Internet Exposure Likelihood: VERY_HIGH
CVSS: 8.6
CVE-2026-104935 is a critical authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure VPN appliances that allows a remote, unauthenticated attacker to execute arbitrary commands directly on the target appliance without any user interaction. The vulnerability affects ICS versions prior to 25.1.3.0 (and between 22.7R2.14 and 22.8R2.4), and has been actively exploited in the wild by threat actor UTA0576 as part of a zero-day exploit chain. As a VPN gateway product whose primary function is to serve as an internet-facing remote access portal, virtually all deployments are directly internet-exposed, making this an extremely high-priority remediation target.
CVE ADDED: 2026-10-13
0 DAY BETWEEN CVE AND KEV
0 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: VERY_HIGH
CVSS: 8.7
CVE-2026-88779 is an unauthenticated, remotely exploitable memory overflow (CWE-119) in NetScaler ADC and NetScaler Gateway that causes a Denial of Service condition. No authentication or user interaction is required, and the vulnerability has been confirmed as actively exploited in the wild targeting SAML gateway configurations. CISA has issued an alert covering this vulnerability as a critical zero-day being weaponised against these internet-facing appliances.
CVE ADDED: 2026-10-04
0 DAY BETWEEN CVE AND KEV
9 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 8.7
CVE-2026-102489 is an actively exploited session hijack vulnerability in Zammad helpdesk (versions 6.3.0–6.5.4) that leads to remote code execution as the 'zammad' system user. Zammad is a web-based customer support platform routinely exposed to the internet, making this a direct T1190 threat. The vulnerability is confirmed in CISA KEV and has been weaponised in real-world attack campaigns, including one that targeted DIVD itself, chained with CVE-2026-102490 to achieve full root-level compromise.
CVE ADDED: 2026-09-30
2 DAYS BETWEEN CVE AND KEV
11 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 9.8
CVE-2026-104286 is a critical unauthenticated path traversal vulnerability (CWE-22) in Fortinet FortiMail affecting versions 7.0.x through 8.0.x. An unauthenticated remote attacker can write arbitrary files to the underlying system via crafted HTTP/HTTPS requests, which can directly lead to remote code execution and full system compromise. FortiMail is an email security gateway that is routinely deployed as an internet-facing service, making this vulnerability directly exploitable via T1190.
CVE ADDED: 2026-10-01
0 DAY BETWEEN CVE AND KEV
12 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 9.8
CVE-2026-76504 is a critical (CVSS 9.8) authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager's API layer, caused by improper URI/hex encoding handling (CWE-177) that allows unauthenticated remote attackers to bypass authentication and gain admin-level API access. Exploitation is trivially simple — a crafted HTTP request is sufficient — requires no credentials or user interaction, and is actively being exploited in the wild as confirmed by Cisco PSIRT in September 2026. SD-WAN Manager is a network management plane component that is frequently exposed to the internet or reachable from semi-trusted networks, making this a severe and immediate threat to enterprise network infrastructure.
CVE ADDED: 2026-09-30
0 DAY BETWEEN CVE AND KEV
13 DAYS SINCE KEV
View Details →
PatchNow