Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
6 matching stories
RCE274 Zimbra Servers Compromised in the Wild via CVE-2026-73570
Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.
CISA KEV adds N-Able N-Central RCE with 3-day federal deadline
CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.
GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282
Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.
Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch
Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.
JetBrains TeamCity RCE (CVE-2026-63077) Exposed via RunZero Asset Discovery
JetBrains TeamCity On-Premises before 2023.05.4 has an authentication bypass (CWE-288) that lets an unauthenticated remote attacker execute arbitrary code on the server, enabling supply-chain compromise of CI/CD builds.
Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago
A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.
