Critical Vulnerabilities in Progress ShareFile (CVE-2026-2699, CVE-2026-2701)

On April 2nd, 2026, the cybersecurity research company watchTowr publicly disclosed a proof-of-concept exploit for two critical vulnerabilities (CVE-2026-2699 and CVE-2026-2701) affecting Progress ShareFile. When chained together, these vulnerabilities allow an unauthenticated attacker to bypass authentication and achieve remote code execution (RCE) on targeted systems.

Apr 2, 2026 - 4 Min Read

Critical Vulnerability Under Active Exploitation in F5 BIG-IP APM (CVE-2025-53521)

On March 28th, F5 published an advisory updating the severity of a previously reported vulnerability in BIG-IP APM (CVE-2025-53521) to a CVSS score of 9.8. Initially classified as a denial-of-service (DoS) vulnerability, it was discovered that the bug was instead being actively used for remote code execution (RCE). BIG-IP devices are commonly deployed on network perimeters, so successful compromise can provide threat actors initial access into an organization’s network.

Mar 30, 2026 - 2 Min Read

Critical Vulnerability in Citrix NetScaler ADC and Gateway Security Products (CVE-2026-3055)

On March 23rd, Citrix published an advisory detailing a critical severity vulnerability in their NetScaler ADC and Gateway products. The vulnerability, tracked as CVE-2026-3055, and with a CVSS score of 9.3 allows an unauthenticated attacker to cause a memory overread in the device potentially disclosing sensitive information.

Mar 23, 2026 - 4 Min Read

Critical Vulnerability in Ubiquiti Network Application (CVE-2026-22557)

On March 18th, Ubiquiti disclosed a Path Traversal vulnerability in the Unifi Network Application, CVE-2026-22557, which can be leveraged to access the underlying file system and could lead to further modifications and result in compromise of an underlying account.

Mar 18, 2026 - 2 Min Read

Critical Vulnerabilities in Cisco SD-Wan Systems Under Active Exploitation (CVE-2026-20127, CVE-2026-20128, CVE-2026-20122)

Updated 03/09/2026 to include additional CVEs disclosed by Cisco affecting the same product line. On February 25th,zCisco disclosed a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Controller and Manager systems. The flaw allows an unauthenticated attacker with network access to the SD-WAN peering service to bypass authentication and establish unauthorized control-plane connections. This vulnerability has been exploited in the wild according to Cisco by a sophisticated threat actor with evidence of exploitation reaching back to 2023.

Feb 25, 2026 - 6 Min Read