CISA
Every ZeroDayFeed story on CISA — across breaches, zero-days, ransomware, patches, policy, and industry, newest first.
-
Zero-Days & Exploits
Apple's Sept. 28 updates fix CoreGraphics zero-day CVE-2026-86950, possibly exploited against targeted iOS users
Apple's September 28 updates fix CVE-2026-86950, a CoreGraphics out-of-bounds write that Apple says may have been exploited against specific targeted people on iOS versions before iOS 27. CISA's October 13 federal deadline has passed.
-
Zero-Days & Exploits
Exploited Cisco Catalyst SD-WAN Manager flaw CVE-2026-76504 gives unauthenticated admin API access
Cisco says attackers are exploiting CVE-2026-76504 (CVSS 9.8), a URI-encoding authentication bypass in Catalyst SD-WAN Manager that grants unauthenticated admin-level API access. There is no workaround. CISA's October 3 federal patch deadline has passed.
-
Zero-Days & Exploits
Citrix NetScaler zero-day CVE-2026-88771 moves to mass exploitation after PoC; CVE-2026-88772 also exploited
Two NetScaler ADC and Gateway flaws rated CVSS v4 9.5 were exploited before disclosure; CVE-2026-88771 was then attacked widely after a public PoC. Responders found stolen config archives and webshells, and CISA's September 30 deadline has passed.
-
Zero-Days & Exploits
FortiMail zero-day CVE-2026-104286 allows unauthenticated file writes; CISA's 3-day deadline has passed
Fortinet says CVE-2026-104286 has been exploited in the wild. The flaw is a CVSS 9.8 path traversal bug in FortiMail that lets unauthenticated attackers write arbitrary files. CISA's October 4 deadline for federal agencies has passed.
-
Zero-Days & Exploits
Plex2Shell: Attackers exploit chained Plex Media Server flaws the day after a public write-up
Attackers began exploiting Plex2Shell, a chain of four Plex Media Server flaws fixed in version 1.43.3, on Oct. 17, the day after the researcher published a write-up and proof-of-concept. A honeypot captured a cryptominer and residential-proxy software being dropped on vulnerable servers.
-
Zero-Days & Exploits
SonicWall SMA1000 SSRF flaw CVE-2026-102255 draws exploitation attempts days after hotfix
Honeypots began logging exploitation attempts consistent with CVE-2026-102255 two days after SonicWall patched the CVSS 10.0 pre-auth SSRF flaw in SMA1000 appliances, and no source has yet confirmed that any attempt succeeded.
-
Zero-Days & Exploits
Attackers chain two AhsayCBS flaws for SYSTEM access; first patch failed, CISA deadline passed
Attackers are chaining an AhsayCBS authentication bypass with a command injection flaw to get SYSTEM-level access, plant webshells and mine crypto. Ahsay says its 10.3.4.0 fix was incomplete, and CISA's October 17 deadline for federal agencies has passed.
-
Zero-Days & Exploits
Citrix NetScaler SAML flaw CVE-2026-88779 exploited in targeted attacks; CISA deadline has passed
Citrix says attackers are targeting CVE-2026-88779, a memory-buffer flaw in SAML-configured NetScaler ADC and Gateway appliances, and CISA's October 7 federal patch deadline has now passed.
-
Zero-Days & Exploits
Cisco Secure Email Gateway Flaw CVE-2026-76519 Exploited: Crafted Attachment Can Yield Root Access
Cisco says attackers are exploiting CVE-2026-76519 (CVSS 9.8), which lets an unauthenticated attacker gain root on a Secure Email Gateway with File Reputation enabled by sending a crafted attachment; there is no workaround, and CISA's October 17 KEV deadline has passed.
-
Zero-Days & Exploits
Atlassian Data Center File-Read Flaw CVE-2026-21589 Exploited After Public PoC; CISA Adds It to KEV
Attacks began within hours of a public proof of concept for CVE-2026-21589, a CVSS 9.3 unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products, and CISA added it to its Known Exploited Vulnerabilities catalog on Oct 15.
-
Zero-Days & Exploits
Ivanti Connect Secure zero-day CVE-2026-104935 chained for root access; third flaw still unpatched
Attackers exploited Ivanti Connect Secure auth bypass CVE-2026-104935 before disclosure, and Volexity says they chained it with a still-unpatched privilege escalation flaw to get root on a fully patched appliance. CISA added it to KEV on Oct 13.
-
Zero-Days & Exploits
Palo Alto patches exploited PAN-OS management-interface flaw that grants root (CVE-2026-0322)
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management-interface code-injection flaw that is being exploited in a very limited number of attacks. It gives authenticated attackers root on PA-Series and VM-Series firewalls and on Panorama, and CISA set an Oct 17 deadline for agencies to patch and check for compromise.
