Microsoft, Oracle, SAP, Atlassian and other enterprise platforms: exploited flaws, fixes and what to check.
PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train’s hotfix and take management off the internet.
An exploited flaw lets anyone reload Cisco ASA or FTD firewalls running SSL VPN with secondary auth. Upgrade to a fixed release or remove secondary auth.
Flaws in TeamViewer’s screen decoder let a malicious host attack the viewer, plus a macOS root bug. Update clients to 15.83 or the fixed legacy builds.
An unauthenticated SQL injection in EBS 12.2.3 to 12.2.15 leads to OS command execution, and decoys saw exploit attempts. Apply the October 2026 CPU.
An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.
Eight critical flaws in Campaign Classic 7.4.4 build 9402 and earlier allow code execution and SQL injection. Upgrade to build 9403 and update Connect clients.
Microsoft re-fixed two October .NET flaws and a Linux tarball privilege bug. Install .NET 8.0.33, 9.0.22 or 10.0.14, then rebuild self-contained apps.
Any authenticated user of on-prem VeloCloud Orchestrator can become superuser operator; Arista says it is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
SoftBank detected an unauthorized access attempt on My SoftBank systems on 17 Oct 2026 and shut its customer websites for four days. No data leak announced.
A record 1,411-fix release includes an exploited Windows Shell Mark of the Web bypass. Install the October cumulative update and Edge 154.0.4258.62.
Three chained Ivanti Connect Secure flaws give unauthenticated root and evade the Integrity Checker. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6.
On 11 Oct 2026 attackers forced refrigeration controllers in hundreds of French stores into defrost. CERT-FR says Danfoss, Copeland and Dixell units were hit.
Ahold Delhaize took most brands’ websites and apps offline in Europe and the US after malicious activity in its network on 12 Oct 2026. No data theft found yet.
A Kotlin DSL sandbox escape gives code execution on TeamCity servers, and Git submodule URLs could read local repos. Update to TeamCity 2026.2.1.
Attackers used one firm’s CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.
A pre-auth file read hits every Atlassian Data Center product and can leak Crowd credentials; exploited. Patch, or apply Atlassian’s block rule.
Exploited bugs in AhsayCBS, SiteGuard Server Edition and Siemens Software Center joined KEV in October 2026. Fixed builds, workarounds and IOCs for each.
An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September’s exploited RCEs.
Unauthenticated attackers write files on FortiMail through the /ibe endpoint; exploited before a patch. Upgrade to 8.0.2, 7.6.7 or 7.4.9, or turn IBE off.
A Zammad session hijack (6.3 to 6.5) plus a root escalation in DEB/RPM packages breached DIVD. Move to Zammad 7.2.2 or later and check logs for leaked cookies.
A URL-encoding trick bypasses SD-WAN Manager API login and grants admin; exploited since September. Upgrade and check the two logs Cisco names.
A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted SSNs of about 3.05 million people with military ties, Oct 2025 to Jul 2026.
A use-after-free in the Windows WinSock driver gave Lazarus SYSTEM rights to install a rootkit on defense targets. Install the August 2026 Windows update.
A default authentication client in SAP Commerce Cloud’s Data Hub Adapter lets attackers run code without logging in. Deploy 2211.55 or 2211-jdk21.17 now.
An incomplete fix let attackers bypass login and take over N-central admin accounts; exploited. Self-hosted servers need 2026.3.1.14 (HF4) or later.
Unauthenticated root code execution through vCenter’s syslog server, exploited since early August. Update to 8.0 U3k, 9.0.2.0100 or 9.1.0.0300.
Bank of Baroda says a compromised employee email account exposed “certain data” after TripleX posted files said to hold KYC and loan documents on 24 Jul 2026.
Three exploited flaws in on-premises SharePoint 2016, 2019 and Subscription Edition chain to code execution. Install the July 2026 update, rotate machine keys.
An unauthenticated endpoint in Splunk Enterprise 10.0 and 10.2 lets attackers write files and run code. Exploited. Update to 10.2.4 or 10.0.7.
A pre-auth flaw in PeopleTools 8.61 and 8.62 was used by ShinyHunters to steal data, mostly from universities. Apply Oracle’s fix and block /PSEMHUB/.
CISA’s BOD 26-04 sets patch deadlines by exposure, KEV status, automation and impact; the riskiest get 3 days. Track KEV dueDate and forensicTriage.
A CVSS 10 command injection in Ivanti Sentry gives unauthenticated root. Exploited after a public PoC. Update to R10.5.2, R10.6.2 or R10.7.1; close port 8443.
An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.
Two exploited Defender bugs let a local user gain SYSTEM or disrupt Defender. Check for engine 1.1.26040.8 and platform 4.18.26040.7 or later on every machine.
A CVSS 9.8 Netlogon overflow lets an unauthenticated attacker crash or take over Windows domain controllers. Install the May 2026 update on every DC.
SAML IdP memory leaks and a Gateway memory bug in NetScaler ADC and Gateway were exploited in 2026. Update to 14.1-73.41 or 13.1-64.28 and end all sessions.
Two exploited CVSS 10 peering bypasses give admin on Cisco Catalyst SD-WAN controllers. Upgrade to the May 2026 fixed releases and hunt for rogue peers.
Copilot CLI, the JetBrains plugin and VS Code had command-injection CVEs in 2026. Update to Copilot CLI 0.0.423, JetBrains plugin 1.5.63 and VS Code 1.132.1.
Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.
Attackers hijacked Notepad++ update traffic for months and served a backdoor to chosen targets. Update to 8.9.2 or later and hunt for the listed indicators.
Two mass-exploited CVSS 9.8 bugs give unauthenticated code execution on on-prem Ivanti EPMM. Apply the RPM fix, reapply after upgrades, hunt for web shells.
A malicious Office file can bypass OLE protections; APT28 used it in RTF phishing. Install the 26 Jan Office 2016/2019 updates and restart Microsoft 365 apps.
