EUVD: actively exploited vulnerabilities from 1 September 2026

Everything the EUVD, NIST NVD, the CISA KEV catalogue and linked CERTs publish about the entries below. It does not say which entry was first reported through the SRP: no source records the reporting route. Overview and caveats: euvd-exploited-baseline.md. Charts and statistics: stats.html. Data in euvd/details/.

60 entries

EUVD-2026-22589 CVE-2026-32202 · Microsoft · exploited since 2026-04-28; KEV event 2026-10-07 · score 4.3

EUVD

EUVD ID

EUVD-2026-22589

Aliases

CVE-2026-32202, GHSA-x62h-w968-3v9v

Description

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Assigner

microsoft

Published

Apr 14, 2026, 4:57:36 PM

Updated

Sep 25, 2026, 5:26:29 PM

Exploited since

Apr 28, 2026, 12:00:00 AM

Base score

4.3 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C

EPSS (as last recorded)

4.9

Products

Windows 11 version 26H1 (Microsoft) 10.0.28000.0 <10.0.28000.2525
Windows 10 Version 22H2 (Microsoft) 10.0.19045.0 <10.0.19045.7548
Windows Server 2025 (Server Core installation) (Microsoft) 10.0.26100.0 <10.0.26100.33158
Windows Server 2019 (Microsoft) 10.0.17763.0 <10.0.17763.9020
Windows Server 2012 R2 (Server Core installation) (Microsoft) 6.3.9600.0 <6.3.9600.23291
Windows Server 2012 (Server Core installation) (Microsoft) 6.2.9200.0 <6.2.9200.26226
Windows 11 Version 24H2 (Microsoft) 10.0.26100.0 <10.0.26100.8875
Windows 11 Version 25H2 (Microsoft) 10.0.26200.0 <10.0.26200.8875
Windows 10 Version 1809 (Microsoft) 10.0.17763.0 <10.0.17763.9020
Windows Server 2019 (Server Core installation) (Microsoft) 10.0.17763.0 <10.0.17763.9020
Windows Server 2016 (Server Core installation) (Microsoft) 10.0.14393.0 <10.0.14393.9339
Windows Server 2022 (Microsoft) 10.0.20348.0 <10.0.20348.5386
Windows Server 2025 (Microsoft) 10.0.26100.0 <10.0.26100.33158
Windows 10 Version 21H2 (Microsoft) 10.0.19044.0 <10.0.19044.7548
Windows Server 2012 (Microsoft) 6.2.9200.0 <6.2.9200.26226
Windows 10 Version 1607 (Microsoft) 10.0.14393.0 <10.0.14393.9339
Windows Server 2012 R2 (Microsoft) 6.3.9600.0 <6.3.9600.23291
Windows Server 2016 (Microsoft) 10.0.14393.0 <10.0.14393.9339
Windows 11 Version 23H2 (Microsoft) 10.0.22631.0 <10.0.22631.7376

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202

NIST NVD

CVE

CVE-2026-32202

Status

Analyzed

Published

2026-04-14T18:17:27.360

Last modified

2026-08-14T17:17:51.127

Description

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Metrics

cvssMetricV31 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (secure@microsoft.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-693

Source

secure@microsoft.com

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202 Vendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-32202-detection-script-spoofing-vulnerability-in-windows-shell Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-32202-mitigation-script-spoofing-vulnerability-in-windows-shell Mitigation, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32202 Third Party Advisory, US Government Resource

CISA KEV catalogue

CVE: CVE-2026-32202
Vendor / project: Microsoft
Product: Windows
Name: Microsoft Windows Protection Mechanism Failure Vulnerability
Added to catalogue: 2026-04-28
Description: Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due: 2026-05-12
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202
CWEs: CWE-693

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-10-07
CISA KEV added: 2026-04-28

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32202

Advisories from CERTs

WID-SEC-W-2026-1104 csaf_certbund · published Apr 14, 2026, 10:00:00 PM · updated Aug 12, 2026, 10:00:00 PM · 30 products
Microsoft Windows: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Produkten ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, um beliebigen Programmcode auszuführen, um falsche Informationen darzustellen, um einen Denial of Service Angriff durchzuführen, und um einen nicht näher spezifizierten Angriff durchzuführen.
NCSC-2026-0119 csaf_ncscnl · published Apr 15, 2026, 8:53:38 AM · updated Apr 15, 2026, 8:53:38 AM · 72 products
Kwetsbaarheden verholpen in Microsoft Windows

Vendor advisories (1)

msrc_CVE-2026-32202 csaf_microsoft · published Apr 14, 2026, 7:00:00 AM · updated Jul 28, 2026, 7:00:00 AM · 57 products
Windows Shell Spoofing Vulnerability

EUVD-2026-45279 CVE-2026-60137 · WordPress · exploited since 2026-07-21; KEV event 2026-09-21 · score 5.9

EUVD

EUVD ID

EUVD-2026-45279

Aliases

CVE-2026-60137

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Assigner

WPScan

Published

Jul 17, 2026, 7:14:12 PM

Updated

Oct 7, 2026, 6:16:21 PM

Exploited since

Jul 21, 2026, 12:00:00 AM

Base score

5.9 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (as last recorded)

5.91

Products

WordPress (WordPress Foundation) 6.9.0 <6.9.5
WordPress (WordPress Foundation) 7.0.0 <7.0.2
WordPress (WordPress Foundation) 6.8.0 <6.8.6

References

NIST NVD

CVE

CVE-2026-60137

Status

Undergoing Analysis

Published

2026-07-17T20:17:27.790

Last modified

2026-10-07T19:17:39.560

Description

Metrics

cvssMetricV31 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (contact@wpscan.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-89

Source

contact@wpscan.com

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf Vendor Advisory
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-60137
Vendor / project: WordPress
Product: Core
Name: WordPress Core SQL Injection Vulnerability
Added to catalogue: 2026-07-21
Description: WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-08-04
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137
CWEs: CWE-89

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-21
CISA KEV added: 2026-07-21

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137

Advisories from CERTs

NCSC-2026-0250 csaf_ncscnl · published Jul 18, 2026, 11:01:56 AM · updated Jul 18, 2026, 11:01:56 AM · 1 products
Kwetsbaarheden verholpen in WordPress door Automattic

