Posts Tagged ‘CISA KEV’
Barracuda ESG Root Access Flaws Exploited
Two Barracuda ESG root access flaws that work together on the appliance are being exploited, per Barracuda’s own update. Barracuda patched them in early November and said on November 9 that it had seen attacks on a small number of organizations. CISA added both to its Known Exploited Vulnerabilities list on November 10 and gave…
Read MorePlex2Shell QNAP NAS Attacks: Patching Is Not Enough
The Plex2Shell QNAP NAS attacks are real enough that QNAP has issued its own advisory: users report compromised devices, and updating Plex does not remove what attackers already installed. Plex 1.43.3.10861 fixes the flaws, but a NAS that ran Plex 1.43.2 or older while reachable from the internet needs more than an update. What Happened…
Read MoreCybersecurity Roundup
Several of October’s attacks started with access that someone had already granted. In Denmark, a private company’s legitimate access to the national population register exposed data on 8.8 million people. In Japan, a contractor’s stolen account was used to attack NEC’s customers, and a login flaw let ransomware into a cloud provider. This Cybersecurity Roundup…
Read MoreSonicWall SonicOS MFA Bypass: Patch and Review
A SonicWall SonicOS MFA bypass is now on CISA’s list of exploited vulnerabilities. CVE-2026-19868 lets someone who holds valid credentials for an alternate sign-in method skip SAML on the SSL-VPN, and with it the multi-factor step. SonicWall published fixed firmware on November 6. As of November 9, its advisory also lists a workaround for anyone…
Read MoreWordPress Core RCE Vulnerability Hits Core Updates
A WordPress core RCE vulnerability can be triggered while a site updates itself: during a full core upgrade, the new files sit for a short time in a predictable folder that anyone can request. Wordfence assigned it CVE-2026-119977 (CVSS 8.1), and CISA added it to the Known Exploited Vulnerabilities catalog on November 3 with a…
Read More