Topic
Vulnerabilities
Critical and actively exploited zero-day vulnerabilities, prioritised for systems common in finance.
228 articles in this topic
BlueHammer (CVE-2026-33825): Defender Zero-Day Hits Saudi Banks
BlueHammer (CVE-2026-33825) abuses a TOCTOU race in Microsoft Defender to grant SYSTEM-level access without user interaction. Here is what Saudi banks must do today under SAMA CSCC and NCA ECC.
VulnerabilitiesCVE-2024-7399: Samsung MagicINFO Flaw Hits Saudi Bank Branches
CISA-listed CVE-2024-7399 in Samsung MagicINFO 9 Server is being weaponized by Mirai variants. Saudi bank branches running digital signage face a hidden OT/TPRM exposure under SAMA CSCC and NCA ECC.
Compliance & RegulationCisco SD-WAN Manager Bugs in CISA KEV Threaten Saudi Banks
CISA flagged three Cisco Catalyst SD-WAN Manager vulnerabilities — CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133 — as actively exploited. Saudi banks running branch SD-WAN must patch immediately to preserve SAMA CSCC and NCA ECC compliance.
VulnerabilitiesCVE-2026-33827: Wormable Windows IPv6 RCE Threatens Saudi Bank Networks
Microsoft's April 2026 Patch Tuesday addresses CVE-2026-33827, a wormable IPv6/IPSec race condition in the Windows TCP/IP stack — a direct threat to SAMA-regulated banks running IPv6 across branch networks and DR sites.
VulnerabilitiesCVE-2026-32746: 32-Year-Old Telnetd RCE Threatens Saudi Bank Edges
A 32-year-old buffer overflow in GNU Inetutils Telnetd (CVE-2026-32746, CVSS 9.8) enables pre-auth RCE on legacy stacks still hiding inside Saudi bank perimeters and NetScaler fleets.
VulnerabilitiesCVE-2026-33824: Windows IKE Zero-Click RCE Threatens Saudi Bank VPNs
Microsoft's April 2026 Patch Tuesday disclosed CVE-2026-33824, a critical double-free in Windows IKE Service Extensions (CVSS 9.8) that enables zero-click remote code execution on IPSec endpoints — the exact technology Saudi banks rely on for branch and partner connectivity.
VulnerabilitiesCVE-2026-20700: Apple dyld Zero-Day Hits Saudi Bank Mobile Fleets
Apple's first actively exploited zero-day of 2026 — CVE-2026-20700 in dyld — was abused in a surveillance-grade chain against specific targets. Here is what Saudi banks under SAMA CSCC must do now.
VulnerabilitiesCVE-2026-41940: cPanel Zero-Day Threatens Saudi Bank Hosting
A critical cPanel authentication bypass (CVE-2026-41940, CVSS 9.8) was exploited as a zero-day for two months before patch. Saudi banks must act on SAMA CSCC patch governance and third-party hosting risk obligations.
VulnerabilitiesCVE-2026-20133: Cisco SD-WAN Manager Leak Hits Saudi Bank Branches
CISA added Cisco Catalyst SD-WAN Manager flaw CVE-2026-20133 to KEV. Active exploitation exposes file-system data on the controller binding Saudi bank branches. Patch and assess now.
VulnerabilitiesCVE-2026-3854: GitHub RCE via Git Push Threatens Saudi Bank CI/CD
A critical 8.7 CVSS GitHub vulnerability lets any authenticated user execute code through a single git push command. Saudi banks running GHES face full source-code and secrets exposure under SAMA CSCC.
VulnerabilitiesCVE-2026-27681: Critical SAP BPC SQL Injection Threatens Saudi Bank Financial Reporting
A near-maximum severity SQL injection flaw (CVSS 9.9) in SAP Business Planning and Consolidation lets low-privileged users execute arbitrary database commands — a direct hit on the financial reporting layer Saudi banks rely on for SAMA submissions.
VulnerabilitiesCVE-2025-2749: Kentico Xperience RCE Threatens Saudi Bank Web Properties
CISA just added CVE-2025-2749, an authenticated RCE in Kentico Xperience's Staging Sync Server, to the KEV catalog with a May 4, 2026 federal deadline. Here's why Saudi banks running public CMS portals must act now under SAMA CSCC.
From reading to doing
Could your systems be exposed to a similar flaw?
A vulnerability assessment finds the weaknesses in your systems before attackers do, and ranks the fixes by risk.
Vulnerability Assessment
Systematic comprehensive scanning of your infrastructure vulnerabilities with a prioritized remediation report for immediate actio...
Internal Penetration Testing
Realistic internal attack simulation to measure your internal network resilience against insider threats
Web Application Penetration Testing
Deep security assessment of web applications following OWASP Top 10 to protect your data and customers
