CISA added this flaw to the KEV catalog with a remediation deadline of 2026-08-29 amid multiple credible reports of in-the-wild exploitation, so teams that leave internet-facing NetScaler appliances unpatched this week are exposed to active attacks.
A memory buffer handling flaw in NetScaler ADC and NetScaler Gateway is reachable over the network without authentication or user interaction (CVSS 8.8, AV:N/PR:N/UI:N). Credible reporting describes it as enabling remote code execution on affected appliances, and at minimum it can take the service down. A related flaw, CVE-2026-8451, is fixed in the same advisory.
Affected: NetScaler ADC and Gateway 14.1 before 14.1-72.61; NetScaler ADC and Gateway 13.1 before 13.1-63.18; NetScaler ADC 13.1 FIPS and NDcPP before 13.1-37.272; NetScaler ADC 14.1 FIPS before 14.1-72.61
How to Test
Check the running NetScaler firmware build: any 14.1 build before 14.1-72.61, 13.1 build before 13.1-63.18, or 13.1 FIPS/NDcPP build before 13.1-37.272 is vulnerable. Treat internet-facing Gateway/ADC virtual servers as exposed and review appliance logs for anomalous crashes or unexpected requests since the June advisory.
How to Patch
Upgrade to NetScaler ADC/Gateway 14.1-72.61 or later, 13.1-63.18 or later, or 13.1 FIPS/NDcPP 37.272 or later per Citrix advisory CTX696604; there is no workaround listed, so prioritize the upgrade before the 2026-08-29 KEV due date.
VulnCheck added this to its known-exploited catalog yesterday and Microsoft published research tying it to in-the-wild attacks on orchestration platforms; an unpatched internet-facing Kestra instance can be taken over without credentials.
Kestra OSS whitelists its public configuration endpoint from Basic Auth using a suffix match on "/configs" instead of an exact path match, so any API path ending in that segment bypasses authentication entirely. An unauthenticated remote attacker can create and execute arbitrary workflows, and because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python) this amounts to remote code execution on the host.
Affected: Kestra < 1.0.45; Kestra >= 1.1.0, < 1.3.21
How to Test
Confirm your Kestra version is below 1.0.45 or in the 1.1.0–1.3.20 range; review API access logs for unauthenticated requests to paths whose last segment is 'configs' and for workflow creations or executions from unexpected sources.
How to Patch
Upgrade to Kestra 1.0.45 or 1.3.21 (or later); until then, remove direct internet exposure and enforce authentication at a reverse proxy in front of the Kestra API so path-suffix tricks cannot reach AuthenticationFilter unauthenticated.
The CVE was added to VulnCheck's known-exploited catalog with two public exploits in XDB, so unpatched sites running the default configuration can have their administrator accounts taken over by unauthenticated attackers using off-the-shelf tooling.
TranslatePress versions up to and including 3.3.1 expose the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary — via the unauthenticated 'trp_get_translations_regular' AJAX action when automatic string saving (the default) is enabled. An attacker can trigger and harvest a reset link to take over the administrator account without any credentials.
Affected: TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.1
How to Test
Confirm the installed plugin version — anything at or below 3.3.1 with automatic string saving enabled (the default) is exploitable; review web server logs for unauthenticated requests invoking the 'trp_get_translations_regular' AJAX action and audit administrator accounts for unexpected password resets or new sessions.
How to Patch
Update TranslatePress to a version later than 3.3.1; until updated, disable automatic string saving in the plugin settings, which the vulnerability requires, and rotate administrator passwords on any site where the vulnerable action was reachable.
Hunt.io published evidence this week that a suspected Chinese-speaking operator used this pre-signed-URL bypass to breach a Philippine nuclear research agency and a naval contractor, so unpatched ownCloud instances remain a demonstrated live target for data theft.
ownCloud core 10.6.0 through 10.13.0 accepts pre-signed WebDAV URLs even when the file owner has no signing-key configured, letting an unauthenticated attacker who knows a valid username read, modify, or delete any of that user's files. Hunt.io documents this flaw being used as the initial access vector in an intrusion that exfiltrated sensitive records from two Philippine organizations.
Affected: ownCloud core (owncloud_server) 10.6.0 through 10.13.0 (fixed in 10.13.1)
How to Test
Confirm your ownCloud core version is below 10.13.1; identify user accounts with no signing-key configured, since those are the exploitable targets; review WebDAV access logs for pre-signed URL requests against user accounts that never configured a signing key, per the detection guidance in the Hunt.io report.
