The Week in Vulnerabilities: WordPress, BeyondTrust, and Critical ICS Bugs

Cyble Research & Intelligence Labs (CRIL) tracked 1,102 vulnerabilities last week. Of these, 166 vulnerabilities already have publicly available Proof-of-Concept (PoC) exploits, significantly increasing the likelihood of real-world attacks. A total of 49 vulnerabilities were rated critical under CVSS v3.1, while 32 received critical severity under CVSS v4.0. Additionally, CISA added 9 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing confirmed active exploitation. On the industrial front, CISA issued 8 ICS advisories covering 18 vulnerabilities impacting Siemens, Honeywell, Delta Electronics, GE Vernova, PUSR, EnOcean, Valmet, and Welker products. Cyble Weekly Vulnerability Report: New Flaws and CVEs CVE-2026-1357 — WPvivid Backup & Migration Plugin (Critical) CVE-2026-1357 is a critical unauthenticated arbitrary file upload and remote code execution vulnerability affecting the WPvivid Backup & Migration plugin for WordPress. The flaw stems from improper handling of RSA decryption errors combined with unsanitized filename inputs, allowing attackers to upload malicious PHP shells to publicly accessible directories A public PoC is available, and the vulnerability surfaced in underground discussions shortly after disclosure, significantly lowering the barrier to exploitation. CVE-2026-1731 — BeyondTrust Remote Support & PRA (Critical) CVE-2026-1731 is a critical OS command injection vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The flaw exists within a WebSocket-based endpoint, allowing unauthenticated attackers to execute arbitrary commands on internet-facing instances. Successful exploitation enables full system compromise, data exfiltration, lateral movement, and persistent access. A PoC is publicly available. CVE-2025-49132 — Pterodactyl Panel (Critical) CVE-2025-49132 affects the Pterodactyl Panel game-server management platform and allows unauthenticated remote code execution through improper validation of user-controlled parameters. Threat actors were observed sharing weaponized exploits on underground forums, highlighting the vulnerability’s operational risk. CVE-2026-25639 — Axios HTTP Client (High Severity) CVE-2026-25639 is a denial-of-service vulnerability in the Axios HTTP client, where crafted JSON payloads exploiting improper configuration merging can crash Node.js or browser applications. The vulnerability was captured in underground forums shortly after disclosure and has a public PoC. CVE-2026-20841 — Windows Notepad (High Severity) CVE-2026-20841 is a command injection vulnerability in the Windows Notepad app, enabling execution of malicious payloads via specially crafted files. Exploitation could enable privilege escalation and malware deployment. Vulnerabilities Added to CISA KEV CISA added 9 vulnerabilities to the KEV catalog during the reporting period. Notable additions include: CVE-2026-2441 — Google Chrome use-after-free vulnerability enabling potential arbitrary code execution via crafted HTML. CVE-2025-15556 — Notepad++ update integrity verification vulnerability reportedly exploited by the China-linked threat actor Lotus Blossom. KEV additions serve as strong indicators of exploitation maturity and heightened ransomware or espionage risk. Critical ICS Vulnerabilities During the reporting period, CISA issued 8 ICS advisories covering 18 vulnerabilities. The majority were rated high severity. CVE-2026-1670 — Honeywell CCTV Products (Critical) CVE-2026-1670 affects Honeywell CCTV products and carries a CVSS score of 9.8. The vulnerability allows an unauthenticated attacker to remotely alter the password recovery email address, effectively hijacking administrator accounts. Successful exploitation enables: Full administrative account takeover Unauthorized access to live surveillance feeds Potential lateral movement into connected networks Because no credentials or user interaction are required, this vulnerability presents a high mass-exploitation risk. CVE-2026-25715 — PUSR USR-W610 Router (Critical) CVE-2026-25715 impacts the PUSR USR-W610 router and involves weak password requirements. If exploited, attackers can bypass authentication, compromise administrator credentials, or disrupt services. The risk is amplified by the vendor’s acknowledgment that the product has reached end-of-life and no patches are planned. Organizations are urged to isolate or replace affected devices immediately. Siemens Simcenter Vulnerabilities (High Severity Cluster) Multiple high-severity out-of-bounds read/write and buffer overflow vulnerabilities were disclosed in Siemens Simcenter Femap and Nastran products (CVE-2026-23715 through CVE-2026-23720). These flaws may enable memory corruption and potential code execution in industrial engineering environments. Impacted Critical Infrastructure Sectors Analysis of the 18 disclosed ICS vulnerabilities shows that Critical Manufacturing accounts for 61.1% of cases, with the sector appearing in 83.3% of all reported vulnerabilities. This concentration highlights the continued exposure of manufacturing environments and their interdependencies with Energy, Water, and Chemical sectors. Conclusion The combination of high-volume IT vulnerabilities, publicly available PoCs, underground exploit discussions, and critical ICS exposures underscores the evolving threat landscape across enterprise and industrial environments. With 166 PoCs already available and 9 KEV additions confirming active exploitation, organizations must adopt a risk-based vulnerability management approach that prioritizes: Rapid patching of internet-facing assets Strict network segmentation between IT and OT environments Removal or isolation of end-of-life devices Deployment of multi-factor authentication Continuous monitoring for anomalous behavior Routine vulnerability assessments and penetration testing Cyble’s attack surface management solutions enable organizations to continuously monitor exposures, prioritize remediation, and detect early warning signals of exploitation. Additionally, Cyble’s threat intelligence and third-party risk intelligence capabilities provide visibility into vulnerabilities actively discussed in underground communities, empowering proactive defense against both IT and ICS threats. The post The Week in Vulnerabilities: WordPress, BeyondTrust, and Critical ICS Bugs appeared first on Cyble.