Veeam KB4905 (published 25 August 2026) documents CVE-2026-65641: an unauthenticated network attacker can coerce SMB authentication from the Veeam ONE service account. Vendor severity Critical, CVSS 4.0 score 9.3 (vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L), reported via HackerOne. Affected: Veeam ONE 13.1.0.7034 and all earlier version 13 builds. Veeam states older 12.x builds are not affected. Fixed in Veeam ONE 13.1 Patch 0 (build 13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159). WA SOC shared advisory 20260828001 pointed operators at this class of issue. Patch promptly; Veeam notes attackers often reverse-engineer disclosed patches.
Gitea GHSA-rcr6-4jqh-j84m / CVE-2026-60004 (28 July 2026 advisory; CISA KEV 25 August 2026): diffpatch API can let a user with repository write access (including self-registered users on open instances) run commands as the Gitea service account. Affected 1.17 through versions before 1.27.1; patch to 1.27.1+. UPDATE 14 September 2026: The Hacker News cites Acronis Threat Research Unit attributing a China-linked cluster (moderate confidence) tracked as Red Heron that weaponised CVE-2026-60004 from ~29 July 2026, scanning 1,386 Gitea instances across seven countries (plus a 477-instance Taiwan dataset) and confirming compromises at 13 organisations in Canada (2), Argentina (1), Taiwan (4), the US (4), Qatar (1), and Sri Lanka (1). Campaign progressed from repository theft to credentials, persistence, and lateral movement (including root on a three-node Proxmox cluster). Tooling includes C++ Linux implant JITTERLY (30+ commands; overlaps AdaptixC2) and LD_PRELOAD rootkit SIXZUT. Primary remains Gitea advisory; secondary: THN / Acronis TRU reporting. Distinct from generic KEV listing alone.
Zoho ManageEngine security advisory for CVE-2026-74849 documents remote code execution in the ADSelfService Plus GINA client — the self-service password-reset / account-unlock portal shown on the Windows logon screen via an embedded (kiosk) browser. An unauthenticated attacker with access to the Windows logon screen may leverage the embedded browser to execute code as NT AUTHORITY\SYSTEM and fully compromise the host. Vendor severity High. Affected: builds 7000 and below. Fixed: build 7001 (fixed on 24 August 2026) by correcting error handling and hardening the embedded logon-screen browser; update via the service pack. Reported by Marouane Belabbassi and Amjad E Alhejaili via Zoho BugBounty. Industry wires (Cyber Security News 23 Sep 2026) cited a CVSS 9.8 figure. The vendor advisory page shows only severity High, but Zoho's own CVE record (Zohocorp as CNA, published 22 September 2026) scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No in-the-wild exploitation claimed in the vendor advisory. WASOC advisory 20260924001 (24 Sep 2026) lists CVE-2026-74849 as Critical CVSS 9.8 (versions 7000 and below) alongside Applications Manager CVE-2026-86708 and OpManager MSP CVE-2026-19599, and states no exploitation observed on WA Government networks at time of writing — WASOC’s 9.8 matches the score on Zoho’s CVE record. Primary: ManageEngine CVE-2026-74849 advisory; AU: WASOC 20260924001. Correction (23 Oct 2026): this card said the CVSS 9.8 figure was not the vendor's and recorded only the advisory page's High rating. Zoho's own CVE record for CVE-2026-74849 (Zohocorp as CNA, published 22 September 2026) scores it CVSS 3.1 9.8. (source: CVE-2026-74849 record (cve.org))
ManageEngine — CVE-2026-74849 ADSelfService Plus GINA client RCE
Unauthenticated remote code execution in JetBrains TeamCity On-Premises via the agent polling protocol. ASD's ACSC warned that the flaw is under active attack against TeamCity On-Premises servers in Australia, according to iTnews (25 Aug 2026). All On-Premises versions are affected. TeamCity Cloud is not. Patch to 2025.11.7 or 2026.1.3, or apply the vendor security patch plugin if you cannot upgrade. UPDATE 24 Sep 2026: BleepingComputer reports CISA updated the KEV entry for CVE-2026-63077 (already catalogued 5 Aug 2026) to flag ransomware-gang abuse — fourth TeamCity KEV item since Oct 2023 also tied to ransomware; Shadowserver ~160 internet-exposed unpatched hosts (down from ~700). Primary: ACSC alert, as reported by iTnews; wire: BleepingComputer 24 Sep. Correction (24 Oct 2026): the ACSC's exploitation warning is now attributed through iTnews's report, because the ACSC page cannot be read from this desk. (source: https://www.itnews.com.au/news/asd-warns-australian-teamcity-servers-under-attack-628400)
Zscaler's 24 August 2026 CVE record describes multiple Client Connector flaws that allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context. Zscaler scored it 9.1 (CVSS 3.1). The CNA points administrators to the 2026 Client Connector app release summary for fixed builds. Affected version strings in that record include Windows before 4.6.0.457 / 4.7.0.317 / 4.8.0.232 / 4.9.0.372, macOS before 4.5.2.312 / 4.7.0.292 / 4.8.0.191, Linux before 3.7.2.64 / 4.2.1.64, Android and ChromeOS before 4.2, and iOS before 4.5.1. Confirm the exact build from the vendor release summary before declaring a fleet patched. Zscaler's CVE records (24 Aug 2026) also cover CVE-2026-59564 (authentication bypass in Client Connector to Portal communications), CVE-2026-59567 (local privilege escalation) and CVE-2026-59565 (buffer overflow causing local and kernel denial of service on Windows). Not in CISA KEV at last check.
