Another week, another parade of vendors acting surprised that insecure code has consequences. Grab your coffee and your patch calendar; both are about to get a workout.
This Week's Hall of Shame: Top CVEs
CVE-2026-56155 — AD FS privilege creep, now with extra regret
The Gist: Microsoft patched a high-severity Active Directory Federation Services flaw with a CVSS score of 7.8. It’s a local privilege escalation bug caused by insufficiently granular access control, and yes, it’s already being exploited in the wild.
Why It Should Keep You Up at Night: If an attacker already has a foothold with low privileges, this bug can help them climb the ladder inside identity infrastructure that really, truly should not be casually climbable. AD FS sits close to the kingdom’s keys, so “local” here is less comforting than vendors like to pretend.
Your Playbook:
- Apply Microsoft’s security update for CVE-2026-56155 as soon as your change window allows.
- Hunt for suspicious privilege changes and unusual AD FS administrative activity, especially on systems where low-privileged access may already be in play.
Sources: Rapid Risk Radar | MSRC Security Updates | CISA Known Exploited | Tenable Blog
CVE-2026-56291 — Joomla plugin turns file upload into open season
The Gist: Balbooa Forms for Joomla is sitting on a CVSS 10.0 unauthenticated arbitrary file upload vulnerability. The bug allows attackers to upload executable files for full remote code execution, and it’s both exploited in the wild and supported by public proof-of-concept material.
Why It Should Keep You Up at Night: Unauthenticated RCE on an internet-facing web component is basically the cybersecurity version of leaving your front door open with a neon sign that says “server this way.” If you’re running this extension, attackers do not need your permission, your password, or even the courtesy to knock.
Your Playbook:
- Immediately identify any Joomla instances running Balbooa Forms and take them offline or restrict public access until a safe remediation path is confirmed.
- Review web roots and upload directories for unexpected executable files, then inspect server logs for suspicious POST requests and follow-on web shell behavior.
Sources: Rapid Risk Radar | CISA Known Exploited | CVE Organization | VulnCheck KEV
CVE-2026-15409 — SonicWall SSRF with zero-days of our lives energy
The Gist: This critical CVSS 10.0 SSRF flaw affects the SMA1000 Appliance Work Place interface and allows a remote unauthenticated attacker to make the appliance send requests to unintended destinations. It’s being exploited in the wild, and proof-of-concept details are available.
Why It Should Keep You Up at Night: SSRF is the bug class that keeps finding new ways to be way more annoying than its name suggests. On an appliance sitting in sensitive network paths, “make requests to unintended location” is corporate-speak for “an attacker may start poking around places your firewall assumed were private.”
Your Playbook:
- Prioritize vendor guidance and isolate exposed SMA1000 interfaces from the public internet wherever possible.
- Monitor appliance and network logs for unusual outbound requests, access to internal metadata-style endpoints, or traffic patterns that don’t match normal administrative behavior.
Sources: Rapid Risk Radar | CISA Known Exploited | HelpNetSecurity | The Hacker News
Industry Intel: What Else is On Fire This Week
-
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution — Because apparently cloning code now comes with a side of accidental self-own, like supply chain risk wearing a developer-friendly hoodie. Read more
-
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware — Your daily reminder that npm trust is less a security model and more a communal leap of faith with JavaScript. Read more
-
Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands — Appliance security continues its long tradition of charging premium prices for premium panic. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.