TODAY

THE THREE

1. #1 · CVE-2016-3081

   Apache

   KEV

   What: This 2016 Apache Struts flaw — the same class of bug behind major breaches — was just added to CISA's exploited list 5 days ago with a 96% chance of active exploitation, meaning attackers are running working code against it right now. Any internet-facing Java application built on Struts 2.3.x with Dynamic Method Invocation enabled can be fully taken over remotely.

   Why it moved: Actively exploited · KEV-listed this week · Everyone runs this · 96% exploit odds · New this week

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Disable Dynamic Method Invocation in Struts configs or upgrade Struts immediately.

2. #2 · CVE-2026-85706

   Gitlab

   KEV

   What: An unauthenticated attacker can read any file on your GitLab server through a path traversal flaw — source code, secrets, credentials, CI/CD tokens, all exposed without logging in. With a CVSS of 10.0 and 93% exploit odds, this is a full compromise waiting to happen for any org running GitLab CE or EE.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply GitLab's patch immediately; block unauthenticated access to the commits API at your perimeter.

3. #3 · CVE-2026-20079

   Cisco

   KEV

   What: Cisco's Firewall Management Center and Security Cloud Control have an authentication bypass that lets a remote attacker skip login entirely — meaning your firewall management plane could be controlled by an outsider. A CVSS 10.0 on your security infrastructure is about as bad as it gets.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply Cisco's patch for FMC/SCC now and restrict management access to trusted IPs only.

TRAVERSAL

NUMBERS

Entities

12M

Relationships

67M

Threat actors

244

Indicators

980k

Feeds live

20

Sources total

24