EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
4 matching stories
RCE274 Zimbra Servers Compromised in the Wild via CVE-2026-73570
Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.
CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline
CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.
Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands
CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.
Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago
A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.
