Cybersecurity articles tagged #Active Exploitation on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cve-2026-48710-kludex-starlette-http-smuggling-for-auth-bypasshttps://runtimerebel.com/blog/cve-2026-48710-kludex-starlette-http-smuggling-for-auth-bypassCVE-2026-48710 impacts Kludex Starlette, enabling HTTP request smuggling and authentication bypass via path injection. Actively exploited.Wed, 02 Sep 2026 19:10:47 GMTAuthentication BypassActive ExploitationCVE-2026-48710Kludex StarletteHTTP Request Smugglinghttps://runtimerebel.com/blog/cve-2026-82078-papercut-ng-mf-unsafe-reflection-exploithttps://runtimerebel.com/blog/cve-2026-82078-papercut-ng-mf-unsafe-reflection-exploitCISA adds CVE-2026-82078 in PaperCut NG/MF to its KEV catalog following active exploitation. Review technical details and patch now.Tue, 01 Sep 2026 02:54:42 GMTCVE-2026-82078PaperCutUnsafe ReflectionActive ExploitationZero-Dayhttps://runtimerebel.com/blog/cve-2026-16812-arista-velocloud-orchestrator-command-injection-exploithttps://runtimerebel.com/blog/cve-2026-16812-arista-velocloud-orchestrator-command-injection-exploitAttackers are actively exploiting a critical command injection vulnerability (CVE-2026-16812) in on-premises Arista VeloCloud Orchestrator, leading to arbitrary code…Tue, 28 Jul 2026 06:28:55 GMTCVE-2026-16812Arista VeloCloud OrchestratorCommand InjectionRCEActive Exploitationhttps://runtimerebel.com/blog/cve-2026-29059-windmill-unauthenticated-path-traversal-exploithttps://runtimerebel.com/blog/cve-2026-29059-windmill-unauthenticated-path-traversal-exploitAttackers are exploiting CVE-2026-29059 in Windmill's get_log_file endpoint to read sensitive server files without authentication. Patch immediately.Wed, 22 Jul 2026 13:59:27 GMTCVE-2026-29059WindmillPath TraversalActive Exploitationhttps://runtimerebel.com/blog/wp2shell-vulnerabilities-cve-2026-60137-cve-2026-63030-exploitedhttps://runtimerebel.com/blog/wp2shell-vulnerabilities-cve-2026-60137-cve-2026-63030-exploitedWordPress sites face active exploitation via WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030. Learn the technical details and mitigation steps.Mon, 20 Jul 2026 06:49:53 GMTWp2shellWordPressCVE-2026-60137CVE-2026-63030RCEActive Exploitationhttps://runtimerebel.com/blog/zimbra-classic-web-client-xss-critical-flaw-under-active-exploithttps://runtimerebel.com/blog/zimbra-classic-web-client-xss-critical-flaw-under-active-exploitA critical XSS vulnerability in Zimbra Classic Web Client is under active exploitation, allowing credential theft and session hijacking.Fri, 10 Jul 2026 14:31:43 GMTZimbraXSSClassic Web ClientZimbra Collaboration SuiteActive Exploitationhttps://runtimerebel.com/blog/gitea-cve-2026-20896-authentication-bypass-under-active-exploitationhttps://runtimerebel.com/blog/gitea-cve-2026-20896-authentication-bypass-under-active-exploitationAttackers are exploiting CVE-2026-20896 in Gitea to bypass authentication via HTTP headers, risking unauthorized access to private code and secrets.Wed, 08 Jul 2026 10:28:08 GMTGiteaCVE-2026-20896Authentication BypassActive Exploitationhttps://runtimerebel.com/blog/cve-2026-48282-adobe-coldfusion-path-traversal-rce-patch-nowhttps://runtimerebel.com/blog/cve-2026-48282-adobe-coldfusion-path-traversal-rce-patch-nowCISA adds actively exploited Adobe ColdFusion vulnerability [CVE-2026-48282] to KEV catalog, warning of critical remote code execution risks.Wed, 08 Jul 2026 06:30:23 GMTCVE-2026-48282Adobe ColdFusionPath TraversalRCECISA KEVActive Exploitationhttps://runtimerebel.com/blog/netscaler-memory-disclosure-flaw-under-active-exploitationhttps://runtimerebel.com/blog/netscaler-memory-disclosure-flaw-under-active-exploitationAttackers