VulnHub

Arista Networks has issued an urgent warning about a critical security flaw in its Virtual Cloud Optimizer (VCO) software that allows remote attackers to access sensitive internal features. This vulnerability poses a significant risk as it could enable unauthorized users to exploit internal functionalities, potentially leading to serious breaches. Companies using VCO are advised to act quickly to patch this vulnerability to prevent exploitation. The situation is serious, as the flaw is already being actively exploited in the wild, increasing the urgency for affected users to secure their systems. Prompt remediation is crucial to safeguard sensitive data and maintain operational integrity.

On July 23, attackers exploited a zero-day vulnerability in Check Point's Security Management Server, identified as CVE-2026-93616. This flaw allows unauthorized users to execute scripts on the server's web service without needing to log in, posing a significant risk to organizations using this system. Check Point, which oversees firewall policies through this server, confirmed that the vulnerability was part of targeted attacks. To address this issue, the company released a patch on September 22, aimed at securing the affected systems. Organizations utilizing Check Point's Security Management Server should prioritize applying this update to mitigate potential exploitation.

WordPress has addressed a serious vulnerability in its software that allows attackers to execute code on certain servers without needing an account. This flaw enables a malicious user to make a site load a PHP file from outside its theme folders, which can lead to unauthorized code execution. The fix was released on September 22, 2023, in version 7.1.2, and it applies to all supported versions of WordPress back to 4.7. Site owners are urged to update their installations promptly to protect against potential exploitation. This incident serves as a reminder of the importance of maintaining up-to-date software to secure websites from vulnerabilities.

D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.

CISA has updated its Known Exploited Vulnerabilities Catalog by adding four new vulnerabilities that are currently being exploited. These include issues affecting multiple Check Point products related to improper certificate validation and path traversal, an input validation flaw in the Arista VeloCloud Orchestrator, and a heap-based buffer overflow in F5's BIG-IP APM. These vulnerabilities can allow attackers to gain control over affected systems, posing serious risks, particularly to federal agencies. Under a new directive, federal agencies are urged to prioritize fixing these high-risk vulnerabilities, but CISA also encourages all organizations to adopt similar vulnerability management practices. If anyone is aware of additional exploited vulnerabilities not listed, CISA invites them to submit nominations for consideration.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious vulnerability affecting Zyxel GS1900 series switches. Attackers are actively exploiting this flaw to steal data, which poses a significant risk to organizations using these devices. The vulnerability allows unauthorized access, making it crucial for affected users to take immediate action. CISA is urging federal agencies to patch the flaw as soon as possible to prevent potential data breaches. This situation highlights the ongoing need for vigilance in network security, especially regarding hardware that may not receive regular updates.

CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, specifically targeting the Zyxel GS1900 Series Switches. This vulnerability, identified as CVE-2026-7273, is a stack-based buffer overflow that attackers can exploit to gain complete control over affected devices. The addition to the catalog signals an urgent need for federal agencies, as outlined in Binding Operational Directive 26-04, to prioritize the rapid patching of high-risk vulnerabilities. While the directive specifically applies to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based management strategies. Organizations are urged to monitor their systems for potential exploitation and apply necessary updates promptly to mitigate risks.

Security experts have identified three vulnerabilities in the Linux kernel that could be exploited by attackers. These flaws may allow attackers to cause denial-of-service conditions, leak sensitive memory information, or alter memory contents. Organizations using affected versions of the Linux kernel should be particularly vigilant, as the vulnerabilities are actively exploited. It's crucial for system administrators to patch their systems promptly to mitigate these risks. Failure to address these vulnerabilities could lead to serious operational disruptions and data breaches, impacting both individual users and larger organizations.

Last week, Revolut confirmed a data breach involving sensitive customer records. The breach occurred when an attacker impersonated a government agency, using an email address from that agency's domain to gain unauthorized access to the bank's systems. This incident raises significant concerns about the security of customer data and the effectiveness of identity verification processes in preventing such impersonation attacks. Meanwhile, Cisco released a patch for a zero-day vulnerability in its email gateway that had been actively exploited. This highlights ongoing challenges in cybersecurity, where organizations must remain vigilant against both social engineering tactics and technical vulnerabilities.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities, identified as CVE-2025-39964 and CVE-2026-53266, affect the Linux kernel and are categorized as a race condition and an out-of-bounds write, respectively. These types of vulnerabilities are commonly targeted by cybercriminals and pose significant risks to federal agencies. The recent Binding Operational Directive (BOD) 26-04 emphasizes that federal agencies must prioritize quick fixes for these high-risk vulnerabilities. While the directive is aimed at federal agencies, CISA encourages all organizations to adopt similar measures for vulnerability management. Organizations aware of other exploited vulnerabilities can submit them for consideration to be added to the KEV Catalog.

CISA has added a new vulnerability, identified as CVE-2025-39682, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability affects the Linux Kernel and involves improper checks for unusual or exceptional conditions, making it a target for attackers. It poses significant risks particularly to federal agencies, as outlined in the Binding Operational Directive (BOD) 26-04, which mandates that these agencies prioritize rapid remediation of high-risk vulnerabilities. While this directive specifically applies to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based vulnerability management practices. Organizations aware of other exploited vulnerabilities that are not listed can submit them for consideration through CISA's nomination form.