How to Patch
Upgrade owncloud/core to 10.13.1 or later, which rejects pre-signed URLs for users without a configured signing-key; the vendor advisory for the WebDAV pre-signed URL authentication bypass is published at owncloud.com/security-advisories.
VulnCheck added this to its known-exploited catalog today with its canary sensors registering exploitation attempts and full public exploit code circulating, so unpatched forums are being probed for unauthenticated takeover right now.
The vB5_Template_Runtime::runMaths() method evals attacker-controlled input from the pagenav[pagenumber] parameter, and its restrictive-looking regex filter can be bypassed with phpfuck-style encoding using only permitted characters. The unauthenticated ajax/render template route lets a remote attacker execute arbitrary PHP on the forum server with no credentials.
Affected: vBulletin >= 5.0.0, <= 5.7.5; vBulletin >= 6.0.0, <= 6.2.1
How to Test
Confirm your vBulletin version is 5.0.0–5.7.5 or 6.0.0–6.2.1; review web server logs for requests to the ajax/render route carrying pagenav[pagenumber] parameters with unusual encoded payloads.
How to Patch
Upgrade to vBulletin 6.2.2, or apply the vendor security patches released for 6.2.1, 6.2.0, and 6.1.6; 5.x installations should be upgraded off the affected branch as no patched 5.x release is listed.
VulnCheck's canary sensors observed exploitation attempts against this service today and added the CVE to their known-exploited catalog, so any Zbtlink router with UDP/9992 reachable can be taken over as root by a single crafted packet.
The infosrvd service listening on UDP/9992 across many Zbtlink router models accepts crafted packets that inject shell commands executed as root, and its authentication is defeated by a hardcoded salt and an all-zero wildcard MAC bypass. One unauthenticated packet is enough to fully compromise the device.
Affected: Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526, CTN720-W1, LF-1541, MT7620N firmware 19.1101; Zbtlink WE2426-C firmware 19.1112; Zbtlink WE5926-EC_QP firmware 20.0516; Zbtlink WF3526-P firmware 19.051; Zbtlink WRC1 firmware 20.0622
How to Test
Check whether your device is one of the listed models on the affected firmware versions, and probe whether UDP port 9992 (the infosrvd service) is reachable from untrusted networks, especially the WAN interface.
How to Mitigate
No vendor fix is cited in the current advisories: block or firewall UDP/9992 so the infosrvd service is unreachable from the internet and untrusted network segments, disable the service if your firmware allows it, monitor for crafted UDP traffic to port 9992, and watch Zbtlink for a firmware update addressing the flaw.
VulnCheck added this to its known-exploited catalog on 2026-08-24 citing a Patchstack exploitation report, and any site still running a version below 1.3.9.9 is open to unauthenticated file-upload takeover.
The plugin strips characters from an uploaded file's name but never re-validates the resulting final name, so unauthenticated attackers can defeat its file type restrictions and place executable files on the server, leading to arbitrary code execution.
Affected: Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9
How to Test
Confirm the installed plugin version in the WordPress admin or via the plugin file header; anything below 1.3.9.9 is vulnerable. Review the uploads directory used by the plugin for unexpected PHP or otherwise executable files and check web server access logs for POSTs to the plugin's upload endpoint from unauthenticated clients.
How to Patch
Update the Drag and Drop Multiple File Upload for Contact Form 7 plugin to version 1.3.9.9 or later. If you cannot update immediately, deactivate the plugin until you can, and remove any attacker-written files found in the uploads path.
CISA added this CVE to KEV yesterday on the heels of Cisco Talos reporting UAT-10147 exploiting AjaxPro-based web servers globally, so teams still shipping the library remain exposed to an active campaign.
Ajax.NET Professional (AjaxPro), a legacy AJAX library used in older ASP.NET applications, deserializes attacker-controlled data into arbitrary .NET classes, allowing an unauthenticated remote attacker to execute code on the web server. Many deployments embed the library indirectly and may be end-of-life.
Affected: Ajax.NET Professional (AjaxPro.2), versions prior to the fixed release
How to Test
Inventory ASP.NET applications for the AjaxPro.2 assembly in application bin directories and for AjaxPro handler registrations in web.config; review IIS logs for unexpected POST requests to AjaxPro handler endpoints on internet-facing apps.
How to Patch
Upgrade to an Ajax.NET Professional build containing fix commit b0e63be5f0bb20dfce507cb8a1a9568f6e73de57 from the michaelschwarz/Ajax.NET-Professional repository; if the embedding application is end-of-life, remove the library or discontinue the product. CISA requires federal agencies to remediate by 2026-09-09.