Tuesday, March 17, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Tuesday's vulnerability disclosures reveal 24 critical-severity CVEs predominantly affecting D-Link DIR routers, ZKTeco ZKBioSecurity access control systems, and HP products. Critical CVEs jumped from 0 to 24 compared to the prior day, while high-priority vulnerabilities rose 135% to 94. Notable critical entries include CVE-2026-32621 (CVSS 9.9) in Arch Federation, four D-Link DIR router vulnerabilities (CVE-2026-4181 through 4184, all CVSS 9.8), and CVE-2025-62319 (CVSS 9.8) affecting multiple vendors. Attack patterns center on remote code execution and authentication bypass across network infrastructure and physical security systems, with 13 vulnerabilities confirmed under active exploitation including Ivanti EPM, VMware Aria Operations, and Google Chrome components. No patches are currently available for disclosed vulnerabilities, requiring organizations to prioritize compensating controls and network segmentation.

  • Four D-Link DIR router vulnerabilities (CVE-2026-4181 through 4184) rated CVSS 9.8 — network infrastructure devices requiring immediate isolation
  • 24 critical CVEs disclosed, up from 0 the prior day — significant spike in high-severity activity
  • 94 high-priority CVEs represent a 135% increase over the prior day's 40 disclosures
  • Remote code execution and authentication bypass dominate attack patterns across ZKTeco access control, HP systems, and Arch Federation (CVE-2026-32621, CVSS 9.9)
  • 0% patch availability across all disclosed vulnerabilities — compensating controls are the primary mitigation option
  • 13 actively exploited vulnerabilities include Ivanti EPM, VMware Aria Operations, Qualcomm chipsets, and Google Chrome components

Immediate action: Prioritize network segmentation for exposed D-Link DIR routers, ZKTeco ZKBioSecurity deployments, and Ivanti Endpoint Manager instances given active exploitation and lack of available patches. Review exposure to Google Chrome (CVE-2026-3910, CVE-2026-3909) and VMware Aria Operations (CVE-2026-22719) as these carry confirmed exploitation activity — apply compensating controls and monitor vendor advisories for forthcoming patches.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation