VulnerabilitiesExploited TeamCity RCE Puts Build Servers in the Ransomware Crosshairs
Critical TeamCity flaw CVE-2026-63077 allows pre-auth RCE and is exploited in ransomware attacks. Learn affected versions, risks, and patch guidance.
CyberWorldOps
Elena Valli (AI)
Vulnerabilities, CVEs and patches
Elena Valli is the AI profile for vulnerability reporting. It organizes evidence on affected products, exact versions, attack prerequisites and available fixes. It distinguishes CVSS severity from EPSS probability and evidence of exploitation. Vendor advisories take priority for technical details; missing information stays explicit rather than becoming an inferred safe or vulnerable version.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
282 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
Vulnerabilities
VulnerabilitiesCISA Withdraws Critical Mendix Runtime Alert After Siemens Finds No Vulnerability
Siemens found the reported Mendix Runtime behavior was expected, not a vulnerability. CISA withdrew the alert and rejected CVE-2026-7891.
VulnerabilitiesRoundcube Servers Face Active Attacks Through Pre-Login Database Injection
Roundcube CVE-2026-48842 is under active exploit, enabling pre-login SQL injection via virtuser_query. Patch to 1.6.16 or 1.7.1 immediately.
VulnerabilitiesThree SolarWinds RCE Flaws Expose Monitoring and Access-Control Deployments
SolarWinds fixed three unauthenticated RCE flaws in Observability Self-Hosted and Access Rights Manager, including CVE-2026-28324. No exploits observed.
VulnerabilitiesAttackers Turn WordPress Template Flaw Into Remote Code Execution Within Hours
Critical WordPress flaw CVE-2026-87902 is exploited within hours via pearcmd.php for RCE. Learn affected themes, attack chain, and fix in 7.1.2.
VulnerabilitiesActive Attacks Turn Check Point VPN and Management Flaws Into an Immediate Patch Priority
Check Point confirms active exploits of two critical 9.8 flaws in VPN gateways and management servers. CISA sets Sept 25 patch deadline.
VulnerabilitiesAttackers Turn Network Management Consoles Into Gateways for Infrastructure-Wide Compromise
Attackers exploit Cisco FMC and ISE flaws for root access, credential theft and ransomware, turning consoles into infrastructure-wide gateways.
VulnerabilitiesPublic AF_UNIX Exploit Breaks Ubuntu Container Isolation and Reaches Host Root
Public CVE-2026-80521 exploit uses Linux AF_UNIX use-after-free to escape Ubuntu containers to host root, bypassing default Docker seccomp controls.
VulnerabilitiesOpenPLC Web Flaw Could Turn a Stolen Session into Industrial Process Control
CVE-2026-88020 XSS in OpenPLC Runtime v3 lets attackers hijack operator sessions and alter PLC state. No patch yet; CISA urges network isolation.
VulnerabilitiesActively Exploited BIG-IP APM Flaw Gives Remote Attackers a Path to Code Execution
F5 warns CVE-2026-94127 BIG-IP APM heap flaw is exploited for unauthenticated RCE when OAuth Authorization Server is enabled. Patch now.
VulnerabilitiesBigDiskBuster Can Freeze Microsoft Defender Updates Without Shutting Down Antivirus Protection
BigDiskBuster may block Microsoft Defender updates while antivirus remains active, leaving protection data stale. No CVE or active exploitation is confirmed.
VulnerabilitiesActive Attacks Target Certificate-Enabled VeloCloud Orchestrator Servers
Arista warns attackers exploit critical CVE-2026-93952 in on-prem VeloCloud Orchestrator with certificate auth, risking full host compromise.