CIS Security Advisories
CIS Security News
CISA News
ISACA SmartBrief
Cyber Security Advisories – MS-ISAC
- A Vulnerability Chain in WordPress Core Could Allow for Remote Code Execution 2026-07-20A vulnerability chain has been discovered in WordPress Core that could allow for remote code execution. WordPress is an open-source content management system (CMS) used to design, build, and publish personal and commercial websites. Successful exploitation of vulnerability chain could allow for remote code execution in the context of the affected service account. Depending on […]
- Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution 2026-07-15Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install […]
- Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution 2026-07-14Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.Adobe After Effects is a digital visual effects and motion graphics application used for creating cinematic movie titles, transitions, and complex animation sequences.Adobe Animate is a professional vector animation software used to design interactive animations and multimedia […]
- Critical Patches Issued for Microsoft Products, July 14, 2026 2026-07-14Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; […]
- Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution 2026-07-01Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.Adobe Campaign Classic is an enterprise-grade marketing automation platform that helps organizations design, automate, and track complex, personalized cross-channel marketing campaigns.Adobe ColdFusion is a commercial rapid web application development platform used to build and deploy dynamic web […]
- Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution 2026-07-01Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet.Thunderbird is a free, open-source email, calendar, and chat application.Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the […]
- Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution 2026-07-01Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install […]
- Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution 2026-06-26Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install […]
- A Vulnerability in PAN-OS Could Allow for Authentication Bypass 2026-06-22A vulnerability has been discovered in the GlobalProtect portal and gateway of PAN-OS which could allow for authentication bypass. The PAN-OS GlobalProtect Portal acts as the central control plane for Palo Alto Networks VPN infrastructure. Successful exploitation of the vulnerability allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
- Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution 2026-06-16Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet.Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.Thunderbird is a free, open-source email, calendar, and chat application.Successful exploitation […]
Blog Feed – Center for Internet Security
- CIS Benchmarks July 2026 Update 2026-07-15These CIS Benchmarks and CIS Build Kits have been updated or recently released and include a full changelog that references all changes.
- Turning Secure Software Development into a Measurable Practice 2026-07-13CIS and SAFECode have updated Secure by Design: A Developer’s Guide to Building Safer Software to address the role of AI on software security.
- 5 Major Emerging Risks to Large-Scale Events 2026-07-09To create safer, more secure large-scale events, read our recommendations for defending against five emerging risks to public gatherings.
- Cybersecurity Grant Funding: FEMA Clarifies SLCGP Use for CIS Services 2026-07-06FEMA clarifies that SLCGP/TCGP grants can fund CIS Services. See what qualifies, what's required, and what's next.
- 6 Key Takeaways: Strengthening Public Safety Through Collective Defense 2026-06-30Here are six key takeaways from a CIS webinar for how U.S. SLTT agencies can strengthen public safety through collective defense.
- CIS Controls Accreditation Drives Global Cybersecurity Standards 2026-06-25CIS Controls Accreditation is raising global cybersecurity standards, setting a trusted benchmark for excellence, resilience, and best practices.
- CIS Benchmarks June 2026 Update 2026-06-18The following CIS Benchmarks and CIS Build Kits have been updated or recently released. We've highlighted the major updates below.
- Keep up with HIPAA Expectations amid Growing Cyber Threats 2026-06-16Healthcare organizations can satisfy cybersecurity and HIPAA compliance obligations while upholding patient safety. Read on to learn how.
- CIS Controls Community Volunteer Spotlight: Diego Bolatti 2026-06-12Diego Bolatti advances CIS Controls adoption for SMEs through research, policy templates, and AI-driven cybersecurity tools.
- The Return of MCAP: Malware Analysis Built for SLTT Members 2026-06-11Our Malicious Code Analysis Platform (MCAP) supports malware analysis specifically designed for SLTT teams. Read our blog post to learn more.
All CISA Advisories
- Panduit IntraVUE 2026-07-23View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling. The following versions of Panduit IntraVUE are affected: IntraVUECISA
- MZ Automation lib60870 2026-07-23View CSAF Summary Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service. The following versions of MZ Automation lib60870 are affected: lib60870CISA
- Johnson Controls C-CURE 9000 and Victor application server 2026-07-23View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected: C-CURE 9000 and victorCISA
- MZ Automation libIEC61850 2026-07-23View CSAF Summary Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions. The following versions of MZ Automation libIEC61850 are affected: libIEC61850 >=v1.0.0|=v1.0.0|=v1.0.0|=v1.0.0|=v1.0.0|CISA
- Johnson Controls XAAP Android 2026-07-23View CSAF Summary Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. The following versions of Johnson Controls XAAP Android are affected: XAAP AndroidCISA
- Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite 2026-07-23Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite Executive summary A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is […]CISA
- Rockwell Automation ThinManager 2026-07-23View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory. The following versions of Rockwell Automation ThinManager are affected: ThinManager >=13.0.0|=13.1.0|=13.2.0|=14.0.0|CISA
- Weintek cMT3092X 2026-07-23View CSAF Summary Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users. The following versions of Weintek cMT3092X are affected: cMT3092X firmwareCISA
- CISA Adds Two Known Exploited Vulnerabilities to Catalog 2026-07-22CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal […]CISA
- Rockwell Automation Studio 5000 Logix Designer 2026-07-21View CSAF Summary Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code. The following versions of Rockwell Automation Studio 5000 Logix Designer are affected: Studio 5000 Logix Designer V36.00 (CVE-2026-9108) Studio 5000 Logix Designer V35.00 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128) Studio 5000 Logix Designer V35.01 […]CISA
ISACA SmartBrief on Cybersecurity
- Have you ever seen a bird's eyes not constantly parsing the sky? 2026-07-23James Seay, poet, writer, educator 1939-2026
- ISACA 2026 Europe Conference Registration is Open 2026-07-23Immerse yourself in premier IS/IT content, network with like-minded professionals, and hear from insightful thought leaders a -More-
- Nov. 16-19, Las Vegas: ISACA Training Week 2026-07-23-More-
- AI drives new cybersecurity roles but skills gap persists 2026-07-23Organizations are redefining cybersecurity roles as AI and regulatory requirements, such as NIS2 and DORA, change hiring prio -More-
- Estée Lauder employee data compromised in Oracle EBS breach 2026-07-23Estée Lauder has notified current and former employees of a data breach linked to a vulnerability in Oracle's E-Business Suit -More-
- AI adoption increases stress, liability concerns for CISOs 2026-07-23The rapid adoption of AI technologies has increased stress among chief information security officers, with 26% considering le -More-
- Acrobat Chrome extension that exposed WhatsApp data fixed 2026-07-23Adobe has quickly patched a vulnerability in its Acrobat Chrome extension that allowed attackers to steal WhatsApp Web data, -More-
- CISA orders agencies to patch Langflow vulnerability 2026-07-23The Cybersecurity and Infrastructure Security Agency has instructed federal agencies to urgently patch a critical vulnerabili -More-
- 2 Claude Chrome extension flaws unpatched, can be hijacked 2026-07-23Security researchers at Manifold Security have identified two unpatched vulnerabilities in the Claude extension for Chrome in -More-
- AI model escape highlights need for increased security 2026-07-23OpenAI says, during a cybersecurity test, it lost control of two AI models, resulting in a breach of Hugging Face's research -More-
