Second Cisco SD-WAN Zero-Day Chains From May's Auth Bypass — No Patch Available
CVE-2026-20245 is a privilege escalation zero-day in Cisco Catalyst SD-WAN Manager being actively exploited. It requires the access conditions created by CVE-2026-20182.
Vulnerability
CVE-2026-8732: WP Maps Pro Support Feature Allows Unauthenticated Admin Account Creation
A missing authentication flaw in WP Maps Pro's vendor support feature allows any unauthenticated attacker to create a WordPress administrator account with a single HTTP request. CVSS 9.8, confirmed active exploitation, 15,800+ installs.
Android Framework Integer Overflow Under Active Targeted Exploitation (CVE-2025-48595)
Google's June 2026 Android Security Bulletin patches an actively exploited integer overflow in the Android Framework that enables local privilege escalation without user interaction. 124 vulnerabilities total, one confirmed zero-day. CISA KEV deadline June 5.
A Nine-Year-Old ptrace Bug Let Unprivileged Users Read SSH Keys and Shadow Passwords
CVE-2026-46333, disclosed by Qualys on May 21, exploits a race condition in the Linux kernel's ptrace access check to steal SSH host private keys, shadow password hashes, and in two variants, execute arbitrary commands as root. The bug has been in the kernel since November 2016.
Six Zero-Days in Six Weeks: Inside Chaotic Eclipse's Windows Exploit Spree
A researcher publishing as Chaotic Eclipse has released six Windows zero-days since April 2026 — escalation flaws, a BitLocker bypass, and a post-exploitation tool — each one following a failed or incomplete vendor response. The latest, MiniPlasma, escalates to SYSTEM on fully patched Windows 11 using a bug Microsoft believed it fixed in 2020.
The Auth Check Is the Attack Surface
A pre-authentication SQL injection in LiteLLM's API key verification path gave attackers read/write access to every credential the proxy manages — and the 401 it returned made each successful query look like a failed login.
When the Handshake Is the Hole: CVE-2026-41089 and the Netlogon Stack Overflow
A pre-authentication buffer overflow in Windows Netlogon puts every unpatched domain controller one crafted packet away from full domain compromise.
When the Firewall Is the Vulnerability
CVE-2026-0300 gives an unauthenticated attacker root-level code execution on PAN-OS firewalls — no credentials, no interaction required. Here's how the Captive Portal became the entry point, what the attackers did next, and why owning the perimeter is a different category of problem.
Copy Fail: How a Nine-Year-Old Kernel Optimization Became a Universal Linux Root Exploit
A logic bug buried in the Linux kernel's cryptographic subsystem since 2017 now lets any unprivileged user become root — reliably, silently, and in 732 bytes of Python. Here is exactly how it works, why containers make it worse, and what to do about it.
CVE-2026-20182: How a Trust Boundary Failure in Cisco SD-WAN Enables Full Fabric Compromise
A missing verification branch in the vdaemon control-plane service lets any unauthenticated attacker become a trusted SD-WAN peer — and from there, rewrite routing policy across every edge site.