#cve

3 articles

Artifactory instances without a join key were given a phantom one. Attackers were minting admin tokens three days after the fix

2026-09-03Security

CVE-2026-82329 lets an unauthenticated attacker forge credentials and mint administrator tokens against JFrog Artifactory, and the vulnerable state is the default one. The patch landed on 28 August; watchTowr saw exploitation from 1 September, including actors creating backdoor users.

Switchvox is being exploited 47 days after the patch — and patching does not rotate the key they already took

2026-09-02Security

CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox that gives code execution as the PostgreSQL superuser. Researchers used it to steal the cookie signing key, which lets them forge a session for any user. That key does not change when you install the update.

A Cisco firewall manager zero-day is being exploited — and it chains with a CVSS 10.0 bug

2026-08-08Security

CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.