Oracle Critical Patch Update (January 2026) lists CVE-2026-21962 in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS. Supported affected versions: 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. NVD rates CVSS 10.0. Unauthenticated network access via HTTP. Apply the January 2026 CPU for the plug-in builds you run.
Unauthenticated OS command injection in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. NVD: crafted SMTP requests can run commands as the zimbra user. CERT Polska reported active exploitation. Patch to 10.1.20. UPDATE 30 Sep 2026: Microsoft Security Blog publishes tracking/hunting notes for unauthenticated command injection on internet-facing mail servers including this CVE. If you cannot upgrade, remove zimbra-snmp / disable snmp_notify and hunt per CERT Polska. UPDATE 1 Oct 2026 desk: Microsoft Security Blog (30 Sep) details post-exploitation observed between patch availability (Zimbra 10.1.20, 20 Jul 2026) and public disclosure (13 Aug 2026) — including Jul 28–Aug 7 out-of-band probes via collaborator/OAST domains, JSP web shells across Jetty/mailboxd paths, wget/curl payload fetch, cron/systemd/memfd persistence, mailbox/authentication-data collection, and privilege escalation abusing Zimbra sudo-authorized helpers (zmmailboxdmgr writable log → PAM symlink → pam_exec → passwordless sudo for the zimbra account). THN 30 Sep amplifies the same Microsoft research. Desk does not reproduce exploit construction. Hunt and contain per Microsoft + CERT Polska; patch remains 10.1.20; if upgrade delayed remove zimbra-snmp / disable snmp_notify.
Kaspersky ICS CERT (KLCERT-26-057): an unauthenticated attacker with network access to TrueConf Server on TCP 4307 can call an undocumented function and run an arbitrary script. Affects 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and earlier than 5.3. NVD CVSS 9.8. Related CVE-2026-72530 is a code-injection issue in the same product line. Patch to the fixed builds and do not expose 4307 to the internet.
Cloud Software Group bulletin CTX696939 (19 August 2026, Critical) covers an authentication bypass using an alternate path in customer-managed NetScaler ADC and NetScaler Gateway. CVSS v4.0 9.3. It applies when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server; on some later 14.1/13.1 builds only when a SAML action is also configured. Not Citrix-managed cloud. No workaround. Patch to 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP, as applicable. Secure Private Access Hybrid using customer-managed NetScaler also needs those builds. Updated 4 Sep 2026 (BleepingComputer, 4 September 11:25 pm Perth): BleepingComputer reports Previdian honeypot sensors saw requests matching a public PoC on 3 September from three source IPs geolocated to Australia, the United States and Germany — evidence of exploitation attempts, not confirmed successful compromise of production systems. The Centre for Cybersecurity Belgium also warned of exploitation attempts the same week. Citrix’s August bulletin had not yet flagged active exploitation. Updated 7 Sep 2026 (WA SOC): WA SOC advisory 20260907003 (7 September 2026, TLP:CLEAR) covers CVE-2026-19490 at CVSS 9.3 for the same build floors, and reports no exploitation on Western Australian Government networks at the time of writing. Distinct from CVE-2026-8452 on this desk. Updated 9 Sep 2026 (CISA): CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog on 9 September 2026 (due 12 September 2026 for FCEB under BOD 26-04, including forensic triage requirements). Patch floors unchanged: 14.1-73.32 / 13.1-63.21 and FIPS mates. Correction (26 Oct 2026): the BleepingComputer, WA SOC and CISA reports, all later than Citrix's 19 August bulletin, now carry Updated lines; the card date stays 19 August 2026. The WA SOC and CISA links now point to the addresses those pages have moved to. (source: Citrix; BleepingComputer; WA SOC; CISA)
Same CTX696939 bulletin: memory overflow that can cause unpredictable behaviour or denial of service when SIP ALG is enabled on a Large Scale NAT (LSN) group. CVSS v4.0 8.8. Customer-managed NetScaler ADC and Gateway only. No workaround. Same patched builds as CVE-2026-19490: 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP. Distinct from the earlier CVE-2026-8452 memory-overflow card.
CVE-2026-18556 and CVE-2026-18577 are authentication-bypass issues in N-able N-central that may allow unauthorised access through an alternate path. ASD's ACSC has observed targeting of the product in Australia. Affects current versions including 2026.3. Vendor Hotfix 2 (build 2026.3.1.10, 6 August 2026) supersedes Hotfix 1. Review whether the console needs to face the internet.
CISA added CVE-2026-64849 to KEV on 19 August 2026. MLflow contains an SSRF issue that can let attackers reach internal or cloud metadata services. The CVE record states the issue is fixed in 3.15.0. Do not expose MLflow tracking servers to untrusted networks.
