We usually worry that employees open emails with viruses or visit shady websites. But what happens when the danger comes from the very programs the IT department uses to manage the network?
In 2026, we have witnessed a wave of critical vulnerabilities in extremely popular infrastructure software, such as pgAdmin, Plesk or Fortinet devices. At Altanet Craiova we know that a "hole" in these programs is like leaving the right key in the door to the server.
Top 3 Vulnerabilities Targeting Company Infrastructure
Hackers are now aiming straight at the network's "brain". Here are the riskiest targets identified recently:
1. pgAdmin (Databases)
pgAdmin is the most widely used tool for managing PostgreSQL databases. Recently, vulnerabilities were discovered that allow attackers to execute code remotely if the pgAdmin server is exposed to the internet.
The risk: Hackers can steal or delete the company's entire database without needing the administrator password.
2. Plesk (Web Hosting)
Plesk is the control panel used by thousands of companies to host their websites. A recent XSS (Cross-Site Scripting) vulnerability combined with root privileges can give attackers full control over all the websites on that server.
The risk: Your website can be replaced with phishing pages or used to attack other customers.
3. Fortinet (Network Security)
Fortinet's VPN and Firewall devices are the guardians of the network. However, the "Remote Code Execution" vulnerabilities discovered in their operating system (FortiOS) allow hackers to pass through the firewall like a hot knife through butter.
The risk: Attackers get into the internal network and can install ransomware unhindered, even if you have VPN enabled.
How do you "patch up" your infrastructure?
The solution is not to give up these tools (they are industry standards), but to administer them properly:
- Do not expose admin panels to the internet: The golden rule. pgAdmin or the Plesk login page must not be directly accessible from a browser, from anywhere. Hide them behind a VPN.
- Aggressive Patch Management: For security devices (Fortinet), the update must be applied within 24 hours of the patch release. Hackers automatically scan the internet for devices that have not been updated.
- Log Monitoring: Periodically check who has logged into the administration panels. If you see a login from Brazil at 4 a.m., you have a problem.
To stay up to date with the latest breaches discovered and the necessary patches, we recommend consulting the security bulletins from CISA (Cybersecurity & Infrastructure Security Agency).
Conclusion
Using professional software does not make you immune. On the contrary, these powerful tools demand even greater responsibility. An unpatched server is a ticking time bomb.
Do you need your network equipment checked or your servers updated safely? Our team provides proactive maintenance and IT services. Visit our contact page and let the professionals take care of your infrastructure.
This material is part of the Altanet educational series on digital safety. Want to know what other risks you are exposed to this year? See the Complete list of cyber threats in 2026.