Sunday, March 22, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Sunday's vulnerability disclosures include 2 critical and 93 high-priority CVEs, a significant reduction from Saturday's 20 critical findings. Ivanti Endpoint Manager (CVE-2026-1603), Broadcom VMware Aria Operations (CVE-2026-22719), and Google Chrome components (CVE-2026-3910, CVE-2026-3909) are among the most notable new entries with active exploitation confirmed. Legacy vulnerabilities in Apple, Hikvision, and Rockwell products continue to see exploitation activity, underscoring persistent risk from unpatched older flaws. Infor WebCTRL (CVE-2026-24060, CVSS 9.1) presents a critical building automation risk, while Qualcomm chipset vulnerabilities affect a broad mobile device footprint. Patch availability currently stands at 0%, requiring organizations to prioritize compensating controls and monitoring until vendor fixes are released.

  • Ivanti EPM, VMware Aria Operations, and Google Chrome/Skia under active exploitation with CVSS 9.5 ratings
  • Critical CVE count dropped to 2, down 90% from Saturday's 20 critical disclosures
  • 93 high-priority vulnerabilities disclosed, a 7% decrease from the prior day
  • Remote code execution and authentication bypass patterns dominate, affecting n8n, Craft CMS, Laravel Livewire, and Wing FTP Server
  • 0% patch availability across all disclosed CVEs — compensating controls and network segmentation recommended
  • 19 actively exploited vulnerabilities spanning Apple, Qualcomm, Hikvision, and Rockwell legacy products

Immediate action: Prioritize network-level mitigations for Ivanti EPM, VMware Aria Operations, and Google Chrome components given confirmed active exploitation. With 0% patch availability, implement compensating controls including network segmentation, enhanced monitoring, and restricting access to affected services until vendor patches are released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation