Threat intelligence, automated.
AI-researched threat write-ups, live IOC feeds, and MITRE ATT&CK mappings — human-reviewed before every publish. Built for defenders.
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass
A critical authentication bypass vulnerability (CVE-2026-102764) in BeyondTrust Remote Support allows unauthenticated remote attackers to perform arbitrary file operations on the appliance. This flaw, rated 9.8 CVSS, is actively exploited in the wild by threat actors like ARMORY CASTLE to gain root access and deploy backdoors, including SAWFLY and BARECLAW malware.
Read full report →CVE-2026-21589: Atlassian Data Center Arbitrary File Read Vulnerability
An unauthenticated arbitrary file read vulnerability (CVE-2026-21589) affects multiple Atlassian Data Center products, allowing attackers to access specific files within the web application root directory. Exploitation requires prior knowledge of the target file’s exact name and path, but can lead to the disclosure of sensitive information. Active exploitation of this vulnerability has been reported.
CVE-2026-76519: Cisco Secure Email Gateway Arbitrary File Write and RCE
A critical vulnerability (CVE-2026-76519) in Cisco Secure Email Gateway’s Advanced Malware Protection (AMP) feature allows unauthenticated, remote attackers to write arbitrary files and execute commands with root privileges. This path traversal flaw is actively exploited, posing a severe risk to affected organizations.
CVE-2026-105133: AhsayCBS Improper Authentication Vulnerability Exploited
CVE-2026-105133 is an improper authentication vulnerability in Ahsay AhsayCBS versions up to 10.3.2, actively exploited in the wild. This flaw allows remote attackers to bypass authentication by manipulating the `random` parameter in the API component’s `checkSysPwd` function. Successful exploitation can lead to unauthorized access, webshell deployment, and cryptominer installation, notably XMRig.
CVE-2026-105134: AhsayCBS Command Injection Vulnerability Actively Exploited
A critical command injection vulnerability (CVE-2026-105134) in Ahsay AhsayCBS Replication Receiver component allows remote attackers to execute arbitrary operating system commands. This flaw, affecting versions up to 10.3.2, is actively exploited in the wild to deploy webshells and XMRig cryptominers. Immediate patching to version 10.3.4 is crucial.
CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
CVE-2026-96951 is a high-severity command injection vulnerability in Microsoft Windows Shell (CWE-77). It allows an unauthorized attacker to bypass security features over a network, though successful exploitation requires user interaction. This flaw can lead to high impact on confidentiality, integrity, and availability.
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass Leading to RCE
A critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure allows remote, unauthenticated attackers to execute arbitrary commands. This flaw, classified as CWE-290, affects versions prior to 25.1.3.0 and poses a significant risk of full system compromise.
FBI Warns of Ongoing FortiBleed Attacks Locking Out FortiGate VPN Admins
The FBI has issued a warning regarding ongoing ‘FortiBleed’ attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. These attacks are leading to the lockout of legitimate administrators, indicating successful unauthorized access and control over critical network infrastructure.
SonicWall SMA1000 Gateways Vulnerable to Max Severity SSRF
SonicWall has issued hotfixes for a critical Server-Side Request Forgery (SSRF) vulnerability affecting its SMA1000 series appliances. This flaw, rated at maximum severity, could allow attackers to force the gateway to make requests to internal network resources, potentially leading to information disclosure or further compromise. Immediate patching is recommended for all affected deployments.
Transparently AI-authored
Every report on this site is researched and drafted by an AI agent, then reviewed and approved by a human analyst before publication. The Agent Logbook shows every step — sources consulted, enrichment calls, tokens used, and approval status — in real time.