Another week, another parade of internet-facing software acting like authentication is more of a suggestion. If your patch queue is starting to look like a hostage note, congratulations: you're doing security in 2026.
This Week's Hall of Shame: Top CVEs
CVE-2026-10520 — Ivanti hands out root like party favors
The Gist: Ivanti Sentry before versions R10.5.2, R10.6.2, and R10.7.1 has a CVSS 10 OS command injection flaw that lets a remote, unauthenticated attacker achieve root-level remote code execution. It is being exploited in the wild, and yes, there is already public proof-of-concept code.
Why It Should Keep You Up at Night: This is the kind of bug defenders dread: no auth, network reachable, root on impact. Sentry often sits in front of sensitive mobile and enterprise infrastructure, so giving attackers a straight shot to privileged execution is less “edge case” and more “open season.”
Your Playbook:
- Upgrade Ivanti Sentry to R10.5.2, R10.6.2, or R10.7.1 immediately, depending on your supported branch.
- Hunt for suspicious command execution and unexpected root-level activity on Sentry appliances, and isolate exposed instances until patched.
Sources: Rapid Risk Radar | CVE Organization | Bleeping Computer | HelpNetSecurity
CVE-2026-48907 — Joomla JCE goes full “come on in”
The Gist: The JCE editor extension for Joomla has a CVSS 10 access control flaw that allows unauthenticated users to create new editor profiles, leading to PHP code upload and execution. It is reportedly exploited in the wild, has a public POC, and has generated a frankly alarming amount of public chatter.
Why It Should Keep You Up at Night: Joomla extensions have a long and storied tradition of turning content management into incident management, and this one keeps the legacy alive. If your site runs JCE and is exposed to the internet, an attacker may not need much more than curiosity and a spare afternoon to turn it into their server.
Your Playbook:
- Audit all Joomla deployments for the JCE extension and disable or restrict it immediately until a verified fixed version is in place.
- Review web server logs and Joomla admin activity for unauthorized profile creation, unexpected file uploads, and newly dropped PHP files.
Sources: Rapid Risk Radar | CVE Organization | CVEShield | VulnCheck KEV
CVE-2026-25089 — FortiSandbox forgets to sandbox
The Gist: Fortinet FortiSandbox and related cloud and PaaS versions contain a CVSS 9.1 OS command injection vulnerability that allows unauthenticated command execution through crafted HTTP requests. The flaw is exploited in the wild and public proof-of-concept material is available.
Why It Should Keep You Up at Night: Security products getting popped by unauthenticated command injection is the cybersecurity equivalent of a lifeguard drowning on shift. FortiSandbox is supposed to analyze threats, not join them, and exposed appliances could become convenient footholds for attackers who enjoy irony.
Your Playbook:
- Identify affected FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS versions and apply Fortinet’s available fixes or supported upgrades without delay.
- Restrict management and web interfaces from untrusted networks and inspect HTTP request logs for crafted requests targeting appliance endpoints.
Sources: Rapid Risk Radar | CVE Organization | The Hacker News | NVD Analysis
Industry Intel: What Else is On Fire This Week
-
The Top 10 Attack Surface Exposures in 2026 — Because apparently “connected to the internet” is still a business strategy, here’s a tidy list of the ways organizations keep leaving the windows open. Read more
-
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats — Your dev tools and browser add-ons would like a word with your secrets, which is adorable in the worst possible way. Read more
-
144 Mastra npm Packages Compromised via Hijacked Contributor Account — The software supply chain remains one overcaffeinated maintainer account away from chaos, as tradition demands. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.