News | CSURFACE Threat Sensor

CSURFACE · 2026-03-02 ·Highlight

APT28 Exploits Microsoft Windows Zero-Day CVE-2026-21513

APT28 exploited a zero-day in Windows 10, CVE-2026-21513, before its disclosure, prompting urgent patching.

CVE-2026-21513 cisa-kev kev ransomware ssvc:attend severity:HIGH active-exploitation zero-day apt-used confirmed-exploited

CSURFACE · 2026-03-01 ·Highlight

Critical Flaw in Juniper Networks Junos OS Evolved Exploited in the Wild

A critical vulnerability in Juniper Networks Junos OS Evolved is actively exploited, risking full device takeover.

CVE-2026-21902 has-poc ssvc:attend severity:CRITICAL poc-released active-exploitation networking

CSURFACE · 2026-03-01 ·Highlight

CVE-2025-64328 Exploited in Over 900 Sangoma FreePBX Instances

A command injection flaw in Sangoma FreePBX has been exploited in over 900 instances, prompting urgent patching.

CVE-2025-64328 poc-released kev confirmed-exploited has-exploit severity:HIGH active-exploitation cisa-kev has-poc ssvc:attend

CSURFACE · 2026-03-01 ·Highlight

CVE-2025-64328 Exploited in Over 900 FreePBX Instances via Web Shells

A command injection flaw in FreePBX has led to over 900 instances being compromised by web shells.

CVE-2025-64328 severity:HIGH rce cisa-kev breach kev confirmed-exploited has-exploit has-poc poc-released active-exploitation ssvc:attend

CSURFACE · 2026-02-26 ·Highlight

Critical RCE Vulnerability in Trend Micro Apex One Exploited in the Wild

A critical RCE vulnerability in Trend Micro Apex One is being actively exploited, urging immediate patching.

CVE-2025-54948 ssvc:act severity:CRITICAL active-exploitation rce cisa-kev kev confirmed-exploited

CSURFACE · 2026-02-25 ·Highlight

LockBit Ransomware Exploits Apache ActiveMQ Flaw for RDP Access

LockBit ransomware exploits an Apache ActiveMQ vulnerability to gain RDP access and deploy ransomware.

breach has-threat-actor ransomware-used

CSURFACE · 2026-02-25 ·Highlight

Zero-Day Exploitation of FileZen Vulnerability Prompts Urgent Patching

A zero-day vulnerability in FileZen, CVE-2026-25108, is being actively exploited, urging immediate patching.

CVE-2026-25108 ssvc:attend severity:HIGH active-exploitation zero-day cisa-kev kev confirmed-exploited

CSURFACE · 2026-02-23 ·Highlight

Critical RCE Flaw in BeyondTrust Exploited in Active Attacks

A critical RCE vulnerability in BeyondTrust's remote access products, CVE-2026-1731, is being actively exploited, prompting urgent patching.

CVE-2026-1731 kev ransomware cisa-kev weaponized active-exploitation breach confirmed-exploited ssvc:act severity:CRITICAL poc-released rce auth-bypass has-exploit has-poc

CSURFACE · 2026-02-18 ·Highlight

Critical Zero-Day in Dell RecoverPoint Exploited for Two Years

A critical zero-day in Dell RecoverPoint, CVE-2026-22769, exploited since 2024, demands urgent patching.

CVE-2026-22769 disclosed active-exploitation zero-day confirmed-exploited cisa-kev breach kev ssvc:act severity:CRITICAL

CSURFACE · 2026-02-17 ·Highlight

Critical Zero-Day in WPvivid Plugin Allows Full Site Takeover

A zero-day flaw in WPvivid Backup & Migration plugin allows attackers to take over WordPress sites.

CVE-2026-1357 disclosed zero-day rce cms active-exploitation has-poc ssvc:attend poc-released severity:CRITICAL

CSURFACE · 2026-02-12 ·Highlight

Apple Patches Zero-Day Memory Corruption Flaw Exploited in the Wild

Apple has patched a zero-day vulnerability in multiple products that was exploited in the wild before disclosure.

CVE-2026-20700 active-exploitation zero-day cisa-kev kev confirmed-exploited severity:HIGH disclosed

CSURFACE · 2026-02-10 ·Highlight

Warlock Ransomware Exploits Critical SmarterMail Vulnerabilities

Warlock ransomware exploits critical SmarterMail vulnerabilities CVE-2026-23760 and CVE-2026-24423.

CVE-2026-23760 CVE-2026-24423 poc-released zero-day has-threat-actor ssvc:act active-exploitation rce confirmed-exploited has-poc kev severity:CRITICAL auth-bypass cisa-kev breach ransomware

CSURFACE · 2026-02-10 ·Highlight

Warlock Ransomware Exploits Unpatched SmarterMail and SharePoint Vulnerabilities

Warlock ransomware exploits unpatched SmarterMail and SharePoint vulnerabilities to deploy attacks.

zero-day has-threat-actor

CSURFACE · 2026-02-08 ·Highlight

Critical RCE Flaw in SolarWinds Web Help Desk Actively Exploited

A critical RCE vulnerability in SolarWinds Web Help Desk, CVE-2025-26399, is actively exploited, prompting urgent patching.

CVE-2025-26399 active-exploitation rce cisa-kev kev confirmed-exploited severity:CRITICAL breach has-poc ssvc:act

CSURFACE · 2026-02-06 ·Highlight

Ransomware Exploits Critical SmarterMail Vulnerability CVE-2026-24423

Ransomware groups are exploiting a critical SmarterMail vulnerability, CVE-2026-24423, for remote code execution.

