CISA added a critical ownCloud flaw to its exploited-vulnerabilities catalog after attackers used it to steal data from a research organization. Tracked as CVE-2023-49105 and scored 9.8, the WebDAV authentication-bypass bug lets an unauthenticated attacker who knows a victim's username read, modify, or delete that user's files when no signing key is configured, which is the platform's default. Disclosed back in November 2023, it affects ownCloud Server core versions 10.6.0 through 10.13.0 and was fixed in 10.13.1, yet unpatched instances remain exposed nearly two years later. Public exploit code exists, and CISA set a short deadline for federal agencies, underscoring that long-standing self-hosted flaws keep getting weaponized.
CISA warned that attackers are exploiting a critical flaw in Gitea, the popular self-hosted Git service, and added it to its exploited-vulnerabilities catalog. Tracked as CVE-2026-60004 and scored 9.8, the code-injection bug lets a user with repository write access send a malicious patch to the diffpatch API endpoint, planting an executable Git hook that runs shell commands as the Gitea service account. Crucially, default installations have open self-registration, so an unauthenticated attacker can simply register, create a repository, and gain code execution. It affects versions 1.17 through 1.27.0 and was fixed in July, and reports describe attackers dropping cryptocurrency miners, with one intrusion taking about eleven seconds.
CISA confirmed that ransomware groups are now exploiting a Windows Task Host privilege-escalation flaw that has been flagged as actively exploited since April. Tracked as CVE-2025-60710 and scored 7.8, it is a link-following weakness in the component that runs background scheduled tasks as SYSTEM: a local attacker with only basic user rights can use a junction on a user-writable path to make a SYSTEM-level task act on files it should not, escalating to full control. Microsoft patched it in November 2025, and it affects Windows 11 and Server 2025. Privilege escalation like this is exactly what ransomware operators need to disable defenses and spread after gaining an initial foothold.
CISA added a critical Progress Kemp LoadMaster flaw to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-8037 and scored 9.6, it is a command injection bug that lets an unauthenticated attacker run arbitrary commands on the load balancer appliance through unsanitized input in several command endpoints. watchTowr traced it to improper handling of user input in a quote-escaping function. Telemetry recorded 792 exploitation attempts over 41 days from 65 addresses across 18 countries, with activity as recent as early August. Federal agencies were directed to patch by August 10, a useful signal of urgency for everyone else.
TrustStrike Labs