Days to Patch: exploited incidents https://daystopatch.com/ Exploited vulnerabilities at watched vendors, with response timelines and archived evidence. en Sat, 24 Oct 2026 03:00:15 GMT BeyondTrust: BeyondTrust Remote Support improper origin validation (BT26-05) https://daystopatch.com/incidents/beyondtrust-cve-2026-102764/ https://daystopatch.com/incidents/beyondtrust-cve-2026-102764/ Fri, 23 Oct 2026 02:47:31 GMT Fixed. CVE-2026-102764. Silence 0h, first fix 0h. Palo Alto Networks: PAN-OS management interface authenticated remote code execution https://daystopatch.com/incidents/palo-alto-networks-cve-2026-0322/ https://daystopatch.com/incidents/palo-alto-networks-cve-2026-0322/ Fri, 23 Oct 2026 02:52:21 GMT Fixed. CVE-2026-0322. Silence 0h, first fix 0h. Cisco: Cisco Secure Email Gateway Arbitrary File Write Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-76519/ https://daystopatch.com/incidents/cisco-cve-2026-76519/ Fri, 23 Oct 2026 02:50:23 GMT Fixed. CVE-2026-76519. Silence 0h, first fix 0h. Microsoft: Microsoft Windows Command Injection Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-96951/ https://daystopatch.com/incidents/microsoft-cve-2026-96951/ Fri, 23 Oct 2026 09:09:29 GMT Fixed. CVE-2026-96951. Silence 0h, first fix 0h. Ivanti: Ivanti Connect Secure zero-day exploit chain (auth bypass + RCE, root privilege escalation) https://daystopatch.com/incidents/ivanti-cve-2026-104935/ https://daystopatch.com/incidents/ivanti-cve-2026-104935/ Fri, 23 Oct 2026 02:51:30 GMT Partly fixed. CVE-2026-104935, CVE-2026-111357. Silence 0h, first fix 0h. Atlassian: Arbitrary File Access Vulnerability impacts Multiple Atlassian Data Center Products https://daystopatch.com/incidents/atlassian-cve-2026-21589/ https://daystopatch.com/incidents/atlassian-cve-2026-21589/ Fri, 23 Oct 2026 02:47:47 GMT Fixed. CVE-2026-21589. Silence 0h, first fix 0h. Citrix: NetScaler ADC and Gateway SAML memory overflow exploited for denial of service https://daystopatch.com/incidents/citrix-cve-2026-88779/ https://daystopatch.com/incidents/citrix-cve-2026-88779/ Fri, 23 Oct 2026 02:48:28 GMT Fixed. CVE-2026-88779. Silence <1h, first fix 32h. Fortinet: FortiMail unauthenticated arbitrary file write via IBE path traversal https://daystopatch.com/incidents/fortinet-cve-2026-104286/ https://daystopatch.com/incidents/fortinet-cve-2026-104286/ Fri, 23 Oct 2026 02:49:57 GMT Fixed. CVE-2026-104286. Silence 0h, first fix 4d. Cisco: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-76504/ https://daystopatch.com/incidents/cisco-cve-2026-76504/ Fri, 23 Oct 2026 02:51:20 GMT Fixed. CVE-2026-76504. Silence 0h, first fix <1h. Apple: Apple Multiple Products Out-of-Bounds Write Vulnerability https://daystopatch.com/incidents/apple-cve-2026-86950/ https://daystopatch.com/incidents/apple-cve-2026-86950/ Fri, 23 Oct 2026 09:07:00 GMT Fixed. CVE-2026-86950. Silence 0h, first fix 0h. Citrix: NetScaler ADC and Gateway zero-day RCE pair (input validation and DTLS memory overflow) https://daystopatch.com/incidents/citrix-cve-2026-88771/ https://daystopatch.com/incidents/citrix-cve-2026-88771/ Fri, 23 Oct 2026 02:49:31 GMT Fixed. CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778. Silence 25h, first fix 25h. F5: BIG-IP APM OAuth authorization server heap overflow allowing unauthenticated RCE https://daystopatch.com/incidents/f5-cve-2026-94127/ https://daystopatch.com/incidents/f5-cve-2026-94127/ Fri, 23 Oct 2026 02:49:39 GMT