InfoSecBulletin Cybersecurity for mankind
Cybersecurity and Infrastructure Security Agency (CISA) have added to its Known Exploited Vulnerabilities (KEV) Catalog. They included two serious flaws that cybercriminals are using. These flaws are a dangerous remote code execution (RCE) issue in Microsoft SharePoint and a stored cross-site scripting (XSS) problem in Zimbra Collaboration Suite. This shows the ongoing danger to both government and private businesses.
The worst of the two, CVE-2026-20963, is a serious security issue in Microsoft SharePoint. It has a CVSS score of 9.8. This problem comes from “deserialization of untrusted data,” a common weakness that lets an attacker run code over a network without any login details.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
In a typical network-based attack, a malicious actor could “write arbitrary code to inject and execute code remotely on the SharePoint Server”. Microsoft fixed this issue during its January Patch Tuesday. The bug moving to the KEV catalog means that hackers are still finding and attacking servers that have not been fixed.
The second addition, CVE-2025-66376, affects the Synacor Zimbra Collaboration Suite (ZCS). This weakness lets attackers perform “Classic UI stored XSS through CSS @import commands in an HTML email.”
An attacker can create a special email that has harmful styles. When the email is opened, these styles can make scripts run in the victim’s browser. This affects ZCS version 10 (before 10.0.18) and version 10.1 (before 10.1.13).
These vulnerabilities are common targets for hackers and can be very risky. The CISA rules mainly apply to federal agencies, but the KEV list is important for security teams all around. If CISA warns it’s being used in attacks, your organization is probably in danger if you haven’t made updates.
