Saturday, April 25, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Saturday's disclosures center on Azure IoT Central, Saltcorn, and Clerk identity platforms, with multiple critical flaws scoring 9.8 or higher across cloud and authentication infrastructure. The brief covers 19 critical CVEs (down 49% from yesterday) and 72 high-priority issues (down 21%). Notable critical entries include CVE-2026-21515 (CVSS 9.9) in Azure IoT Central, CVE-2026-41478 (CVSS 9.9) in Saltcorn, and CVE-2026-1949 (CVSS 9.8) in Delta Electronics AS320T industrial controllers. Remote code execution and authentication bypass dominate the attack patterns, with cloud services, ICS hardware, and developer authentication libraries all represented. Patches are not yet broadly available for today's disclosures, so defenders should rely on access controls and monitoring while vendor fixes propagate.

  • Azure IoT Central CVE-2026-21515 (CVSS 9.9) and Saltcorn CVE-2026-41478 (CVSS 9.9) lead today's critical disclosures
  • 19 critical CVEs disclosed, a 49% decrease from yesterday's 37
  • 72 high-priority CVEs disclosed, a 21% decrease from yesterday's 91
  • Remote code execution and authentication bypass affect Clerk identity, Delta Electronics ICS, and AWS Ops Wheel
  • 0% patch availability across today's critical set; mitigations and access restrictions are the near-term control
  • 19 actively exploited entries span Microsoft Office, SharePoint, Adobe Acrobat, Apache ActiveMQ, and SimpleHelp

Immediate action: Prioritize Azure IoT Central, Saltcorn, Clerk, and Delta Electronics AS320T deployments for immediate review, and isolate exposed instances pending vendor fixes. With no patches yet available for today's critical CVEs, apply network segmentation, restrict management interfaces, and monitor for exploitation indicators on Microsoft, Adobe, and SimpleHelp products listed in the actively exploited set.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation