Tag
News and blog posts tagged Zero-Day on AppSecNews.
News Vulnerabilities & Zero-Days
BeyondTrust has patched CVE-2026-102764, a critical flaw in Remote Support that Google's Mandiant says a suspected China-nexus espionage group it calls ARMORY CASTLE exploited as a zero-day from late August 2026. Self-hosted appliances need to be patched manually.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management interface flaw that lets an authenticated attacker run code as root, after observing very limited exploitation. CISA gave US federal agencies until 17 October 2026 to fix it.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Microsoft's October 2026 updates fix more than 1,400 vulnerabilities, a record, including CVE-2026-96951, a Windows Shell flaw exploited in the wild that bypasses Mark of the Web protections. CISA gave US federal agencies until 16 October to patch it.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Ivanti patched CVE-2026-104935 in Connect Secure on 13 October 2026 after limited exploitation in the wild, and CISA gave US federal agencies until 16 October to fix it. Volexity says an attacker chained it with a third, still unpatched flaw to run commands as root.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Cisco says attackers are exploiting CVE-2026-76519, a 9.8-rated flaw that lets an unauthenticated sender write files to a Secure Email Gateway with a crafted attachment, which can lead to commands running as root. There is no workaround.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Citrix has released emergency security updates for a high-severity NetScaler vulnerability, CVE-2026-88779, after confirming that attackers are exploiting the flaw in targeted attacks. The vulnerability can cause denial-of-service on affected NetScaler deployments using SAML authentication.
Jaydeep Bhatt