Version 1.2: PHP - Kritische Schwachstellen bedrohen Webanwendungen weltweit
No brief is available for this item.
Read the original at www.bsi.bund.de (in German)
Security bulletins
Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
Version 1.0: BeyondTrust Remote Support - Zero-Day Schwachstelle seit mindestens August ausgenutzt
BeyondTrust Remote Support has a zero-day vulnerability.
BeyondTrust Remote Support has a critical vulnerability tracked as CVE-2026-102764. BeyondTrust has rated it 9.3 out of 10. The Google Threat Intelligence Group and BeyondTrust report exploitation since August.
Recommended by the publisher: BSI recommends updating BeyondTrust Remote Support.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: Cisco Secure Email Gateway - Zero-Day Schwachstelle wird aktiv ausgenutzt
Cisco Secure Email Gateway has a zero-day vulnerability.
CVE-2026-76519 affects Cisco Secure Email Gateway, allowing remote attackers to write files and execute commands with root privileges. Cisco has confirmed exploitation. The vulnerability is caused by a flawed processing of email attachments with the Advanced Malware Protection feature enabled.
Recommended by the publisher: BSI recommends updating the product.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: Ivanti Connect Secure - Aktive Ausnutzung mehrerer Zero-Day Schwachstellen
Ivanti Connect Secure has zero-day vulnerabilities.
Ivanti Connect Secure has a zero-day vulnerability with CVE-2026-104935, allowing remote command execution. Ivanti reports limited attacks. The CVSS score is 8.6.
Recommended by the publisher: Ivanti published an advisory.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.1: Citrix NetScaler - Systeme werden über ZeroDay-Schwachstellen angegriffen
Citrix NetScaler systems are under attack via ZeroDay vulnerabilities.
The BSI reports active exploitation of two ZeroDay vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in Citrix NetScaler ADC and NetScaler Gateway. These vulnerabilities allow remote code execution without authentication. The CVSS score is 9.5.
Recommended by the publisher: The BSI recommends updating affected systems.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: Check Point - Angreifer nutzen Schwachstellen seit Sommer aus
Check Point products are affected by critical vulnerabilities.
Check Point's Spark Firewall and Security Gateway Appliances are affected by CVE-2026-85102 and CVE-2026-93616. These vulnerabilities allow authentication bypass and remote code execution. The BSI assesses that exploitation is confirmed by the source.
Recommended by the publisher: The BSI recommends checking the advisory for Spark Firewall and Security Management Server products.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: F5 BIG-IP APM - Aktive Ausnutzug einer Zero-Day Schwachstelle
F5 BIG-IP APM has a zero-day vulnerability.
The vulnerability, CVE-2026-94127, allows remote code execution on APM appliances. F5 reports active exploitation. The CVSS score is 9.8/10.
Recommended by the publisher: The BSI recommends updating F5 BIG-IP APM.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: Cisco Secure Email Gateway - Aktive Ausnutzung einer Zero-Day-Schwachstelle
Cisco Secure Email Gateway has a zero-day vulnerability.
Cisco Secure Email Gateway is affected by CVE-2026-76461, a vulnerability in E-Mail Parsing of AsyncOS. The BSI reports that an attacker could execute SQL commands with root rights. Cisco has confirmed exploitation of the vulnerability.
Recommended by the publisher: The BSI recommends reviewing the Cisco advisory.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: GitLab - Schwachstellen bereits kurz nach Veröffentlichung im Fokus von Angreifern
GitLab has security vulnerabilities.
GitLab Enterprise and Community editions have 18 security vulnerabilities. The CVSS shows 2 critical, 6 high, 9 medium and 1 low severity. Attacks were observed shortly after publication.
Recommended by the publisher: The BSI recommends updating GitLab.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: SAP - Kritische Schwachstellen bedrohen verschiedene Anwendungen
SAP products have critical vulnerabilities.
SAP has disclosed 19 vulnerabilities, including CVE-2026-44756 in the SAP Extended Passport Processing library. An attacker could execute OS commands with administrative rights. The vulnerability affects several SAP components and can be exploited without authentication.
Recommended by the publisher: The BSI recommends reviewing the SAP Patchday information.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: Deutsche Institutionen über TerminalFix-Kampagne kompromittiert
German institutions compromised via TerminalFix campaign.
The BSI was informed of a network compromise at a state institution in August 2026. The attack is consistent with Microsoft's reported TerminalFix campaign. The attackers attempted to install Ransomware and extort victims.
Recommended by the publisher: The BSI recommends checking the BSI-IT-Sicherheitsmitteilung for further information.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.0: SonicWall SMA1000 - Schwachstellen werden aktiv ausgenutzt
SonicWall SMA1000 vulnerabilities are being actively exploited.
SonicWall has published an advisory for two vulnerabilities in its SMA1000 product series, CVE-2026-83548 and CVE-2026-83549. SonicWall has stated that these vulnerabilities are being exploited. Attackers can use the vulnerabilities to bypass authentication mechanisms and execute code remotely on vulnerable systems.
Recommended by the publisher: The BSI recommends checking the IT-Sicherheitshinweis for further information.
Read the original at www.bsi.bund.de (in German) · Machine-written brief
Version 1.2: SonicWall SMA1000 - Zero-Day Schwachstellen aktiv ausgenutzt
Read the original at www.bsi.bund.de (in German)
Version 1.1: WordPress - Schwachstellen erlauben Remote Code Execution
Read the original at www.bsi.bund.de (in German)
Version 1.0: Microsoft SharePoint - Zero-Day und kritische Schwachstellen geschlossen
Read the original at www.bsi.bund.de (in German)
Version 1.0: Auswirkungen auf die Cybersicherheit von Organisationen durch die Entwicklung im Bereich Künstlicher Intelligenz
Read the original at www.bsi.bund.de (in German)
Version 1.0: Check Point Remote Access VPN und Mobile Access - Aktiv ausgenutzte Schwachstelle ermöglicht Aufbau von VPN-Sessions ohne Authentifizierung
Read the original at www.bsi.bund.de (in German)
Gemeinsamer Sicherheitshinweis (BfV und BSI) - Auskundschaftung schlecht geschützter PV-Anlagen durch staatliche Cyberakteure
Read the original at www.bsi.bund.de (in German)
Version 1.0: Ivanti EPMM: Systeme über neue Schwachstelle angegriffen
Read the original at www.bsi.bund.de (in German)
Version 1.0: cPanel und WHM - Aktiv ausgenutzte Schwachstelle ermöglicht Umgehen der Authentifizierung
Read the original at www.bsi.bund.de (in German)