Alert

Fortinet has released a critical security advisory urging administrators to promptly update FortiClientEMS, its central management tool for endpoint protection. A vulnerability, CVE-2026-21643, has a CVSSv3 score of 9.1 and may enable remote attackers to run unauthorized code on affected servers. The flaw is categorized as an SQL Injection (SQLi) …

Researchers have discovered a large botnet made up of compromised devices that has infiltrated networks worldwide, including sensitive government systems. A report from Silent Push has identified over 10,000 unique IP addresses infected with SystemBC, a proxy malware used by cybercriminals to conceal their actions and deploy ransomware. The discovery …

F5 Networks has issued its Quarterly Security Notification, highlighting several vulnerabilities that may severely impact enterprise infrastructures. F5 rates these flaws as “Medium” severity, but the CVSS v4.0 framework scores the most critical issues at 8.2 (High), indicating serious risks for production environments using BIG-IP, NGINX, and similar components. High-Risk …

CISA announced on Tuesday that a security flaw in SolarWinds Web Help Desk is now listed in its Known Exploited Vulnerabilities catalog, indicating it is actively being targeted in attacks. The vulnerability, CVE-2025-40551 (CVSS score: 9.8), allows untrusted data deserialization that could enable remote code execution. Web Help Desk is …

A serious security flaw in WinRAR, a popular file compression tool for Windows, is being exploited by attackers to gain unauthorized access to systems. CVE-2025-8088 is a vulnerability that lets attackers insert harmful files into sensitive system folders unnoticed, giving them control over Windows computers. The security flaw was first …

Fortinet has revealed a critical vulnerability affecting its products. The company issued a Public Advisory on January 27 after noticing initial attacks on January 23, when it disabled two malicious accounts exploiting the single sign-on feature in FortiOS. In December 2025, an advisory was issued about two previous SSO bypass …

Microsoft has issued emergency security updates to fix a critical zero-day vulnerability in Microsoft Office that has been actively exploited. The vulnerability, CVE-2026-21509, affects several Office versions: Microsoft Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise (the company’s cloud-based subscription service). “Reliance on untrusted inputs …

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a serious security flaw in Broadcom VMware vCenter Server to its Known Exploited Vulnerabilities catalog on Friday, noting it was actively being exploited despite a patch released in June 2024. CVE-2024-37079 (CVSS score: 9.8) is a vulnerability related to a heap …

Cisco revealed a zero-day RCE vulnerability, CVE-2026-20045, that is being actively exploited. The vulnerability in key Unified Communications products lets unauthenticated attackers execute arbitrary commands on the OS, risking root access. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability …

Fortinet customers are observing attackers exploiting a patch bypass for a previously fixed critical FortiGate authentication vulnerability (CVE-2025-59718) to hack patched firewalls. One affected admins said that Fortinet has allegedly confirmed that the latest FortiOS version (7.4.10) didn’t fully address this authentication bypass vulnerability, which should’ve been patched in early …