DACH - DIESEC - Page 4

SonicWall SMA1000 RCE Vulnerability: Patch Now

By Editorial Team | September 7, 2026

A new SonicWall SMA1000 RCE vulnerability is under active exploitation: an unauthenticated server-side request forgery chained with an OS command injection lets an attacker take full root-level control of the appliance with no login required. CISA added both flaws to its Known Exploited Vulnerabilities catalog on September 2, with a federal deadline of September 5,…

Exchange Authentication Bypass Vulnerability Now Exploitable

By Editorial Team | September 1, 2026

A public exploit for an Exchange authentication bypass vulnerability is live, and 85% of German on-prem servers remain unpatched, BSI warns.

A working exploit for an Exchange authentication bypass vulnerability is now public on GitHub, and heise.de reports that roughly 85% of on-premises Exchange servers in Germany remain vulnerable three weeks after Microsoft shipped a fix. The catch: for organizations still running Exchange 2016 or 2019, that fix is locked behind Microsoft’s paid Extended Security Update…

Identity Theft in Germany: What SMEs Need to Know

By Editorial Team | August 26, 2026

Identity theft and stolen credentials drive most cybercrime in Germany

Germany’s cybercrime problem has a number attached to it: an estimated €202.4 billion in damage to the German economy for the 2025 reporting period, around 4.5 percent of GDP, according to the Federal Criminal Police Office’s (BKA) latest Bundeslagebild Cybercrime report. Behind much of that damage sits a quieter but persistent issue: identity theft in…

Zimbra Command Injection Vulnerability Actively Exploited

By Editorial Team | August 26, 2026

A Zimbra command injection vulnerability is under active exploitation against on-premises mail servers; the CISA federal deadline already passed.

A Zimbra command injection vulnerability is under confirmed active exploitation against on-premises mail servers, and CISA’s federal remediation deadline of August 24 has already passed. Tracked as CVE-2026-73570, the flaw lets an unauthenticated attacker execute arbitrary shell commands on any unpatched Zimbra Collaboration Suite instance with SNMP notifications enabled — a configuration many administrators never…

Microsoft Entra ID RCE Vulnerability Exploited

By Editorial Team | August 24, 2026

A maximum-severity Microsoft Entra ID RCE vulnerability was already being exploited before Microsoft's August 20 disclosure, and no customer patch exists.

Microsoft disclosed a maximum-severity Microsoft Entra ID RCE vulnerability on August 20, 2026, and confirmed the flaw was already being exploited in the wild before the advisory went public. CVE-2026-69836 carries a CVSS score of 10.0, needs no authentication and no user interaction, and sits in the identity backbone underneath Microsoft 365, Azure AD sign-in,…