TODAY
Old and new exploited flaws hit firewalls, GitLab, SharePoint and Struts; patch internet-facing systems first
THE THREE
- KEV#1 · CVE-2016-3081
Apache
What: Anyone running Apache Struts web apps with Dynamic Method Invocation enabled can be taken over remotely, which means stolen data or a foothold for ransomware. It was added to the CISA exploited list 9 days ago, and its exploit odds are 96%.
Why it moved: Actively exploited · Everyone runs this · 96% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Upgrade Struts or disable Dynamic Method Invocation on every app.
- KEV#2 · CVE-2026-85706
Gitlab
What: An attacker with no login can read any file on an unpatched GitLab server. That can expose source code, secrets and credentials. It scores a 10.0 and has been actively exploited for 36 days.
Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Patch GitLab now and rotate any secrets stored on the server.
- KEV#3 · CVE-2026-20079
Cisco
What: Cisco Secure Firewall Management Center and Security Cloud Control Firewall Management can be accessed without logging in. An attacker who controls your firewall manager controls your network defenses. It scores a 10.0 and has been exploited for 38 days.
Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Apply Cisco's fix and restrict management access to trusted networks.
TRAVERSAL
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Entities
- 12M
- Relationships
- 67M
- Threat actors
- 246
- Indicators
- 996k
- Feeds live
- 20
- Sources total
- 24
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.