VulnHub

A serious vulnerability has been discovered in the Unbound DNS resolver, specifically in its DNSSEC validator. Versions prior to 1.26.1 contain a heap overflow flaw that could allow an attacker to execute remote code if they control a malicious DNS zone and target a vulnerable resolver. This issue, tracked as CVE-2026-81642, was disclosed by NLnet Labs, the maintainer of Unbound. The newly released version 1.26.1 resolves this critical flaw, making it essential for users and organizations running affected versions to update immediately. The potential for remote code execution poses significant risks, including unauthorized access to systems and data breaches, underlining the importance of keeping software up to date.

Schneider Electric has identified vulnerabilities in its PowerChute Serial Shutdown software, which is used for managing uninterruptible power supplies (UPS) and ensuring proper system shutdowns. The affected versions include PowerChute Serial Shutdown version 1.5 and earlier, as well as version 1.6, which is associated with CVE-2026-13348. This vulnerability allows unauthorized access through excessive authentication attempts, potentially disrupting operations and compromising system data. Users are urged to upgrade to version 1.6, which includes a fix for these issues. Failure to address this vulnerability could leave systems exposed, emphasizing the need for timely updates and adherence to cybersecurity best practices.

A vulnerability has been discovered in Mitsubishi Electric's GX Works3 and Motion Control Settings software that could allow local attackers to bypass authentication even with an invalid password. This flaw, identified as CVE-2026-15688, affects all versions of these products. Attackers could exploit this weakness to access, modify, or delete control programs, posing a significant risk to critical manufacturing operations globally. Mitsubishi Electric recommends users update to specific software versions to mitigate the risk and implement several security measures, including restricting network access and using firewalls. This incident emphasizes the need for robust cybersecurity practices in industrial control systems.

Hitachi Energy has identified multiple vulnerabilities in its FACTS Control Platform (FCP) that could significantly impact the confidentiality, integrity, and availability of its systems. These vulnerabilities affect systems with the GWS component installed, particularly versions released since 2020, including versions 3.4.0 through 4.1.1. Attackers who exploit these flaws could potentially inject malicious code, access or modify critical files, hijack sessions, and redirect users to phishing sites. This is a serious concern for organizations relying on these systems for energy management, as it could lead to unauthorized access and data breaches. Users are advised to follow the recommended mitigation strategies provided by Hitachi Energy to safeguard their installations.

Schneider Electric has identified multiple security vulnerabilities in its NetBotz 5 750 and 755 products, which are designed to monitor environmental conditions and security. Specifically, these vulnerabilities could allow attackers to execute arbitrary code or perform SQL injection attacks, potentially leading to unauthorized access and manipulation of the devices. The affected versions are NetBotz 5 750 and 755, both running version 5.5.2 or earlier. Users are strongly encouraged to upgrade to version 5.6.0, which includes fixes for these issues. Failing to apply these updates could pose significant risks, especially for organizations relying on these devices for critical infrastructure monitoring.

Schneider Electric has identified a vulnerability affecting several of its Modicon M340 Controllers and communication modules, which could allow attackers to execute a Denial of Service (DoS) attack. The issue stems from improper input validation, specifically when a malicious FTP command is sent to the device. This flaw affects various models, including the Modicon M340 X80 Ethernet Communication modules and the M580 Global Data module. Users are urged to apply firmware updates to mitigate the risk, as failure to do so could lead to device unavailability. This vulnerability is significant for sectors such as energy, manufacturing, and water management, where these devices are commonly deployed.

Bransys ELD is facing serious security vulnerabilities that could allow unauthorized access to sensitive telemetry data and firmware. The vulnerabilities, identified as CVE-2026-86520, CVE-2026-86689, and CVE-2026-77960, affect versions of the Bransys ELD app on Android devices older than 11.00.00 and iOS devices older than 1.1.54. The issues include hardcoded credentials for MQTT and FTP, which could enable attackers to read real-time data and access sensitive information transmitted in cleartext. Users are urged to update their apps to the latest versions to protect against these risks, as exploitation could have significant implications for data integrity and privacy, especially in the transportation sector where the system is deployed.