are actively exploiting a new memory disclosure flaw in Citrix NetScaler products, rapidly weaponizing a public proof-of-concept.Mon, 06 Jul 2026 21:41:04 GMTCitrix NetScalerMemory DisclosureActive ExploitationPoChttps://runtimerebel.com/blog/cisco-unified-communications-manager-urgent-patch-for-active-exploitationhttps://runtimerebel.com/blog/cisco-unified-communications-manager-urgent-patch-for-active-exploitationCISA mandates urgent patching for an actively exploited vulnerability in Cisco Unified Communications Manager, posing immediate risk to federal agencies and beyond.Fri, 26 Jun 2026 20:39:28 GMTCisco Unified Communications ManagerCISAActive ExploitationUC ManagerVulnerability Managementhttps://runtimerebel.com/blog/cisco-cucm-ssrf-flaw-rapid-exploitation-root-privilege-escalationhttps://runtimerebel.com/blog/cisco-cucm-ssrf-flaw-rapid-exploitation-root-privilege-escalationAttackers are rapidly weaponizing a Cisco Unified CM server-side request forgery (SSRF) flaw, escalating privileges to root. Immediate patching is critical.Fri, 26 Jun 2026 05:32:30 GMTCisco Unified CMCisco Unified CM SMESSRFPrivilege EscalationRoot AccessActive Exploitationhttps://runtimerebel.com/blog/cve-2024-20230-critical-rce-in-cisco-unified-cm-actively-exploitedhttps://runtimerebel.com/blog/cve-2024-20230-critical-rce-in-cisco-unified-cm-actively-exploitedCisco confirms active exploitation of CVE-2024-20230, a critical 9.9 CVSS vulnerability in Unified Communications Manager. Urgent patching is required.Wed, 24 Jun 2026 09:17:44 GMTCVE-2024-20230Cisco Unified CMRCEActive ExploitationUC Securityhttps://runtimerebel.com/blog/cve-2026-54420-litespeed-cpanel-plugin-flaw-under-active-exploithttps://runtimerebel.com/blog/cve-2026-54420-litespeed-cpanel-plugin-flaw-under-active-exploitCISA warns of active exploitation targeting CVE-2026-54420 in LiteSpeed cPanel user-end plugin, urging immediate patching for server security.Tue, 16 Jun 2026 13:58:29 GMTCVE-2026-54420LiteSpeedcPanelActive ExploitationCISAWeb Hostinghttps://runtimerebel.com/blog/fortinet-fortisandbox-attackers-exploit-cve-2026-39813-39808-25089https://runtimerebel.com/blog/fortinet-fortisandbox-attackers-exploit-cve-2026-39813-39808-25089Critical Fortinet FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active exploitation. Patch immediately.Tue, 16 Jun 2026 13:57:36 GMTFortinetFortiSandboxCVE-2026-39813CVE-2026-39808CVE-2026-25089Path TraversalActive Exploitationhttps://runtimerebel.com/blog/critical-fortinet-apache-cisco-ios-xe-vulnerabilities-patch-monitorhttps://runtimerebel.com/blog/critical-fortinet-apache-cisco-ios-xe-vulnerabilities-patch-monitorAlert: New critical vulnerabilities impact FortiClient, FortiNAC, and Apache products. Cisco IOS XE continues to face active exploitation. Urgent patching is required.Fri, 05 Jun 2026 05:38:47 GMTForticlientFortinacApacheCisco Ios XeVulnerabilityActive ExploitationPatchinghttps://runtimerebel.com/blog/cve-2024-21182-oracle-weblogic-server-under-active-exploitationhttps://runtimerebel.com/blog/cve-2024-21182-oracle-weblogic-server-under-active-exploitationCISA added CVE-2024-21182, an unspecified vulnerability in Oracle WebLogic Server, to its KEV Catalog due to active exploitation. Immediate patching required.Mon, 01 Jun 2026 18:11:46 GMTCVE-2024-21182Oracle WebLogic ServerCISA KEVActive ExploitationUnspecified Vulnerabilityhttps://runtimerebel.com/blog/palo-alto-pan-os-globalprotect-vpn-active-auth-bypass-exploitationhttps://runtimerebel.com/blog/palo-alto-pan-os-globalprotect-vpn-active-auth-bypass-exploitationUrgent advisory on the active exploitation of