SURIQZero-days
Previously unknown vulnerabilities exploited or disclosed before a patch existed.
NetScaler CVE-2026-88772: Pre-Auth RCE Zero-Day, Patch Then Hunt
CVE-2026-88771 and CVE-2026-88772 hit Citrix NetScaler as zero-days, exploited before a patch. Patching does not remove the web shell attackers left.
F5 BIG-IP APM CVE-2026-94127: Pre-Auth RCE, Exploited Now
CVE-2026-94127 is an unauthenticated RCE in F5 BIG-IP APM configured as an OAuth authorization server, exploited now. Who is exposed and how to patch.
Cisco ISE CVE-2026-76460: Exploited Auth-Bypass Zero-Day, Patch
CVE-2026-76460 is an unauthenticated API auth bypass in Cisco ISE, CVSS 10.0, actively exploited and in CISA KEV. Patch ISE 3.1-3.5 to the fixed build now.
Chrome CVE-2026-85046: Exploited V8 Zero-Day, Update Now
CVE-2026-85046 is an actively exploited V8 type confusion zero-day in Chrome. Update to 152.0.7977.82, and patch Edge, Brave, Opera and Electron apps too.
SonicWall SMA1000 zero-days chain a pre-login SSRF into remote code execution, exploited now
SonicWall SMA1000 zero-days CVE-2026-83548 and CVE-2026-83549 chain a pre-login SSRF into admin command injection for RCE. Exploited now. Patch and hunt.
PaperCut print servers are under active attack through a login-free code-execution flaw
Attackers are exploiting an unauthenticated flaw in PaperCut NG and MF print servers to run code as the host account. Restrict access and patch now.
GeoServer zero-day: unauthenticated SQL injection can reach remote code execution, and there is no patch yet
A GeoServer zero-day lets unauthenticated attackers run SQL injection that can reach remote code execution. No CVE, no patch, and probing has already started.
North Korea's Lazarus used fake job offers and a Windows zero-day to hijack defense firms' PCs
North Korea's Lazarus group used fake job offers and a Windows zero-day (CVE-2026-68820) to seize SYSTEM control of defense and aerospace PCs. Patch now.
Metabase zero-day (CVSS 10.0): unauthenticated SQL injection hands attackers admin and data. Patch now.
Metabase's SQL injection zero-day (CVSS 10.0) gives unauthenticated attackers admin access and stored database credentials. Exploited now: patch and rotate.
Zimbra webmail zero-day (CVE-2025-66376) let Russian spies steal mail and mint MFA-bypass passwords
Russian group Void Blizzard exploited Zimbra webmail flaw CVE-2025-66376 as a zero-day to steal 90 days of mail and mint app passwords that survive resets.
Inc ransomware used the SonicWall SMA zero-days to steal MFA seeds. Resetting passwords will not evict it.
Rapid7 ties the SonicWall SMA 1000 zero-days to an Inc ransomware actor that stole credentials, sessions, and TOTP seeds. A password reset won't evict it.
Fully patched Windows, no fix: a new local privilege zero-day
LegacyHive is a Windows User Profile Service privilege-escalation zero-day that works on fully patched systems, with no CVE and no fix yet.
Two SonicWall remote-access zero-days are under attack, and patching alone will not clean the box
SonicWall patched two actively exploited SMA 1000 zero-days, CVE-2026-15409 and CVE-2026-15410.
Two Microsoft zero-days were exploited before the fix shipped
Microsoft's July 2026 Patch Tuesday fixes two zero-days already exploited in the wild: an ADFS and a SharePoint Server privilege bug.
A logged-in user can hijack the Linux graphics server, and on many systems that means root
X.Org patched two memory-corruption bugs in the X server and XWayland. A local client can reach root where Xorg runs as root. Update to 21.1.24 and 24.1.13.
We said a password reset wouldn't stop FortiBleed. Now it is deploying ransomware.
FortiBleed harvested 110 million Fortinet credentials. SOCRadar links that access to INC and Lynx ransomware, with 12 encryptions and a Nextcloud zero-day.
Two flaws in Unraid's control panel let a logged-in user seize the whole server
Two command injection flaws in Unraid's web panel, CVE-2026-9772 and CVE-2026-9773, let any logged-in user run code as www-data.
INC ransomware never used a zero-day. It used your patch backlog.
INC reached top-tier RaaS in 2026 with no zero-days. Every edge-device flaw it exploits was patched months earlier. Here is what to actually fix.
PeopleSoft's PSEMHUB zero-day turns the patch service into the breach
CVE-2026-35273 sits in PeopleSoft's Updates Environment Management module. Mandiant ties active exploitation to ShinyHunters, with 100+ orgs already breached.
See what Suriq finds on your own servers.
Agentless checks for uptime and your cloud, a lightweight agent for detection on each server, and one console that ranks and explains what it finds.