Company
Offensive security firm known for its NodeZero autonomous pentesting platform and for researching and disclosing exploitable vulnerabilities.
Horizon3 detailed how two AhsayCBS backup-server flaws chain into unauthenticated code execution as SYSTEM and root. Attackers were already planting webshells through the chain before Ahsay issued hotfixes on 12 October 2026.
Reality
CISA added Zammad's unauthenticated WebSocket session-disclosure flaw, CVE-2026-102489, to its exploited-vulnerabilities catalog on October 2. The fix ships in Zammad 7.2.0, leaving teams on the unsupported 6.5-and-earlier releases to make a major-version jump.
Reality
WatchTowr reproduced CVE-2026-19478 from the advisory and patch alone, then caught the first exploitation attempts on its honeypots. Self-managed owners do not get a week to schedule this.
Perspective Coverage
5 publishersReality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
Horizon3 reproduced CVE-2026-102489 and showed one unauthenticated request to Zammad's /ws endpoint reflects every active user's session cookie. A leaked admin cookie opens the second half of the chain, remote code execution.
Reality
VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.
Perspective Coverage
4 publishersReality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishersReality
Rejetto HFS 3.0.0 through 3.2.0 signs session cookies with a Math.random() key, and five leaked PRNG outputs let an attacker forge an admin session. Exploitation began on October 1, and version 3.2.1 restores secure key generation.
Reality
Horizon3 used Anthropic's Mythos model to find CVE-2026-61500, a chain that forges Rejetto HFS admin sessions and reaches remote code execution. The firm expects frontier models to make deeper, less reliable bug classes worth weaponizing at scale.
Reality
Cisco Talos says three threat clusters are exploiting a CVSS 10.0 pre-auth root bypass and a 5.3 hard-coded credential in Secure Firewall Management Center. A patch policy with a severity cutoff above 5.3 would have skipped the credential fix on the console that pushes policy to every managed firewall.
Reality
Exposure to CVE-2026-19490, a CVSS 9.8 NetScaler bypass CISA lists as exploited, depends on each appliance's exact build and SAML setup. Older builds qualify with any Gateway or AAA virtual server, while later builds short of the fix also need a SAML action configured.
Reality
An Iran-linked intrusion kept a British generator down for four days while US wastewater plants lost pressure across 12 states. The number that matters now is restoration time.
Perspective Coverage
4 publishersReality
CVE-2026-86218 lets an unauthenticated attacker run code on an N-central server with no user interaction. N-able fixed it in build 2026.3.1.14 and has already patched its own hosted instances.
Reality
A Horizon3.ai whitepaper argues offensive operations have entered a machine-speed era. The one figure in it tied to a real campaign is Anthropic's estimate that AI ran 80 to 90 percent of the tactical work.
Reality
CVE-2026-48710 is in CISA's Known Exploited Vulnerabilities catalog, scored 6.5 by Starlette's maintainers and 10.0 by Horizon3.ai once chained with a LiteLLM command injection. Version 1.0.1 is the fix.
Reality
Formerly CYTRIX, the company says more than 25 agents exploit, rank, route and then retest customer systems continuously. The accuracy and growth figures are self-reported, and the 0.1% false-positive rate comes without a sample or a period.
Reality
Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
PaperCut says the advisory covers all releases of NG and MF, that exploitation is already happening in customer environments, and that its fix is an emergency patch built outside the normal release process.
Reality