What you need to know today.

A critical command injection vulnerability in Progress ADC Products, specifically the LoadMaster appliance, is being actively exploited. This flaw allows unauthenticated attackers to execute arbitrary commands by exploiting unsanitized input in various command endpoints. The vulnerability, tracked as CVE-2026-8037, has a CVSS score of 9.6 and is a significant concern for organizations relying on Progress ADC for network load balancing and application delivery. The vendor has released patches, and users are urged to update immediately to mitigate the risk of remote code execution and potential system compromise.

Cisco Secure Email Gateway is facing active exploitation of a critical vulnerability that allows unauthenticated, remote attackers to write arbitrary files to the underlying operating system. This flaw, CVE-2026-76519, stems from an issue within the Advanced Malware Protection (AMP) feature. The exploitability of this vulnerability has led to its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog. Cisco has issued a warning and provided a patch, emphasizing the urgency for customers to apply the update to prevent unauthorized file system access and potential system takeover. The Hacker News reported, SecurityWeek noted, and Cyber Security News highlighted the active exploitation.

Microsoft has addressed a critical Windows Shell vulnerability, CVE-2026-96951, which was being actively exploited in the wild. This command injection flaw allows unauthorized attackers to bypass security features over a network. The vulnerability was part of Microsoft's record-breaking October Patch Tuesday, which included over 1,400 CVEs. Its inclusion in the CISA KEV catalog underscores the immediate threat it posed. Organizations are strongly advised to apply the latest Windows updates to protect against potential exploitation, which could lead to unauthorized command execution and system compromise. Multiple outlets, including CyberScoop, The Record, and Malwarebytes Labs, covered this critical update.

A critical OS command injection vulnerability in AhsayCBS, up to version 10.3.2, has been actively exploited, leading to the deployment of web shells and cryptocurrency miners. Tracked as CVE-2026-105134, the flaw resides in the Replication Receiver component and can be triggered by manipulating an argument in the UpdateReceivers.do file. This vulnerability has been added to the CISA KEV catalog due to its active exploitation. While initial patches were incomplete, updated fixes are now available. Users of AhsayCBS are urged to apply these patches immediately to prevent further compromise. The Hacker News and SecurityWeek provided detailed coverage.

A critical vulnerability in the Nrwl Nx Console, specifically version 18.95.0, allowed for the distribution of a malicious version for approximately 18 minutes before being removed. Tracked as CVE-2026-48027, this critical flaw had a CVSS score of 9.8 and was present in the Visual Studio Marketplace. While the exact impact is not fully detailed, the short window of availability for a malicious package raises concerns about potential infections. Users who may have downloaded the affected version are advised to investigate their systems.

Several critical vulnerabilities have been disclosed across various D-Link, Wavlink, Edimax, Linksys, and Trendnet devices, primarily involving OS command injection. These flaws, including CVE-2026-110536, CVE-2026-109110, CVE-2026-108918, CVE-2026-108896, CVE-2026-108894, CVE-2026-108892, and CVE-2026-108804, affect the web management interfaces and CGI handlers of these routers and network devices. Attackers can exploit these vulnerabilities remotely by manipulating specific arguments, leading to command injection and potential system compromise. Users of these affected devices should check for firmware updates from their respective vendors.

Adobe Experience Manager is affected by critical Incorrect Authorization vulnerabilities, CVE-2026-48383 and CVE-2026-48382, which could allow for arbitrary code execution in the context of the current user. This could lead to elevated access or control over a victim's account or system. Additionally, Adobe Commerce is vulnerable to an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, CVE-2026-103849, also potentially resulting in arbitrary code execution. Users of these Adobe products should apply available patches to mitigate these risks.

OpenBSD's ssh-agent component in OpenSSH versions prior to 9.3p2 contains a critical vulnerability, CVE-2023-38408, related to an insufficiently trustworthy search path in its PKCS#11 feature. This flaw could lead to remote code execution if an agent is forwarded to an attacker-controlled system. While this CVE is from a previous year, its inclusion in this window highlights ongoing concerns with SSH security. Users are advised to update to OpenSSH 9.3p2 or later to address this risk.

A critical vulnerability in Barracuda Service Center, versions prior to 2025.1.1, allows for arbitrary file writes due to improper URL verification in attacker-controlled WSDL files. Tracked as CVE-2025-34392, this flaw could be exploited to overwrite critical system files or inject malicious content. Users of Barracuda Service Center should update to version 2025.1.1 or later to patch this vulnerability.

Gogs, a self-hosted Git service, has a critical vulnerability, CVE-2025-8110, in its PutContents API related to improper symbolic link handling. This flaw allows for local code execution. Users of Gogs should update to a patched version to prevent local attackers from escalating privileges or executing arbitrary code.

The Expat (libexpat) XML parsing library has a critical vulnerability, CVE-2022-25236, that allows attackers to insert namespace-separator characters into namespace URIs. This could lead to unexpected behavior or parsing errors, potentially impacting applications that rely on Expat for XML processing. Users of affected Expat versions should update to 2.4.5 or later.

IBM Common Licensing Agent and ART components, versions up to 9.0.0.2, are vulnerable to cross-site request forgery (CSRF). Tracked as CVE-2025-15399, this vulnerability could allow an attacker to trick a user into executing malicious and unauthorized actions. Organizations using these IBM components should ensure they are updated to mitigate CSRF risks.