Trending now

CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability impacting SonicWall SMA 1000 Series appliances. This flaw resides within the SMA1000 Appliance WorkPlace interface. Exploitation of CVE-2026-15409 can allow remote, unauthenticated attackers to compel the appliance to initiate requests to unintended network locations. This vulnerability has been observed in active exploitation, frequently in conjunction with CVE-2026-15410. SonicWall has released firmware patches to address this issue and advises customers to upgrade their appliances and investigate for potential compromise.

CVE-2026-58644 is a vulnerability found in Microsoft Office SharePoint, categorized as a deserialization of untrusted data flaw. This vulnerability enables an unauthorized attacker to execute code over a network. The flaw affects multiple versions of Microsoft SharePoint Server, including Subscription Edition, 2019, and 2016. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-58644 to its Known Exploited Vulnerabilities Catalog, indicating that it is being actively exploited.

CVE-2026-25089 is an operating system (OS) command injection vulnerability affecting Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. This flaw, categorized as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), allows an unauthenticated, remote attacker to execute unauthorized commands on the appliance. The vulnerability is triggered by sending specially crafted HTTP requests, specifically exploiting a second-order command injection within the JSON input of the "start VNC" feature in the web-based management interface. Successful exploitation of CVE-2026-25089 can lead to the execution of arbitrary OS commands on the underlying system. Affected versions include FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, all FortiSandbox 4.2 versions, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5.

CVE-2026-39808 is an operating system (OS) command injection vulnerability affecting Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw stems from the improper neutralization of special elements used in OS commands, which allows attackers to inject malicious commands into system operations. Successful exploitation of CVE-2026-39808 enables remote attackers to execute unauthorized code or commands on the target system. This can be achieved without requiring any authentication or user interaction, typically through specially crafted HTTP requests to an API endpoint.

CVE-2026-58536 is an elevation of privilege vulnerability found in the Windows Cloud Files Mini Filter Driver. This flaw is categorized as a "use after free" vulnerability. An authorized attacker can exploit this vulnerability to locally elevate their privileges within the system. Microsoft addressed CVE-2026-58536 as part of its July 2026 Patch Tuesday release, which included fixes for numerous other vulnerabilities across various products.

CVE-2025-62221 is an elevation of privilege vulnerability affecting the Windows Cloud Files Mini Filter Driver. It stems from a use-after-free issue within the driver. An attacker with local access and some privileges can exploit this vulnerability to gain SYSTEM-level privileges. Successful exploitation of CVE-2025-62221 allows an attacker to gain full control of a Windows system. The attack complexity is low, and no user interaction is required. This vulnerability is actively being exploited.

CVE-2025-26529 is a stored Cross-Site Scripting (XSS) vulnerability found in Moodle's site administration live log functionality. The vulnerability exists because description information displayed in the site administration live log was not properly sanitized. This flaw affects Moodle versions 4.5 to 4.5.1, 4.4 to 4.4.5, 4.3 to 4.3.9, 4.1 to 4.1.15, and earlier unsupported versions. Successful exploitation of this vulnerability could allow attackers to inject malicious scripts that would be executed in the context of other users' browsers when they view the affected live log section in the site administration area. To remediate this vulnerability, users are advised to upgrade to the patched versions: Moodle 4.5.2, 4.4.6, 4.3.10, and 4.1.16. The fix involves implementing proper sanitization for event descriptions in the live log functionality.

CVE-2026-56155 is an elevation of privilege vulnerability found in Microsoft Active Directory Federation Services (AD FS). This flaw stems from an insufficient granularity of access control within the service. An authorized attacker can exploit this vulnerability to locally elevate their privileges. Microsoft has addressed this issue, noting that it was actively exploited in the wild as a zero-day vulnerability. Organizations are advised to apply mitigations in accordance with vendor instructions to address this vulnerability.

CVE-2026-15410 is identified as a code injection flaw affecting the SonicWall SMA1000 Appliance Management Console. This vulnerability could enable remote attackers, once authenticated as an administrator, to execute arbitrary operating system commands and achieve remote code execution on the affected appliance. This issue impacts SonicWall's SMA6210, SMA7210, and SMA8200v appliances, specifically certain firmware versions including 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. Reports indicate that this vulnerability has been actively exploited in conjunction with another flaw, CVE-2026-15409.

CVE-2026-56164 is a missing authentication for critical function vulnerability found in Microsoft SharePoint Server. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects all supported on-premises SharePoint Server versions, including Subscription Edition, 2019, and 2016. It has been actively exploited in the wild as a zero-day, enabling cyber threat actors to gain unauthorized access to SharePoint Server instances and potentially engage in post-exploitation activities.