Analyst Guidance
Security teams should prioritize patching Grid Protection Alliance products and actively monitor CISA CSAF documents for detailed remediation guidance on OT equipment.
CVE Details & Remediation
How to read this report
🛡️Verified facts — NVD & CISA KEV
⏳Partially verified — awaiting NVD enrichment
🧠AI analysis — synthesis, verify before acting
🛡️Actionable · Verified facts
NVD-published · CISA KEV cross-checked🛡️CVE-2015-3306 – Proftpd ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
AffectedGovernment Energy
Remediation Steps
- Apply ProFTPD security patch immediately
- Review access logs for unauthorized administrative access attempts
- Restrict network access to FTP services to trusted networks only
- Monitor for Flax Typhoon indicators of compromise
References:
🛡️CVE-2026-5430 – WSO2 Multiple Products ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P47
ActionPatch immediately
Remediation Steps
- Apply available patches from GitHub
- Review GitHub repository access logs for unauthorized activity
- Audit repository permissions and access controls
- Monitor for credential compromise or token abuse
References:
🛡️CVE-2026-76460 – Cisco Identity Services Engine ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS14% · P96
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Cisco Identity Services Engine as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93952 – Arista VeloCloud Orchestrator ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P64
ActionPatch immediately
Remediation Steps
- Review VeloCloud Orchestrator instances configured with certificate-based Edge authentication
- Restrict network access to the VCO management interface to trusted administrative networks
- Monitor authentication logs for unauthorized privilege escalation attempts
References:
🛡️CVE-2026-102489 – Zammad GmbH Zammad ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P69
ActionPatch immediately
Remediation Steps
- Check CISA Known Exploited Vulnerabilities Catalog for detailed product and version information
- Apply vendor-supplied patches or mitigations
- Review internal systems for compromise indicators
References:
🛡️CVE-2026-104286 – Fortinet FortiMail ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
Remediation Steps
- Apply vendor patch for Fortrix to remediate known exploited vulnerability
- Verify patch deployment across all affected instances
- Monitor security logs for exploitation attempts post-patching
References:
🛡️CVE-2026-76504 – Cisco Catalyst SD-WAN Manager ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P78
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Cisco Catalyst Sd-Wan Manager as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88771 – Citrix NetScaler ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P64
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-94127 – F5 BIG-IP APM ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
AffectedTechnology Retail
Remediation Steps
- Apply the vendor security update for F5 BIG-IP APM as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85102 – Check Point Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS8% · P94
ActionPatch immediately
AffectedGovernment Finance Technology
Remediation Steps
- Apply the vendor security update for Check Point Security Gateway, Check Point Spark Firewall as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93616 – Check Point Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS20% · P97
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Check Point Security Management Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2025-39682 – Linux Kernel ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS3% · P86
ActionPatch immediately
Remediation Steps
- Apply the latest Linux kernel security patches
- Prioritize patching systems exposed to untrusted networks
- Review system logs for signs of active exploitation
- Test patches in non-production environments before deployment
References:
🛡️CVE-2026-76461 – Cisco Secure Email Gateway ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS28% · P98
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Cisco Asyncos as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-102490 – Zammad GmbH Zammad ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P44
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Zammad Ticketing System as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2021-3199 – ONLYOFFICE Docs ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS19% · P97
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for ONLYOFFICE Docs as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-71362 – Adobe Commerce And Magento ✓ NVD
CVSS9.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS88% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Adobe Commerce as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86950 – Apple Multiple Products ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P68
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Apple iOS, iPadOS, macOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-65660 – Microsoft SharePoint ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P81
ActionPatch immediately
Remediation Steps
- Apply the latest Microsoft security patch
- Prioritize patching across all affected systems
- Monitor email systems and document processing for suspicious activity
- Review recent file access and document modification logs
References:
🛡️CVE-2026-7273 – Zyxel GS1900 Series Switches ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS3% · P84
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Zyxel GS1900 Smart Managed Switches as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-53266 – Linux Kernel ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P56
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Linux Kernel as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-58704 – Google Pixel ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P47
ActionPatch immediately
AffectedTechnology Government Defense
Remediation Steps
- Apply the vendor security update for Google Android as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2016-3081 – Apache Struts ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS96% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Huawei Agile Controller-Campus Firmware as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88772 – Citrix NetScaler ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P70
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Citrix NetScaler ADC/Gateway as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772
🛡️CVE-2026-87902 – WordPress Core ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS40% · P99
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for WordPress Core as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2015-5477 – ISC BIND ✓ NVD
CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS99% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Juniper Junos as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88779 – Citrix NetScaler ✓ NVD
CVSS7.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P47
ActionPatch immediately
AffectedHealthcare Education
Remediation Steps
- Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-67279 – MikroTik RouterOS ✓ NVD
CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P63
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for MikroTik RouterOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2023-22894 – Strapi ✓ NVD
CVSS4.9 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS4% · P89
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for Strapi Strapi as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
⏳Actionable · Partially verified
CVE in source articles · NVD enrichment pending⏳CVE-2026-10462 – Grid Protection Alliance openPDC and openHistorian pending NVD
CVSSawaiting NVD
Triage statusUnder Review
ExploitationNo exploitation reported
ActionSchedule for next cycle
AffectedEnergy
Remediation Steps
- Identify affected Grid Protection Alliance openPDC and openHistorian installations running versions before 2.9.477 or 2.9.482
- Apply the vendor patch to upgrade to patched versions
- Test patches in a non-production environment before deploying to operational systems
- Consult the CSAF advisory at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json for detailed remediation steps
References:
🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.