Vulnerabilities & Patches
Cisco Secure FMC CVE-2026-20316 Exploited
Cisco Secure FMC CVE-2026-20316 is under confirmed active exploitation: a hardcoded, low-privilege account built into every on-premises Secure Firewall Management Center gives an unauthenticated attacker a foothold — and in the same advisory cycle, Cisco quietly reactivated a five-month-old, maximum-severity root-level bypass in the same product, sharing an identical indicator of compromise. CISA added the…
Read MoreCertighost CVE-2026-54121 Active Directory Domain Takeover
Certighost CVE-2026-54121 Active Directory is a certificate-services flaw that turns any ordinary domain-user account into full control of your entire Windows domain — no admin rights, no malware, no phishing required. Microsoft patched it on July 14, 2026, but a full technical writeup and working proof-of-concept went public on July 24. If your Active Directory…
Read MoreArista VeloCloud Orchestrator CVE-2026-16812 Exploited
Arista VeloCloud Orchestrator CVE-2026-16812 is a maximum-severity, unauthenticated command injection flaw under active exploitation right now, and it hands an attacker control of an entire SD-WAN fabric from a single unpatched management console. CISA added it to the Known Exploited Vulnerabilities catalog on July 27, with a federal patch deadline of July 30. If your…
Read MoreGitLab Oj Spill RCE Exploit Goes Public
The GitLab Oj Spill RCE is now public: a working exploit chain and full technical writeup were released on July 24 for a remote-code-execution flaw that GitLab quietly patched six weeks earlier, on June 10. If your self-managed GitLab instance is still on 18.10.7 or older, any developer who can push a commit can now…
Read MoreCheck Point SmartConsole CVE-2026-16232: Admin Bypass
Check Point SmartConsole CVE-2026-16232 is now on CISA’s Known Exploited Vulnerabilities list: an unauthenticated attacker can forge a login token and get full administrator access to the console that manages an organization’s entire firewall fleet. Check Point patched it on July 22 and confirmed a handful of customers were already targeted. The federal remediation deadline…
Read More