TODAY
Windows, SharePoint, and macOS all hit with active exploits this week.
THE THREE
- KEV#1 · CVE-2026-33824
Windows
What: Any Windows machine reachable over a network can be fully taken over without a password — attackers are already doing this, and nearly every organization runs Windows. This is a ransomware delivery vector waiting to happen.
Why it moved: Actively exploited · KEV-listed this week · Everyone runs this · Critical severity · 78% exploit odds · New this week
Who is exploiting: Actively-exploited (CISA KEV)
Action · Apply Microsoft's patch for the Windows IKE Extension flaw immediately.
- KEV#2 · CVE-2026-8037
Progress
What: Progress LoadMaster load balancers are being actively exploited by unauthenticated attackers who can run any command on the appliance — effectively owning your network edge. Exploit probability is essentially certain at 99%.
Why it moved: Actively exploited · Widely deployed · Critical severity · 99% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Patch or isolate all Progress LoadMaster appliances from internet exposure now.
- KEV#3 · CVE-2026-34486
Apache
What: Apache Tomcat's traffic encryption can be bypassed, and this flaw chains with a previously known Tomcat vulnerability — meaning attackers can combine both for greater impact on any org running Tomcat web servers.
Why it moved: Actively exploited · Everyone runs this · 83% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Update Apache Tomcat and verify EncryptInterceptor is functioning after patching.
TRAVERSAL
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Entities
- 11M
- Relationships
- 67M
- Threat actors
- 359
- Indicators
- 572k
- Feeds live
- 0
- Sources total
- 21
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.