Incidents by attack type:
Fortinet disclosed CVE-2026-104286, a critical FortiMail flaw exploited in the wild to write arbitrary files to email gateways, prompting an emergency CISA patching order.
Citrix confirmed two critical NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild for unauthenticated remote code execution before patches shipped.
Cisco confirmed active exploitation of CVE-2026-76461, a pre-authentication SQL injection in Secure Email Gateway that lets a crafted email execute commands as root, prompting a CISA remediation order.
Cosmetics group Estée Lauder disclosed that attackers exploiting an Oracle E-Business Suite flaw accessed its HR system in August 2025, exposing Social Security numbers, passport and bank details, health data and employment records.
SonicWall issued an urgent advisory after attackers were caught chaining two zero-day flaws in its SMA 1000 secure remote-access appliances — an unauthenticated SSRF rated CVSS 10.0 and a post-authentication command-injection bug — with Rapid7 having observed the pair exploited in tandem against internet-facing devices before any patch existed.
The National Association of Insurance Commissioners disclosed on 23 June 2026 that attackers exploited an Oracle PeopleSoft zero-day to access part of its environment, and by 25 June the extortion group ShinyHunters had published the stolen data online, claiming more than 3.1 terabytes.
Researchers disclosed a Microsoft Defender privilege-escalation zero-day dubbed RoguePlanet (CVE-2026-47281) that abuses a race condition to redirect a SYSTEM-level file operation and hand a local attacker full SYSTEM access on fully updated Windows machines.
Oracle issued an emergency out-of-band alert after the ShinyHunters crew exploited a critical unauthenticated remote-code-execution zero-day in PeopleSoft PeopleTools to steal data from more than 100 organisations, most of them universities.
Google shipped an emergency Chrome update fixing CVE-2026-11645, a high-severity out-of-bounds memory flaw in the V8 engine that lets a crafted web page run arbitrary code and for which an exploit already exists in the wild.
Check Point disclosed that attackers, including a Qilin ransomware affiliate, were actively exploiting a critical authentication-bypass zero-day (CVE-2026-50751) in its Remote Access and Mobile Access VPN products to log in without a valid password.
Cisco warned that an unpatched high-severity zero-day in Catalyst SD-WAN Manager (CVE-2026-20245) was being actively exploited to execute arbitrary commands and escalate to root, after Mandiant reported a limited number of real-world attacks.
Google's June 2026 Android security update fixed 124 vulnerabilities, including CVE-2025-48595, an actively exploited integer-overflow flaw in the Android Framework that lets a local attacker escalate privileges without user interaction.
Cisco disclosed a maximum-severity authentication bypass in Catalyst SD-WAN Controller and Manager that was already being exploited by the UAT-8616 cluster to gain administrative access, prompting CISA to give federal agencies three days to patch.
Fortinet released emergency hotfixes for CVE-2026-35616, a critical (CVSS 9.8) improper access control flaw in FortiClient Endpoint Management Server that lets unauthenticated attackers bypass API authentication and run code, after exploitation was observed in the wild from 31 March 2026.
An extortion actor using the Cl0p brand exploited a zero-day in Oracle E-Business Suite (CVE-2025-61882) to steal data from customers' ERP environments, then sent mass extortion emails to executives from late September 2025.
Cl0p exploited CVE-2023-34362 in Progress Software's MOVEit Transfer to mass-extort over 2,700 organizations, including the BBC, British Airways, and the U.S. Department of Energy.
A trivially exploitable remote code execution flaw in Apache Log4j 2, the ubiquitous Java logging library, scored a maximum CVSS 10.0 and exposed hundreds of millions of devices and applications worldwide to instant takeover via a single crafted log string.
China-linked group Hafnium chained four Exchange Server zero-days (ProxyLogon) to plant web shells and steal email; after Microsoft's emergency patch, mass exploitation by multiple groups compromised an estimated 60,000+ organisations worldwide.