TODAY

THE THREE

1. #1 · CVE-2026-33824

   Microsoft

   KEV

   What: A memory bug in Microsoft's IKE networking service lets an attacker run their own code on your system remotely — no login required. This hits any Windows system using IKE for VPN or network authentication, which is most enterprise environments.

   Why it moved: Actively exploited · Everyone runs this · Critical severity · 73% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply Microsoft's patch for CVE-2026-33824 immediately, prioritize internet-facing systems.

2. #2 · CVE-2026-8037

   Progress

   KEV

   What: Progress LoadMaster — a widely used application delivery controller — has a command injection flaw that anyone on the internet can exploit without a password to run arbitrary commands on the appliance. Exploit probability is essentially 100%, meaning working attack tools are in the wild.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 100% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Update Progress LoadMaster to the patched version and block external management access.

3. #3 · CVE-2026-34486

   Apache

   KEV

   What: Apache Tomcat's encryption protection can be completely bypassed, and this flaw chains with a previously known vulnerability (CVE-2025-24813) to amplify damage — attackers can potentially read or manipulate sensitive data in transit. Tomcat is everywhere, and exploit likelihood is 99%.

   Why it moved: Actively exploited · Everyone runs this · 99% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Patch Apache Tomcat now and verify EncryptInterceptor is correctly configured post-update.

TRAVERSAL

NUMBERS

Entities

11M

Relationships

67M

Threat actors

291

Indicators

590k

Feeds live

18

Sources total

21