Monday, March 16, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Monday's vulnerability disclosures affect a broad range of enterprise and consumer products, with Ivanti Endpoint Manager, Broadcom VMware Aria Operations, and multiple Apple platforms among the most notable targets. The day's dataset includes 40 high-priority CVEs (CVSS 7.0-8.9), unchanged from the prior day, with no new critical-severity disclosures. Actively exploited vulnerabilities include CVE-2026-1603 in Ivanti EPM, CVE-2026-22719 in VMware Aria Operations, and CVE-2026-25108 in Soliton FileZen, all carrying CVSS 9.5 scores. Attack patterns span remote code execution, authentication bypass, and memory corruption flaws, with Qualcomm chipset vulnerabilities (CVE-2026-21385) extending the threat surface to mobile and embedded devices. Patch availability currently stands at 0%, requiring organizations to prioritize compensating controls and network segmentation until vendor fixes are released.

  • Ivanti Endpoint Manager (CVE-2026-1603) and VMware Aria Operations (CVE-2026-22719) both face actively exploited CVSS 9.5 vulnerabilities requiring immediate attention
  • No new critical-severity CVEs disclosed, unchanged from the prior day
  • 40 high-priority CVEs (CVSS 7.0-8.9) identified, consistent with the previous day's volume
  • Attack patterns include remote code execution in n8n workflow automation (CVE-2025-68613), authentication bypass in Rockwell industrial products (CVE-2021-22681), and memory corruption in Apple iOS/iPadOS (CVE-2023-41974)
  • Patch availability at 0% across all disclosed vulnerabilities — compensating controls and network isolation are essential
  • 13 vulnerabilities confirmed under active exploitation, including legacy flaws in Hikvision (CVE-2017-7921) and Omnissa Workspace ONE (CVE-2021-22054)

Immediate action: Prioritize network segmentation and access restrictions for Ivanti EPM, VMware Aria Operations, and Soliton FileZen deployments, as all three face active exploitation with no patches currently available. Review exposure of Qualcomm-based mobile devices and Apple platforms, and monitor vendor advisories closely for forthcoming security updates.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation