Analyst Guidance
Four CVEs with explicit identifiers warrant immediate attention this week: and. Additionally, CISA has added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog, signaling confirmed threat activity. Organizations should prioritize patching these vulnerabilities and review network exposure of internet-facing services such as SSH and web management interfaces.
CVE Details & Remediation
How to read this report
🛡️Verified facts — NVD & CISA KEV
⏳Partially verified — awaiting NVD enrichment
🧠AI analysis — synthesis, verify before acting
🛡️Actionable · Verified facts
NVD-published · CISA KEV cross-checked🛡️CVE-2026-49869 – Kestra OSS ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P79
ActionPatch immediately
AffectedTechnology Finance Healthcare
Remediation Steps
- Apply the vendor security update for Kestra OSS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-83548 – SonicWall SMA1000 Appliances ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P51
ActionPatch immediately
Remediation Steps
- Apply SonicWall security updates for SMA 1000 series VPN appliances as released by vendor
- If patching cannot be completed immediately, isolate affected SMA 1000 appliances from untrusted networks
- Monitor appliance logs for unusual SSRF or authentication bypass attempts
- Enforce network access restrictions to administrative interfaces
- Review and revoke any suspicious user sessions or API tokens created on affected appliances
References:
🛡️CVE-2026-21962 – Oracle HTTP Server And Oracle Weblogic Server Proxy Plug-In ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS42% · P99
ActionPatch immediately
AffectedTechnology Finance Government
Remediation Steps
- Apply the vendor security update for Oracle HTTP Server And Oracle Weblogic Server Proxy Plug-In as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-72898 – Metabase ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS94% · P100
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Metabase Metabase as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-81578 – PaperCut NG/MF ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS2% · P74
ActionPatch immediately
AffectedEducation
Remediation Steps
- Apply the vendor patch to address the authentication bypass flaw
- Review access logs for evidence of unauthorized authentication or command execution
- Conduct credential audit of accounts that may have been exposed
- Restrict network access to PaperCut management interfaces
References:
🛡️CVE-2026-9586 – Sangoma Switchvox ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS12% · P96
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Sangoma Switchvox as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-82329 – JFrog Artifactory ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS8% · P94
ActionPatch immediately
AffectedTechnology Healthcare Finance
Remediation Steps
- Apply the vendor security update for JFrog Artifactory as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2023-49105 – Owncloud Server ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS43% · P99
ActionPatch immediately
Remediation Steps
- Apply ownCloud security patch for CVE-2023-49105 immediately
- Review access logs for indicators of compromise targeting file repositories
- Restrict network access to ownCloud instances to trusted networks where possible
- Monitor for unauthorized file access or exfiltration activity
References:
🛡️CVE-2021-23758 – Ajaxpro.2 Project Ajaxpro.2 (also: Michaelschwarz) ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS84% · P100
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Ajaxpro.2 Project Ajaxpro.2 as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-72529 – TrueConf Server ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P74
ActionPatch immediately
Remediation Steps
- Apply the vendor security patch
- Review system logs for evidence of exploitation
- Verify affected systems are fully patched
- Monitor for suspicious activity post-remediation
References:
🛡️CVE-2026-33824 – Microsoft Internet Key Exchange (IKE) Service Extensions ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS73% · P99
ActionPatch immediately
Remediation Steps
- Consult CISA Known Exploited Vulnerabilities Catalog for affected product details
- Apply vendor patch when available
- Verify patch deployment across affected systems
References:
🛡️CVE-2026-59310 – Broadcom VMware VCenter ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS46% · P99
ActionPatch immediately
AffectedHealthcare Government
Remediation Steps
- Apply the vendor security update for Vmware Vcenter Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-65400 – Apple MacOS ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS10% · P95
ActionPatch immediately
AffectedHealthcare Government
Remediation Steps
- Apply the vendor security update for Apple Macos as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-60004 – Gitea ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS87% · P100
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Gitea Gitea as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-8452 – Citrix NetScaler ADC And NetScaler Gateway ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P74
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Citrix NetScaler ADC and NetScaler Gateway as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-64849 – Lfprojects Mlflow ✓ NVD
CVSS9.3 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS16% · P97
ActionPatch immediately
Remediation Steps
- Apply the vendor security patch
- Review system logs for evidence of exploitation
- Verify affected systems are fully patched
- Monitor for suspicious activity post-remediation
References:
🛡️CVE-2026-82078 – PaperCut NG/MF ✓ NVD
CVSS9.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS2% · P76
ActionPatch immediately
AffectedEducation
Remediation Steps
- Apply the vendor patch to address the remote code execution vulnerability
