CISA has confirmed that attackers are exploiting these 4 vulnerabilities. If you use any of the products below, check that the fixes are installed today.
Microsoft Windows (CVE-2026-96951)
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
ISC BIND (CVE-2015-5477)
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Apache Struts (CVE-2016-3081)
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Strapi Strapi (CVE-2023-22894)
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Check who can reach your devices
Routers, cameras and NAS boxes are often left open to the internet with their default passwords. Change them and switch off remote access you do not use.
Doing it once, properly
Saving now often means paying twice: cut-price IT work is frequently rebuilt from the start, and the outage or breach before the rebuild is the expensive part.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-96951 on the National Vulnerability Database
- CVE-2015-5477 on the National Vulnerability Database
- CVE-2016-3081 on the National Vulnerability Database
- CVE-2023-22894 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.