Latest briefing — 2026-09-04 (updated daily)
Nine CVEs newly exploited; patch Microsoft, Ivanti, and Progress now.
AI-written summary of the ranked list. The ranking and scores are computed from the graph; the prose is model-generated.
Today's top 3 vulnerabilities to patch
- KEV
What: This flaw in Microsoft's IKE Service — used in Windows VPN and secure networking — lets attackers remotely take over systems with no user interaction required. With a 73% exploit probability and confirmed active exploitation, any Windows system with IKE exposed is a target.
Why it moved: Actively exploited · Everyone runs this · Critical severity · 73% exploit odds
Who is exploiting: No named group yet — CISA confirms active attacks
Action · Apply Microsoft's patch for CVE-2026-33824 immediately across all Windows systems.
- KEV
What: Progress LoadMaster load balancers have a command injection flaw that unauthenticated attackers are already exploiting in the wild — essentially a front door anyone on the internet can walk through to run their own commands on your appliance. Exploit probability is effectively 100%.
Why it moved: Actively exploited · Widely deployed · Critical severity · 100% exploit odds
Who is exploiting: No named group yet — CISA confirms active attacks
Action · Update Progress LoadMaster firmware now and restrict management interfaces to trusted IPs.
- KEV#3 · CVE-2026-10520
Ivanti
What: Ivanti Sentry, which sits at the edge managing mobile device traffic, has a maximum-severity flaw (CVSS 10.0) allowing unauthenticated remote attackers to gain full root control — this is as bad as it gets, and it's being actively exploited. Any exposed Sentry appliance should be treated as potentially compromised.
Why it moved: Actively exploited · Widely deployed · Critical severity · 100% exploit odds
Who is exploiting: No named group yet — CISA confirms active attacks
Action · Patch Ivanti Sentry immediately and audit logs for signs of unauthorized access.
How today's threats connect
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Threat-intel graph nodes (older definition)
- —
- Threat-intel graph relationships (older definition)
- —
- Threat actors (reviewed)
- —
- Indicators (all-time)
- —
- Feeds reporting (older definition)
- —
- Sources with data
- 21
This edition predates threat-intel-only counting; its entity, relationship, actor, indicator and feed totals used older definitions (non-threat news data, unreviewed actors), so they are not shown.
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.