an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect VPN. Patch immediately.Mon, 01 Jun 2026 18:09:49 GMTPalo Alto NetworksPAN OSGlobalProtect VPNAuthentication BypassActive ExploitationVPN Vulnerabilityhttps://runtimerebel.com/blog/cve-2024-10642-wp-maps-pro-exploited-to-create-wordpress-admin-accountshttps://runtimerebel.com/blog/cve-2024-10642-wp-maps-pro-exploited-to-create-wordpress-admin-accountsAttackers are exploiting a critical privilege escalation flaw in the WP Maps Pro WordPress plugin to create rogue admin accounts without authentication.Sun, 31 May 2026 16:31:35 GMTCVE-2024-10642WordPressWP Maps ProPrivilege EscalationActive Exploitationhttps://runtimerebel.com/blog/cve-2026-0257-palo-alto-pan-os-auth-bypass-under-active-attackhttps://runtimerebel.com/blog/cve-2026-0257-palo-alto-pan-os-auth-bypass-under-active-attackCISA adds CVE-2026-0257, an actively exploited authentication bypass in Palo Alto Networks PAN-OS, to its KEV catalog.Fri, 29 May 2026 20:55:29 GMTCVE-2026-0257Palo Alto NetworksPAN OSAuthentication BypassCISA KEVActive Exploitationhttps://runtimerebel.com/blog/ghost-cms-cve-2022-41654-over-700-websites-compromisedhttps://runtimerebel.com/blog/ghost-cms-cve-2022-41654-over-700-websites-compromisedAttackers are exploiting a critical Ghost CMS vulnerability to inject malicious scripts into sites belonging to Harvard, Oxford, and DuckDuckGo.Mon, 25 May 2026 16:50:54 GMTGhost CMSCVE-2022-41654Active ExploitationWeb Securityhttps://runtimerebel.com/blog/cve-2026-9082-drupal-core-sql-injection-under-active-exploitationhttps://runtimerebel.com/blog/cve-2026-9082-drupal-core-sql-injection-under-active-exploitationCISA adds CVE-2026-9082, a critical Drupal Core SQL Injection vulnerability, to KEV Catalog due to active exploitation. Immediate patching required for all organizations.Sat, 23 May 2026 00:55:48 GMTCVE-2026-9082DrupalSQL InjectionCISA KEV CatalogActive Exploitationhttps://runtimerebel.com/blog/cve-2026-9082-drupal-under-active-exploitation-patch-nowhttps://runtimerebel.com/blog/cve-2026-9082-drupal-under-active-exploitation-patch-nowCritical Drupal vulnerability CVE-2026-9082 is actively exploited shortly after disclosure. Urgent patching is required to prevent compromise of thousands of websites.Fri, 22 May 2026 20:38:07 GMTCVE-2026-9082DrupalWeb VulnerabilityActive ExploitationCMS Securityhttps://runtimerebel.com/blog/microsoft-defender-cve-2026-41091-privilege-escalation-exploitedhttps://runtimerebel.com/blog/microsoft-defender-cve-2026-41091-privilege-escalation-exploitedMicrosoft warns of active exploitation of CVE-2026-41091 in Defender, a privilege escalation flaw allowing attackers to gain SYSTEM privileges on Windows.Thu, 21 May 2026 13:16:31 GMTCVE-2026-41091Microsoft DefenderPrivilege EscalationActive Exploitationhttps://runtimerebel.com/blog/cve-2026-42897-microsoft-exchange-xss-under-active-exploitationhttps://runtimerebel.com/blog/cve-2026-42897-microsoft-exchange-xss-under-active-exploitationCISA adds CVE-2026-42897, a Microsoft Exchange Server Cross-Site Scripting vulnerability, to KEV Catalog due to active exploitation. Immediate patching advised.Fri, 15 May 2026 20:32:11 GMTCVE-2026-42897Microsoft Exchange ServerCross Site ScriptingXSSCISA KEVActive Exploitationhttps://runtimerebel.com/blog/praisonai-auth-bypass-cve-2026-44338-exploited-patching-guidehttps://runtimerebel.com/blog/praisonai-auth-bypass-cve-2026-44338-exploited-patching-guideThreat actors are actively exploiting CVE-2026-44338, a critical authentication bypass in the PraisonAI framework, just hours after public disclosure.Thu, 14 May 2026 12:45:06 GMTCVE-2026-44338PraisonAIAuth BypassAI SecurityActive