Skip to content
Threat Feed
Subscribe

Tag

Active Exploitation

9 briefs RSS
critical threat

Drupal Commerce Core: Access Bypass Vulnerability (CVE-2026-118539)

An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.

exploited Commerce Core +1 web-application-vulnerability access-bypass e-commerce active-exploitation
1t 1c updated
critical threat

Oracle E-Business Suite: SQL Injection Remote Code Execution (CVE-2026-101767)

Threat actors are actively probing for CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in the Oracle E-Business Suite Application Object Library that allows for remote code execution.

exploited E-Business Suite +3 sql-injection rce vulnerability active-exploitation remote-code-execution oracle
1r 1t 1c updated
critical threat

Critical RCE Vulnerability in Cisco Secure Email Gateway

Cisco Secure Email Gateway contains a critical vulnerability in the Advanced Malware Protection (AMP) feature allowing unauthenticated remote code execution with root privileges, which is currently being exploited in the wild.

exploited Secure Email Gateway +1 remote-code-execution cisco vulnerability active-exploitation path-traversal rce
3t updated
critical threat

Unauthenticated SQL Injection in Fumasoft Fumeng Cloud

Fumasoft Fumeng Cloud contains a critical SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to execute arbitrary database queries.

exploited Fumeng Cloud web-application sql-injection active-exploitation
1r 1t 1c
critical threat

Active Exploitation of SQL Injection in Cisco Secure Email Gateway

Cisco has confirmed active exploitation of a SQL injection vulnerability (CVE-2026-76461) affecting multiple versions of Cisco Secure Email Gateway and Secure Email and Web Manager products.

exploited Cisco AsyncOS for Cisco Secure Email Gateway +2 vulnerability cve network active-exploitation
1c
critical threat

Active Exploitation of MikroTik RouterOS via SSH

Multiple vulnerabilities in MikroTik RouterOS are being actively exploited in the wild, targeting internet-exposed SSH services to achieve full system compromise.

exploited PoC RouterOS +4 active-exploitation network-security
1t 3c updated
critical threat

Active Exploitation of CVE-2026-1207 in Django Framework

A critical vulnerability, CVE-2026-1207, affecting Django versions prior to 4.2.28, 5.2.11, and 6.0.2, is actively being exploited, posing a significant risk of web server compromise and data exfiltration to organizations using the affected framework.

PoC Django 4.2 +2 web-application vulnerability active-exploitation python django
1c updated
high threat

UAT-7810 Expands ORB Networks with New Malware; ARToken Phishing-as-a-Service and Device Vulnerabilities Highlighted

The China-nexus threat actor UAT-7810 is expanding its Operational Relay Box (ORB) networks by exploiting known vulnerabilities in unpatched Ruckus and ASUS routers to deploy custom backdoors like LONGLEASH and DOGLEASH, while other threats include the ARToken Phishing-as-a-Service platform targeting Microsoft 365, critical flaws in AirDrop/Quick Share, and a backdoor in Tenda router firmware.

Ruckus routers +5 UAT-7810 China-nexus APT router-exploitation ORB-network backdoor phishing-as-a-service credential-theft data-exfiltration +3
10t 8i
critical threat

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Added to CISA KEV Catalog

CVE-2026-0300, a Palo Alto Networks PAN-OS out-of-bounds write vulnerability, has been added to CISA's Known Exploited Vulnerabilities Catalog due to evidence of active exploitation.

exploited PAN-OS cve-2026-0300 kev out-of-bounds write active exploitation
3r 1t