Loading story…
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation affecting Samsung MagicINFO 9 Server, SimpleHelp, and D-Link DIR-823X devices. The newly listed flaws are CVE-2024-7399 in Samsung MagicINFO, CVE-2024-57726 and CVE-2024-57728 in SimpleHelp, and CVE-2025-29635 in D-Link DIR-823X. The Samsung issue allows unauthenticated attackers to upload JSP files and execute code with system-level privileges, while the D-Link flaw is a command injection bug that Akamai said is being exploited by a Mirai botnet through crafted POST requests.
The two SimpleHelp vulnerabilities are especially concerning because they can be chained from a low-privileged technician account into full server and downstream host compromise, a pattern linked to ransomware precursor activity. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate the KEV-listed flaws by May 8, 2026, and CISA urged broader patching and review as attackers increasingly target peripheral infrastructure such as remote support platforms, digital signage servers, and SOHO edge devices.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA required Federal Civilian Executive Branch agencies to remediate the newly listed KEV vulnerabilities by 2026-05-08. Private organizations were also urged to review and patch affected systems.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2024-7399 in Samsung MagicINFO 9 Server, CVE-2024-57726 and CVE-2024-57728 in SimpleHelp, and CVE-2025-29635 in D-Link DIR-823X. The agency cited evidence of active exploitation for all four flaws.
Akamai reported that a Mirai botnet was exploiting CVE-2025-29635 in D-Link DIR-823X routers using crafted POST requests. This established active exploitation of the D-Link vulnerability in the wild.
Researchers observed exploitation of CVE-2024-7399 in Samsung MagicINFO 9 Server shortly after public proof-of-concept code was released. The flaw allows unauthenticated attackers to upload JSP files and execute code with system-level privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: a command injection flaw in Array Networks ArrayOS AG VPN devices (CVE-2025-66644) and a buffer overflow in D-Link Go-RT-AC750 routers (CVE-2022-37055). The Array Networks vulnerability affects versions before 9.4.5.9 and has been exploited since August 2025, primarily targeting Japanese organizations, allowing attackers to deploy PHP webshells and create rogue user accounts. The D-Link vulnerability impacts end-of-life routers, enabling remote code execution and lateral movement, with no official patches available, prompting recommendations for device retirement and additional mitigations. Federal agencies are mandated under Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by specified deadlines, while all organizations are strongly urged to prioritize patching and mitigation efforts. CISA emphasizes the persistent risk posed by vulnerabilities in VPN appliances and legacy routers, recommending immediate action such as patching, isolating affected hardware, and integrating KEV feeds into vulnerability management processes to reduce exposure to active cyber threats.
Jun 29, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1666 to 1670 entries and flagging active exploitation affecting **Microsoft Internet Key Exchange (IKE) Service Extensions**, **Microsoft SharePoint**, **Broadcom VMware vCenter**, and **Apple macOS Screen Sharing**. The newly listed issues are `CVE-2026-33824`, `CVE-2026-55040`, `CVE-2026-59310`, and `CVE-2026-65400`, covering weaknesses that can enable remote code execution, path traversal, weak authentication, or improper authentication. Under **BOD 22-01**, CISA directed U.S. federal agencies to remediate all four flaws by **2026-08-21** and urged other organizations to review exposure and apply available fixes. Reporting on the update said the SharePoint issue is tied to a JWT forgery attack chain, while the macOS Screen Sharing flaw was confirmed as actively exploited by the Dutch National Cyber Security Centre; Apple has already released patches, and CISA's KEV data indicates ransomware use is currently unknown for all four CVEs.
Aug 23, 2026