cisa - Tech News from Simmons Systems

Tech News from Simmons Systems

cisa

A collection of 47 posts

Ransomware Gangs Now Exploiting Critical VMware vCenter Flaw, CISA Warns

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that ransomware gangs have joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. Broadcom fixed the flaw, tracked as CVE-2026-59310, on July 29, describing it as a directory traversal vulnerability in the vCenter Syslog server that allows

Cisco Warns of Actively Exploited Root Zero-Day in Secure Email Gateway

Cisco warns that attackers are actively exploiting a critical zero-day vulnerability in its Secure Email Gateway products. The flaw, tracked as CVE-2026-76461, resides in the email parsing logic of Cisco AsyncOS Software and affects both virtual and physical appliances regardless of configuration. Successful exploitation allows unauthenticated, remote attackers to execute

CISA Warns of Active Attacks Exploiting Critical GitLab Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are actively exploiting a maximum-severity GitLab vulnerability tracked as CVE-2026-85706. The flaw stems from missing authentication enforcement and improper path confinement in the repository commits API, allowing unauthenticated attackers to read credentials, secrets, and other sensitive files from

CISA Orders Federal Agencies to Patch Exploited Citrix NetScaler Flaw by Saturday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a high-severity Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and orders federal agencies to patch affected appliances by Saturday, August 29. The flaw, tracked as CVE-2026-8452, stems from a memory overflow weakness affecting NetScaler ADC and NetScaler

Attackers Compromise 270+ Zimbra Servers Using SNMP Flaw

Threat actors have compromised more than 270 Zimbra Collaboration Suite (ZCS) servers in ongoing remote code execution attacks targeting a high-severity vulnerability tracked as CVE-2026-73570. The flaw stems from a command injection weakness in the SNMP monitoring component, and it allows unauthenticated attackers to gain remote code execution when SNMP

CISA Orders Federal Agencies to Patch Actively Exploited Zimbra Flaw Within Three Days

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. federal agencies to patch an actively exploited vulnerability in the Zimbra Collaboration Suite within three days. The flaw, tracked as CVE-2026-73570, is a command injection weakness in the SNMP monitoring component that allows unauthenticated attackers to achieve remote code

Hackers Actively Exploit Critical Windows IKE Extension Remote Code Execution Flaw

CISA is warning that hackers are actively exploiting a critical remote code execution vulnerability in the Windows Internet Key Exchange Service Extensions component. The flaw, tracked as CVE-2026-33824, stems from a double free issue and allows unauthenticated attackers to execute code by sending specially crafted packets to unpatched systems over

Ransomware Gangs Now Weaponize Windows Task Host Privilege Escalation Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirms that ransomware gangs are now exploiting CVE-2025-60710, a high-severity Windows Task Host vulnerability. Task Host is a core Windows component that runs DLL-based processes in the background and ensures they close properly during shutdown to prevent data corruption. The flaw,

CISA Warns Medusa Ransomware Has Breached Over 500 Critical Infrastructure Targets

The Cybersecurity and Infrastructure Security Agency (CISA), in a joint advisory with the FBI and the Department of Health and Human Services, announces that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. The victims span multiple sectors, including Healthcare

Hackers Weaponize SharePoint Exploit Code Within Days of Release

A proof-of-concept exploit for a critical Microsoft SharePoint vulnerability is already being weaponized by attackers just days after its publication. Cybersecurity firm Rapid7 released the exploit code and a detailed technical writeup for CVE-2026-55040, which allows attackers to bypass authentication through the JWT token validation pipeline without requiring any prior

CISA Warns of Critical Progress LoadMaster Flaw Actively Exploited by Hackers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are actively exploiting a critical-severity command injection vulnerability in Progress Kemp LoadMaster. The flaw, tracked as CVE-2026-8037, allows unauthenticated attackers to execute arbitrary commands on unpatched appliances by exploiting unsanitized API inputs across multiple command endpoints. Nearly 300

CISA Mandates Federal Agencies Patch Actively Exploited Langflow AI Framework Flaw

CISA adds a critical vulnerability in the Langflow visual framework for building AI agents to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch their systems by Friday. Tracked as CVE-2026-0770, the flaw allows unauthenticated attackers to achieve remote code execution with root privileges through low-complexity attacks. Trend Micro

Check Point Rushes Patch for Actively Exploited SmartConsole Zero-Day

Check Point Software addresses a critical zero-day vulnerability in its SmartConsole admin panel that attackers actively exploit in the wild. Tracked as CVE-2026-16232, the authentication bypass flaw allows unauthenticated attackers to obtain login tokens and gain administrator privileges on vulnerable Security Management Servers. The vulnerability enables attackers to modify security

CISA Orders Federal Agencies to Patch Exploited Fortinet FortiSandbox Flaws by Sunday

CISA has ordered federal agencies to patch two critical vulnerabilities in Fortinet's FortiSandbox threat detection platform by Sunday, July 19. The flaws, tracked as CVE-2026-39808 and CVE-2026-25089, allow unauthenticated attackers to execute remote code through command injection attacks that require no user interaction. Both vulnerabilities have been added

CISA Urges Immediate Patching of Actively Exploited SharePoint Vulnerabilities

CISA warns that attackers are actively exploiting three serious vulnerabilities in Internet-exposed, on-premises Microsoft SharePoint Server instances. These flaws, tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, affect all supported self-hosted versions of SharePoint Server. Attackers use them to bypass authentication, execute remote code, and establish persistence on compromised systems. According to