EUVD-2026-45280 CVE-2026-63030 · WordPress · exploited since 2026-07-21; KEV event 2026-09-21 · score 9.8

EUVD

EUVD ID

EUVD-2026-45280

Aliases

CVE-2026-63030

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Assigner

WPScan

Published

Jul 17, 2026, 7:14:12 PM

Updated

Oct 7, 2026, 6:26:30 PM

Exploited since

Jul 21, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

10.12

Products

WordPress (WordPress Foundation) 7.0.0 <7.0.2
WordPress (WordPress Foundation) 6.9.0 <6.9.5

References

NIST NVD

CVE

CVE-2026-63030

Status

Undergoing Analysis

Published

2026-07-17T20:17:28.490

Last modified

2026-10-07T19:17:39.767

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (contact@wpscan.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-436

Source

contact@wpscan.com

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q Vendor Advisory
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-63030
Vendor / project: WordPress
Product: Core
Name: WordPress Core Interpretation Conflict Vulnerability
Added to catalogue: 2026-07-21
Description: WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-07-24
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030
CWEs: CWE-436

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-21
CISA KEV added: 2026-07-21

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030

Advisories from CERTs

NCSC-2026-0250 csaf_ncscnl · published Jul 18, 2026, 11:01:56 AM · updated Jul 18, 2026, 11:01:56 AM · 1 products
Kwetsbaarheden verholpen in WordPress door Automattic

EUVD-2026-50404 CVE-2026-20316 · Cisco · exploited since 2026-07-29; KEV event 2026-09-09 · score 5.3

EUVD

EUVD ID

EUVD-2026-50404

Aliases

CVE-2026-20316, GHSA-x85f-hvgg-4944

Description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Assigner

cisco

Published

Jul 29, 2026, 4:22:08 PM

Updated

Sep 16, 2026, 8:14:18 PM

Exploited since

Jul 29, 2026, 12:00:00 AM

Base score

5.3 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (as last recorded)

35.1

Products

Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.4.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.8
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.12
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.10.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.6
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.9
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.10.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.3.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.10.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.11
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.7
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.1.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 10.0.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.10
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.5.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.6
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.1.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.8.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.8.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6
Cisco Secure Firewall Management Center (FMC) (Cisco) 10.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.8
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.11
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.5.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.7
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.10
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.7
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.9
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.1.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.1.1

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

NIST NVD

CVE

CVE-2026-20316

Status

Analyzed

Published

2026-07-29T17:16:51.840

Last modified

2026-09-16T21:17:10.150

Description

Metrics

cvssMetricV31 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (psirt@cisco.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-259

Source

psirt@cisco.com

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-20316
Vendor / project: Cisco
Product: Secure Firewall Management Center (FMC)
Name: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Added to catalogue: 2026-07-29
Description: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-08-01
Known ransomware use: Known
Forensic triage (BOD 26-04): No
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20316
CWEs: CWE-259

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-09
CISA KEV added: 2026-07-29

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316

Advisories from CERTs

NCSC-2026-0271 csaf_ncscnl · published Jul 30, 2026, 6:20:48 AM · updated Sep 11, 2026, 2:54:01 PM · 2 products
Kwetsbaarheid verholpen in Cisco Secure Firewall Management Center

Vendor advisories (1)

cisco-sa-fmc-static-cred-BET3Cjh csaf_cisco · published Jul 29, 2026, 4:00:00 PM · updated Sep 16, 2026, 4:05:47 PM · 8 products
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnera ...

EUVD-2026-32016 CVE-2026-48710 · Kludex · exploited since 2026-09-02; KEV event 2026-09-02 · score 6.5

EUVD

EUVD ID

EUVD-2026-32016

Aliases

CVE-2026-48710, PYSEC-2026-161, X41-2026-002, GHSA-86qp-5c8j-p5mr

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Assigner

GitHub_M

Published

May 26, 2026, 9:54:54 PM

Updated

Oct 1, 2026, 5:41:26 PM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

6.5 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS (as last recorded)

7.06

Products

starlette (encode) < 1.0.1

References

NIST NVD

CVE

CVE-2026-48710

Status

Analyzed

Published

2026-05-26T22:16:44.020

Last modified

2026-10-01T18:17:18.153

Description

Metrics

cvssMetricV31 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (security-advisories@github.com)
cvssMetricV31 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (nvd@nist.gov)
cvssMetricV31 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-1289, CWE-444

Source

security-advisories@github.com

References

https://badhost.org Mitigation, Third Party Advisory
https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6 Patch
https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr Vendor Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml Third Party Advisory
https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette Mitigation, Third Party Advisory
https://www.secwest.net/starlette Exploit, Mitigation, Third Party Advisory
https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette Exploit, Mitigation, Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:22992 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:22993 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:23346 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:24866 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:26226 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30088 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:30089 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:34456 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:34526 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:34532 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:37275 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:43038 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:44696 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:51357 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:60520 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:63337 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-48710 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2481742 Issue Tracking, Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710 Third Party Advisory, US Government Resource
https://www.wiz.io/blog/ai-infrastructure-honeypot Exploit, Third Party Advisory
https:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points Broken Link

CISA KEV catalogue

CVE: CVE-2026-48710
Vendor / project: Kludex
Product: Starlette
Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Added to catalogue: 2026-09-02
Description: Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-16
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710
CWEs: CWE-444

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710

Advisories from CERTs

NCSC-2026-0171 csaf_ncscnl · published May 29, 2026, 7:08:23 PM · updated May 29, 2026, 7:08:23 PM · 1 products
Kwetsbaarheid verholpen in Starlette

Vendor advisories (27)

RHSA-2026:34532 csaf_redhat · published Jul 1, 2026, 8:43:21 PM · updated Oct 2, 2026, 2:21:55 AM · 2 products
Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-rhel9 container image
A new satellite/iop-host-inventory-rhel9 container image is now generally available in the Red Hat container registry.
RHSA-2026:70965 csaf_redhat · published Sep 23, 2026, 4:57:00 PM · updated Oct 2, 2026, 7:20:39 PM · 2 products
Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (cpu)
Red Hat AI Inference 3.4.5 (cpu) is now available.
RHSA-2026:69466 csaf_redhat · published Sep 21, 2026, 2:30:50 PM · updated Oct 2, 2026, 7:20:33 PM · 2 products
Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (cpu)
Red Hat AI Inference 3.4.5 (cpu) is now available.
RHSA-2026:26226 csaf_redhat · published Jun 16, 2026, 9:06:21 AM · updated Oct 2, 2026, 11:30:32 AM · 2 products
Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-rhel9 container image
A new satellite/iop-host-inventory-rhel9 container image is now generally available in the Red Hat container registry.
RHSA-2026:34526 csaf_redhat · published Jul 1, 2026, 8:42:58 PM · updated Oct 2, 2026, 5:42:03 PM · 2 products
Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image
A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry.
RHSA-2026:44696 csaf_redhat · published Jul 23, 2026, 8:38:41 PM · updated Oct 3, 2026, 10:10:53 PM · 2 products
Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-advisor-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
RHSA-2026:73987 csaf_redhat · published Sep 30, 2026, 1:36:01 PM · updated Oct 3, 2026, 9:57:52 PM · 236 products
Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
SUSE-SU-2026:22151-1 csaf_suse · published Jun 17, 2026, 8:36:56 AM · updated Sep 16, 2026, 7:56:53 PM · 3 products
Security update for python-starlette
Security update for python-starlette
RHSA-2026:30088 csaf_redhat · published Jun 25, 2026, 7:30:53 PM · updated Oct 2, 2026, 5:41:53 PM · 2 products
Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (ROCm)
Red Hat AI Inference Server 3.3.5 (ROCm) is now available.
RHSA-2026:51357 csaf_redhat · published Aug 6, 2026, 8:30:54 PM · updated Oct 3, 2026, 1:05:15 PM · 2 products
Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
RHSA-2026:63337 csaf_redhat · published Sep 3, 2026, 8:43:08 PM · updated Oct 2, 2026, 5:41:01 PM · 2 products
Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
RHSA-2026:70979 csaf_redhat · published Sep 23, 2026, 5:05:01 PM · updated Oct 2, 2026, 7:20:40 PM · 3 products
Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (cuda)
Red Hat AI Inference 3.4.5 (cuda) is now available.
RHSA-2026:43038 csaf_redhat · published Jul 21, 2026, 10:10:10 PM · updated Oct 3, 2026, 10:10:47 PM · 28 products
Red Hat Security Advisory: Migration Toolkit for Applications
A new version of Migration Toolkit for Applications (MTA) is now available.
openSUSE-SU-2026:11044-1 csaf_opensuse · published Jun 16, 2026, 12:00:00 AM · updated Sep 17, 2026, 5:10:00 PM · 13 products
python311-google-adk-2.2.0-1.1 on GA media
python311-google-adk-2.2.0-1.1 on GA media
RHSA-2026:30089 csaf_redhat · published Jun 25, 2026, 7:32:31 PM · updated Oct 2, 2026, 5:41:53 PM · 3 products
Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (CUDA)
Red Hat AI Inference Server 3.3.5 (CUDA) is now available.
openSUSE-SU-2026:11026-1 csaf_opensuse · published Jun 13, 2026, 12:00:00 AM · updated Sep 17, 2026, 5:09:41 PM · 25 products
python311-starlette-1.2.0-1.1 on GA media
python311-starlette-1.2.0-1.1 on GA media
RHSA-2026:24866 csaf_redhat · published Jun 9, 2026, 5:09:44 PM · updated Oct 2, 2026, 5:37:08 PM · 115 products
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update
An update is now available for Red Hat Ansible Automation Platform 2.6
RHSA-2026:23346 csaf_redhat · published Jun 4, 2026, 2:20:50 PM · updated Oct 2, 2026, 1:08:34 AM · 7 products
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update
An update is now available for Red Hat Ansible Automation Platform 2.7
RHSA-2026:69464 csaf_redhat · published Sep 21, 2026, 2:29:35 PM · updated Oct 2, 2026, 7:20:32 PM · 4 products
Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (spyre)
Red Hat AI Inference 3.4.5 (spyre) is now available.
RHSA-2026:60520 csaf_redhat · published Aug 27, 2026, 2:50:42 PM · updated Oct 3, 2026, 10:11:45 PM · 322 products
Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
RHSA-2026:37275 csaf_redhat · published Jul 9, 2026, 11:57:58 AM · updated Oct 3, 2026, 10:10:16 PM · 236 products
Red Hat Security Advisory: RHOAI 3.3.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
RHSA-2026:69467 csaf_redhat · published Sep 21, 2026, 2:32:33 PM · updated Oct 2, 2026, 7:20:33 PM · 3 products
Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (cuda)
Red Hat AI Inference 3.4.5 (cuda) is now available.
RHSA-2026:34456 csaf_redhat · published Jul 1, 2026, 6:20:13 PM · updated Oct 2, 2026, 2:16:44 AM · 322 products
Red Hat Security Advisory: RHOAI 3.4.2 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
RHSA-2026:22993 csaf_redhat · published Jun 3, 2026, 8:30:54 PM · updated Oct 2, 2026, 1:08:31 AM · 2 products
Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.
openSUSE-SU-2026:20975-1 csaf_opensuse · published Jun 17, 2026, 8:36:30 AM · updated Sep 17, 2026, 5:35:06 PM · 2 products
Security update for python-starlette
Security update for python-starlette
RHSA-2026:70969 csaf_redhat · published Sep 23, 2026, 4:58:38 PM · updated Oct 2, 2026, 7:20:39 PM · 4 products
Red Hat Security Advisory: Red Hat AI Inference 3.4.5 (spyre)
Red Hat AI Inference 3.4.5 (spyre) is now available.
RHSA-2026:22992 csaf_redhat · published Jun 3, 2026, 7:56:00 PM · updated Oct 2, 2026, 1:08:31 AM · 2 products
Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.

EUVD-2026-39922 CVE-2026-49869 · kestra-io · exploited since 2026-09-02; KEV event 2026-09-02 · score 10.0

EUVD

EUVD ID

EUVD-2026-39922

Aliases

CVE-2026-49869

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

Assigner

GitHub_M

Published

Jun 26, 2026, 8:58:19 PM

Updated

Sep 3, 2026, 3:55:27 AM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

2.1

Products

kestra (kestra-io) < 1.0.45
kestra (kestra-io) 1.1.0, < 1.3.21

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx

NIST NVD

CVE

CVE-2026-49869

Status

Analyzed

Published

2026-06-26T22:16:32.113

Last modified

2026-09-03T13:05:55.387

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (security-advisories@github.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-184, CWE-287, CWE-78, CWE-918

Source

security-advisories@github.com

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx Exploit, Vendor Advisory
https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx Exploit, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-49869
Vendor / project: Kestra
Product: Kestra OSS
Name: Kestra OSS OS Command Injection Vulnerability
Added to catalogue: 2026-09-02
Description: Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869
CWEs: CWE-78, CWE-184, CWE-287, CWE-918

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869

EUVD-2026-42359 CVE-2026-59822 · berriai · exploited since 2026-09-02; KEV event 2026-09-02 · score 8.8

EUVD

EUVD ID

EUVD-2026-42359

Aliases

CVE-2026-59822, GHSA-7488-6r32-c95q

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

Assigner

GitHub_M

Published

Jul 8, 2026, 7:32:18 PM

Updated

Sep 3, 2026, 3:56:05 AM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

8.8 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS (as last recorded)

0.84

Products

LiteLLM (berriai) < 1.84.0

References

NIST NVD

CVE

CVE-2026-59822

Status

Analyzed

Published

2026-07-08T20:16:57.683

Last modified

2026-09-03T13:05:59.573

Description

Metrics

cvssMetricV31 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (nvd@nist.gov)
cvssMetricV40 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (security-advisories@github.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-287, CWE-306

Source

security-advisories@github.com

References

https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c Patch
https://github.com/BerriAI/litellm/pull/26463 Issue Tracking, Patch
https://github.com/BerriAI/litellm/releases/tag/v1.84.0 Product, Release Notes
https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q Mitigation, Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822 US Government Resource
https://www.wiz.io/blog/ai-infrastructure-honeypot Third Party Advisory

CISA KEV catalogue

CVE: CVE-2026-59822
Vendor / project: BerriAI
Product: LiteLLM
Name: BerriAI LiteLLM Improper Authentication Vulnerability
Added to catalogue: 2026-09-02
Description: BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-16
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822
CWEs: CWE-287, CWE-306

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822

EUVD-2026-45205 CVE-2026-9586 · Sangoma · exploited since 2026-09-02; KEV event 2026-09-02 · score 9.3 seen in honeypot

EUVD

EUVD ID

EUVD-2026-45205

Aliases

CVE-2026-9586, GHSA-m32j-v93f-gfgc

Description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Assigner

SRA

Published

Jul 17, 2026, 3:57:42 PM

Updated

Sep 3, 2026, 3:55:29 AM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

9.3 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS (as last recorded)

18.98

Products

Switchvox SMB Edition (Sangoma) 8.3 (104997) <8.4.0.2

References

NIST NVD

CVE

CVE-2026-9586

Status

Analyzed

Published

2026-07-17T17:17:18.150

Last modified

2026-09-03T13:06:25.427

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (57dba5dd-1a03-47f6-8b36-e84e47d335d8)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-89

Source

57dba5dd-1a03-47f6-8b36-e84e47d335d8

References

https://labs.sra.io/posts/switchvox/ Third Party Advisory
https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 Release Notes
https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/# Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586 Third Party Advisory, US Government Resource

CISA KEV catalogue

CVE: CVE-2026-9586
Vendor / project: Sangoma
Product: Switchvox
Name: Sangoma Switchvox SQL Injection Vulnerability
Added to catalogue: 2026-09-02
Description: Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586
CWEs: CWE-89

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

CVE: CVE-2026-9586
Source: shadowserver
First seen: Sep 4, 2026, 3:00:00 AM
Last seen (as last recorded): Oct 13, 2026, 7:12:23 AM
Last 24 h (as last recorded): 8 connections, 7 unique IPs
Averages 7d / 30d / 90d: 1.0 / 1.0 / 0.0
Trend (as last recorded): UPTICK
Product: Sangoma Sangoma Switchvox
Class: voip

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586

EUVD-2026-67861 CVE-2026-82329 · JFrog · exploited since 2026-09-02; KEV event 2026-09-02, 2026-10-01 · score 9.8 seen in honeypot

EUVD

EUVD ID

EUVD-2026-67861

Aliases

CVE-2026-82329, GHSA-c5pf-6p5j-gj87

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Assigner

JFROG

Published

Aug 28, 2026, 6:27:43 PM

Updated

Sep 3, 2026, 3:56:03 AM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

14.12

Products

Artifactory (JFrog) 0 <7.111.21
Artifactory (JFrog) 7.161.0 <7.161.20
Artifactory (JFrog) 7.146.0 <7.146.38
Artifactory (JFrog) 7.125.0 <7.125.20
Artifactory (JFrog) 7.117.0 <7.117.28
Artifactory (JFrog) 7.133.0 <7.133.29

References

NIST NVD

CVE

CVE-2026-82329

Status

Analyzed

Published

2026-08-28T20:20:21.293

Last modified

2026-09-03T13:06:15.630

Description

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (reefs@jfrog.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-287

Source

reefs@jfrog.com

References

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases Release Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329 Third Party Advisory, US Government Resource

CISA KEV catalogue

CVE: CVE-2026-82329
Vendor / project: JFrog
Product: Artifactory
Name: JFrog Artifactory Improper Authentication Vulnerability
Added to catalogue: 2026-09-02
Description: JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329
CWEs: CWE-287

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-10-01
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

CVE: CVE-2026-82329
Source: shadowserver
First seen: Oct 4, 2026, 3:00:00 AM
Trend (as last recorded): STEADY

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329

Advisories from CERTs

NCSC-2026-0336 csaf_ncscnl · published Sep 2, 2026, 8:32:39 AM · updated Sep 2, 2026, 8:32:39 AM · 2 products
Kwetsbaarheid verholpen in JFrog Artifactory
WID-SEC-W-2026-3093 csaf_certbund · published Aug 30, 2026, 10:00:00 PM · updated Sep 2, 2026, 10:00:00 PM · 7 products
JFrog Artifactory: Schwachstelle ermöglicht Erlangen von Administratorrechten
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in JFrog Artifactory ausnutzen, um Administratorrechte zu erlangen.

EUVD-2026-69704 CVE-2026-83548 · SonicWall · exploited since 2026-09-02; KEV event 2026-09-02 · score 10.0

EUVD

EUVD ID

EUVD-2026-69704

Aliases

CVE-2026-83548, GHSA-ghw2-cfh2-xvgc

Description

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

Assigner

sonicwall

Published

Sep 1, 2026, 9:25:45 PM

Updated

Sep 3, 2026, 3:55:31 AM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

8.76

Products

SMA1000 (SonicWall) 12.4.3-03453 (platform-hotfix) and older versions
SMA1000 (SonicWall) 12.5.0-02835 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

NIST NVD

CVE

CVE-2026-83548

Status

Analyzed

Published

2026-09-01T22:17:13.170

Last modified

2026-09-03T13:06:16.053

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-441, CWE-918

Source

PSIRT@sonicwall.com

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-83548
Vendor / project: SonicWall
Product: SMA1000 Appliances
Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Added to catalogue: 2026-09-02
Description: SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548
CWEs: CWE-918, CWE-441

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548

EUVD-2026-69707 CVE-2026-83549 · SonicWall · exploited since 2026-09-02; KEV event 2026-09-02 · score 7.8

EUVD

EUVD ID

EUVD-2026-69707

Aliases

CVE-2026-83549, GHSA-vxcc-7cf2-wcgh

Description

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Assigner

sonicwall

Published

Sep 1, 2026, 9:28:50 PM

Updated

Sep 21, 2026, 1:07:29 PM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

7.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

10.76

Products

SMA1000 (SonicWall) 12.5.0-02835 (platform-hotfix) and older versions
SMA1000 (SonicWall) 12.4.3-03453 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

NIST NVD

CVE

CVE-2026-83549

Status

Analyzed

Published

2026-09-01T22:17:13.290

Last modified

2026-09-21T14:17:21.703

Description

Metrics

cvssMetricV31 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-78

Source

PSIRT@sonicwall.com

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-83549
Vendor / project: SonicWall
Product: SMA1000 Appliances
Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
Added to catalogue: 2026-09-02
Description: SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549
CWEs: CWE-78

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549

EUVD-2026-70645 CVE-2026-58400 · geonetwork · exploited since 2026-09-02; KEV event 2026-09-02 · score 9.1 not in CISA KEV

EUVD

EUVD ID

EUVD-2026-70645

Aliases

CVE-2026-58400

Description

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

Assigner

GitHub_M

Published

Sep 3, 2026, 5:06:17 PM

Updated

Sep 4, 2026, 1:42:08 PM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

9.1 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

1.19

Products

core-geonetwork (geonetwork) 4.3.0, < 4.4.12
core-geonetwork (geonetwork) < 4.2.17

References

NIST NVD

CVE

CVE-2026-58400

Status

Deferred

Published

2026-09-03T18:17:22.827

Last modified

2026-09-09T21:09:13.080

Description

Metrics

cvssMetricV31 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (security-advisories@github.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-470, CWE-94

Source

security-advisories@github.com

References

CISA KEV catalogue

Not in the CISA catalogue. Another source flagged this entry as exploited.

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-02
CISA KEV added: not listed

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

No CERT links in the records.

Advisories from CERTs

NCSC-2026-0343 csaf_ncscnl · published Sep 7, 2026, 12:00:00 PM · updated Sep 7, 2026, 12:00:00 PM · 2 products
Kwetsbaarheden verholpen in GeoNetwork door OpenGeo

EUVD-2026-70647 CVE-2026-63219 · geonetwork · exploited since 2026-09-02; KEV event 2026-09-02 · score 8.6 not in CISA KEV

EUVD

EUVD ID

EUVD-2026-70647

Aliases

CVE-2026-63219

Description

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

Assigner

GitHub_M

Published

Sep 3, 2026, 5:13:01 PM

Updated

Sep 3, 2026, 5:40:21 PM

Exploited since

Sep 2, 2026, 12:00:00 AM

Base score

8.6 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS (as last recorded)

0.47

Products

core-geonetwork (geonetwork) 4.3.0, < 4.4.12
core-geonetwork (geonetwork) < 4.2.17

References

NIST NVD

CVE

CVE-2026-63219

Status

Deferred

Published

2026-09-03T18:17:22.997

Last modified

2026-09-09T21:09:13.080

Description

Metrics

cvssMetricV31 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N (security-advisories@github.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-862

Source

security-advisories@github.com

References

CISA KEV catalogue

Not in the CISA catalogue. Another source flagged this entry as exploited.

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-02
CISA KEV added: not listed

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

No CERT links in the records.

Advisories from CERTs

NCSC-2026-0343 csaf_ncscnl · published Sep 7, 2026, 12:00:00 PM · updated Sep 7, 2026, 12:00:00 PM · 2 products
Kwetsbaarheden verholpen in GeoNetwork door OpenGeo

EUVD-2026-70702 CVE-2026-85046 · Google · exploited since 2026-09-04; KEV event 2026-09-04 · score 8.8

EUVD

EUVD ID

EUVD-2026-70702

Aliases

CVE-2026-85046, GHSA-84qv-4wj5-wwmm

Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Assigner

Chrome

Published

Sep 3, 2026, 7:26:12 PM

Updated

Sep 21, 2026, 12:53:20 PM

Exploited since

Sep 4, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (as last recorded)

48.88

Products

Chrome (Google) 152.0.7977.82 <152.0.7977.82

References

NIST NVD

CVE

CVE-2026-85046

Status

Analyzed

Published

2026-09-03T20:17:24.210

Last modified

2026-09-21T13:17:10.970

Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-843

Source

chrome-cve-admin@google.com

References

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html Release Notes, Vendor Advisory
https://issues.chromium.org/issues/542403045 Permissions Required
https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md Exploit, Third Party Advisory
https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67 Patch
https://news.ycombinator.com/item?id=49570669 Issue Tracking, Third Party Advisory
https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/ Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-85046
Vendor / project: Google
Product: Chromium V8
Name: Google Chromium V8 Type Confusion Vulnerability
Added to catalogue: 2026-09-04
Description: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-18
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85046
CWEs: CWE-843

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-04

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046

Advisories from CERTs

WID-SEC-W-2026-3175 csaf_certbund · published Sep 3, 2026, 10:00:00 PM · updated Sep 8, 2026, 10:00:00 PM · 7 products
Google Chrome / Microsoft Edge: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome / Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen und um Sicherheitsmechanismen zu umgehen.
NCSC-2026-0341 csaf_ncscnl · published Sep 4, 2026, 1:20:15 PM · updated Sep 4, 2026, 1:20:15 PM · 1 products
Kwetsbaarheden verholpen in Google Chrome

