TODAY

THE THREE

1. #1 · CVE-2026-33824

   Windows

   KEV

   What: A flaw in Windows IKE (the VPN key-exchange component) lets an attacker run their own code on your Windows machine over the network with no login required — KEV-listed just 3 days ago with a 78% exploit probability. Any Windows system reachable on the network is at risk of full takeover.

   Why it moved: Actively exploited · KEV-listed this week · Everyone runs this · Critical severity · 78% exploit odds · New this week

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply Microsoft's patch for CVE-2026-33824 to all Windows systems immediately.

2. #2 · CVE-2026-8037

   Progress

   KEV

   What: Progress LoadMaster load balancers have a command injection flaw that lets anyone on the internet run arbitrary commands on the appliance — no credentials needed, and exploit probability is essentially certain at 99%. Compromise of a load balancer can expose every application sitting behind it.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 99% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Update Progress LoadMaster to the patched version or isolate it from the internet now.

3. #3 · CVE-2026-34486

   Apache

   KEV

   What: Apache Tomcat's traffic encryption can be bypassed, and this flaw chains with a previously known vulnerability (CVE-2025-24813) to amplify the damage — 83% exploit odds and actively exploited. Organizations running Tomcat for web apps risk sensitive data exposure or full server compromise.

   Why it moved: Actively exploited · Everyone runs this · 83% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Patch Apache Tomcat and verify EncryptInterceptor is properly configured after updating.

TRAVERSAL

NUMBERS

Entities

11M

Relationships

67M

Threat actors

359

Indicators

568k

Feeds live

0

Sources total

21