SonicWall SMA1000 SSRF Vulnerability: Third Max Flaw

By Editorial Team | October 14, 2026
SonicWall SMA1000 SSRF vulnerability is the third max-severity flaw in three months. Attempts are reported; patch to 12.4.3-03670 or 12.5.0-03082.

A third maximum-severity flaw in three months has been fixed in SonicWall’s SMA1000 remote-access appliances, and this SonicWall SMA1000 SSRF vulnerability may already be under attack. SonicWall’s October advisory describes an unauthenticated server-side request forgery rated CVSS 10.0. A security firm says its honeypots saw exploitation attempts, while SonicWall says it has no evidence of…

Read More

Atlassian File Access Vulnerability in Data Center

By Editorial Team | October 8, 2026
Atlassian Data Center file access vulnerability CVE-2026-21589 (CVSS 9.3) hits eight products with no login. No exploitation reported yet. Patch now.

The Atlassian file access vulnerability CVE-2026-21589 (CVSS 9.3) lets an unauthenticated attacker read files from the web root of eight self-hosted products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Every version is affected until it is upgraded. CISA lists it as exploited, and the patched releases are out. What decides…

Read More

FortiMail Zero-Day Vulnerability Exploited in the Wild

By Editorial Team | October 5, 2026
A FortiMail zero-day vulnerability lets attackers write files with no login. Exploited now; fixes for 7.4, 7.6 and 8.0 were pending at disclosure.

A FortiMail zero-day vulnerability, CVE-2026-104286 (CVSS 9.8), lets an unauthenticated attacker write arbitrary files onto Fortinet’s email security appliance with nothing more than crafted web requests. Fortinet confirmed active exploitation on October 1, CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, and fixed releases for the 7.4, 7.6 and 8.0…

Read More

Spectre v2 Branch Target Reuse vulnerability

By Editorial Team | October 1, 2026
A new Spectre v2 Branch Target Reuse vulnerability lets attackers leak a Linux root password hash in minutes, bypassing existing CPU defenses.

Researchers disclosed a new Spectre v2 Branch Target Reuse vulnerability on September 29 that lets an attacker recover a Linux system’s root password hash in minutes, on a fully patched Intel machine, by abusing a gap between how CPUs and just-in-time compilers handle recycled memory. The flaw touches Intel, AMD and Arm processors alike, and…

Read More

Citrix NetScaler unauthenticated RCE vulnerability

By Editorial Team | September 29, 2026
Citrix NetScaler unauthenticated RCE vulnerability lets attackers run commands with no login. Two zero-days exploited, patch now, CISA deadline Sep 30.

Citrix confirmed on September 27 that a Citrix NetScaler unauthenticated RCE vulnerability, tracked as two separate CVEs, was already being exploited in the wild before any patch existed. CVE-2026-88771 lets an attacker with no credentials run arbitrary commands on any NetScaler ADC or Gateway appliance in a vulnerable version, default configuration included. Its sibling flaw,…

Read More