InfoSecBulletin Cybersecurity for mankind
Cybersecurity and Infrastructure Security Agency (CISA) have added to its Known Exploited Vulnerabilities (KEV) Catalog. They included two serious flaws that cybercriminals are using. These flaws are a dangerous remote code execution (RCE) issue in Microsoft SharePoint and a stored cross-site scripting (XSS) problem in Zimbra Collaboration Suite. This shows the ongoing danger to both government and private businesses.
The worst of the two, CVE-2026-20963, is a serious security issue in Microsoft SharePoint. It has a CVSS score of 9.8. This problem comes from “deserialization of untrusted data,” a common weakness that lets an attacker run code over a network without any login details.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
In a typical network-based attack, a malicious actor could “write arbitrary code to inject and execute code remotely on the SharePoint Server”. Microsoft fixed this issue during its January Patch Tuesday. The bug moving to the KEV catalog means that hackers are still finding and attacking servers that have not been fixed.
The second addition, CVE-2025-66376, affects the Synacor Zimbra Collaboration Suite (ZCS). This weakness lets attackers perform “Classic UI stored XSS through CSS @import commands in an HTML email.”
An attacker can create a special email that has harmful styles. When the email is opened, these styles can make scripts run in the victim’s browser. This affects ZCS version 10 (before 10.0.18) and version 10.1 (before 10.1.13).
These vulnerabilities are common targets for hackers and can be very risky. The CISA rules mainly apply to federal agencies, but the KEV list is important for security teams all around. If CISA warns it’s being used in attacks, your organization is probably in danger if you haven’t made updates.
