Morning Review in IT Security — March 21, 2026

Federal agencies face an urgent deadline as critical vulnerabilities continue to emerge across enterprise infrastructure. Today's security landscape reflects the accelerating pace at which threat actors exploit newly disclosed flaws, with multiple maximum-severity issues demanding immediate attention from organizations worldwide.

CISA Orders Federal Agencies to Patch Critical Cisco Firewall Vulnerability by Sunday

The Cybersecurity and Infrastructure Security Agency has issued a mandatory directive requiring all federal agencies to patch a maximum-severity vulnerability in Cisco Secure Firewall Management Center by Sunday, March 22. The vulnerability, identified as CVE-2026-20131, represents a critical risk to federal infrastructure and has prompted an expedited remediation timeline. Source: CISA orders feds to patch max-severity Cisco flaw by Sunday

The flaw has been associated with multiple malware families including Interlock, NodeSnake, and Slopoly, indicating active exploitation attempts. The vulnerability also correlates with ClickFix attack techniques, suggesting coordinated threat actor campaigns leveraging this weakness in critical network management infrastructure.

Langflow Critical Vulnerability Exploited Within 20 Hours of Public Disclosure

A critical authentication bypass and code injection flaw in Langflow has entered active exploitation within just 20 hours of its public disclosure, demonstrating the compressed timeline between vulnerability announcement and weaponization. The vulnerability, tracked as CVE-2026-33017 with a CVSS score of 9.3, enables remote code execution through missing authentication controls combined with code injection capabilities. Source: Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure

The rapid exploitation of this open-source component vulnerability highlights supply chain risks within AI-related infrastructure. Threat actors have already developed and deployed exploitation toolkits, with attack traffic originating from IP address 173.212.205.251, indicating organized and immediate attempts to compromise vulnerable systems.

Ubiquiti UniFi Networking Application Vulnerability Poses Account Takeover Risk

A maximum-severity vulnerability affecting Ubiquiti's UniFi Networking Application creates significant account takeover risks for customers managing networked infrastructure. The flaw has not yet been exploited in the wild, providing a critical window for remediation before active attacks commence. Source: Ubiquiti defect poses account takeover risk for UniFi Networking Application users

Two related vulnerabilities, CVE-2026-22557 and CVE-2026-22558, affect the application's identity and access management functions, potentially allowing attackers to compromise administrator accounts and gain unauthorized control over network device management infrastructure.

Oracle Releases Emergency Patch for Critical Identity Manager Remote Code Execution Flaw

Oracle has released an out-of-band security update addressing a critical unauthenticated remote code execution vulnerability in Identity Manager and Web Services Manager. The vulnerability, designated CVE-2026-21992, allows attackers to execute arbitrary code without authentication, representing an immediate threat to organizations relying on Oracle's identity management infrastructure. Source: Oracle pushes emergency fix for critical Identity Manager RCE flaw

The emergency nature of this patch underscores the severity of the flaw and the urgency with which organizations must apply updates to prevent potential compromise of critical identity systems.

The convergence of multiple maximum-severity vulnerabilities across diverse platforms—from network management to identity services to open-source AI components—demands immediate action from security teams. Organizations should prioritize patching efforts based on asset criticality while monitoring for active exploitation attempts targeting these newly disclosed flaws.

CISA orders feds to patch max-severity Cisco flaw by Sunday

Source: CISA orders feds to patch max-severity Cisco flaw by Sunday

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability, CVE-2026-20131, in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22. [...]

Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure

Source: Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure

A critical security flaw impacting Langflow has come under active exploitation within 20 hours of public disclosure, highlighting the speed at which threat actors weaponize newly published vulnerabilities. The security defect, tracked as CVE-2026-33017 (CVSS score: 9.3), is a case of missing authentication combined with code injection that could result in remote code execution. "The POST /api/v1

Ubiquiti defect poses account takeover risk for UniFi Networking Application users

Source: Ubiquiti defect poses account takeover risk for UniFi Networking Application users

The maximum-severity vulnerability, which hasn’t been exploited in the wild yet, affects software customers use to manage networking devices. The post Ubiquiti defect poses account takeover risk for UniFi Networking Application users appeared first on CyberScoop.

Oracle pushes emergency fix for critical Identity Manager RCE flaw

Source: Oracle pushes emergency fix for critical Identity Manager RCE flaw

Oracle has released an out-of-band security update to fix a critical unauthenticated remote code execution vulnerability in Identity Manager and Web Services Manager tracked as CVE-2026-21992. [...]