Vendor advisories (3)

openSUSE-SU-2026:21799-1 csaf_opensuse · published Sep 5, 2026, 11:43:46 PM · updated Sep 17, 2026, 5:44:02 PM · 7 products
Security update for chromium
Security update for chromium
openSUSE-SU-2026:11714-1 csaf_opensuse · published Sep 8, 2026, 12:00:00 AM · updated Sep 17, 2026, 5:23:22 PM · 9 products
chromedriver-152.0.7977.82-1.1 on GA media
chromedriver-152.0.7977.82-1.1 on GA media
msrc_CVE-2026-85046 csaf_microsoft · published Sep 9, 2026, 3:09:50 PM · updated Sep 9, 2026, 3:09:50 PM · 2 products
Chromium: CVE-2026-85046 Type confusion in V8

EUVD-2026-72024 CVE-2026-67276 · MikroTik · exploited since 2026-09-05; KEV event 2026-09-05 · score 9.2 not in CISA KEV

EUVD

EUVD ID

EUVD-2026-72024

Aliases

CVE-2026-67276, GHSA-j9wg-77fw-f22f

Description

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

Assigner

CERT-PL

Published

Sep 5, 2026, 8:00:55 PM

Updated

Sep 9, 2026, 4:26:19 AM

Exploited since

Sep 5, 2026, 12:00:00 AM

Base score

9.2 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS (as last recorded)

6.45

Products

RouterOS (MikroTik) 7.24 <7.24.2
RouterOS (MikroTik) 7.9 <7.23.4

References

NIST NVD

CVE

CVE-2026-67276

Status

Analyzed

Published

2026-09-05T20:17:17.977

Last modified

2026-09-25T14:57:53.150

Description

Metrics

cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.2 CRITICAL CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (cvd@cert.pl)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-347

Source

cvd@cert.pl

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Mitigation, Third Party Advisory
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ Exploit, Third Party Advisory

CISA KEV catalogue

Not in the CISA catalogue. Another source flagged this entry as exploited.

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-05
CISA KEV added: not listed

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CERT Polska: https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
CERT Polska: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

Advisories from CERTs

NCSC-2026-0345 csaf_ncscnl · published Sep 8, 2026, 9:46:33 AM · updated Sep 8, 2026, 9:46:33 AM · 1 products
Kwetsbaarheden verholpen in MikroTik RouterOS

EUVD-2026-72025 CVE-2026-67277 · MikroTik · exploited since 2026-09-05; KEV event 2026-09-05, 2026-09-10 · score 8.8

EUVD

EUVD ID

EUVD-2026-72025

Aliases

CVE-2026-67277, GHSA-6q2x-6fhj-r3w8

Description

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Assigner

CERT-PL

Published

Sep 5, 2026, 8:00:56 PM

Updated

Sep 11, 2026, 3:55:58 AM

Exploited since

Sep 5, 2026, 12:00:00 AM

Base score

8.8 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS (as last recorded)

1.56

Products

RouterOS (MikroTik) 7.0.0 <7.23.4
RouterOS (MikroTik) 7.24 <7.24.2
RouterOS (MikroTik) 6.0.0 <6.49.21

References

NIST NVD

CVE

CVE-2026-67277

Status

Analyzed

Published

2026-09-05T20:17:18.120

Last modified

2026-09-11T12:52:29.533

Description

Metrics

cvssMetricV31 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H (nvd@nist.gov)
cvssMetricV40 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (cvd@cert.pl)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-306

Source

cvd@cert.pl

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Mitigation, Third Party Advisory
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 Release Notes
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-67277
Vendor / project: MikroTik
Product: RouterOS
Name: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
Added to catalogue: 2026-09-10
Description: MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-13
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://mikrotik.com/supportsec/september-2026-vulnerability/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67277
CWEs: CWE-306

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-05
CISA KEV added: 2026-09-10

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

Advisories from CERTs

NCSC-2026-0345 csaf_ncscnl · published Sep 8, 2026, 9:46:33 AM · updated Sep 8, 2026, 9:46:33 AM · 1 products
Kwetsbaarheden verholpen in MikroTik RouterOS

EUVD-2026-72029 CVE-2026-86060 · MikroTik · exploited since 2026-09-05; KEV event 2026-09-05, 2026-09-10 · score 9.2

EUVD

EUVD ID

EUVD-2026-72029

Aliases

CVE-2026-86060, GHSA-6425-cjxv-52gp

Description

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Assigner

CERT-PL

Published

Sep 5, 2026, 8:00:59 PM

Updated

Sep 11, 2026, 3:55:59 AM

Exploited since

Sep 5, 2026, 12:00:00 AM

Base score

9.2 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS (as last recorded)

6.39

Products

RouterOS (MikroTik) 6.0.0 <6.49.21
RouterOS (MikroTik) 7.24 <7.24.2
RouterOS (MikroTik) 7.0.0 <7.23.4

References

NIST NVD

CVE

CVE-2026-86060

Status

Analyzed

Published

2026-09-05T20:17:18.703

Last modified

2026-09-11T12:52:16.507

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (cvd@cert.pl)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-88

Source

cvd@cert.pl

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Mitigation, Third Party Advisory
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 Release Notes
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-86060
Vendor / project: MikroTik
Product: RouterOS
Name: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
Added to catalogue: 2026-09-10
Description: MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-13
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://mikrotik.com/supportsec/september-2026-vulnerability ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86060
CWEs: CWE-88

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-05
CISA KEV added: 2026-09-10

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

Advisories from CERTs

NCSC-2026-0345 csaf_ncscnl · published Sep 8, 2026, 9:46:33 AM · updated Sep 8, 2026, 9:46:33 AM · 1 products
Kwetsbaarheden verholpen in MikroTik RouterOS

EUVD-2026-72041 CVE-2026-86218 · N-Able · exploited since 2026-09-08; KEV event 2026-09-08 · score 10.0

EUVD

EUVD ID

EUVD-2026-72041

Aliases

CVE-2026-86218, GHSA-5f24-g9g9-m3v8

Description

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Assigner

N-able

Published

Sep 6, 2026, 2:15:28 AM

Updated

Sep 9, 2026, 4:25:45 AM

Exploited since

Sep 8, 2026, 12:00:00 AM

Base score

10.0 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (as last recorded)

