The Debrief

First Contact 3 September 2026

Kestra had a login, and a suffix match walked around it

A CVSS 10.0 flaw let unauthenticated attackers run workflows as root on reachable Kestra servers. Microsoft assesses it was exploited the same month it was disclosed, and CISA cataloged it ten weeks later.

5 min read

First Contact 2 September 2026

SonicWall SMA1000: two pre-auth chains in seven weeks

SonicWall says both new SMA1000 flaws are being exploited. The entry point is a CVSS 10.0 bug in the internet-facing portal that needs no credential, and it is the second of that shape since July.

5 min read

First Contact 1 September 2026

JFrog Artifactory: the self-hosted ones were reachable, the cloud ones were not

JFrog's own advisory says an unauthenticated attacker with network access could obtain administrative privileges. Four days after the patch shipped, a research firm reported seeing exactly that.

5 min read

First Contact 27 August 2026

PaperCut was exploited before it had a CVE to give

PaperCut told customers on 27 August that a vulnerability in NG and MF was being exploited. Before there was a CVE or a build for every branch, the instruction was to restrict the web interface to trusted addresses.

5 min read

First Contact 25 August 2026

TeamCity CVE-2026-63077: ransomware found the 160 servers still exposed

TeamCity CVE-2026-63077 is under active exploitation. JetBrains says internet-facing servers should restrict external access and limit reachability to trusted networks.

5 min read

First Contact 24 August 2026

Cisco ASA SSL-VPN: a denial of service with no workaround to apply

Cisco says CVE-2026-20349 has no workaround. Its own firewall guidance still shows that organizations can restrict who reaches the VPN service.

4 min read

First Contact 23 August 2026

Akira used valid credentials on a SonicWall SSL VPN with no MFA

An Akira affiliate entered through an exposed SSL VPN with valid credentials and no MFA. EDR later mattered, but only after the attacker was already inside.

4 min read

First Contact 20 August 2026

NetScaler CVE-2026-19490: the SAML path answers before the login does

Citrix disclosed a critical NetScaler authentication bypass on 19 August, the third serious problem in the same pre-authentication SAML surface since the end of June. Workarounds listed: None.

5 min read

First Contact 17 August 2026

FortiClient EMS: one forged header and the console pushed the malware

An unauthenticated API bypass in FortiClient EMS gave attackers the management server, which they used to push an infostealer to managed endpoints disguised as a Fortinet patch. The console was reachable before it authenticated anything.

5 min read