Proactive Threat Intelligence from the team that finds the vulnerabilities. We publish what is being exploited right now, who is doing it, and whether it reaches you. No vendor summaries written a week late.

Intelligence

Emerging threats, analyzed the day they matter.

CVE-2026-21589 is an Arbitrary File Read vulnerability in Atlassian Jira and Confluence (and other Data Center and Server Products) that lets an
CVE-2026-21589 is an Arbitrary File Access vulnerability affecting eight Atlassian Data Center and Server products, letting unauthenticated attackers read specific files without
CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can cause a denial of service when SAML authentication

Threat analysis

Browse everything →

CVE-2026-88779 is a Denial Of Service (Memory Overflow) in Citrix NetScaler that can make appliances configured for SAML authentication stop responding. Apply
Fortinet disclosed a Path Traversal in FortiMail that lets an unauthenticated attacker write files onto the underlying system through crafted web requests.
Cisco disclosed the Authentication Bypass in Cisco Catalyst SD-WAN Manager, which lets an unauthenticated attacker gain admin-level access to the management API.
CVE-2026-88771 and CVE-2026-88772 are Citrix NetScaler remote code execution zero-days, exploited in the wild and fixed in CTX697096. What is affected, how
CVE-2026-88771 and CVE-2026-88772 are remote code execution zero-days in Citrix NetScaler ADC and Citrix NetScaler Gateway, exploited in the wild and now
Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.