What you need to know today.

Two critical vulnerabilities in Collabora Online's built-in CODE Server have been actively exploited in the wild, allowing remote code execution. The first, CVE-2026-110447, affects versions before 26.4.303 and is a different issue than CVE-2025-66208. Attackers have used this flaw to backdoor Nextcloud servers, as reported by The Hacker News and Cyber Security News. The second actively exploited vulnerability, CVE-2026-114625, impacts Arista VeloCloud Orchestrator (VCO) on-prem deployments, enabling remote attackers to access privileged internal functionality and potentially compromise the host. This marks the third Arista VCO zero-day exploited in recent months, with SecurityWeek noting its significance. The Hacker News also reported on a related SQL injection zero-day in VCO. CISA has added both CVE-2026-110447 and CVE-2026-114625 to its Known Exploited Vulnerabilities (KEV) catalog, urging immediate patching.

A significant batch of vulnerabilities has been disclosed across HPE's Aruba networking products. Critical flaws in AOS-10, including CVE-2026-79847 and CVE-2026-79851, could lead to unauthenticated remote code execution through buffer overflows. Additionally, AOS-8 is affected by multiple vulnerabilities, such as CVE-2026-79850 and CVE-2026-79849, which permit authentication bypass and SQL injection, respectively. Cyber Security News highlighted that these issues could allow attackers complete control over devices. Vypr Intelligence detailed 25 vulnerabilities in AOS-8, emphasizing critical auth bypass and RCE flaws. Successful exploitation of these vulnerabilities could range from arbitrary code execution to command injection, impacting the confidentiality, integrity, and availability of affected systems.

Microsoft has addressed six critical vulnerabilities impacting Azure and Exchange services. Among these, CVE-2026-97785, CVE-2026-83938, and CVE-2026-110063 are particularly concerning, allowing unauthorized attackers to elevate privileges over a network. CVE-2026-97785 affects AAD App Proxy, CVE-2026-83938 impacts Azure Kubernetes Configuration Service, and CVE-2026-110063 relates to VM Inspector for Azure Virtual Machines. Vypr Intelligence reported on these disclosures, noting the potential for privilege escalation. While the CVSS scores for these vulnerabilities are high, their inclusion in the KEV catalog is pending. Organizations using Azure services are advised to review and apply the latest security updates to mitigate these risks.

Apple has released extensive security updates addressing numerous vulnerabilities across its product lines, including a critical authentication issue in macOS Golden Gate, Sequoia, Sonoma, and Tahoe, identified as CVE-2026-65400. This flaw, which could be exploited by an attacker on the network to bypass authentication, has been added to CISA's KEV catalog and was reportedly exploited in the wild to deploy cryptominers on internet-exposed Macs, as detailed by Help Net Security and Malwarebytes Labs. Other significant updates include patches for Adobe Campaign Classic (CVE-2026-71398) and WordPress plugins (CVE-2026-61962, CVE-2026-27544), addressing critical remote code execution and improper authentication vulnerabilities.

A coordinated disclosure has revealed 25 vulnerabilities affecting various Apache projects, including Apache Pulsar Manager (CVE-2026-105944). While specific details on the exploitability and impact of all Apache vulnerabilities are still emerging, CVE-2026-105944 in Pulsar Manager presents a risk due to its web console nature and potential for credential misuse. Vypr Intelligence noted the broad scope of the Apache disclosures. Additionally, Oracle has released a massive security update addressing 1295 vulnerabilities, including a critical flaw in Oracle E-Business Suite's Workflow Notification Mailer (CVE-2026-101809), which is easily exploitable by unauthenticated network attackers, as reported by Cyber Security News.