TODAY
Windows, macOS, and SharePoint all hit with active exploits this week.
THE THREE
- KEV#1 · CVE-2026-33824
Windows
What: This Windows flaw lets an attacker run their own code on your machine over the network with no login required — it was added to CISA's exploited list 6 days ago and has a 78% probability of being exploited. Every Windows shop is exposed.
Why it moved: Actively exploited · KEV-listed this week · Everyone runs this · Critical severity · 78% exploit odds · New this week
Who is exploiting: Actively-exploited (CISA KEV)
Action · Apply Microsoft's patch for the Windows IKE Extension immediately.
- KEV#2 · CVE-2026-8037
Progress
What: Progress LoadMaster load balancers can be fully taken over by anyone on the internet — no credentials needed — and exploit probability is essentially 100%. Attackers can run any command on the appliance, making this a network chokepoint nightmare.
Why it moved: Actively exploited · Widely deployed · Critical severity · 99% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Update Progress LoadMaster to the vendor-patched version right now.
- KEV#3 · CVE-2026-34486
Apache
What: Apache Tomcat's encryption protection can be bypassed, and this flaw chains with a previously known vulnerability (CVE-2025-24813) to amplify the damage — 83% exploit odds and actively being used in the wild. Any org running Tomcat for web apps is at risk of data exposure or takeover.
Why it moved: Actively exploited · Everyone runs this · 83% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Patch Apache Tomcat and verify EncryptInterceptor is properly configured.
TRAVERSAL
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Entities
- 11M
- Relationships
- 67M
- Threat actors
- 289
- Indicators
- 574k
- Feeds live
- 0
- Sources total
- 21
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.