Rapid7 Intelligence

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 Intelligence

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Rapid7 Intelligence

Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)

CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

Rapid7 Analysis: Check Point SmartConsole Authentication Bypass (CVE-2026-16232)

CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild

From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

Anna Širokova, Jan Recinsky

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)

Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain

Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime

Jeremy Makowski