Cisco has issued a warning regarding a serious security vulnerability in its Identity Services Engine (ISE), identified as CVE-2026-76460, which carries a maximum CVSS score of 10.0. This flaw allows attackers to bypass authentication without needing any credentials, potentially exposing sensitive systems to unauthorized access. The issue stems from inadequate authentication controls on an API endpoint, making it particularly concerning as it is currently being exploited in the wild. Organizations using Cisco ISE are at risk, and immediate action is necessary to protect their networks from potential breaches. This incident underscores the importance of maintaining up-to-date security measures and promptly addressing vulnerabilities as they are disclosed.

A serious vulnerability has been identified in the Issabel Framework, an open-source platform for unified communications. This flaw, designated as CVE-2026-89026, has a high severity score, allowing an unauthenticated attacker to execute arbitrary operating system commands remotely. The issue stems from a hard-coded configuration within the framework. As attackers are actively exploiting this vulnerability, it poses a significant risk to users of Issabel. Organizations using this software should take immediate action to secure their systems to prevent potential breaches.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are currently being exploited by attackers. The vulnerabilities include CVE-2026-76460, which affects Cisco Identity Services Engine due to incorrect use of privileged APIs, and CVE-2026-87886, related to incorrect default permissions in Acronis Backup. These vulnerabilities pose significant risks, especially for federal agencies, which are required to prioritize their remediation under CISA's Binding Operational Directive 26-04. While this directive applies specifically to Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based practices to handle vulnerabilities effectively. Organizations are urged to check for potential compromises before applying patches to ensure their systems remain secure.

Google has acknowledged a serious vulnerability in the Pixel Cellular Modem, identified as CVE-2026-58704, which has a CVSS score of 8.0. This flaw allows for privilege escalation due to a logic error, potentially enabling unauthorized access or control over affected devices. Although the company has indicated that there are signs of limited targeted exploitation, it is crucial for users of Pixel devices to be aware of the risks. The flaw could affect various models in the Pixel lineup, impacting their cellular modem functionality. Google has released patches to address this vulnerability, and users are encouraged to update their devices promptly to mitigate any potential threats.

Acronis has reported a serious security vulnerability in its Backup plugin for cPanel and Web Host Manager (WHM), which is currently being exploited in targeted attacks. The flaw, known as CVE-2026-87886, has a CVSS score of 7.8 and allows local privilege escalation due to improper file permissions. This issue affects the Acronis Backup plugin for cPanel and WHM on Linux systems. Users of these services should take immediate action, as the vulnerability poses a significant risk to their systems. Promptly addressing this flaw is crucial to prevent unauthorized access and potential data breaches.

A serious security vulnerability in WSO2 API Manager, identified as CVE-2026-5430, is currently being exploited by attackers. This flaw, with a CVSS score of 9.8, allows for improper verification of cryptographic signatures, potentially leading to account takeovers. Discovered by the Hacktron Team, the issue poses a significant risk to organizations using the WSO2 API Manager, as it could allow unauthorized users to gain administrative access. Companies utilizing this platform should act quickly to mitigate the risk of exploitation, as the vulnerability is already being targeted in the wild. Immediate attention to patching or implementing workarounds is crucial to protect sensitive data and maintain system integrity.

A Thai broadband provider has fallen victim to a cyber attack that exploited a vulnerability in Fortinet's security products. The attackers used various scripts for reconnaissance and probing, along with brute-force tools and methods to escalate privileges within the network. This breach raises concerns about the security of internet service providers and their ability to protect customer data. As the incident unfolds, it serves as a reminder for organizations to patch known vulnerabilities promptly and strengthen their defenses against such tactics. Users of the affected service may need to monitor their accounts for any unusual activity as a precaution.