Exploitationhttps://runtimerebel.com/blog/cpanel-cve-2026-41940-exploited-for-authentication-bypass-backdoorhttps://runtimerebel.com/blog/cpanel-cve-2026-41940-exploited-for-authentication-bypass-backdoorA critical authentication bypass vulnerability, CVE-2026-41940, in cPanel and WHM is under active exploitation to deploy the Filemanager backdoor.Mon, 11 May 2026 20:39:59 GMTCVE-2026-41940cPanelWebHost ManagerMr Rot13Filemanager BackdoorAuthentication BypassActive Exploitationhttps://runtimerebel.com/blog/ivanti-epmm-rce-via-cve-2026-6973-mitigation-guidehttps://runtimerebel.com/blog/ivanti-epmm-rce-via-cve-2026-6973-mitigation-guideIvanti warns of active exploitation of CVE-2026-6973, a high-severity RCE flaw in Endpoint Manager Mobile (EPMM) allowing admin-level access on core servers.Thu, 07 May 2026 20:32:01 GMTCVE-2026-6973Ivanti EPMMRCEActive ExploitationMDM Securityhttps://runtimerebel.com/blog/cve-2026-0300-palo-alto-networks-pan-os-out-of-bounds-write-exploithttps://runtimerebel.com/blog/cve-2026-0300-palo-alto-networks-pan-os-out-of-bounds-write-exploitCISA adds CVE-2026-0300, a Palo Alto Networks PAN-OS out-of-bounds write vulnerability, to its KEV Catalog due to active exploitation.Wed, 06 May 2026 20:37:19 GMTCVE-2026-0300Palo Alto NetworksPAN OSOut of Bounds WriteKEV CatalogActive Exploitationhttps://runtimerebel.com/blog/cve-2026-31431-linux-kernel-resource-transfer-vulnerability-actively-exploitedhttps://runtimerebel.com/blog/cve-2026-31431-linux-kernel-resource-transfer-vulnerability-actively-exploitedCISA adds CVE-2026-31431, a Linux Kernel incorrect resource transfer vulnerability, to its KEV catalog due to active exploitation. Prioritize remediation.Fri, 01 May 2026 20:24:29 GMTCVE-2026-31431Linux KernelResource TransferCISA KEVActive ExploitationBOD 22 01https://runtimerebel.com/blog/cve-2026-32202-active-exploitation-of-windows-shell-spoofing-bughttps://runtimerebel.com/blog/cve-2026-32202-active-exploitation-of-windows-shell-spoofing-bugMicrosoft confirms CVE-2026-32202, a Windows Shell spoofing flaw, is under active exploitation. Read our analysis and mitigation guide for enterprise security.Tue, 28 Apr 2026 08:56:52 GMTCVE-2026-32202Windows ShellMicrosoftSpoofingActive Exploitationhttps://runtimerebel.com/blog/lmdeploy-ssrf-cve-2026-33626-exploit-and-mitigation-guidehttps://runtimerebel.com/blog/lmdeploy-ssrf-cve-2026-33626-exploit-and-mitigation-guideAttackers are actively exploiting CVE-2026-33626, a high-severity SSRF in LMDeploy, to access sensitive LLM data. Learn how to detect and patch this flaw.Fri, 24 Apr 2026 08:48:12 GMTCVE-2026-33626LMDeploySSRFLLM SecurityActive Exploitationhttps://runtimerebel.com/blog/cve-2024-57353-nginx-ui-auth-bypass-actively-exploited-patch-nowhttps://runtimerebel.com/blog/cve-2024-57353-nginx-ui-auth-bypass-actively-exploited-patch-nowAttackers are exploiting CVE-2024-57353, a critical authentication bypass in Nginx UI, to achieve full server takeover. Update to v2.0.0.beta.39 immediately.Thu, 16 Apr 2026 00:46:34 GMTCVE-2024-57353Nginx UIAuthentication BypassRCEActive Exploitationhttps://runtimerebel.com/blog/adobe-acrobat-reader-zero-day-exploitation-immediate-patch-requiredhttps://runtimerebel.com/blog/adobe-acrobat-reader-zero-day-exploitation-immediate-patch-requiredAdobe has patched an actively exploited Zero-Day in Acrobat and Reader. Attackers used crafted PDF files for at least four months. Update immediately.Tue, 14 Apr 2026 00:46:27 GMTAdobe AcrobatAdobe ReaderZero-DayPDFActive Exploitationhttps://runtimerebel.com/blog/adobe-acrobat-reader-rce-via-cve-2026-34621-patch-nowhttps://runtimerebel.com/blog/adobe-acrobat-reader-rce-via-cve-2026-34621-patch-nowAdobe