Security news.
Critical enterprise infrastructure is under heavy fire today, led by active zero-day exploitation targeting Cisco Catalyst SD-WAN Manager and Citrix NetScaler appliances. Concurrently, zero-day vulnerabilities facilitated major breaches at both DIVD and crypto platform Bitget, while CISA warns of a pre-authentication remote code execution flaw in MikroTik routers. Security teams should prioritize patching edge management systems and reviewing internet-facing infrastructure immediately.
Cisco Patches Actively Exploited Catalyst SD-WAN Zero-Day
Cisco released emergency updates for a critical authentication bypass (CVE-2026-76504) in Catalyst SD-WAN Manager that allows unauthenticated remote attackers to gain administrative API access, an issue already added to CISA's KEV catalog.
Citrix NetScaler Flaws Exploited for Root Access and Backdoors
Attackers are weaponizing newly patched critical vulnerabilities in Citrix NetScaler ADC and Gateway (including CVE-2026-88772) against government and financial targets to execute shellcode and deploy persistent backdoors.
Zammad Zero-Days Enable AI-Driven Breach at DIVD
The Dutch Institute for Vulnerability Disclosure reported that attackers compromised its internal network by chaining two zero-day vulnerabilities in the open-source Zammad ticketing platform.
CISA Warns of Critical Pre-Auth RCE in MikroTik RouterOS
CISA issued an advisory for an integer underflow vulnerability (CVE-2026-84411, CVSS 9.8) affecting MikroTik RouterOS versions prior to 7.24 that can allow remote code execution or system-wide denial-of-service.
Bitget Suffers $387.5M Theft via Third-Party Zero-Day
Cryptocurrency exchange Bitget revealed that a threat actor stole $387.5 million after compromising internal systems through an unpatched vulnerability in an unnamed third-party security product.
Attackers Weaponize Unauthenticated Zimbra RCE Flaw
Microsoft Security observed threat actors exploiting an unauthenticated command injection bug in Zimbra Collaboration Suite (CVE-2026-73570, CVSS 8.9) to deploy web shells and steal authentication tokens from mail servers.
Over 543,000 Live Secrets Exposed in Public GitHub Repos
Researchers discovered more than 543,000 active, valid credentials exposed across public GitHub repositories, demonstrating severe credential leakage despite native push-protection controls.
OpenSSL Patches High-Severity DTLS Memory Leak
OpenSSL issued updates addressing a high-severity flaw in DTLS handshake handling that could trigger application crashes or leak plaintext heap memory to remote endpoints.