12.93

Products

N-central (N-Able) 0 <2026.3.1.14

References

https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution

NIST NVD

CVE

CVE-2026-86218

Status

Analyzed

Published

2026-09-06T03:17:17.373

Last modified

2026-09-09T05:18:19.490

Description

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (a5532a13-c4dd-4202-bef1-e0b8f2f8d12b)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-96

Source

a5532a13-c4dd-4202-bef1-e0b8f2f8d12b

References

https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-86218
Vendor / project: N-able
Product: N-central
Name: N-able N-central Static Code Injection Vulnerability
Added to catalogue: 2026-09-08
Description: N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ ; https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86218
CWEs: CWE-96

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218

Advisories from CERTs

NCSC-2026-0342 csaf_ncscnl · published Sep 7, 2026, 11:34:49 AM · updated Sep 11, 2026, 1:43:21 PM · 1 products
Kwetsbaarheid verholpen in N-central van N-able

EUVD-2026-72530 CVE-2026-75650 · Adobe · exploited since 2026-09-08; KEV event 2026-09-08 · score 10.0

EUVD

EUVD ID

EUVD-2026-72530

Aliases

CVE-2026-75650, GHSA-fj37-xm58-mf28

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Assigner

adobe

Published

Sep 7, 2026, 8:17:16 PM

Updated

Sep 9, 2026, 4:25:47 AM

Exploited since

Sep 8, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

3.95

Products

Adobe Commerce (Adobe) 0 ≤2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
Magento Open Source (Magento) 0 ≤2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
Adobe Commerce B2B (Adobe) 0 ≤1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug

References

https://helpx.adobe.com/security/products/magento/apsb26-146.html

NIST NVD

CVE

CVE-2026-75650

Status

Analyzed

Published

2026-09-07T21:17:30.863

Last modified

2026-09-09T05:18:07.237

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (psirt@adobe.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-1336

Source

psirt@adobe.com

References

https://helpx.adobe.com/security/products/magento/apsb26-146.html Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-75650
Vendor / project: Adobe
Product: Commerce and Magento
Name: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Added to catalogue: 2026-09-08
Description: Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://helpx.adobe.com/security/products/magento/apsb26-146.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-75650
CWEs: CWE-1336

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650

Advisories from CERTs

NCSC-2026-0344 csaf_ncscnl · published Sep 8, 2026, 7:26:00 AM · updated Sep 8, 2026, 7:26:00 AM · 3 products
Kwetsbaarheid verholpen in Adobe Commerce en Magento

EUVD-2026-73365 CVE-2026-85880 · Microsoft · exploited since 2026-09-08; KEV event 2026-09-08 · score 7.8

EUVD

EUVD ID

EUVD-2026-73365

Aliases

CVE-2026-85880, GHSA-96fm-jjf3-wv64

Description

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Assigner

microsoft

Published

Sep 8, 2026, 5:14:21 PM

Updated

Oct 8, 2026, 6:15:38 PM

Exploited since

Sep 8, 2026, 12:00:00 AM

Base score

7.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

EPSS (as last recorded)

3.62

Products

Windows Server 2016 (Microsoft) 10.0.14393.0 <10.0.14393.9512
Windows Server 2012 (Microsoft) 6.2.9200.0 <6.2.9200.26349
Windows Server 2012 (Server Core installation) (Microsoft) 6.2.9200.0 <6.2.9200.26349
Windows 10 Version 22H2 (Microsoft) 10.0.19045.0 <10.0.19045.7725
Windows Server 2022 (Microsoft) 10.0.20348.0 <10.0.20348.5622
Windows Server 2016 (Server Core installation) (Microsoft) 10.0.14393.0 <10.0.14393.9512
Windows Server 2019 (Server Core installation) (Microsoft) 10.0.17763.0 <10.0.17763.9245
Windows Server 2012 R2 (Microsoft) 6.3.9600.0 <6.3.9600.23398
Windows 10 Version 21H2 (Microsoft) 10.0.19044.0 <10.0.19044.7725
Windows Server 2019 (Microsoft) 10.0.17763.0 <10.0.17763.9245
Windows Server 2012 R2 (Server Core installation) (Microsoft) 6.3.9600.0 <6.3.9600.23398
Windows 10 Version 1607 (Microsoft) 10.0.14393.0 <10.0.14393.9512
Windows 10 Version 1809 (Microsoft) 10.0.17763.0 <10.0.17763.9245

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

NIST NVD

CVE

CVE-2026-85880

Status

Analyzed

Published

2026-09-08T18:21:14.087

Last modified

2026-09-24T23:19:20.773

Description

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Metrics

cvssMetricV31 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (secure@microsoft.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-122, CWE-908

Source

secure@microsoft.com

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880 Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-85880
Vendor / project: Microsoft
Product: Windows
Name: Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Added to catalogue: 2026-09-08
Description: Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-22
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85880
CWEs: CWE-122, CWE-908

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880

Advisories from CERTs

NCSC-2026-0353 csaf_ncscnl · published Sep 8, 2026, 6:49:09 PM · updated Sep 9, 2026, 8:04:57 AM · 38 products
Kwetsbaarheden verholpen in Microsoft Windows

Vendor advisories (1)

msrc_CVE-2026-85880 csaf_microsoft · published Sep 8, 2026, 7:00:00 AM · updated Sep 16, 2026, 7:00:00 AM · 27 products
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

EUVD-2026-73889 CVE-2026-81963 · Microsoft · exploited since 2026-09-08; KEV event 2026-09-08 · score 7.8

EUVD

EUVD ID

EUVD-2026-73889

Aliases

CVE-2026-81963, GHSA-4j4j-2wjq-mxqj

Description

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Assigner

microsoft

Published

Sep 8, 2026, 5:19:13 PM

Updated

Oct 8, 2026, 6:20:15 PM

Exploited since

Sep 8, 2026, 12:00:00 AM

Base score

7.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

EPSS (as last recorded)

