Internet Exposure Likelihood: HIGH
CVSS: 9.3
CVE-2026-21589 is a critical unauthenticated arbitrary file read vulnerability (CVSS 9.3) affecting eight Atlassian Data Center products including Confluence, Jira, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated remote attacker can read specific files within the web application root directory — potentially exposing configuration files, database credentials, API keys, and other sensitive material stored on the server — without requiring any authentication or user interaction. Active exploitation in the wild was observed within two hours of public disclosure, and a public PoC exploit is available.
CVE ADDED: 2026-10-05
10 DAYS BETWEEN CVE AND KEV
0 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 7.3
CVE-2026-105133 is an improper authentication vulnerability (CWE-287) in the Ahsay AhsayCBS backup management API, specifically in the checkSysPwd function of ApiStructsAction.java, where manipulation of the 'random' argument allows authentication bypass. The vulnerability is remotely exploitable without credentials or user interaction, and is actively being exploited in the wild by threat actors chaining it with a command injection flaw (CVE-2026-105134) to achieve unauthenticated RCE, deploy webshells, and install cryptominers. AhsayCBS is server software that functions as a backup management console and is frequently exposed to the internet to support remote client backup operations.
CVE ADDED: 2026-10-04
10 DAYS BETWEEN CVE AND KEV
1 DAY SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 10.0
CVE-2026-105134 is a critical unauthenticated OS command injection vulnerability (CWE-78) in Ahsay AhsayCBS versions up to 10.3.2, exploitable remotely via the /rps/api/json/UpdateReceivers.do Replication Receiver endpoint. Successful exploitation grants attackers full remote code execution on the server with no authentication or user interaction required. Active exploitation has been confirmed in the wild, with threat actors deploying webshells and XMRig cryptominers on compromised backup servers.
CVE ADDED: 2026-10-04
10 DAYS BETWEEN CVE AND KEV
1 DAY SINCE KEV
View Details →
Internet Exposure Likelihood: VERY_HIGH
CVSS: 9.8
CVE-2026-76519 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in Cisco Secure Email Gateway's Advanced Malware Protection (AMP) feature, triggered by sending a specially crafted email attachment through the gateway. Successful exploitation allows an attacker to write arbitrary files and execute commands with root privileges on the underlying OS. The vulnerability is confirmed actively exploited in the wild as of October 2026, and email gateways are by definition internet-facing, making this an immediate, severe threat requiring emergency patching.
CVE ADDED: 2026-10-14
0 DAY BETWEEN CVE AND KEV
1 DAY SINCE KEV
View Details →
Internet Exposure Likelihood: VERY_HIGH
CVSS: 8.6
CVE-2026-104935 is a critical authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure VPN appliances that allows a remote, unauthenticated attacker to execute arbitrary commands directly on the target appliance without any user interaction. The vulnerability affects ICS versions prior to 25.1.3.0 (and between 22.7R2.14 and 22.8R2.4), and has been actively exploited in the wild by threat actor UTA0576 as part of a zero-day exploit chain. As a VPN gateway product whose primary function is to serve as an internet-facing remote access portal, virtually all deployments are directly internet-exposed, making this an extremely high-priority remediation target.
CVE ADDED: 2026-10-13
0 DAY BETWEEN CVE AND KEV
2 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: VERY_HIGH
CVSS: 8.7
CVE-2026-88779 is an unauthenticated, remotely exploitable memory overflow (CWE-119) in NetScaler ADC and NetScaler Gateway that causes a Denial of Service condition. No authentication or user interaction is required, and the vulnerability has been confirmed as actively exploited in the wild targeting SAML gateway configurations. CISA has issued an alert covering this vulnerability as a critical zero-day being weaponised against these internet-facing appliances.
CVE ADDED: 2026-10-04
0 DAY BETWEEN CVE AND KEV
11 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 8.7
CVE-2026-102489 is an actively exploited session hijack vulnerability in Zammad helpdesk (versions 6.3.0–6.5.4) that leads to remote code execution as the 'zammad' system user. Zammad is a web-based customer support platform routinely exposed to the internet, making this a direct T1190 threat. The vulnerability is confirmed in CISA KEV and has been weaponised in real-world attack campaigns, including one that targeted DIVD itself, chained with CVE-2026-102490 to achieve full root-level compromise.
CVE ADDED: 2026-09-30
2 DAYS BETWEEN CVE AND KEV
13 DAYS SINCE KEV
View Details →
Internet Exposure Likelihood: HIGH
CVSS: 9.8
CVE-2026-104286 is a critical unauthenticated path traversal vulnerability (CWE-22) in Fortinet FortiMail affecting versions 7.0.x through 8.0.x. An unauthenticated remote attacker can write arbitrary files to the underlying system via crafted HTTP/HTTPS requests, which can directly lead to remote code execution and full system compromise. FortiMail is an email security gateway that is routinely deployed as an internet-facing service, making this vulnerability directly exploitable via T1190.
CVE ADDED: 2026-10-01
0 DAY BETWEEN CVE AND KEV
14 DAYS SINCE KEV
View Details →
PatchNow