What you need to know today.

Microsoft Exchange Server remains a prime target, with multiple critical remote code execution vulnerabilities (CVE-2021-26855, CVE-2021-42321, CVE-2023-21529) added to the Known Exploited Vulnerabilities catalog. These flaws, some dating back to 2021, allow attackers to gain control of affected servers. The ongoing exploitation highlights the persistent risk associated with unpatched Exchange environments. As The Hacker News and Securelist report, these vulnerabilities are being leveraged in campaigns like StrikeShark to deploy Cobalt Strike. Other Microsoft products are also affected, including Internet Explorer (CVE-2021-26411, CVE-2021-27085) and Active Directory Domain Services (CVE-2021-42287, CVE-2021-42278), with privilege escalation and RCE capabilities.

Cisco has released patches for several critical vulnerabilities in its Crosswork and Secure Workload products. These flaws, including CVE-2026-20030, CVE-2026-20317, CVE-2026-20357, and CVE-2026-20358, could allow for remote code execution. While the provided details are sparse, Cisco's proactive security review indicates a potential for significant impact if exploited. SecurityWeek covered these advisories, emphasizing the importance of applying the latest software hardening releases.

Several critical vulnerabilities have been disclosed in Microsoft products, including a remote code execution flaw in Microsoft Word (CVE-2023-21716) and two in the Protected Extensible Authentication Protocol (PEAP) (CVE-2023-21690, CVE-2023-21689). Additionally, a critical vulnerability in the Windows Common Log File System driver (CVE-2023-23376) allows for elevation of privilege. These vulnerabilities, despite varying exploitation risk scores, represent significant threats due to their critical severity and potential for widespread impact across Microsoft's user base.

A critical vulnerability in Joomla Extension's yootheme.com component (CVE-2026-74803) allows unauthenticated arbitrary file uploads. This occurs when the image element accepts files within the image MIME group, regardless of the client-supplied Content-Type. This flaw, affecting versions prior to 4.1.64, could enable attackers to upload malicious files and gain a foothold in affected systems.

Critical vulnerabilities have been identified in Ozols Grupa OZOLS software (CVE-2026-22306) on Windows. These issues stem from a combination of factors including abandoned auto-update mechanisms, lack of integrity checks during code downloads, inclusion of untrusted code, and cleartext transmission of sensitive information. The specific impact and exploitability remain under investigation, but the combination of flaws suggests a high risk to systems utilizing this software.