Posts Tagged ‘vpn’
Ivanti Connect Secure Zero-Day Chain Reaches Root
Volexity found an Ivanti Connect Secure zero-day chain that gave one attacker unauthenticated root on a VPN appliance running the latest build at the time. Ivanti has fixed two of the three flaws. As of October 14, the third, the privilege escalation that turns a web-server foothold into root, has no fix. Ivanti’s own Integrity…
Read MoreSonicWall SMA1000 SSRF Vulnerability: Third Max Flaw
A third maximum-severity flaw in three months has been fixed in SonicWall’s SMA1000 remote-access appliances, and this SonicWall SMA1000 SSRF vulnerability may already be under attack. SonicWall’s October advisory describes an unauthenticated server-side request forgery rated CVSS 10.0. A security firm says its honeypots saw exploitation attempts, while SonicWall says it has no evidence of…
Read MoreWatchGuard Firebox Ransomware Exploitation
WatchGuard Firebox ransomware exploitation is now officially confirmed. CISA updated its Known Exploited Vulnerabilities catalog entry for CVE-2025-14733 on September 10, 2026, to reflect that ransomware gangs, not just opportunistic access brokers, are actively weaponizing a firewall flaw that has had a public patch available since December 2025. What Happened CVE-2025-14733 is an out-of-bounds write…
Read MoreCheck Point VPN Certificate Vulnerability: Patch Now
Check Point disclosed a Check Point VPN certificate vulnerability pair, CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8, on September 9, and the Dutch National Cyber Security Centre has since warned that large-scale exploitation is likely imminent, even though Check Point itself has not yet observed attacks in the wild. Both flaws allow unauthenticated remote code execution…
Read MoreSonicWall SMA1000 RCE Vulnerability: Patch Now
A new SonicWall SMA1000 RCE vulnerability is under active exploitation: an unauthenticated server-side request forgery chained with an OS command injection lets an attacker take full root-level control of the appliance with no login required. CISA added both flaws to its Known Exploited Vulnerabilities catalog on September 2, with a federal deadline of September 5,…
Read More