Fixed. CVE-2026-94127. Silence 0h, first fix 0h. Check Point: Check Point Management Server pre-auth path traversal and file upload (exploited since July) https://daystopatch.com/incidents/check-point-cve-2026-93616/ https://daystopatch.com/incidents/check-point-cve-2026-93616/ Fri, 23 Oct 2026 02:49:41 GMT Fixed. CVE-2026-93616. Silence 0h, first fix 0h. Cisco: Cisco Identity Services Engine Authentication Bypass Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-76460/ https://daystopatch.com/incidents/cisco-cve-2026-76460/ Fri, 23 Oct 2026 09:12:07 GMT Fixed. CVE-2026-76460. Silence 0h, first fix 0h. Google: Google Pixel Improper Authorization Vulnerability https://daystopatch.com/incidents/google-cve-2026-58704/ https://daystopatch.com/incidents/google-cve-2026-58704/ Fri, 23 Oct 2026 02:49:57 GMT Status unknown. CVE-2026-58704. Silence –, first fix –. Cisco: Cisco Secure Email Gateway SQL Injection Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-76461/ https://daystopatch.com/incidents/cisco-cve-2026-76461/ Fri, 23 Oct 2026 09:11:28 GMT Fixed. CVE-2026-76461. Silence 0h, first fix 0h. GitLab: GitLab CE/EE path traversal in repository commits API (critical patch release 19.3.2, 19.2.6, 19.1.8) https://daystopatch.com/incidents/gitlab-cve-2026-85706/ https://daystopatch.com/incidents/gitlab-cve-2026-85706/ Fri, 23 Oct 2026 02:51:11 GMT Fixed. CVE-2026-85706. Silence 0h, first fix 0h. Check Point: Check Point Security Gateway and Spark VPN certificate validation flaw allowing pre-auth RCE https://daystopatch.com/incidents/check-point-cve-2026-85102/ https://daystopatch.com/incidents/check-point-cve-2026-85102/ Fri, 23 Oct 2026 02:49:45 GMT Fixed. CVE-2026-85102, CVE-2026-85103. Silence 0h, first fix 0h. Google: Google Chromium V8 Out of Bounds Write Vulnerability https://daystopatch.com/incidents/google-cve-2026-87491/ https://daystopatch.com/incidents/google-cve-2026-87491/ Fri, 23 Oct 2026 10:26:04 GMT Fixed. CVE-2026-87491. Silence 0h, first fix 0h. Microsoft: Microsoft Windows Link Following Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-81963/ https://daystopatch.com/incidents/microsoft-cve-2026-81963/ Fri, 23 Oct 2026 09:09:25 GMT Fixed. CVE-2026-81963. Silence 0h, first fix 0h. Microsoft: Microsoft Windows Heap-Based Buffer Overflow Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-85880/ https://daystopatch.com/incidents/microsoft-cve-2026-85880/ Fri, 23 Oct 2026 09:09:25 GMT Fixed. CVE-2026-85880. Silence 0h, first fix 0h. Adobe: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability https://daystopatch.com/incidents/adobe-cve-2026-75650/ https://daystopatch.com/incidents/adobe-cve-2026-75650/ Fri, 23 Oct 2026 02:50:48 GMT Status unknown. CVE-2026-75650. Silence –, first fix –. N-able: N-able N-central pre-authentication remote code execution (static code injection) https://daystopatch.com/incidents/n-able-cve-2026-86218/ https://daystopatch.com/incidents/n-able-cve-2026-86218/ Fri, 23 Oct 2026 02:51:55 GMT Fixed. CVE-2026-86218. Silence 0h, first fix 0h. Google: Google Chromium V8 Type Confusion Vulnerability https://daystopatch.com/incidents/google-cve-2026-85046/ https://daystopatch.com/incidents/google-cve-2026-85046/ Fri, 23 Oct 2026 10:26:04 GMT Fixed. CVE-2026-85046. Silence 0h, first fix 0h. ConnectWise: ConnectWise ScreenConnect client file transfer and execution without authorization (26.6.5 bulletin) https://daystopatch.com/incidents/connectwise-cve-2026-84869/ https://daystopatch.com/incidents/connectwise-cve-2026-84869/ Fri, 23 Oct 2026 02:50:08 GMT Fixed. CVE-2026-84869. Silence 0h, first fix 5d. SonicWall: SonicWall SMA1000 pre-auth SSRF chained with AMC command injection https://daystopatch.com/incidents/sonicwall-cve-2026-83548/ https://daystopatch.com/incidents/sonicwall-cve-2026-83548/ Fri, 23 Oct 2026 02:52:57 GMT Fixed. CVE-2026-83548, CVE-2026-83549. Silence 0h, first fix 0h. Citrix: NetScaler ADC and Gateway authentication bypass via alternate path (SAML/AAA) https://daystopatch.com/incidents/citrix-cve-2026-19490/ https://daystopatch.com/incidents/citrix-cve-2026-19490/ Fri, 23 Oct 2026 09:08:31 GMT Fixed. CVE-2026-19490, CVE-2026-19489. Silence 0h, first fix 0h. Adobe: Adobe Commerce and Magento Incorrect Authorization Vulnerability https://daystopatch.com/incidents/adobe-cve-2026-71362/ https://daystopatch.com/incidents/adobe-cve-2026-71362/ Fri, 23 Oct 2026 02:49:35 GMT Status unknown. CVE-2026-71362. Silence –, first fix –. Microsoft: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-68820/ https://daystopatch.com/incidents/microsoft-cve-2026-68820/ Fri, 23 Oct 2026 09:09:21 GMT Fixed. CVE-2026-68820. Silence 0h, first fix 0h. Microsoft: Microsoft SharePoint Code Injection Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-65660/ https://daystopatch.com/incidents/microsoft-cve-2026-65660/ Fri, 23 Oct 2026 09:09:21 GMT Fixed. CVE-2026-65660. Silence 0h, first fix 0h. Cisco: Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Denial of Service Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-20349/ https://daystopatch.com/incidents/cisco-cve-2026-20349/ Fri, 23 Oct 2026 09:11:10 GMT Fixed. CVE-2026-20349. Silence 0h, first fix 0h. Apple: Apple macOS Improper Authentication Vulnerability https://daystopatch.com/incidents/apple-cve-2026-65400/ https://daystopatch.com/incidents/apple-cve-2026-65400/ Fri, 23 Oct 2026 09:07:30 GMT Fixed. CVE-2026-65400. Silence 0h, first fix 0h. N-able: N-able N-central authentication bypass and account takeover (CVE-2026-18556 and its incomplete-fix bypass CVE-2026-18577) https://daystopatch.com/incidents/n-able-cve-2026-18577/ https://daystopatch.com/incidents/n-able-cve-2026-18577/ Fri, 23 Oct 2026 02:52:20 GMT Fixed. CVE-2026-18577, CVE-2026-18556. Silence 0h, first fix 5d. Broadcom (VMware): VMware vCenter Syslog server directory-traversal vulnerability (VMSA-2026-0006) https://daystopatch.com/incidents/broadcom-vmware-cve-2026-59310/ https://daystopatch.com/incidents/broadcom-vmware-cve-2026-59310/ Fri, 23 Oct 2026 02:51:52 GMT Fixed. CVE-2026-59310. Silence 0h, first fix 0h. Cisco: Cisco Secure Firewall Management Center Software Static Credential Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-20316/ https://daystopatch.com/incidents/cisco-cve-2026-20316/ Fri, 23 Oct 2026 09:11:42 GMT Fixed. CVE-2026-20316. Silence 0h, first fix 22h. Check Point: Check Point SmartConsole login authentication bypass via application token https://daystopatch.com/incidents/check-point-cve-2026-16232/ https://daystopatch.com/incidents/check-point-cve-2026-16232/ Fri, 23 Oct 2026 02:52:33 GMT Fixed. CVE-2026-16232. Silence 0h, first fix 0h. Microsoft: Microsoft SharePoint Weak Authentication Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-55040/ https://daystopatch.com/incidents/microsoft-cve-2026-55040/ Fri, 23 Oct 2026 09:09:18 GMT Fixed. CVE-2026-55040. Silence 0h, first fix 