SAP NetWeaver Exploited, Claude Weaponized Again, and a Wave of KEV Additions Hit the Catalog

News

SAP NetWeaver Visual Composer Flaw Actively Exploited in the Wild

A critical unauthenticated file upload vulnerability in SAP NetWeaver is being exploited to drop webshells on enterprise systems. SAP environments are high-value targets and patch cycles are notoriously slow, so if you're running NetWeaver, this is a drop-everything patch situation.

CISA KEV Catalog Gets Multiple New Additions Across Vendor Products

CISA added several new entries to its Known Exploited Vulnerabilities catalog, spanning networking and enterprise software products. Cross-reference your asset inventory against the KEV list now if you haven't done it this week.

Analysis

Researchers Show Claude Being Directed to Automate Offensive Recon and Attack Chains

Follow-up research confirms that Claude can be prompted to chain together recon, vulnerability identification, and exploitation steps with minimal human input. The offensive automation gap between well-resourced attackers and defenders keeps widening.

Tools

ProjectDiscovery Drops New Nuclei Templates Covering Recent Critical CVEs

Fresh templates landed covering several recently disclosed critical vulnerabilities, making it easy to scan your own infrastructure before attackers get there. If you're not running Nuclei against your perimeter weekly, you're leaving easy wins on the table.