
Cisco Email Gateway CVE-2026-76461: Root RCE Patch
CVE-2026-76461 (CVSS 9.8) in Cisco AsyncOS lets any attacker root the Secure Email Gateway by sending a crafted email. No workarounds. CISA September 17 deadline.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Win an All Access InfoSec World 2026 pass, valued at $3,895.
Win a $3,895 InfoSec World 2026 pass.
21 results tagged zero-day

CVE-2026-76461 (CVSS 9.8) in Cisco AsyncOS lets any attacker root the Secure Email Gateway by sending a crafted email. No workarounds. CISA September 17 deadline.

Adobe Acrobat Reader CVE-2026-34621: prototype pollution zero-day exploited by APT for 5 months before emergency patch APSB26-43.

April 2026 Patch Tuesday is the second-largest in Microsoft's history: 167 CVEs, 2 zero-days, and an Adobe Acrobat Reader flaw actively exploited by an APT-linked actor since at least November 2025. CVE-2026-34621 and CVE-2026-32201 are on CISA's KEV catalog today. BlueHammer (CVE-2026-33825) had a working public PoC before the patch. Here's the full priority triage, attack chain details, and a six-step action list.

Google shipped an emergency patch for CVE-2026-5281, a use-after-free in Chrome's Dawn/WebGPU component confirmed exploited in the wild. CISA added it to KEV the next day with an April 15 deadline. Here's what happened, why renderer-compromise-required is not reassuring, and what your fleet needs right now.

CVE-2025-0282 is a critical stack-based buffer overflow in Ivanti Connect Secure (versions before 22.7R2.5), Policy Secure, and Neurons for ZTA Gateways, disclosed January 2025. Exploited as a zero-day by UNC5337 (linked to the 2024 ArcaneDoor actor UNC5221), the flaw allows unauthenticated remote code execution on the VPN gateway. Mandiant confirmed exploitation in the wild beginning mid-December 2024. CVSS 9.0.

CVE-2024-47575 is a CVSS 9.8 missing authentication vulnerability in Fortinet FortiManager (FortiManager Cloud also affected) that allows an unauthenticated remote attacker to execute arbitrary code or commands via specially crafted requests to the FGFM (FortiGate to FortiManager) daemon. Dubbed 'FortiJump' by Mandiant. Exploited as a zero-day by UNC5820, a suspected Chinese state-sponsored actor, targeting managed service providers and enterprise FortiManager deployments. CISA added it to the KEV catalog on October 23, 2024.

CVE-2024-20353 and CVE-2024-20359 are two Cisco ASA and FTD zero-day vulnerabilities exploited in the ArcaneDoor espionage campaign by a suspected Chinese state-sponsored actor. The flaws enabled persistent backdoor implants (Line Dancer and Line Runner) on perimeter VPN devices protecting government and critical infrastructure networks across multiple countries. First exploitation observed in November 2023, five months before public disclosure.

CVE-2024-3400 is a CVSS 10.0 OS command injection in Palo Alto Networks PAN-OS affecting devices with the GlobalProtect gateway or portal enabled. An unauthenticated attacker sends a crafted HTTP request with a malicious SESSID cookie value, achieving root-level remote code execution. Discovered and disclosed April 12, 2024, it was being actively exploited as a zero-day by a state-sponsored threat actor (UTA0218) since at least March 26, 2024.

CVE-2023-46805 is an authentication bypass (CVSS 8.2) in Ivanti Connect Secure and Policy Secure. Chained with CVE-2024-21887, a command injection (CVSS 9.1), it produces unauthenticated remote code execution on the VPN gateway. Exploited as a zero-day by suspected Chinese state-sponsored actor UNC5221 for at least two weeks before disclosure. CISA issued Emergency Directive 24-01 ordering federal agencies to disconnect or mitigate within 48 hours. Over 2,100 devices were compromised globally before patches were available.

CVE-2023-20198 is a critical unauthenticated privilege escalation vulnerability in Cisco IOS XE software's web UI feature. Exploited as a zero-day before Cisco published any advisory, attackers used it to create administrator accounts and then chained it with CVE-2023-20273 to deploy a persistent Lua-based implant on over 50,000 network devices. No authentication or user interaction required.