- Audit logs for malicious script execution or unauthorized commands
- Verify integrity of system binaries and scripts on affected servers
- Restrict inbound access to PaperCut services to trusted networks
References:
🛡️CVE-2026-55040 – Microsoft SharePoint ✓ NVD
CVSS9.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS40% · P99
ActionPatch immediately
AffectedHealthcare Government
Remediation Steps
- Apply the vendor security update for Microsoft Sharepoint Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-72530 – TrueConf Server ✓ NVD
CVSS9 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P77
ActionPatch immediately
AffectedTransportation Technology Finance
Remediation Steps
- Apply the vendor security update for Trueconf Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-73570 – Synacor Zimbra Collaboration Suite (ZCS) ✓ NVD
CVSS8.9 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS32% · P98
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Synacor Zimbra Collaboration Suite as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85046 – Google Chromium V8 ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS1% · P65
ActionPatch immediately
Remediation Steps
- Consult CISA Known Exploited Vulnerabilities catalog for product-specific details
- Determine if your organization uses the affected product
- Apply vendor patch when available
- Monitor for any indicators of compromise related to this CVE
References:
🛡️CVE-2025-62593 – Ray-Project Ray ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS17% · P97
ActionPatch immediately
AffectedTechnology Manufacturing Energy
Remediation Steps
- Apply the vendor security update for Anyscale Ray as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2019-1068 – Microsoft SQL Server ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS53% · P99
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Microsoft SQL Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-20349 – Cisco Secure Firewall Adaptive Security Appliance (ASA) And Secure Firewall Threat Defense (FTD) ✓ NVD
CVSS8.6 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P81
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Cisco Adaptive Security Appliance Software as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-59822 – BerriAI LiteLLM ✓ NVD
CVSS8.2 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P56
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for BerriAI LiteLLM as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-53362 – Linux Kernel ✓ NVD
CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P42
ActionPatch immediately
AffectedTechnology Finance Government
Remediation Steps
- Apply the vendor security update for Linux Kernel as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2015-5287 – Red Hat Automatic Bug Reporting Tool ✓ NVD
CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS5% · P92
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Red Hat Automatic Bug Reporting Tool as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2022-0995 – Linux Kernel ✓ NVD
CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS10% · P95
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Linux Kernel as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-83549 – SonicWall SMA1000 Appliances ✓ NVD
CVSS7.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P75
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for SonicWall SMA1000 Appliances as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-68820 – Microsoft Windows Ancillary Function Driver For WinSock ✓ NVD
CVSS7 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS6% · P93
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Microsoft Windows 10 1607 as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-48710 – Kludex Starlette ✓ NVD
CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS36% · P98
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Kludex Starlette as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-66384 – JFrog Artifactory ✓ NVD
CVSS5.3 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P46
ActionPatch immediately
AffectedTechnology Finance Government
Remediation Steps
- Apply the vendor security update for Jfrog Artifactory as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2015-3246 – Red Hat Libuser ✓ NVD
CVSS5.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS9% · P95
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Red Hat Libuser as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-19490 – Citrix NetScaler ✓ NVD
CVSS9.3 NVD 4.0
Triage statusNo Known Exploit
ExploitationNo exploitation reported
EPSS3% · P88
ActionPatch within 48 hours
Remediation Steps
- Apply the vendor patch from Citrix for the authentication bypass flaw
- Restrict inbound access to NetScaler management and proxy interfaces to trusted IP ranges
- Monitor for unauthorized authentication attempts in NetScaler logs
- Review active sessions for evidence of compromise
References:
🛡️CVE-2026-32475 – Elementor Pro WordPress Plugin ✓ NVD
CVSS9 NVD 3.1
Triage statusNo Known Exploit
ExploitationNo exploitation reported ● New this week
EPSS2% · P83
ActionPatch within 48 hours
AffectedTechnology Retail Telecom
Remediation Steps
- Apply the vendor security update for Elementor Pro WordPress Plugin as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
⏳Actionable · Partially verified
CVE in source articles · NVD enrichment pending⏳CVE-2026-59346 – VMware Workstation and Fusion pending NVD
CVSSawaiting NVD
Triage statusUnder Review
ExploitationNo exploitation reported
ActionPatch within 48 hours
Remediation Steps
- Apply the latest security update from Broadcom for VMware Workstation and Fusion
- Restrict local access to VMware products to trusted users only
- Monitor for evidence of exploitation on affected hosts
- Review host system logs for unauthorized code execution
References:
🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.