Latest vendor security incidents

Breach notices and SEC cyber filings for the vendors we track, newest first, followed by security flaws added to CISA's exploited list in the last 90 days.

Breach notices and SEC filings

1. Apr 27, 2026Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 01/13/2025, 10/21/2024.

   Source: California Attorney General

2. Mar 24, 2026Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

   Source: California Attorney General

3. Jan 30, 2026Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

   Source: California Attorney General

4. Jan 2, 2026Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

   Source: California Attorney General

5. Dec 18, 2025Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

   Source: California Attorney General

6. Dec 18, 2025Breach noticeVeradigm (Allscripts)

   Veradigm LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 12/15/2024.

   Source: California Attorney General

7. Dec 2, 2025Breach noticeVeradigm (Allscripts)

   Veradigm LLC filed a data breach notice with the Washington Attorney General. Cause listed: Unauthorized Access. Washington residents affected: 845.

   Source: Washington Attorney General (record) · all Washington notices

8. Nov 19, 2025Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

   Source: California Attorney General

9. Oct 31, 2025Breach noticeConduent

   Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024.

   Source: California Attorney General

10. Oct 24, 2025Breach noticeConduent

    Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

    Source: California Attorney General

11. Oct 24, 2025Breach noticeConduent

    Conduent Business Services LLC filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Ransomware. Washington residents affected: 786,927.

    Source: Washington Attorney General (record) · all Washington notices

12. Oct 15, 2025SEC cyber filingF5

    F5 filed a Form 8-K with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

13. Oct 8, 2025Breach noticeConduent

    Conduent Business Services, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/21/2024, 01/13/2025.

    Source: California Attorney General

14. Sep 22, 2025Breach noticeVeradigm (Allscripts)

    Veradigm LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 12/15/2025.

    Source: California Attorney General

15. Jul 25, 2025Breach noticeOracle Health (Cerner)

    Cerner Corporation filed a data breach notice with the California Attorney General. Breach date(s) listed: 01/22/2025.

    Source: California Attorney General

16. Jul 25, 2025Breach noticeOracle Health (Cerner)

    Cerner Corporation filed a data breach notice with the Washington Attorney General. Cause listed: Unauthorized Access. Washington residents affected: 69,238.

    Source: Washington Attorney General (record) · all Washington notices

17. Apr 14, 2025SEC cyber filingConduent

    Conduent filed a Form 8-K with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

18. Oct 23, 2024Breach noticeHenry Schein (Dentrix)

    Henry Schein, Inc. filed a data breach notice with the California Attorney General.

    Source: California Attorney General

19. Aug 3, 2024Breach noticeChange Healthcare (UnitedHealth Group)

    Change Healthcare Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 02/12/2024, 02/22/2024.

    Source: California Attorney General

20. Aug 3, 2024Breach noticeChange Healthcare (UnitedHealth Group)

    Change Healthcare Inc. filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Ransomware. Washington residents affected: 3,121,209.

    Source: Washington Attorney General (record) · all Washington notices

21. May 9, 2024Breach noticePaychex

    Paychex, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 03/22/2024.

    Source: California Attorney General

22. May 1, 2024SEC cyber filingDropbox

    Dropbox filed a Form 8-K with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

23. Apr 24, 2024SEC cyber filingChange Healthcare (UnitedHealth Group)

    UnitedHealth Group (parent company) filed a Form 8-K/A with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

24. Mar 8, 2024SEC cyber filingChange Healthcare (UnitedHealth Group)

    UnitedHealth Group (parent company) filed a Form 8-K/A with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

25. Mar 8, 2024SEC cyber filingMicrosoft (Microsoft 365, Windows)

    Microsoft filed a Form 8-K/A with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

26. Feb 22, 2024SEC cyber filingChange Healthcare (UnitedHealth Group)

    UnitedHealth Group (parent company) filed a Form 8-K with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

27. Jan 26, 2024Breach noticeHenry Schein (Dentrix)

    Henry Schein, Inc. filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Ransomware. Washington residents affected: 1,953.

