Our Blog
CISA added one new entry to its Known Exploited Vulnerabilities catalog this week: CVE-2026-20316, an actively exploited authentication bypass in Cisco Secure Firewall Management Center (FMC) caused by static credentials. This flaw matters operationally because FMC serves as the central management plane for enterprise firewalls and threat policies, meaning initial access gives attackers visibility into overall network security architectures and potential exploit chaining vectors. Organizations operating Cisco Secure FMC software must apply vendor hotfixes immediately to prevent unauthorized remote access to management interfaces.
Reading time 10 minutes
July 2026 saw 26 new entries added to CISA's Known Exploited Vulnerabilities (KEV) catalog, dominated by targeting of enterprise collaboration platforms, edge network infrastructure, and web content management systems. Threat actors demonstrated a concentrated focus on management planes (Arista VCO, Cisco FMC) and enterprise application backbones (Microsoft SharePoint, Oracle EBS), utilizing deserialization, hardcoded authentication bypasses, and OS command injection to bypass traditional perimeter security controls. Security operations, vulnerability management leads, and infrastructure administrators must use this intelligence-led priority assessment to cut through raw CVSS noise and execute targeted remediation across high-exposure assets.
Reading time 10 minutes
CISA added eight new vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog during the past seven days, spanning enterprise network orchestrators (Arista VeloCloud Orchestrator), security gateways (Check Point SmartConsole), firewalls & SD-WAN (Fortinet FortiOS), collaboration platforms (Microsoft SharePoint), web publishing platforms (WordPress Core), AI application frameworks (Langflow), and consumer/SOHO networking firmware (DD-WRT). The most significant operational trend is the active exploit chaining targeting web core architectures alongside perimeter authentication bypasses and deserialization vectors. Security, vulnerability management, and infrastructure teams should prioritize internet-facing management consoles, content management instances, and collaboration servers for immediate validation and remediation activity.
Reading time 10 minutes
In February 2025, researchers discovered two weaponized AI models on Hugging Face that evaded detection for over eight months using a technique called NullifAI — exploiting Python's Pickle serialization to execute reverse shells on developers' machines while bypassing every existing scanner. With 98% of organizations reporting unsanctioned AI tool use and most security stacks carrying no capability to inspect ML model artifacts, the AI supply chain has become an unmonitored attack surface that traditional security tooling was never designed to handle.
Reading time 15 minutes