TODAY

THE THREE

1. #1 · CVE-2016-3081

   Apache

   KEV

   What: If your organization runs Apache Struts with Dynamic Method Invocation enabled, an attacker can remotely run any command on your server — this 10-year-old bug was just added to CISA's exploited list this week with a 96% chance of active exploitation. The result is full server takeover, often leading to ransomware or data theft.

   Why it moved: Actively exploited · KEV-listed this week · Everyone runs this · 96% exploit odds · New this week

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Disable Dynamic Method Invocation in Apache Struts immediately and apply the latest patch.

2. #2 · CVE-2026-85706

   Gitlab

   KEV

   What: Any organization hosting GitLab (Community or Enterprise Edition) is at risk — an unauthenticated attacker can read any file on your server through the repository commits API, exposing source code, credentials, and secrets. This is actively exploited with a 93% exploit probability.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Update GitLab to the latest patched version and restrict public API access now.

3. #3 · CVE-2026-20079

   Cisco

   KEV

   What: Organizations using Cisco Firewall Management Center or Security Cloud Control are exposed to complete authentication bypass — an attacker with no credentials can take over your firewall management console remotely. This is a perfect-score CVSS 10 flaw that is actively exploited.

   Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds

   Who is exploiting: Actively-exploited (CISA KEV)

   Action · Apply Cisco's patch for FMC/SCC immediately and isolate management interfaces from the internet.

TRAVERSAL

NUMBERS

Entities

12M

Relationships

67M

Threat actors

244

Indicators

985k

Feeds live

19

Sources total

24