VulnHub

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted government agencies about two significant security vulnerabilities affecting the Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint. Both flaws, identified as CVE-2025-66376 and another not specified in the article, have been found to be actively exploited by attackers. The CVE-2025-66376 vulnerability has a CVSS score of 7.2, indicating a moderate to high risk. Organizations using these platforms are urged to apply the necessary patches to protect against potential attacks. The exploitation of these vulnerabilities underscores the need for timely updates and vigilance in cybersecurity practices, especially for government entities.

A significant vulnerability in Cisco's Catalyst SD-WAN, identified as CVE-2026-20133, poses a serious risk that some organizations may be overlooking. Cybersecurity experts have expressed concern that security teams are focusing their attention on another vulnerability, CVE-2026-20127, which is a zero-day exploit. This could lead to a dangerous situation where the high-severity flaw is not addressed, leaving systems vulnerable to potential attacks. Organizations using Cisco SD-WAN products should be aware of this oversight, as failing to remediate the CVE-2026-20133 vulnerability could expose critical data and systems to exploitation. The urgency of addressing this issue cannot be overstated, especially as cyber threats continue to evolve rapidly.

Amazon Threat Intelligence has issued a warning regarding an active ransomware campaign known as Interlock, which is exploiting a significant vulnerability in Cisco's Secure Firewall Management Center (FMC) Software. This vulnerability, identified as CVE-2026-20131, has a maximum severity score of 10.0 and stems from an insecure deserialization of user-supplied Java byte streams. This flaw could allow attackers to gain root access without authentication, posing a serious risk to organizations using affected Cisco products. The exploitation of this vulnerability is concerning as it enables unauthorized access, potentially leading to data breaches and system compromises. Companies using Cisco FMC Software must take immediate action to protect their systems from this ongoing threat.

Researchers have identified a severe vulnerability in the GNU InetUtils telnet daemon, known by its CVE identifier CVE-2026-32746. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges through Telnet connections on port 23. With a CVSS score of 9.8, this vulnerability poses a significant risk to systems using the affected telnetd. The issue arises from an out-of-bounds write in the LINEMODE Set, which could be exploited easily by attackers. Organizations using this software need to take immediate action to secure their systems, as the implications of this flaw could lead to unauthorized access and control over critical infrastructure.

A serious SQL injection vulnerability (CVE-2026-2413) has been discovered in the Ally plugin for WordPress, which is currently used on over 400,000 websites. This flaw allows attackers to exploit the plugin without needing any authentication, potentially enabling them to access and steal sensitive data from affected sites. The vulnerability has a CVSS score of 7.5, indicating a high severity level. Security researchers at Acquia, including Drew Webber, identified this issue, raising concerns for site administrators who may not be aware of the risks. It's crucial for users of the Ally plugin to take immediate action to protect their sites from potential attacks.

In March 2026, a significant security update was released, addressing eight critical vulnerabilities among a total of 82 Common Vulnerabilities and Exposures (CVEs). Two of these vulnerabilities had been publicly disclosed before the patch, raising concerns about their potential exploitation. The vulnerabilities affect various products and systems, making it crucial for organizations and users to apply the updates promptly to safeguard their environments. The nature of these vulnerabilities could allow attackers to gain unauthorized access or disrupt services, emphasizing the need for vigilance in maintaining software security. Companies and IT departments should prioritize these patches to mitigate risks associated with these newly identified threats.

Cisco has confirmed that two vulnerabilities in the Catalyst SD-WAN Manager are currently being exploited by attackers. The first vulnerability, identified as CVE-2026-20122, has a CVSS score of 7.1 and allows authenticated remote users to overwrite files on the local file system. This could lead to significant disruptions and unauthorized access to sensitive data. Organizations using the Catalyst SD-WAN Manager should take immediate action to address these vulnerabilities, as they pose a serious risk to network security. It’s crucial for affected users to monitor their systems closely and apply any available patches as soon as possible.

Recent threat intelligence reports indicate that a single threat actor is behind the majority of attacks exploiting two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), identified as CVE-2026-21962 and CVE-2026-24061. These vulnerabilities allow for remote code execution, posing significant risks to organizations using this mobile management solution. The findings suggest that companies using Ivanti's software need to be vigilant, as the attacks are actively occurring. The focus on a single actor highlights the need for targeted defenses against this specific threat. Organizations are encouraged to monitor for unusual activity and apply any available patches to mitigate potential exploitation.

A serious vulnerability has been identified in the WPvivid backup plugin, tracked as CVE-2026-1357, which has a high severity score of 9.8. This issue affects all versions of the plugin up to version 0.9.123, leaving many WordPress sites potentially at risk. The flaw allows attackers to execute remote code, which could lead to unauthorized access or control over affected systems. Users of the plugin are strongly advised to take immediate action to protect their sites. This vulnerability poses a significant threat, especially for those who have not updated their plugins recently.

Hackers have begun exploiting a serious vulnerability in BeyondTrust Remote Support known as CVE-2026-1731, which allows unauthenticated remote code execution. This flaw was identified and a proof of concept (PoC) was released just a day prior to the exploitation attempts, indicating a rapid response from malicious actors. Organizations using BeyondTrust Remote Support should be particularly vigilant, as this vulnerability poses significant risks, potentially allowing attackers to take control of affected systems. The quick exploitation of this flaw underscores the importance of timely patch management and security measures to protect sensitive data and systems from unauthorized access. Users are urged to monitor for updates and apply any patches as soon as they become available to mitigate risks.

Apple has addressed a serious zero-day vulnerability, identified as CVE-2026-20700, which was used in targeted attacks last year. This flaw, a memory corruption issue in the dyld component of Apple's operating systems, could allow attackers to execute arbitrary code on affected devices. Specifically, the vulnerability impacts versions of iOS prior to iOS 26 and was reportedly exploited in sophisticated attacks against select individuals. Users of these older versions should update their devices to protect against potential exploitation.

In February 2026, Microsoft addressed over 50 security vulnerabilities during its Patch Tuesday update, including six zero-day flaws that were actively exploited by attackers. Notably, three of these zero-days involve security feature bypasses. One of the vulnerabilities, identified as CVE-2026-21513, impacts the MSHTML/Trident browser engine used in Internet Explorer on Windows, while CVE-2026-21514 affects Microsoft Word. Attackers can exploit these vulnerabilities by tricking users into opening malicious files or links. As these security holes are actively being exploited, users and organizations must apply the updates promptly to protect their systems from potential breaches.