U.S. Cybersecurity and Infrastructure Security Agency (CISA) Archives

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

6Aug

By RBNo Comments

News

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reports that a recently patched security vulnerability affecting on-premise versions of JetBrains TeamCity has been actively exploited in the field. The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could enable an unauthenticated attacker with access to a TeamCity server to get around authentication checks and use the privileges of the TeamCity server process to execute arbitrary operating system commands. A deserialization of untrusted data vulnerability in JetBrains TeamCity may enable unauthenticated remote code execution through the agent polling protocol, according to CISA. JetBrains claims that an unauthenticated attacker can use the TeamCity a...

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

13Jul

By RBNo Comments

News

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

Following reports of zero-day exploitation in the field, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) database with two maximum-severity security holes affecting the iCagenda and Balbooa extensions for Joomla. The vulnerabilities listed below have both received a CVSS score of 10.0: CVE-2026-48939 is a vulnerability in the Joomla iCagenda extension that permits arbitrary files to be uploaded using the file attachment feature, resulting in the upload and execution of PHP code. CVE-2026-56291 is a flaw in the Joomla Balbooa Forms extension that permits the upload of any file, resulting in remote code execution. MySites.guru, a cloud-based dashboard service for managing WordPress and Joomla websites, claims t...

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

2Jul

By RBNo Comments

News

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

Citing indications of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity vulnerability affecting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) list on Wednesday. The vulnerability, identified as CVE-2026-45659 (CVSS score: 8.8), involves the deserialization of untrusted data, which can lead to remote code execution. Microsoft fixed the problem in SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 in May 2026. Microsoft stated that the vulnerability does not require admin or other elevated access and that it could be triggered by any authenticated attacker. An authenticated attacker with at least Site Member permissions (PR:L) might use it to remotely...

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

17Jun

By RBNo Comments

News

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

Citing evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity security vulnerability affecting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) list on Tuesday. The vulnerability, identified as CVE-2026-48907 (CVSS score: 10.0), is an instance of inadequate access control that may allow arbitrary code execution. According to CISA, the Widget Factory Joomla Content Editor has an insufficient access control vulnerability that could allow unauthenticated users to upload and execute PHP code by creating new editor profiles The JCE editor extension for Joomla is the source of the vulnerability, which enables a bad actor to establish new editor profiles for unauthenticated users, ...

CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV

4May

By RBNo Comments

News

CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV

Citing indications of active exploitation in the open, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a recently discovered security vulnerability affecting many Linux distributions to its Known Exploited Vulnerabilities (KEV) list on Friday. This vulnerability, known as CVE-2026-31431 (CVSS score: 7.8), is a local privilege escalation (LPE) bug that could give an unauthorized local user root access. Theori and Xint also track the nine-year-old flaw as Copy Fail. Linux kernel versions 6.18.22, 6.19.12, and 7.0 now include fixes. According to a CISA alert, the Linux kernel has a vulnerability that could allow for privilege escalation due to improper resource transfer across spheres. According to a report released earlier this week, Copy Fail is caused by a ...

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

17Apr

By RBNo Comments

News

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), a high-severity security weakness in Apache ActiveMQ Classic has been actively exploited in the field. In order to address this, the government has updated its Known Exploited Vulnerabilities (KEV) catalog with the vulnerability, tagged as CVE-2026-34197 (CVSS score: 8.8), and mandated that Federal Civilian Executive Branch (FCEB) entities implement the solutions by April 30, 2026. According to descriptions, CVE-2026-34197 is an instance of incorrect input validation that may result in code injection, hence enabling an attacker to run arbitrary code on vulnerable installations. Naveen Sunkavally of Horizon3.ai claims that CVE-2026-34197 has been "hiding in plain sight" for 13 years. Sunkavally stated t...

FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks

23Mar

By RBNo Comments

News

FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) reported on Friday that threat actors connected to Russian Intelligence Services are running phishing campaigns to breach commercial messaging applications (CMAs) like WhatsApp and Signal in order to take control of accounts belonging to people with high intelligence value. FBI Director Kash Patel stated in a post on X that the effort targets people of high intelligence value, including as current and former U.S. government officials, military personnel, political figures, and journalists. This endeavor has led to thousands of individual accounts being accessed without authorization worldwide. The actors can send messages as the victim, check messages and contact lists, and ca...

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths

17Mar

By RBNo Comments

News

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths

Citing evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a medium-severity security vulnerability affecting Wing FTP to its Known Exploited Vulnerabilities (KEV) database on Monday. CVE-2025-47813 (CVSS score: 4.3) is an information disclosure vulnerability that, in some circumstances, exposes the application's installation path. According to CISA, utilizing a lengthy value in the UID cookie causes Wing FTP Server to generate error messages that include sensitive information vulnerabilities. All software versions before and including version 7.4.3 are impacted by the flaw. After RCE Security researcher Julien Ahrens made a responsible disclosure, the problem was fixed in version 7.4.4, which was released in May. Notably, CVE-2...

CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed

12Mar

By RBNo Comments

News

CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed

Based on evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a significant security vulnerability affecting n8n to its Known Exploited Vulnerabilities (KEV) database on Wednesday. A case of expression injection that results in remote code execution is the subject of the vulnerability, which is tracked as CVE-2025-68613 (CVSS score: 9.9). In December 2025, n8n fixed the security flaw in versions 1.120.4, 1.121.1, and 1.122.0. The first n8n vulnerability added to the KEV database is CVE-2025-68613. According to CISA, N8n has a vulnerability in its workflow expression evaluation system that permits remote code execution due to inappropriate control of dynamically managed code resources. The workflow automation platform's maintainer...

CISA Confirms Active Exploitation of FileZen CVE-2026-25108 Vulnerability

25Feb

By RBNo Comments

News

CISA Confirms Active Exploitation of FileZen CVE-2026-25108 Vulnerability

Citing indications of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a recently discovered FileZen vulnerability to its list of known exploited vulnerabilities (KEV) on Tuesday. The operating system (OS) command injection vulnerability, identified as CVE-2026-25108 (CVSS v4 score: 8.7), may enable an authorized user to carry out arbitrary commands through carefully constructed HTTP requests. When a user enters in to the impacted product and submits a specially constructed HTTP request, Soliton Systems K.K. FileZen has an OS command injection vulnerability, according to CISA. The following file transfer product versions are impacted by the issue, per the Japan issue Notes (JVN): Versions 4.2.1 to 4.2.8 Versions 5.0.0 to 5.0.10 ...