    Source: Washington Attorney General (record) · all Washington notices

28. Jan 19, 2024SEC cyber filingMicrosoft (Microsoft 365, Windows)

    Microsoft filed a Form 8-K with the SEC under Item 1.05, which is used to report a material cybersecurity incident.

    Source: SEC EDGAR

29. Dec 6, 2023Breach noticeHenry Schein (Dentrix)

    Henry Schein, Inc. filed a data breach notice with the California Attorney General.

    Source: California Attorney General

30. Nov 9, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 05/27/2023.

    Source: California Attorney General

31. Nov 1, 2023Breach noticeOkta

    Okta, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 09/23/2023.

    Source: California Attorney General

32. Oct 4, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 05/27/2023, 05/31/2023.

    Source: California Attorney General

33. Oct 4, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services/Emerald Financial Services filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Malware. Washington residents affected: 15,776.

    Source: Washington Attorney General (record) · all Washington notices

34. Sep 19, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 05/27/2023, 05/31/2023.

    Source: California Attorney General

35. Aug 11, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 05/27/2023.

    Source: California Attorney General

36. Aug 11, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services, Inc. / Umpqua Bank filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Malware. Washington residents affected: 145,274.

    Source: Washington Attorney General (record) · all Washington notices

37. Jul 17, 2023Breach noticeFIS (Fidelity National Information Services)

    Fidelity National Information Services, Inc. / Sound Community Bank filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Ransomware. Washington residents affected: 13,795.

    Source: Washington Attorney General (record) · all Washington notices

38. May 17, 2023Breach noticeGoDaddy

    GoDaddy.com LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/16/2019.

    Source: California Attorney General

39. May 5, 2023Breach noticeNextGen Healthcare

    NextGen Healthcare, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 03/29/2023, 04/14/2023.

    Source: California Attorney General

40. May 3, 2023Breach noticeNextGen Healthcare

    NextGen Healthcare, Inc. filed a data breach notice with the Washington Attorney General. Cause listed: Unauthorized Access. Washington residents affected: 21,981.

    Source: Washington Attorney General (record) · all Washington notices

41. Jan 18, 2023Breach noticePayPal

    PayPal, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 12/06/2022.

    Source: California Attorney General

42. Jan 18, 2023Breach noticePayPal

    PayPal, Inc. filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Other. Washington residents affected: 890.

    Source: Washington Attorney General (record) · all Washington notices

43. Nov 23, 2021Breach noticeGoDaddy

    GoDaddy.com, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 09/06/2021, 09/07/2021, 09/08/2021, 09/09/2021, 09/10/2021, 09/11/2021, 11/07/2021.

    Source: California Attorney General

44. Nov 23, 2021Breach noticeGoDaddy

    GoDaddy.com, LLC filed a data breach notice with the Washington Attorney General. Cause listed: Cyberattack: Malware. Washington residents affected: 9,581.

    Source: Washington Attorney General (record) · all Washington notices

45. May 3, 2020Breach noticeGoDaddy

    GoDaddy.com LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/19/2019.

    Source: California Attorney General

46. Apr 29, 2019Breach noticeCitrix

    Citrix Systems, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 10/13/2018.

    Source: California Attorney General

47. Nov 27, 2018Breach noticePaylocity

    Paylocity Corporation filed a data breach notice with the California Attorney General. Breach date(s) listed: 11/01/2018.

    Source: California Attorney General

48. Mar 26, 2018Breach noticePaycor

    Paycor, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 02/16/2018.

    Source: California Attorney General

49. Feb 21, 2018Breach noticeSolera (DealerSocket)

    Solera Holdings, Inc. filed a data breach notice with the California Attorney General.

    Source: California Attorney General

50. Jun 29, 2017Breach noticeGoogle (Workspace, Chrome, Android)

    Google Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 08/10/2016, 03/09/2017.

