnerability in Titan, an internal analytics service used by Microsoft. This flaw potentially allowed unauthorized users to access a massive database containing 17 trillion rows of sensitive data, including employee records and Bing search analytics. Meanwhile, Citrix has been dealing with the fallout from two zero-day vulnerabilities in its NetScaler product, which have reportedly been exploited globally for weeks. Citrix has released patches for eight critical and high-severity vulnerabilities, but the ongoing exploitation raises concerns for organizations using these systems. The incidents serve as a reminder of the vulnerabilities that can exist even in well-established services and the need for constant vigilance in cybersecurity.

The latest Security Affairs newsletter covers a range of cybersecurity issues, including a new macOS backdoor disguised as a fake Zoom installer. This backdoor, known as CloudSyncD, poses a significant risk to macOS users who may unknowingly install this malicious software. Additionally, a critical vulnerability in GitLab's AI Gateway, identified as CVE-2026-90970, has been patched, addressing a serious security flaw that could have been exploited by attackers. The newsletter also highlights the Antino backdoor, which has been linked to various cyberattacks. These incidents emphasize the need for users and organizations to remain vigilant about the software they install and to apply security updates promptly.

Dell has issued security updates to fix several serious vulnerabilities in its Container Storage Modules (CSM), which could allow attackers to gain unauthorized administrative access and potentially control Kubernetes nodes. One of the most critical flaws, identified as CVE-2026-63688, has a CVSS score of 10.0, indicating its severity. These vulnerabilities could be exploited without authentication, putting systems at risk of being taken over. Organizations using Dell's CSM should prioritize applying these updates to protect their environments. The implications of these flaws are significant, as they could lead to unauthorized access to sensitive data and disruption of services.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities, identified as CVE-2026-102489 and CVE-2026-102490, are linked to the Zammad session fixation and improper privilege management issues, respectively. They pose significant risks, especially to federal agencies, as they could allow attackers to gain total control of affected systems. CISA's Binding Operational Directive 26-04 mandates that federal agencies prioritize the quick remediation of high-risk vulnerabilities like these. While the directive specifically targets federal entities, CISA encourages all organizations to adopt similar risk-based approaches to vulnerability management. Organizations aware of other exploited vulnerabilities can submit them for consideration in the KEV Catalog.

Fortinet has issued a warning to its customers regarding a zero-day vulnerability (CVE-2026-104286) in its FortiMail email security gateway. This flaw, which involves improper path traversal and handling of null bytes, allows unauthenticated attackers to exploit the system. Reports indicate that this vulnerability is currently being actively exploited in the wild, raising concerns about potential unauthorized access to sensitive email communications. Fortinet has advised users to implement a temporary workaround until a permanent fix is available. This vulnerability poses significant risks to organizations relying on FortiMail for email security, making it crucial for users to take immediate action to safeguard their systems.

Fortinet has issued a warning about a serious vulnerability in its FortiMail product, identified as CVE-2026-104286. This flaw is currently being exploited by attackers in zero-day attacks, allowing them to execute unauthorized code or commands on affected devices. Organizations using FortiMail should be particularly vigilant, as this vulnerability poses a significant risk to their email security systems. Fortinet has advised its customers to take immediate action to protect their systems from potential breaches. Users are encouraged to stay updated with patches and security measures to mitigate the risks associated with this vulnerability.

Johnson Controls has reported a vulnerability in its EasyIO Neo Series EC and CW Controllers that could allow attackers to intercept sensitive information, such as credentials and session data, transmitted in cleartext over the network. The affected versions include EC Controllers V3.3b62 and V3.3b63, and CW Controllers V3.3b24 and V3.3b25. This issue is significant because it impacts critical infrastructure sectors like manufacturing, government services, and energy systems, where secure data transmission is essential. Users are urged to upgrade to fixed firmware versions, which include improvements like disabling HTTP communication by default. Until updates can be applied, Johnson Controls recommends several mitigations, such as enforcing HTTPS/TLS and isolating devices on a secured network.

The Meari IoT Cloud Platform OpenAPI Service has been discovered to have significant vulnerabilities that could be exploited by attackers. Specifically, there are two authorization flaws: one allows authenticated users to change device configurations they do not own and the other gives access to sensitive information from any device by using its ID. These vulnerabilities could lead to unauthorized actions and exposure of personal data, including device credentials and owner details. Meari has not planned any fixes for these issues and did not respond to coordination attempts from CISA. Users of the platform are urged to reach out to Meari for support and should take precautions to secure their networks to prevent potential exploitation.

Monta's charging station management app, monta.app, has several critical vulnerabilities that could allow attackers to gain unauthorized control over charging stations or disrupt services. All versions of the app are affected by these issues, which include missing authentication for critical functions and insufficient session management. Specifically, attackers could exploit weaknesses in the WebSocket API to impersonate charging stations or launch denial-of-service attacks. Monta is actively working to enhance security by promoting authenticated connections and has implemented measures like rate limiting and connection throttling to mitigate these risks. This situation poses significant concerns for users in the energy and transportation sectors, as it could jeopardize the security of charging infrastructure worldwide.

Armatura LLC's Armatura One software has several critical vulnerabilities that could allow attackers to gain unauthorized access to sensitive systems. Versions prior to 4.7.2 and 4.6.1 for the USA release are affected by issues including the ability to execute arbitrary code and access hard-coded credentials. Specifically, a deserialization flaw in the software's embedded Apache ActiveMQ component is a major concern, as it can allow unauthenticated attackers to execute code with high privileges. Additionally, hard-coded cryptographic keys and passwords could lead to further exploitation if attackers gain access to the installation package. Users are strongly advised to upgrade to the latest versions to mitigate these risks.