PatchNow - High Risk Vulnerability Alerts

CVE-2026-45247

Thu, 04 Jun 2026 06:53:20 -0000

Critical PHP object injection vulnerability in Mirasvit Cache Warmer for Magento 2 allows unauthenticated remote code execution via crafted cookie data. Affects e-commerce platforms that are inherently internet-facing by design. CISA KEV listing confirms active exploitation.

Risk Assessment

CVSS Score: 9.8
MITRE ATT&CK: T1190
Internet Exposure: VERY_HIGH

Affected Products

Magento 2 with Mirasvit Cache Warmer

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update Mirasvit Full Page Cache Warmer to version 1.11.12 or later
Review web server access logs for suspicious cookie values or serialized PHP objects in CacheWarmer cookies

View full analysis →

CVE-2026-0257

Sat, 30 May 2026 19:25:26 -0000

Authentication bypass vulnerability in GlobalProtect portal/gateway components of Palo Alto Networks PAN-OS allows remote attackers to establish unauthorized VPN connections. Active exploitation confirmed with public PoC available.

Risk Assessment

CVSS Score: 7.8
MITRE ATT&CK: T1190
Internet Exposure: VERY_HIGH

Affected Products

PAN-OS
Prisma Access

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review VPN logs for unauthorized connections, check for suspicious authentication patterns, verify user session legitimacy
Immediately apply vendor patches per upgrade matrix or implement workarounds (disable authentication override cookies or use dedicated certificates)
Monitor GlobalProtect logs for unusual connection patterns, failed authentication attempts, or connections from unexpected geographic locations

View full analysis →

CVE-2026-48172

Wed, 27 May 2026 18:00:41 -0000

Critical privilege escalation vulnerability in LiteSpeed cPanel/WHM plugins allowing attackers to potentially gain root access via network exploitation. This vulnerability is actively exploited in the wild and affects widely deployed web hosting control panel systems.

Risk Assessment

CVSS Score: 10.0
MITRE ATT&CK: T1190
Internet Exposure: VERY_HIGH

Affected Products

LiteSpeed cPanel Plugin (versions 2.3 to < 2.4.7)
LiteSpeed WHM Plugin (versions < 5.3.1.0)

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Run detection command: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null
IMMEDIATE: Update LiteSpeed WHM Plugin to version 5.3.1.0 and cPanel Plugin to version 2.4.7
URGENT: Examine system logs for suspicious IP addresses and block any unauthorized access attempts

View full analysis →

CVE-2026-9082

Fri, 22 May 2026 18:25:36 -0000

Critical unauthenticated SQL injection vulnerability in Drupal core affecting installations using PostgreSQL databases. Allows direct remote exploitation of internet-facing Drupal websites for full database access and potential remote code execution.

Risk Assessment

CVSS Score: 9.1
MITRE ATT&CK: T1190
Internet Exposure: VERY_HIGH

Affected Products

Drupal 8.9.0 through 10.4.9
Drupal 10.5.0 through 10.5.9
Drupal 10.6.0 through 10.6.8
Drupal 11.0.0 through 11.1.9
Drupal 11.2.0 through 11.2.11
...and 1 more

Key Recommendations

URGENT: Immediately update all Drupal installations to patched versions (10.4.10+, 10.5.10+, 10.6.9+, 11.1.10+, 11.2.12+, 11.3.10+)
Prioritize Drupal sites using PostgreSQL databases as they are specifically vulnerable
Review web server logs for suspicious SQL injection attempts or unusual database queries

View full analysis →

CVE-2026-42897

Fri, 15 May 2026 17:30:43 -0000

CVE-2026-42897 is a cross-site scripting vulnerability in Microsoft Exchange Server that enables spoofing attacks. This vulnerability is actively exploited in the wild and affects widely deployed internet-facing email servers through crafted network requests.

Risk Assessment

CVSS Score: 8.1
MITRE ATT&CK: T1190
Internet Exposure: VERY_HIGH

Affected Products

Exchange Server 2019
Exchange Server 2016
Exchange Server Subscription Edition

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Exchange server logs, check for unauthorized access, verify system integrity, and examine web access logs for suspicious crafted requests
Apply Microsoft security updates immediately for all affected Exchange Server versions (2016 CU23, 2019 CU14/CU15, Subscription Edition RTM)
Monitor Exchange server web traffic for malicious requests and implement web application firewall rules to detect XSS attempts

View full analysis →

CVE-2026-20182

Thu, 14 May 2026 17:45:33 -0000

Critical authentication bypass in Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to gain administrative privileges through crafted requests. This vulnerability is actively being exploited in the wild and is listed in CISA's KEV catalog.

Risk Assessment

CVSS Score: 10.0
MITRE ATT&CK: T1190
Internet Exposure: HIGH

Affected Products

Cisco Catalyst SD-WAN Manager

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately upgrade to fixed software releases as recommended by Cisco advisory cisco-sa-sdwan-rpa2-v69WY2SW
Implement network segmentation to restrict access to SD-WAN Manager interfaces

View full analysis →

CVE-2026-42208

Sat, 09 May 2026 17:45:55 -0000

Critical SQL injection vulnerability in LiteLLM proxy server allowing unauthenticated attackers to read/modify database contents including API keys and credentials. Actively exploited within 36 hours of disclosure and added to CISA KEV catalog.

Risk Assessment

CVSS Score: 9.3
MITRE ATT&CK: T1190
Internet Exposure: HIGH

Affected Products

LiteLLM Proxy Server (versions 1.81.16 to 1.83.6)

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately upgrade to LiteLLM version 1.83.7 or later
Review database logs for suspicious SQL queries or unauthorized data access

View full analysis →

CVE-2026-0300

Thu, 07 May 2026 19:20:47 -0000

Critical unauthenticated buffer overflow vulnerability in Palo Alto PAN-OS User-ID Authentication Portal allowing remote code execution with root privileges. Already under active exploitation in the wild against internet-facing firewalls.

Risk Assessment

CVSS Score: 9.3
MITRE ATT&CK: T1190
Internet Exposure: HIGH

Affected Products

Palo Alto PAN-OS (PA-Series firewalls)
Palo Alto PAN-OS (VM-Series firewalls)

Key Recommendations

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
IMMEDIATE: Apply security patches listed in the advisory (PAN-OS versions 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6 and their respective hotfixes)
URGENT: If patching cannot be completed immediately, restrict User-ID Authentication Portal access to only trusted internal IP addresses and disable Response Pages on internet-facing interfaces

View full analysis →

CVE-2026-6973

Thu, 07 May 2026 16:25:37 -0000

CVE-2026-6973 is an OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows authenticated administrators to achieve remote code execution. EPMM is typically deployed as an internet-facing mobile device management server, making this a direct network exploitation risk.

Risk Assessment

CVSS Score: 7.2
MITRE ATT&CK: T1190
Internet Exposure: HIGH

Affected Products

Ivanti Endpoint Manager Mobile (EPMM)

Key Recommendations

IMMEDIATE: Update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 depending on your current branch
Audit administrative accounts with access to EPMM console for unauthorized access or suspicious activity
Review EPMM server logs for evidence of command injection attempts or unusual administrative activity

View full analysis →