    Source: California Attorney General

51. Oct 25, 2016Breach noticeCisco

    Cisco Systems, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 08/18/2016.

    Source: California Attorney General

52. May 6, 2016Breach noticeGoogle (Workspace, Chrome, Android)

    Google Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 03/29/2016.

    Source: California Attorney General

53. Jun 8, 2015Breach noticeADP

    ADP, LLC filed a data breach notice with the California Attorney General. Breach date(s) listed: 04/07/2015, 05/18/2015.

    Source: California Attorney General

54. May 28, 2015Breach noticeHeartland Payroll Solutions

    Heartland Payroll Solutions, Inc. filed a data breach notice with the California Attorney General. Breach date(s) listed: 02/22/2015.

    Source: California Attorney General

55. Apr 6, 2015Breach noticeIntuit (QuickBooks, TurboTax, Mailchimp)

    Intuit filed a data breach notice with the California Attorney General. Breach date(s) listed: 02/01/2014, 02/27/2015.

    Source: California Attorney General

56. Oct 3, 2013Breach noticeAdobe

    Adobe Systems Incorporated filed a data breach notice with the California Attorney General. Breach date(s) listed: 09/11/2013, 09/12/2013, 09/13/2013, 09/14/2013, 09/15/2013, 09/16/2013, 09/17/2013.

    Source: California Attorney General

57. Jun 5, 2013Breach noticeADP

    ADP filed a data breach notice with the California Attorney General.

    Source: California Attorney General

58. Jul 3, 2012Breach noticeGlobal Payments (Heartland)

    Global Payments Inc. filed a data breach notice with the California Attorney General.

    Source: California Attorney General

59. May 11, 2012Breach noticeFiserv (Clover, First Data)

    First Data filed a data breach notice with the California Attorney General.

    Source: California Attorney General

Actively exploited security flaws, last 90 days

1. Oct 16, 2026Exploited flawFortinet

   Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Oct 16, 2026Exploited flawBeyondTrust

   BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Oct 15, 2026Exploited flawAtlassian (Jira, Confluence)

   Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Oct 14, 2026Exploited flawPalo Alto Networks

   Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

5. Oct 14, 2026Exploited flawCisco

   Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Oct 13, 2026Exploited flawIvanti

   Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

7. Oct 13, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

   Microsoft Windows Command Injection Vulnerability (CVE-2026-96951). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

8. Oct 4, 2026Exploited flawCitrix

   Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

9. Oct 1, 2026Exploited flawFortinet

   Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

10. Sep 30, 2026Exploited flawCisco

    Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (CVE-2026-76504). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

11. Sep 29, 2026Exploited flawApple

    Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

12. Sep 27, 2026Exploited flawCitrix

    Citrix NetScaler Improper Input Validation Vulnerability (CVE-2026-88771). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

13. Sep 27, 2026Exploited flawCitrix

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88772). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

14. Sep 25, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft SharePoint Code Injection Vulnerability (CVE-2026-65660). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

15. Sep 25, 2026Exploited flawMikroTik

    Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVE-2026-67279). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

16. Sep 25, 2026Exploited flawWordPress

    WordPress Core Remote File Inclusion Vulnerability (CVE-2026-87902). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

17. Sep 24, 2026Exploited flawAdobe

    Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVE-2026-71362). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

18. Sep 22, 2026Exploited flawCheck Point

    Check Point Multiple Products Improper Certificate Validation Vulnerability (CVE-2026-85102). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

19. Sep 22, 2026Exploited flawCheck Point

    Check Point Multiple Products Path Traversal Vulnerability (CVE-2026-93616). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

20. Sep 22, 2026Exploited flawF5

    F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (CVE-2026-94127). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

21. Sep 21, 2026Exploited flawZyxel

    Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (CVE-2026-7273). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

22. Sep 16, 2026Exploited flawGoogle (Workspace, Chrome, Android)

    Google Pixel Improper Authorization Vulnerability (CVE-2026-58704). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

23. Sep 16, 2026Exploited flawCisco

    Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (CVE-2026-76460). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

