KEV Adds SonicWall, GitLab; Critical Flaws Hit Check Point, Palo Alto

A critical deserialization vulnerability in SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This pre-authentication flaw, tracked as CVE-2025-23006, could allow a remote attacker to execute arbitrary code under specific conditions. The vulnerability affects SMA1000 versions prior to the latest patches. As noted by Tenable, this zero-day has already been observed in the wild, underscoring the urgency for affected organizations to apply security updates.

GitLab has released patches for a critical path traversal vulnerability, CVE-2026-85706, affecting multiple versions of GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows an unauthenticated user to read arbitrary files on the server, potentially leading to the disclosure of sensitive information or credentials. The vulnerability has been actively exploited in the wild, with CyberScoop reporting widespread probes shortly after its disclosure. Patches are available for versions 18.11.12, 19.0.9, 19.1.8, 19.2.6, and 19.3.2 and later.

Check Point has addressed a critical vulnerability, CVE-2026-85102, in its Quantum Security Gateway that allows an unauthenticated remote attacker to execute arbitrary code. The flaw stems from improper certificate trust validation during VPN negotiation. This vulnerability has been exploited in targeted attacks, prompting warnings from multiple sources including Cyber Security News and The Hacker News. Check Point has released security updates to mitigate this risk.

A critical authentication bypass vulnerability in Palo Alto Networks PAN-OS, CVE-2025-0108, has been added to the CISA KEV catalog. This flaw enables an unauthenticated attacker with network access to the management web interface to bypass authentication mechanisms. While details on exploitation are scarce, its inclusion in the KEV catalog signifies a significant threat to organizations utilizing PAN-OS.

Multiple critical vulnerabilities have been disclosed in Adobe Campaign Classic (ACC), including several instances of code injection and an incorrect authorization flaw. These vulnerabilities, such as CVE-2026-89275 and CVE-2026-73369, could allow an attacker to execute arbitrary code in the context of the current user. Vypr Intelligence reported on 17 critical vulnerabilities affecting ACC, highlighting the broad attack surface presented by this product.

CVE-2024-48248, a high-severity absolute path traversal vulnerability in NAKIVO Backup & Replication, has been added to the CISA KEV. This flaw, present in versions prior to 11.0.0.88174, can lead to remote code execution due to the cleartext credentials exposed through the vulnerability. The ability to read files via the getImageByPath function to /c/router poses a significant risk to enterprise data protection infrastructure.

A critical vulnerability in Craft CMS, CVE-2025-32432, allows remote attackers to perform unspecified actions. Affecting versions from 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, this flaw has been added to the CISA KEV catalog, indicating active exploitation and a high risk to organizations using the platform.

A high-severity vulnerability in tj-actions changed-files, CVE-2025-30066, allows remote attackers to discover secrets by reading action logs. This issue affected versions up to v45.0.7 and was exploited by a threat actor to modify logs. The vulnerability has been added to the CISA KEV catalog, emphasizing the risk to CI/CD pipelines and the sensitive information they may handle.

Google Chrome versions prior to 138.0.7204.157 contain a high-severity sandbox escape vulnerability, CVE-2025-6558, affecting ANGLE and GPU components. A remote attacker could exploit this via a crafted HTML page to break out of the browser sandbox. While not yet on the KEV, the widespread use of Chrome makes this a significant concern.

Cisco iOS versions 12.4 on the 871 Integrated Services Router are affected by multiple cross-site request forgery (CSRF) vulnerabilities, CVE-2008-4128. These flaws in the HTTP Administration component could allow remote attackers to execute arbitrary commands by tricking users into clicking malicious links. This vulnerability has been added to the CISA KEV catalog.

Microsoft Management Console (MMC) has a local security feature bypass vulnerability, CVE-2025-26633, that could be exploited by an unauthorized attacker. While this vulnerability requires local access, its inclusion in the KEV catalog suggests it may be leveraged in conjunction with other exploits or in specific insider threat scenarios.

Zoho ManageEngine Applications Manager versions 182200 and below are vulnerable to the exposure of a Google Cloud service-account private key within the installer. This critical vulnerability, CVE-2026-86708, could allow an unauthenticated attacker to impersonate legitimate services and gain unauthorized access to cloud resources.

Netcore NBR200V2 1.3.241127.071246 contains a vulnerability in its CGI Diagnostic Endpoint component, CVE-2026-94097. Manipulation of arguments within the /www/cgi-bin/network_tools endpoint can lead to command injection, allowing a remote attacker to execute arbitrary commands on the affected device.

Active! mail 6 and earlier versions are affected by a stack-based buffer overflow vulnerability, CVE-2025-42599. A remote, unauthenticated attacker could exploit this by sending a specially crafted request, potentially leading to arbitrary code execution and denial-of-service conditions. This critical vulnerability has been added to the CISA KEV catalog.