Two critical Ivanti EPMM zero-days (CVE-2026-1281 and CVE-2026-1340) are being exploited in the wild to achieve unauthenticated remote code execution. Interim RPM patches stop the immediate attacks, but they must be re-applied after upgrades; a permanent fix is scheduled for EPMM 12.8.0.0 in Q1 2026. Observed exploitation and its immediate effects Attackers are sending simple, […]
A critical unauthenticated RCE in Weaver E‑cology 10.0 (CVE‑2026‑22679) was actively exploited in mid‑ to late‑March 2026 after the vendor released a patch on March 12; endpoint defenses intervened and prevented persistent compromise, leaving timely patching as the primary remediation. How the March exploitation sequence unfolded The vendor released a patch on March 12, 2026; […]
The recent sequence of fixes for the Ninja Forms – File Upload extension matters because an incomplete February patch left thousands of WordPress sites exposed to unauthenticated remote code execution until a full remediation arrived on March 19, 2026. CVE-2026-0740 (CVSS 9.8) allows arbitrary file upload via the plugin’s handle_upload() AJAX endpoint; only version 3.3.27 […]
F5‘s BIG-IP Access Policy Manager vulnerability CVE-2025-53521—originally treated as a denial-of-service issue—was reclassified as an unauthenticated remote code execution (RCE) after March 2026 intelligence showed active exploitation. The change forced CISA into the Known Exploited Vulnerabilities (KEV) list and triggered federal patch mandates; organizations must treat this as an immediate compromise risk, not a mere […]
CVE-2026-4681 is a critical remote-code-execution flaw in PTC Windchill PDMLink and FlexPLM tied to unsafe deserialization; independent detections show Indicators of Compromise (IOCs) consistent with active exploitation attempts, so organizations running affected versions should treat this as an incident in progress rather than a purely theoretical risk. Which deployments are at highest immediate risk The […]
Microsoft released out-of-band hotpatch KB5084597 on March 13, 2026, to fix three critical RRAS remote‑code‑execution flaws. The patch can install without rebooting, but only on enterprise devices that meet specific hotpatch enrollment and configuration requirements. Details of the March 13 hotpatch and the vulnerabilities it fixes KB5084597 addresses CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111—integer overflow and heap […]