24. Sep 16, 2026Exploited flawAcronis

    Acronis Backup Incorrect Default Permissions Vulnerability (CVE-2026-87886). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

25. Sep 14, 2026Exploited flawCisco

    Cisco Secure Email Gateway SQL Injection Vulnerability (CVE-2026-76461). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

26. Sep 11, 2026Exploited flawConnectWise

    ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability (CVE-2026-84869). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

27. Sep 10, 2026Exploited flawMikroTik

    MikroTik RouterOS Missing Authentication for Critical Function Vulnerability (CVE-2026-67277). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

28. Sep 10, 2026Exploited flawMikroTik

    MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability (CVE-2026-86060). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

29. Sep 9, 2026Exploited flawFortinet

    Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (CVE-2025-25249). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

30. Sep 9, 2026Exploited flawCitrix

    Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-19490). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

31. Sep 9, 2026Exploited flawCisco

    Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-20079). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

32. Sep 9, 2026Exploited flawGoogle (Workspace, Chrome, Android)

    Google Chromium V8 Out of Bounds Write Vulnerability (CVE-2026-87491). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

33. Sep 8, 2026Exploited flawAdobe

    Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2026-75650). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

34. Sep 8, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft Windows Link Following Vulnerability (CVE-2026-81963). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

35. Sep 8, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft Windows Heap-Based Buffer Overflow Vulnerability (CVE-2026-85880). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

36. Sep 8, 2026Exploited flawN-able

    N-able N-central Static Code Injection Vulnerability (CVE-2026-86218). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

37. Sep 4, 2026Exploited flawGoogle (Workspace, Chrome, Android)

    Google Chromium V8 Type Confusion Vulnerability (CVE-2026-85046). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

38. Sep 2, 2026Exploited flawSonicWall

    SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (CVE-2026-83548). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

39. Sep 2, 2026Exploited flawSonicWall

    SonicWall SMA1000 Appliances OS Command Injection Vulnerability (CVE-2026-83549). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

40. Sep 2, 2026Exploited flawSangoma (FreePBX)

    Sangoma Switchvox SQL Injection Vulnerability (CVE-2026-9586). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

41. Aug 31, 2026Exploited flawPaperCut

    PaperCut NG/MF Missing Authentication for Critical Function Vulnerability (CVE-2026-81578). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

42. Aug 31, 2026Exploited flawPaperCut

    PaperCut NG/MF Unsafe Reflection Vulnerability (CVE-2026-82078). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

43. Aug 26, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft SQL Server Remote Code Execution Vulnerability (CVE-2019-1068). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

44. Aug 26, 2026Exploited flawCitrix

    Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-8452). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

45. Aug 24, 2026Exploited flawOracle

    Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (CVE-2026-21962). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

46. Aug 21, 2026Exploited flawZimbra (Synacor)

    Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CVE-2026-73570). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

47. Aug 18, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability (CVE-2026-33824). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

48. Aug 18, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

49. Aug 18, 2026Exploited flawVMware (Broadcom)

    Broadcom VMware vCenter Path Traversal Vulnerability (CVE-2026-59310). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

50. Aug 18, 2026Exploited flawApple

    Apple macOS Improper Authentication Vulnerability (CVE-2026-65400). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

51. Aug 11, 2026Exploited flawCisco

    Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability (CVE-2026-20349). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

52. Aug 11, 2026Exploited flawMicrosoft (Microsoft 365, Windows)

    Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (CVE-2026-68820). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

53. Aug 7, 2026Exploited flawProgress Software (MOVEit, WS_FTP)

    Progress LoadMaster Command Injection Vulnerability (CVE-2026-8037). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

54. Aug 4, 2026Exploited flawN-able

    N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-18556). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

55. Aug 3, 2026Exploited flawN-able

    N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-18577). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

56. Jul 29, 2026Exploited flawCisco

    Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (CVE-2026-20316). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

Data checked Oct 26, 2026.