Vulnerability intelligence

CVE-2025-25249 is a heap-based buffer overflow vulnerability affecting Fortinet FortiOS and FortiSwitchManager products. This flaw allows remote attackers to execute unauthorized code or commands on vulnerable devices. The vulnerability is triggered by sending specially crafted network packets to the affected systems. It exists within the `cw_acd` daemon in FortiOS and FortiSwitchManager. Multiple versions of FortiOS (including 6.4, 7.0, 7.2, 7.4, and 7.6 branches) and FortiSwitchManager (versions 7.0 and 7.2) are impacted.

CVE-2026-86060 is an argument-handling flaw identified in MikroTik RouterOS, specifically within its SSH login path. This vulnerability arises when usernames begin with a prohibited character, which can be manipulated to alter the trusted RouterOS policy mask. Such a change ultimately leads to privilege escalation within the system. Exploitation of CVE-2026-86060 requires an unauthenticated SSH session to successfully reach the RouterOS login helper. This flaw is often discussed in conjunction with CVE-2026-67276, an SSH authentication bypass, as chaining these two vulnerabilities can allow an attacker to gain full, unauthenticated control over affected MikroTik devices. MikroTik has released fixes for this issue in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

CVE-2026-67276 is an SSH authentication bypass vulnerability affecting MikroTik RouterOS. The flaw stems from an incomplete verification process of RSA public keys during SSH authentication. Specifically, RouterOS checks the key type and modulus but fails to compare the entire RSA public key, omitting the exponent. This oversight allows an attacker, who possesses knowledge of a user's public modulus, to forge a different key and successfully log in via SSH without needing the corresponding private key. This vulnerability has been actively exploited as part of a larger attack chain dubbed "MikroTrick" and has been addressed in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

CVE-2026-87491 is an out-of-bounds write vulnerability found in V8, Google Chrome's JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The vulnerability was reported by Jihyeon Jeong of the Compsec Lab at Seoul National University on August 6, 2026. Google has confirmed that an exploit for CVE-2026-87491 exists in the wild, making it an actively exploited zero-day vulnerability. The issue has been addressed in Chrome version 153.0.8010.36 for Windows, macOS, and Linux, and is the seventh actively exploited Chrome zero-day patched by Google in 2026.

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

CVE-2026-19490 is an authentication bypass vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw, classified as CWE-288: Authentication Bypass Using an Alternate Path, allows an unauthenticated remote attacker to circumvent authentication controls on vulnerable systems. The vulnerability specifically affects appliances configured as a Gateway (such as SSL VPN, ICA Proxy, Clientless VPN/CVPN, or RDP Proxy) or as an AAA virtual server. For newer vulnerable builds, exploitation may require a SAML action to be configured, while older builds have a broader attack surface where the Gateway or AAA configuration alone is sufficient. Successful exploitation of CVE-2026-19490 could grant an attacker unauthorized access to internal applications and services that are typically secured behind authentication boundaries, without needing valid credentials or user interaction. The affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32, and 13.1 before 13.1-63.21, along with corresponding FIPS and NDcPP releases. Cloud Software Group, the vendor, has released security updates and strongly recommends that customers upgrade affected customer-managed NetScaler appliances immediately.