issues emergency patches for CVE-2026-34621 in Acrobat Reader. This critical vulnerability is under active exploitation, allowing remote code execution.Sun, 12 Apr 2026 08:22:44 GMTCVE-2026-34621Adobe Acrobat ReaderRCEActive ExploitationEmergency Patchhttps://runtimerebel.com/blog/cve-2026-1340-ivanti-epmm-code-injection-patch-nowhttps://runtimerebel.com/blog/cve-2026-1340-ivanti-epmm-code-injection-patch-nowCISA adds CVE-2026-1340, a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM), to its KEV Catalog due to active exploitation.Thu, 09 Apr 2026 00:36:46 GMTCVE-2026-1340Ivanti EPMMCode InjectionActive ExploitationCISA KEVhttps://runtimerebel.com/blog/ninja-forms-rce-via-arbitrary-file-upload-mitigation-guidehttps://runtimerebel.com/blog/ninja-forms-rce-via-arbitrary-file-upload-mitigation-guideHackers are actively exploiting a critical Ninja Forms vulnerability to upload arbitrary files and achieve RCE. Learn how to secure your WordPress site now.Wed, 08 Apr 2026 12:28:42 GMTWordPressNinja FormsRemote Code ExecutionActive ExploitationFile Uploadhttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2026-35616-mitigation-guidehttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2026-35616-mitigation-guideFortinet releases emergency patches for CVE-2026-35616, a critical SQL injection flaw in FortiClient EMS exploited to achieve unauthenticated RCE.Sun, 05 Apr 2026 20:12:25 GMTCVE-2026-35616FortinetFortiClient EMSRCEActive Exploitationhttps://runtimerebel.com/blog/cve-2026-3055-citrix-netscaler-out-of-bounds-read-under-active-exploitationhttps://runtimerebel.com/blog/cve-2026-3055-citrix-netscaler-out-of-bounds-read-under-active-exploitationCISA adds CVE-2026-3055, an actively exploited Citrix NetScaler Out-of-Bounds Read vulnerability, to its KEV Catalog, urging immediate remediation.Mon, 30 Mar 2026 20:19:34 GMTCVE-2026-3055Citrix NetScalerOut of Bounds ReadCISA KEVActive Exploitationhttps://runtimerebel.com/blog/f5-big-ip-rce-via-cve-2023-46747-mitigation-and-exploitation-guidehttps://runtimerebel.com/blog/f5-big-ip-rce-via-cve-2023-46747-mitigation-and-exploitation-guideExploit analysis of the critical F5 BIG-IP authentication bypass (CVE-2023-46747). Learn how to detect webshell deployment and apply essential security patches.Mon, 30 Mar 2026 12:31:42 GMTCVE-2023-46747F5 BIG IPRCEAuth BypassActive Exploitationhttps://runtimerebel.com/blog/langflow-ai-platform-critical-code-injection-under-active-attackhttps://runtimerebel.com/blog/langflow-ai-platform-critical-code-injection-under-active-attackThreat actors are actively exploiting a critical code injection vulnerability in the Langflow AI platform, demanding immediate patching to prevent compromise.Thu, 26 Mar 2026 20:15:10 GMTLangflowAICode InjectionActive ExploitationCritical Vulnerabilityhttps://runtimerebel.com/blog/langflow-cve-2026-33017-ai-workflow-hijacking-under-active-exploitationhttps://runtimerebel.com/blog/langflow-cve-2026-33017-ai-workflow-hijacking-under-active-exploitationCISA warns of active exploitation of CVE-2026-33017 in Langflow, enabling attackers to hijack AI workflows and potentially compromise AI agents.Thu, 26 Mar 2026 20:14:50 GMTLangflowCVE-2026-33017AI SecurityWorkflow HijackingActive ExploitationCISAhttps://runtimerebel.com/blog/cve-2026-33017-langflow-code-injection-patch-immediatelyhttps://runtimerebel.com/blog/cve-2026-33017-langflow-code-injection-patch-immediatelyCISA adds actively exploited Langflow Code Injection Vulnerability (CVE-2026-33017) to KEV catalog. Critical patch urged for all organizations.Wed, 25 Mar 2026 20:18:12 GMTCVE-2026-33017LangflowCode InjectionCISA KEVActive