0h. Microsoft: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-58644/ https://daystopatch.com/incidents/microsoft-cve-2026-58644/ Fri, 23 Oct 2026 09:09:18 GMT Fixed. CVE-2026-58644. Silence 0h, first fix 0h. Microsoft: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-50522/ https://daystopatch.com/incidents/microsoft-cve-2026-50522/ Fri, 23 Oct 2026 09:09:18 GMT Fixed. CVE-2026-50522. Silence 0h, first fix 0h. Microsoft: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-56164/ https://daystopatch.com/incidents/microsoft-cve-2026-56164/ Fri, 23 Oct 2026 09:09:18 GMT Fixed. CVE-2026-56164. Silence 0h, first fix 0h. Microsoft: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability https://daystopatch.com/incidents/microsoft-cve-2026-56155/ https://daystopatch.com/incidents/microsoft-cve-2026-56155/ Fri, 23 Oct 2026 09:09:18 GMT Fixed. CVE-2026-56155. Silence 0h, first fix 0h. SonicWall: SonicWall SMA1000 Work Place SSRF chained with AMC code injection (zero-day) https://daystopatch.com/incidents/sonicwall-cve-2026-15409/ https://daystopatch.com/incidents/sonicwall-cve-2026-15409/ Fri, 23 Oct 2026 09:09:56 GMT Fixed. CVE-2026-15409, CVE-2026-15410. Silence 0h, first fix 0h. Zimbra (Synacor): Zimbra SNMP notification command injection (CVE-2026-73570) https://daystopatch.com/incidents/zimbra-cve-2026-73570/ https://daystopatch.com/incidents/zimbra-cve-2026-73570/ Fri, 23 Oct 2026 02:51:44 GMT Fixed. CVE-2026-73570. Silence 0h, first fix 13d. Adobe: Adobe ColdFusion Path Traversal Vulnerability https://daystopatch.com/incidents/adobe-cve-2026-48282/ https://daystopatch.com/incidents/adobe-cve-2026-48282/ Fri, 23 Oct 2026 02:53:02 GMT Status unknown. CVE-2026-48282. Silence –, first fix –. Citrix: NetScaler ADC and Gateway memory overflow (Gateway/AAA) later exploited for RCE https://daystopatch.com/incidents/citrix-cve-2026-8452/ https://daystopatch.com/incidents/citrix-cve-2026-8452/ Fri, 23 Oct 2026 09:08:45 GMT Fixed. CVE-2026-8452, CVE-2026-8451, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474. Silence 0h, first fix 0h. Linux kernel: Linux kernel IPv6 fraggap heap overflow, 'ipv6_frag_escape' container escape (CVE-2026-53362) https://daystopatch.com/incidents/linux-kernel-cve-2026-53362/ https://daystopatch.com/incidents/linux-kernel-cve-2026-53362/ Fri, 23 Oct 2026 02:50:59 GMT Fixed. CVE-2026-53362. Silence 5.6d, first fix 5.6d. Linux kernel: Linux kernel netfilter ebtables SNAT ARP rewrite out-of-bounds write (CVE-2026-53266) https://daystopatch.com/incidents/linux-kernel-cve-2026-53266/ https://daystopatch.com/incidents/linux-kernel-cve-2026-53266/ Fri, 23 Oct 2026 02:49:52 GMT Fixed. CVE-2026-53266. Silence 0h, first fix 0h. Zyxel: Zyxel GS1900 series switches CGI stack-based buffer overflow https://daystopatch.com/incidents/zyxel-cve-2026-7273/ https://daystopatch.com/incidents/zyxel-cve-2026-7273/ Fri, 23 Oct 2026 02:49:46 GMT Fixed. CVE-2026-7273. Silence 0h, first fix 0h. Cisco: Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability https://daystopatch.com/incidents/cisco-cve-2026-20262/ https://daystopatch.com/incidents/cisco-cve-2026-20262/ Fri, 23 Oct 2026 02:53:15 GMT Fixed. CVE-2026-20262. Silence 0h, first fix 0h. Oracle: Oracle PeopleSoft PeopleTools zero-day exploited by ShinyHunters (CVE-2026-35273) https://daystopatch.com/incidents/oracle-cve-2026-35273/ https://daystopatch.com/incidents/oracle-cve-2026-35273/ Fri, 23 Oct 2026 02:54:26 GMT Fixed. CVE-2026-35273. Silence 0h, first fix 6d.