CVE-2026-24423 poc-released rce cisa-kev kev has-poc ssvc:act ransomware-used confirmed-exploited active-exploitation ransomware severity:CRITICAL

CSURFACE · 2026-02-05 ·Highlight

Critical Telnetd Flaw in GNU InetUtils Exploited in the Wild

A critical telnetd flaw in GNU InetUtils, CVE-2026-24061, is being exploited in the wild, allowing remote root access.

CVE-2026-24061 active-exploitation kev has-poc severity:CRITICAL ssvc:act poc-released auth-bypass cisa-kev confirmed-exploited has-exploit

CSURFACE · 2026-02-04 ·Highlight

Critical RCE Flaw in React Native CLI Actively Exploited in the Wild

A critical RCE vulnerability in React Native CLI, CVE-2025-11953, is being actively exploited, urging immediate patching.

CVE-2025-11953 has-poc severity:CRITICAL poc-released rce kev active-exploitation cisa-kev confirmed-exploited ssvc:act

CSURFACE · 2026-02-04 ·Highlight

WinRAR Zero-Day CVE-2025-8088 Exploited for Malware Distribution

WinRAR's CVE-2025-8088 zero-day vulnerability is actively exploited to distribute malware, urging immediate patching.

CVE-2025-8088 severity:HIGH active-exploitation zero-day ssvc:attend apt-used poc-released cisa-kev confirmed-exploited has-poc ransomware lfi kev

CSURFACE · 2026-02-03 ·Highlight

Critical RCE Vulnerability Exploited in SolarWinds Web Help Desk

A critical RCE vulnerability in SolarWinds Web Help Desk is being actively exploited, urging immediate patching.

CVE-2025-40551 confirmed-exploited has-exploit ssvc:act active-exploitation rce cisa-kev kev severity:CRITICAL

CSURFACE · 2026-01-19 ·Highlight

Zero-Day Exploit Targets Modular DS Plugin for Privilege Escalation

A zero-day vulnerability in the Modular DS plugin is being exploited for privilege escalation, affecting WordPress sites.

CVE-2026-23550 active-exploitation severity:LOW cms breach has-poc poc-released zero-day priv-esc

CSURFACE · 2026-01-13 ·Highlight

MongoDB 'MongoBleed' Vulnerability CVE-2025-14847 Actively Exploited

MongoDB's CVE-2025-14847, known as 'MongoBleed,' is actively exploited, urging immediate patching.

CVE-2025-14847 confirmed-exploited rce cisa-kev has-poc active-exploitation database kev poc-released info-disclosure has-exploit ssvc:act severity:HIGH weaponized

CSURFACE · 2026-01-09 ·Highlight

Critical RCE Vulnerability in n8n Platform Actively Exploited

A critical RCE flaw in n8n, CVE-2026-21858, is being actively exploited, urging immediate patching.

CVE-2026-21858 active-exploitation rce has-exploit has-poc ssvc:attend severity:CRITICAL poc-released

CSURFACE · 2026-01-08 ·Highlight

Critical RCE Flaw in HPE OneView Actively Exploited in the Wild

A critical RCE vulnerability in HPE OneView, CVE-2025-37164, is actively exploited, urging immediate patching.

CVE-2025-37164 poc-released active-exploitation confirmed-exploited has-poc ssvc:act severity:CRITICAL rce cisa-kev kev has-exploit

CSURFACE · 2026-01-08 ·Highlight

Critical SmarterMail Vulnerability Exploited in the Wild

A critical SmarterMail vulnerability, CVE-2025-52691, is being actively exploited, allowing remote code execution.

CVE-2025-52691 has-exploit severity:CRITICAL rce cisa-kev kev confirmed-exploited poc-released active-exploitation has-poc ssvc:act

CSURFACE · 2026-01-01 ·Highlight

Critical Next.js Middleware Flaw CVE-2025-29927 Exposes Web Apps to Authorization Bypass

A critical vulnerability in Next.js allows attackers to bypass middleware authorization checks, posing a significant risk to web applications.

CVE-2025-29927 breach has-poc ssvc:attend severity:CRITICAL poc-released auth-bypass

CSURFACE · 2025-12-26 ·Highlight

Exploited RCE Vulnerability in n8n Automation Platform Prompts Urgent Patching

A critical RCE vulnerability in n8n, CVE-2025-68613, is actively exploited, urging immediate patching.

CVE-2025-68613 active-exploitation has-poc severity:HIGH cisa-kev kev confirmed-exploited has-exploit disclosed poc-released rce ssvc:attend

CSURFACE · 2025-12-23 ·Highlight

Critical Zero-Day in WatchGuard Fireware OS Actively Exploited

A critical zero-day vulnerability in WatchGuard Fireware OS, CVE-2025-14733, is being actively exploited, allowing remote code execution on affected systems.

CVE-2025-14733 has-poc active-exploitation zero-day rce confirmed-exploited ssvc:act severity:CRITICAL poc-released cisa-kev kev

CSURFACE · 2025-12-18 ·Highlight

ASUS Live Update Supply Chain Flaw Exploited as Zero-Day

A critical zero-day flaw in ASUS Live Update, CVE-2025-59374, was exploited via a supply chain attack.

CVE-2025-59374 active-exploitation kev confirmed-exploited severity:CRITICAL disclosed zero-day cisa-kev supply-chain ssvc:act

CSURFACE · 2025-12-18 ·Highlight

SonicWall Patches Actively Exploited Zero-Day in SMA1000 Appliances

SonicWall has patched CVE-2025-40602, a zero-day in SMA1000 appliances exploited in the wild.

CVE-2025-40602 confirmed-exploited has-poc severity:MEDIUM kev disclosed poc-released active-exploitation zero-day priv-esc cisa-kev ssvc:attend