Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Q1 2026 Critical Vulnerability Roundup: Mitigating Risk

netspi.com | blog | #rce | #patch-management | #ivanti | #epmm | #in-the-wild | #vulnerability-roundup | #oracle-weblogic | #cve-2026-21962

Summary

A Q1 2026 roundup of top exploited criticals, including unauthenticated RCE in the Oracle WebLogic Server Proxy Plugin and an Ivanti EPMM auth bypass plus path traversal combo (CVE-2026-1281/1340).
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Ivanti Endpoint Manager Mobile (EPMM) [CVE-2026-1281 & CVE-2026-1340]: Overview & Takeaways
Ivanti EPMM has two actively exploited zero-day code injection flaws, CVE-2026-1281 and CVE-2026-1340, letting unauthenticated remote attackers compromise appliances and access sensitive data.
vulnerability · wiz.io
Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild
Wiz details in-the-wild exploitation of Ivanti EPMM: CVE-2025-4427 (auth bypass) plus CVE-2025-4428 (Java EL injection RCE) combine into unauthenticated RCE — despite CVSS scores of 5.3 and 7.2.
vulnerability · hacktron.ai
Hacktron finds another pre-auth RCE variant in Ivanti EPMM
Hacktron identified a new EL injection sink in Ivanti EPMM and used it to demonstrate yet another pre-authentication RCE variant in the mobile device management platform.
blog · bishopfox.com
Understanding the CVE Ecosystem and NIST’s Changing Role
Bishop Fox unpacks NIST's move to prioritized CVE enrichment — KEV, federal software, and EO 14028 critical software first from April 15, 2026 — and argues for risk-based patch management.
blog · bishopfox.com
OOB Memory Read: Netscaler ADC and Gateway
Bishop Fox details an unauthenticated out-of-bounds memory read in Citrix NetScaler ADC and Gateway (CVE-2023-6549) that can leak prior POST request bodies; patched releases listed per CTX584986.
blog · hackerone.com
Patch the Planet: HackerOne Joins OpenAI's Daybreak Initiative to Secure Critical Open-Source Software
HackerOne is a launch partner in Patch the Planet, a new initiative pairing AI-assisted research with expert human validation to deliver verified fixes to open-source maintainers at scale.
back