Vulnerabilities & Patches

Zimbra Command Injection Vulnerability Actively Exploited

By Editorial Team | August 26, 2026

A Zimbra command injection vulnerability is under active exploitation against on-premises mail servers; the CISA federal deadline already passed.

A Zimbra command injection vulnerability is under confirmed active exploitation against on-premises mail servers, and CISA’s federal remediation deadline of August 24 has already passed. Tracked as CVE-2026-73570, the flaw lets an unauthenticated attacker execute arbitrary shell commands on any unpatched Zimbra Collaboration Suite instance with SNMP notifications enabled — a configuration many administrators never…

Windows Defender Zero-Day Vulnerability Has No Patch

By Editorial Team | August 25, 2026

A Windows Defender zero-day vulnerability disclosed on August 12, 2026 lets a low-privileged local attacker bypass Microsoft’s own patch for an earlier Defender flaw and escalate straight to SYSTEM. Tracked as CVE-2026-69414 and nicknamed ShieldBreak, the flaw still has no fix ten days after Microsoft assigned the CVE. Any Windows endpoint running default Defender is…

Microsoft Entra ID RCE Vulnerability Exploited

By Editorial Team | August 24, 2026

A maximum-severity Microsoft Entra ID RCE vulnerability was already being exploited before Microsoft's August 20 disclosure, and no customer patch exists.

Microsoft disclosed a maximum-severity Microsoft Entra ID RCE vulnerability on August 20, 2026, and confirmed the flaw was already being exploited in the wild before the advisory went public. CVE-2026-69836 carries a CVSS score of 10.0, needs no authentication and no user interaction, and sits in the identity backbone underneath Microsoft 365, Azure AD sign-in,…

Windows IKE RCE: Patched in April, Exploited Now

By Editorial Team | August 20, 2026

CVE-2026-33824 Windows IKE RCE is now actively exploited despite an April patch. CVSS 9.8, no auth needed. See who's affected and what to check today.

CVE-2026-33824 Windows IKE RCE has gone from a quietly patched bug in April to an actively exploited flaw four months later: CISA added it to its Known Exploited Vulnerabilities catalog on August 18, 2026, giving U.S. federal agencies until August 21 to patch — while Microsoft’s own advisory still lists it as not exploited. What…

Progress LoadMaster CVE-2026-8037: 792 Attacks Logged

By Editorial Team | August 19, 2026

Progress LoadMaster CVE-2026-8037 (CVSS 9.6) is on CISA's KEV list after 792 exploit attempts. Unauthenticated root RCE — patch now.

Progress LoadMaster CVE-2026-8037, a CVSS 9.6 unauthenticated command-injection flaw, has already been hit with 792 confirmed exploitation attempts from 65 IP addresses over 41 days — and CISA added it to its Known Exploited Vulnerabilities catalog on August 7. If your load balancer is still running an unpatched build, the scanning has almost certainly already…