TODAY

THE THREE

1. #1 · CVE-2016-3081

   Apache

   KEV

   What: If your organization runs Apache Struts with Dynamic Method Invocation enabled — common in older Java web apps — attackers can execute any command on your server remotely, no credentials needed. This 10-year-old flaw was just added to CISA's exploited list four days ago, meaning active attacks are happening right now.

   Why it moved: Actively exploited · KEV-listed this week · Everyone runs this · 96% exploit odds · New this week

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Audit all Apache Struts deployments and disable Dynamic Method Invocation immediately.

2. #2 · CVE-2026-85706

   Gitlab

   KEV

   What: Any organization hosting GitLab (self-managed Community or Enterprise Edition) is at risk: an unauthenticated attacker can read arbitrary files from your repositories, potentially exposing source code, secrets, and credentials. With 93% exploit probability and active exploitation confirmed, this is a high-priority fix.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply GitLab's latest security patch or restrict repository commits API access now.

3. #3 · CVE-2026-20079

   Cisco

   KEV

   What: Cisco Firewall Management Center and Security Cloud Control are your network's control plane — a bypass here lets an unauthenticated attacker take over firewall policy, effectively blinding your defenses. This is actively exploited and a perfect ransomware pre-stage.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply Cisco's patch for FMC/SCC and verify no unauthorized admin sessions exist.

TRAVERSAL

NUMBERS

Entities

12M

Relationships

67M

Threat actors

244

Indicators

977k

Feeds live

20

Sources total

24