Exploitationhttps://runtimerebel.com/blog/quest-kace-sma-cve-2025-32975-exploited-critical-patch-guidancehttps://runtimerebel.com/blog/quest-kace-sma-cve-2025-32975-exploited-critical-patch-guidanceThreat actors are exploiting a critical CVSS 10.0 vulnerability, CVE-2025-32975, in Quest KACE Systems Management Appliances exposed to the internet.Mon, 23 Mar 2026 08:25:12 GMTCVE-2025-32975Quest SoftwareKACE SMARemote Code ExecutionActive Exploitationhttps://runtimerebel.com/blog/cve-2026-33017-critical-langflow-rce-exploited-within-20-hourshttps://runtimerebel.com/blog/cve-2026-33017-critical-langflow-rce-exploited-within-20-hoursCVE-2026-33017 is a critical RCE vulnerability in Langflow currently under active exploitation. Learn how to secure your AI orchestration and detect attacks.Fri, 20 Mar 2026 16:18:45 GMTCVE-2026-33017LangflowRCEAI SecurityActive Exploitationhttps://runtimerebel.com/blog/cve-2026-20963-microsoft-sharepoint-deserialization-exploit-patch-nowhttps://runtimerebel.com/blog/cve-2026-20963-microsoft-sharepoint-deserialization-exploit-patch-nowCISA adds CVE-2026-20963, a Microsoft SharePoint deserialization vulnerability, to its KEV catalog due to active exploitation.Wed, 18 Mar 2026 20:17:46 GMTCVE-2026-20963Microsoft SharePointDeserialization VulnerabilityKEV CatalogActive Exploitationhttps://runtimerebel.com/blog/cisa-kev-update-five-actively-exploited-cves-in-apple-hikvision-rockwellhttps://runtimerebel.com/blog/cisa-kev-update-five-actively-exploited-cves-in-apple-hikvision-rockwellCISA adds five actively exploited vulnerabilities, including Apple iOS/iPadOS use-after-free and Hikvision improper authentication, to its KEV Catalog.Thu, 05 Mar 2026 20:18:17 GMTCVE-2017-7921CVE-2021-22681CVE-2021-30952CVE-2023-41974CVE-2023-43000CISA KEV CatalogHikvisionRockwell AutomationApple iOSApple iPadOSVulnerability ManagementActive ExploitationImproper AuthenticationUse After Freehttps://runtimerebel.com/blog/cisco-catalyst-sd-wan-manager-cve-2023-20252-mitigation-guidehttps://runtimerebel.com/blog/cisco-catalyst-sd-wan-manager-cve-2023-20252-mitigation-guideCisco warns of active exploitation targeting Catalyst SD-WAN Manager vulnerabilities CVE-2023-20252 and CVE-2023-20253. Immediate patching is required.Thu, 05 Mar 2026 12:19:33 GMTCiscoSD WANCVE-2023-20252CVE-2023-20253Active Exploitationhttps://runtimerebel.com/blog/cisco-sd-wan-zero-day-cve-2026-20127-exploited-for-admin-accesshttps://runtimerebel.com/blog/cisco-sd-wan-zero-day-cve-2026-20127-exploited-for-admin-accessCVE-2026-20127 is a critical CVSS 10.0 flaw in Cisco SD-WAN controllers exploited since 2023, allowing unauthenticated remote administrative access.Thu, 26 Feb 2026 08:18:56 GMTCVE-2026-20127CiscoSD WANvManagevSmartZero-DayActive Exploitationhttps://runtimerebel.com/blog/cisa-adds-two-cisco-sd-wan-exploits-to-kev-cataloghttps://runtimerebel.com/blog/cisa-adds-two-cisco-sd-wan-exploits-to-kev-catalogCISA adds CVE-2022-20775 (Path Traversal) and CVE-2026-20127 (Auth Bypass) affecting Cisco SD-WAN to its Known Exploited Vulnerabilities Catalog.Wed, 25 Feb 2026 20:17:03 GMTCVE-2022-20775CVE-2026-20127Cisco Catalyst SD WANCISA KEVActive ExploitationPath TraversalAuthentication Bypasshttps://runtimerebel.com/blog/cisa-alert-cve-2026-25108-soliton-filezen-os-command-injection-exploitedhttps://runtimerebel.com/blog/cisa-alert-cve-2026-25108-soliton-filezen-os-command-injection-exploitedCISA adds CVE-2026-25108, a Soliton Systems FileZen OS Command Injection vulnerability, to KEV Catalog due to active exploitation. Immediate remediation advised.Wed, 25 Feb 2026 04:44:11 GMTCVE-2026-25108Soliton SystemsFileZen OSCommand InjectionKEV CatalogActive Exploitation