TODAY
Old, unpatched servers and edge devices are still being actively exploited
THE THREE
- KEV#1 · CVE-2016-3081
Apache
What: Attackers can run their own commands on web apps built on Apache Struts with a certain feature enabled, with no login needed. This is a very old bug with a 96% exploit-odds score, and it often leads to full server takeover.
Why it moved: Actively exploited · Everyone runs this · 96% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Find Struts apps, patch them, and disable Dynamic Method Invocation.
- KEV#2 · CVE-2026-85706
Gitlab
What: Anyone on the internet can read files off a vulnerable GitLab server without logging in. That can expose source code, passwords and API keys stored in repositories. It scores a perfect 10.0.
Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Update GitLab to the fixed version and rotate any stored secrets.
- KEV#3 · CVE-2026-20079
Cisco
What: Attackers can skip the login on Cisco's firewall management console and take control of the system that manages your firewalls. Control of that console lets them change security rules across your network. It scores 10.0.
Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Apply Cisco's patch and restrict management access to trusted networks.
TRAVERSAL
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Entities
- 12M
- Relationships
- 67M
- Threat actors
- 246
- Indicators
- 1000k
- Feeds live
- 20
- Sources total
- 24
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.