CVE-2023-4966, named Citrix Bleed, is a buffer over-read vulnerability in Citrix NetScaler ADC and Gateway that leaks memory contents, including active user session tokens, via unauthenticated HTTP requests. Stolen tokens bypass MFA because they represent already-authenticated sessions. Exploited as a zero-day by LockBit ransomware against Boeing, Comcast Xfinity, and others.

CVE-2023-22515 is a maximum-severity broken access control vulnerability in Atlassian Confluence Data Center and Server. An unauthenticated external attacker can reach Confluence's setup endpoint on a fully configured instance and create a new administrator account, gaining complete control without credentials. Microsoft attributed active exploitation to Storm-0062 (a Chinese state-sponsored threat actor) beginning September 14, 2023, three weeks before Atlassian's advisory.

CVE-2023-3519 is a CVSS 9.8 unauthenticated remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway (formerly Citrix ADC / Citrix Gateway). Exploited as a zero-day before any patch was available, it was used to compromise a US critical infrastructure organization. After patches were released, mass exploitation resulted in over 2,000 backdoored appliances within days. Requires the device to be configured as a Gateway or AAA virtual server.

CVE-2023-36884 is a remote code execution vulnerability in Windows Search and Microsoft Office exploited as a zero-day by Russian-nexus group Storm-0978 (RomCom) during the July 2023 NATO summit. Malicious Office documents triggered the flaw without macros or Protected View bypass, targeting NATO member governments. Microsoft disclosed it without a same-day patch, the fix arrived a month later.

CVE-2023-27997 is a pre-authentication heap buffer overflow in the Fortinet FortiOS SSL-VPN component enabling unauthenticated remote code execution on FortiGate VPN appliances. Exploited as a zero-day before Fortinet's June 2023 advisory, it affects FortiOS 6.0 through 7.2.4 with SSL-VPN enabled. CISA linked related Fortinet exploitation to Chinese state-sponsored actor Volt Typhoon targeting US critical infrastructure.

CVE-2023-28252 is a zero-day elevation of privilege vulnerability in the Windows Common Log File System (CLFS) kernel driver. A low-privileged attacker exploits a flaw in CLFS log file parsing to escalate to SYSTEM privileges. Discovered being actively used by the Nokoyawa ransomware gang as part of their pre-ransomware deployment privilege escalation chain. Patched on April 11, 2023 Patch Tuesday as a zero-day. CVSS 7.8.

CVE-2023-0669 is a pre-authentication remote code execution vulnerability in Fortra GoAnywhere MFT (Managed File Transfer). The Cl0p ransomware group exploited it as a zero-day for approximately 10 days before any advisory was published, claiming over 130 victim organisations. The vulnerability allows unauthenticated attackers to execute commands on the GoAnywhere server via a Java deserialization attack against the administrative console. Affected versions: GoAnywhere MFT prior to 7.1.2.

CVE-2022-41040 and CVE-2022-41082, collectively called ProxyNotShell, are chained vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040 is a server-side request forgery flaw that, when chained with CVE-2022-41082, enables an authenticated attacker to achieve remote code execution. Both were exploited in the wild before Microsoft released patches.

CVE-2022-3236 is a critical code injection vulnerability in the User Portal and Webadmin interfaces of Sophos Firewall versions 19.5 MR3 and older. Exploited as a zero-day by a Chinese APT (Storm Cloud / Volt Typhoon cluster), the flaw enabled unauthenticated root-level code execution on internet-facing firewall appliances. Sophos delivered an automatic hotfix but it required manual intervention on restricted networks, leaving many deployments exposed.

CVE-2022-26134 is a critical OGNL injection vulnerability in Atlassian Confluence Server and Data Center, enabling unauthenticated remote code execution. Disclosed as a zero-day on June 2, 2022 with active exploitation already confirmed, this vulnerability scores 10.0 CVSS. Within hours of technical details becoming public, mass scanning and exploitation began across the internet.

CVE-2021-40444 is a remote code execution vulnerability in the MSHTML (Trident) browser engine built into Windows. A malicious Office document embedding a specially crafted ActiveX control causes MSHTML to download and execute a malicious DLL from an attacker-controlled server. No macros are used. No Enable Content prompt appears. The exploit was used in targeted attacks before Microsoft patched it.