Blog | Arctic Wolf
arcticwolf.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
12 CVEs- CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1133External Remote Services4 reports95.0%Top 0.14%93.3priority
- CVE-2026-18577N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-able · N-centralKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1078Valid Accounts7 reports14.6%Top 3.3%88.0priority
- CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall · SMA1000 AppliancesKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1090Proxy1 report6.8%Top 6%87.7priority
- CVE-2026-15410SonicWall SMA1000 Appliances Code Injection VulnerabilitySonicWall · SMA1000 AppliancesKEVRansomwarePublic exploitHigh · 7.2T1078Valid AccountsT1059Command and Scripting Interpreter1 report11.8%Top 3.9%86.1priority
- CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application1 report88.7%Top 0.23%83.8priority
- CVE-2026-18556N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-able · N-centralKEVPublic exploitHigh · 7.4T1190Exploit Public-Facing ApplicationT1078Valid Accounts5 reports7.9%Top 5.3%82.1priority
- CVE-2026-20316Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityCisco · Secure Firewall Management Center (FMC)KEVRansomwareMedium · 5.3T1078Valid AccountsT1005Data from Local System1 report35.1%Top 1.6%80.3priority
- CVE-2026-39808Fortinet FortiSandbox OS Command Injection VulnerabilityFortinet · FortiSandboxKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report93.2%Top 0.17%78.7priority
- CVE-2026-6875Sandbox Escape in ServiceNow AI PlatformServiceNow · ServiceNow AI PlatformPublic exploitCritical · 9.51 report1.4%Top 27%71.7priority
- CVE-2026-50656Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft · Microsoft Malware Protection EnginePublic exploitHigh · 7.87 reports11.2%Top 4.1%42.4priority
- CVE-2026-28323SolarWinds Web Help Desk SAML Authentication Bypass VulnerabilitySolarWinds · Web Help DeskCritical · 9.85 reports1.0%Top 36%31.2priority
- CVE-2026-28299SolarWinds Web Help Desk Denial-of-Service VulnerabilitySolarWinds · Web Help DeskHigh · 8.25 reports0.7%Top 46%29.0priority
Where it names them
CVE-2026-0257 Original (opens in a new tab) ↗
Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware
CVE-2026-18577 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW ALLView All
CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate Patching
CVE-2026-15409 Original (opens in a new tab) ↗
CVE-2026-15409, CVE-2026-15410: Security Bulletin: SonicWall SMA 1000 Series Zero-Day Vulnerabilities
CVE-2026-15410 Original (opens in a new tab) ↗
CVE-2026-15409, CVE-2026-15410: Security Bulletin: SonicWall SMA 1000 Series Zero-Day Vulnerabilities
CVE-2026-20079 Original (opens in a new tab) ↗
CVE-2026-20316, CVE-2026-20079: Active Exploitation of Cisco Secure Firewall Management Center Zero-Day
CVE-2026-18556 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW ALLView All
CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate Patching
CVE-2026-20316 Original (opens in a new tab) ↗
CVE-2026-20316, CVE-2026-20079: Active Exploitation of Cisco Secure Firewall Management Center Zero-Day
CVE-2026-39808 Original (opens in a new tab) ↗
CVE-2026-39808: Critical Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-6875 Original (opens in a new tab) ↗
CVE-2026-6875: Critical Remote Code Execution Vulnerability in ServiceNow AI Platform Urgent Mitigation Required
CVE-2026-50656 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass
Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)
CVE-2026-28323 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW
SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299
CVE-2026-28299 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW ALLView All
SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.