One flaw allows an unauthenticated attacker to read files from the server. GitLab urged operators of self-managed installations to upgrade immediately.

SonicWall customers have confronted a barrage of attacks for years, including five actively exploited vulnerabilities in SMA 1000 appliances since late 2025.

Researchers said the vulnerabilities, which attackers are chaining together, were first exploited three weeks before the vendor disclosed and patched the defects.

The escalated threat posed by the defect showcases how quickly a seemingly mild vulnerability can turn into an urgent warning.

A researcher who found a repository that leaked on GitHub said it was one of the worst he’s witnessed.

The vendor hasn’t released a patch for the vulnerability or described the scope and objective of confirmed attacks.

The agency added the flaw to the KEV list days after hosting providers confirmed active, ongoing attacks.

Two critical defects in FortiClient EMS have been exploited in the past couple weeks. Experts push for users to apply an immediate hotfix.

Limited attacks occurred prior to Ivanti’s disclosure, followed by mass exploitation by multiple threat groups. More than 1,400 potentially vulnerable instances remain exposed.

Attackers have exploited the critical defect to reconfigure firewall settings and create unauthorized accounts with privileged access to multiple versions of the vendor’s security products.