Threat Library

A critical vulnerability chain in the widely used Avada WordPress theme allows unauthenticated attackers to achieve remote code execution on affected servers with no user interaction required. Given Avada's large install base as a premium theme, this represents a significant risk of mass exploitation against websites and hosting infrastructure.

PayRange API, used to manage internet-connected vending and payment devices, contains a missing authorization vulnerability that exposes verbose device management data to unauthenticated or authenticated attackers. Exploitation could allow information disclosure, denial of service, or manipulation of device-displayed content across the PayRange network. PayRange has not engaged with CISA to remediate the issue, leaving affected deployments exposed.

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation, spanning Red Hat Libuser/ABRT, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, and Citrix NetScaler ADC/Gateway. BOD 26-04 mandates FCEB agencies prioritize rapid remediation of these on internet-facing assets, particularly those allowing full post-exploitation control. All organizations, including those hosting AI infrastructure, are encouraged to remediate promptly given confirmed in-the-wild exploitation.

CISA released a review analyzing FY2024-2025 vulnerability and exploitation data, finding that most breaches stem from unpatched, well-known vulnerabilities rather than novel attack techniques. The report highlights recurring software weakness classes and provides a risk-based prioritization framework (per BOD 26-04) to help organizations focus remediation efforts before automated and AI-assisted vulnerability discovery becomes more prevalent.

A critical, publicly disclosed stack-based buffer overflow exists in TOTOLINK N600R routers (firmware 4.3.0cu.7647_B20210106) via the Hostname parameter in the setSystemConfig function of cstecgi.cgi. The flaw is remotely exploitable without authentication and carries a maximum CVSS score of 10.0, allowing attackers to potentially achieve remote code execution on affected devices.

A critical authentication bypass exists in Alluxio's S3 REST proxy, where default configurations fail to validate AWS Signature Version 4 signatures. This allows unauthenticated attackers to extract usernames from unsigned Authorization headers and impersonate any user or service account, enabling unauthorized read, write, and delete access to arbitrary stored data.

A critical OS command injection vulnerability in Adobe Campaign Classic (CVE-2026-76197) allows attackers to achieve arbitrary code execution without requiring user interaction, and carries a maximum CVSS score of 10.0. Organizations running ACC for marketing automation should treat this as an urgent patching priority given the scope change and lack of required authentication or interaction.

A critical OS Command Injection vulnerability in Adobe Campaign Classic (ACC) allows an attacker to achieve arbitrary code execution in the context of the current user without requiring any user interaction. With a maximum CVSS score of 10.0 and a changed scope, successful exploitation could allow attackers to pivot beyond the vulnerable component into connected infrastructure.

CVE-2026-8452 is an improper memory buffer restriction vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can result in denial of service. CISA has added this CVE to its Known Exploited Vulnerabilities catalog with a short remediation window, indicating active exploitation in the wild. Organizations using NetScaler appliances as gateways or load balancers should prioritize patching due to the aggressive due date.

CVE-2022-0995 is an out-of-bounds write vulnerability in the Linux Kernel's watch_queue event notification subsystem that allows a local attacker to escalate privileges or crash the system. It is listed in CISA's Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild. Organizations running affected Linux kernel versions must remediate promptly per CISA's mandated due date.

CVE-2015-5287 is a local privilege escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT), exploitable via a symlink attack on a predictably named file. The flaw allows local users with certain permissions to escalate privileges on affected Linux systems. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild despite its age.

CVE-2015-3246 is a race condition vulnerability in Red Hat's libuser library that allows authenticated local users to corrupt /etc/passwd, resulting in denial of service or privilege escalation. The flaw has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild despite its age. Organizations still running affected libuser versions on Linux systems should prioritize patching before the specified due date.

Ajax.NET Professional (AjaxPro) is affected by a deserialization vulnerability (CVE-2021-23758) that allows remote code execution through instantiation of arbitrary .NET classes. The affected product is end-of-life, meaning no vendor patch is available, and CISA has added it to the Known Exploited Vulnerabilities catalog due to active exploitation.

Meta has expanded WhatsApp's account security by enabling support for multiple passkeys per account across iOS and Android, allowing users to sign in using phishing-resistant authentication methods on multiple devices. This is a defensive security enhancement rather than a threat, aimed at reducing account takeover risk for over 1 billion existing passkey users.

The U.S. Department of the Treasury has imposed new sanctions on Iranian cyber actors linked to breaches of critical infrastructure, as part of a broader economic pressure campaign against Iran. This is a policy and enforcement action rather than a newly disclosed technical vulnerability, though it signals continued Iranian state-sponsored targeting of critical infrastructure sectors.

Threat actors are abusing npm and its mirror services to host malicious HTML pages that impersonate Cloudflare CAPTCHA verification screens. Visitors who interact with these fake pages are redirected to attacker-controlled sites, likely for further phishing, malware delivery, or credential theft. The abuse leverages the inherent trust and reachability of npm's infrastructure to evade detection and blocklisting.

The Los Angeles County Museum of Art (LACMA) disclosed a data breach from the prior year that exposed sensitive personal information, including Social Security numbers and medical data, belonging to customers and employees. Details on the initial attack vector and threat actor attribution have not been publicly confirmed at this time.

CISA added CVE-2026-60004, a code injection vulnerability in Gitea, to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation. Federal agencies are required under BOD 26-04 to remediate this vulnerability on a prioritized basis, and CISA urges all organizations to do the same given the risk of total asset compromise.

Rently Smart Home versions 20.1.0 and earlier contain a vulnerability that insufficiently protects credentials, allowing an attacker to retrieve PINs, including the Master PIN, and override standard user permissions. Rently has released a patch as of late June 2026, and no known public exploitation has been reported.

The Ebyte NE2-D11 gateway (Firmware FW-9167-0-11) contains eleven distinct vulnerabilities including missing authentication, client-side authentication bypass, cleartext credential and MQTT traffic transmission, CSRF, clickjacking, and missing authorization checks. Several flaws are rated CVSS 9.8, allowing an unauthenticated remote attacker to fully compromise device confidentiality, integrity, and availability. Ebyte has not released a patch or responded to CISA coordination requests, leaving affected deployments in critical manufacturing and energy sectors exposed with no vendor remediation timeline.