VulnHub

CISA has updated its Known Exploited Vulnerabilities Catalog by adding four new vulnerabilities that are currently being exploited. These include issues affecting multiple Check Point products related to improper certificate validation and path traversal, an input validation flaw in the Arista VeloCloud Orchestrator, and a heap-based buffer overflow in F5's BIG-IP APM. These vulnerabilities can allow attackers to gain control over affected systems, posing serious risks, particularly to federal agencies. Under a new directive, federal agencies are urged to prioritize fixing these high-risk vulnerabilities, but CISA also encourages all organizations to adopt similar vulnerability management practices. If anyone is aware of additional exploited vulnerabilities not listed, CISA invites them to submit nominations for consideration.

Siemens has identified a denial of service vulnerability in its WTV676 and WTV776 devices that could allow attackers to disable remote connectivity functions. Specifically, the affected versions are WTV676-HB6035 Web Interface versions below 3.94 and WTV776-HB6035 Web Interface versions below 4.17. If exploited, this vulnerability could force the devices into protection mode, which would cut off remote access for users. Siemens is urging customers to update to the latest versions to mitigate the risk. This issue is particularly concerning for critical infrastructure sectors, such as energy, where reliable device connectivity is essential.

Siemens has identified a vulnerability known as 'Copy Fail' affecting various versions of its SIPLUS and SIMATIC products, specifically linked to CVE-2026-31431. This vulnerability can impact multiple devices, including the SIMATIC HMI series and the AX Runtime Core across different platforms. Siemens is urging users to upgrade to the latest versions of the affected products to mitigate potential risks. For products that do not yet have a fix available, Siemens is providing specific countermeasures. This situation is important as it affects numerous industrial control systems, which could pose operational risks if not addressed promptly.

Siemens has identified a serious vulnerability in its SIMOVE Fleetmanager and SIPLANT products, which could allow attackers to access sensitive files on affected systems. This flaw, classified as a path traversal vulnerability (CVE-2026-67367), means that an unauthenticated attacker could read arbitrary files from the operating system, potentially exposing critical data like credentials and configuration secrets. The affected versions include various releases of SIMOVE Fleetmanager (up to V4.0) and multiple versions of SIPLANT (including V1.7 to V3.1). Siemens has urged users to update to the latest versions to mitigate this risk, emphasizing the importance of securing network access to these devices. Organizations using these products should act quickly to ensure their systems are protected against potential exploitation.

CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, specifically targeting the Zyxel GS1900 Series Switches. This vulnerability, identified as CVE-2026-7273, is a stack-based buffer overflow that attackers can exploit to gain complete control over affected devices. The addition to the catalog signals an urgent need for federal agencies, as outlined in Binding Operational Directive 26-04, to prioritize the rapid patching of high-risk vulnerabilities. While the directive specifically applies to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based management strategies. Organizations are urged to monitor their systems for potential exploitation and apply necessary updates promptly to mitigate risks.

Microsoft has addressed a serious security flaw in Azure AI Foundry, identified as CVE-2026-85889, which has been assigned a maximum severity score of 10.0. The vulnerability stems from a lack of authentication for critical functions, allowing unauthorized users to escalate their privileges over a network. This flaw could potentially let attackers gain higher-level access than intended, posing significant risks for organizations using the platform. Fortunately, Microsoft has implemented fixes, and users do not need to take any additional action to secure their systems. However, the incident emphasizes the importance of vigilance in cloud security practices.

CISA has added a new vulnerability, identified as CVE-2025-39682, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability affects the Linux Kernel and involves improper checks for unusual or exceptional conditions, making it a target for attackers. It poses significant risks particularly to federal agencies, as outlined in the Binding Operational Directive (BOD) 26-04, which mandates that these agencies prioritize rapid remediation of high-risk vulnerabilities. While this directive specifically applies to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based vulnerability management practices. Organizations aware of other exploited vulnerabilities that are not listed can submit them for consideration through CISA's nomination form.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities, identified as CVE-2025-39964 and CVE-2026-53266, affect the Linux kernel and are categorized as a race condition and an out-of-bounds write, respectively. These types of vulnerabilities are commonly targeted by cybercriminals and pose significant risks to federal agencies. The recent Binding Operational Directive (BOD) 26-04 emphasizes that federal agencies must prioritize quick fixes for these high-risk vulnerabilities. While the directive is aimed at federal agencies, CISA encourages all organizations to adopt similar measures for vulnerability management. Organizations aware of other exploited vulnerabilities can submit them for consideration to be added to the KEV Catalog.

A serious vulnerability has been identified in Orkes Conductor, specifically CVE-2026-58138. This flaw allows attackers to execute remote code without authentication by exploiting inline workflow definitions. Organizations using Orkes Conductor could be at risk, as this vulnerability could lead to unauthorized access and control over systems. The existence of this vulnerability means that users need to be vigilant, as attackers might attempt to exploit it. Immediate action is necessary to protect affected systems from potential breaches.

Check Point has addressed a serious vulnerability identified as CVE-2026-91843, which allows attackers to execute code with root privileges on its Security Management and Log Servers without needing any authentication. This flaw has a CVSS score of 9.8, indicating its critical nature. If exploited, it could lead to unauthorized control over these servers, potentially compromising sensitive data and security measures. Organizations using Check Point's Security Management and Log Servers should prioritize applying the fix to safeguard their systems from potential attacks. The vulnerability emphasizes the importance of timely updates and security vigilance in protecting against unauthorized access.

A serious vulnerability has been discovered in Docker Sandboxes running on macOS, allowing malicious code to escape its designated project directory. This flaw, tracked as CVE-2026-77179, enables attackers to read and modify files on the host system with the same privileges as the user running the virtual machine. Docker issued a security warning on September 15, highlighting the potential risks for users of affected Docker versions. This vulnerability is particularly concerning because it could lead to unauthorized access to sensitive files, posing a significant threat to data integrity and privacy. Users of Docker on macOS should take immediate action to secure their systems against potential exploitation.