0.39

Products

Windows 11 Version 24H2 (Microsoft) 10.0.26100.0 <10.0.26100.9445
Windows 11 Version 23H2 (Microsoft) 10.0.22631.0 <10.0.22631.7582
Windows Server 2025 (Microsoft) 10.0.26100.0 <10.0.26100.33438
Windows 11 version 26H1 (Microsoft) 10.0.28000.0 <10.0.28000.2954
Windows Server 2025 (Server Core installation) (Microsoft) 10.0.26100.0 <10.0.26100.33438
Windows 11 Version 25H2 (Microsoft) 10.0.26200.0 <10.0.26200.9445

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963

NIST NVD

CVE

CVE-2026-81963

Status

Analyzed

Published

2026-09-08T18:21:00.090

Last modified

2026-09-09T05:18:17.173

Description

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Metrics

cvssMetricV31 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (secure@microsoft.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-284, CWE-59

Source

secure@microsoft.com

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963 Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-81963
Vendor / project: Microsoft
Product: Windows
Name: Microsoft Windows Link Following Vulnerability
Added to catalogue: 2026-09-08
Description: Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-22
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963
CWEs: CWE-59, CWE-284

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963

Advisories from CERTs

NCSC-2026-0353 csaf_ncscnl · published Sep 8, 2026, 6:49:09 PM · updated Sep 9, 2026, 8:04:57 AM · 38 products
Kwetsbaarheden verholpen in Microsoft Windows

Vendor advisories (1)

msrc_CVE-2026-81963 csaf_microsoft · published Sep 8, 2026, 7:00:00 AM · updated Sep 11, 2026, 7:00:00 AM · 15 products
Windows Update Stack Elevation of Privilege Vulnerability

EUVD-2026-2223 CVE-2025-25249 · Fortinet · exploited since 2026-09-09; KEV event 2026-09-09 · score 7.4

EUVD

EUVD ID

EUVD-2026-2223

Aliases

CVE-2025-25249, GHSA-mj8x-m8f5-x4w8

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Assigner

fortinet

Published

Jan 13, 2026, 4:32:35 PM

Updated

Oct 7, 2026, 5:56:49 PM

Exploited since

Sep 9, 2026, 12:00:00 AM

Base score

7.4 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C

EPSS (as last recorded)

3.86

Products

FortiOS (Fortinet) 7.4.0 ≤7.4.7
FortiOS (Fortinet) 7.2.4 ≤7.2.11
FortiOS (Fortinet) 7.6.0 ≤7.6.2
FortiSwitchManager (Fortinet) 7.2.2 ≤7.2.5

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-084

NIST NVD

CVE

CVE-2025-25249

Status

Analyzed

Published

2026-01-13T17:15:56.910

Last modified

2026-10-07T18:17:13.180

Description

Metrics

cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (psirt@fortinet.com)
cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-122, CWE-787

Source

psirt@fortinet.com

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-084 Mitigation, Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-864900.html Third Party Advisory
https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/ Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249 US Government Resource

CISA KEV catalogue

CVE: CVE-2025-25249
Vendor / project: Fortinet
Product: Multiple Products
Name: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Added to catalogue: 2026-09-09
Description: Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-12
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-084 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-25249
CWEs: CWE-122, CWE-787

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-09

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249

Advisories from CERTs

WID-SEC-W-2026-0085 csaf_certbund · published Jan 13, 2026, 11:00:00 PM · updated Jan 13, 2026, 11:00:00 PM · 6 products
Fortinet FortiOS: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiOS ausnutzen, um beliebigen Programmcode auszuführen.
NCSC-2026-0015 csaf_ncscnl · published Jan 15, 2026, 12:31:57 PM · updated Sep 10, 2026, 2:21:16 PM · 3 products
Kwetsbaarheid verholpen in Fortinet FortiOS
ICSA-25-135-01 csaf_cisa · published May 13, 2025, 12:00:00 AM · updated Jul 9, 2026, 6:00:00 AM · 1 products
Siemens RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications.

Vendor advisories (1)

SSA-864900 csaf_siemens · published May 13, 2025, 12:00:00 AM · updated Aug 11, 2026, 12:00:00 AM · 1 products
SSA-864900: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.

EUVD-2026-62395 CVE-2026-19490 · NetScaler · exploited since 2026-09-09; KEV event 2026-09-09 · score 9.3

EUVD

EUVD ID

EUVD-2026-62395

Aliases

CVE-2026-19490, GHSA-7c6h-rhhv-wm8r

Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Assigner

NetScaler

Published

Aug 19, 2026, 12:54:39 PM

Updated

Oct 7, 2026, 6:01:17 PM

Exploited since

Sep 9, 2026, 12:00:00 AM

Base score

9.3 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

EPSS (as last recorded)

23.16

Products

Gateway (NetScaler) 14.1 ≤73.32
ADC (NetScaler) 13.1 ≤63.21
Gateway (NetScaler) 13.1 ≤63.21
ADC (NetScaler) 14.1 ≤73.32

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939

NIST NVD

CVE

CVE-2026-19490

Status

Analyzed

Published

2026-08-19T13:17:45.000

Last modified

2026-10-07T19:17:36.500

Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-288

Source

50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-19490
Vendor / project: Citrix
Product: NetScaler
Name: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added to catalogue: 2026-09-09
Description: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-12
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19490
CWEs: CWE-288

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-09

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490

Advisories from CERTs

NCSC-2026-0318 csaf_ncscnl · published Aug 20, 2026, 6:56:47 AM · updated Sep 7, 2026, 2:35:47 PM · 3 products
Kwetsbaarheden verholpen in Citrix NetScaler ADC en NetScaler Gateway

EUVD-2026-74529 CVE-2026-87491 · Google · exploited since 2026-09-09; KEV event 2026-09-09 · score 8.8

EUVD

EUVD ID

EUVD-2026-74529

Aliases

CVE-2026-87491, GHSA-8x3p-8g9v-xc7m

Description

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Assigner

Chrome

Published

Sep 9, 2026, 12:09:38 AM

Updated

Sep 21, 2026, 12:51:58 PM

Exploited since

Sep 9, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (as last recorded)

3.14

Products

Chrome (Google) 153.0.8010.36 <153.0.8010.36

References

NIST NVD

CVE

CVE-2026-87491

Status

Analyzed

Published

2026-09-09T01:17:05.887

Last modified

2026-09-21T13:17:11.283

Description

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-787

Source

chrome-cve-admin@google.com

References

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html Release Notes, Vendor Advisory
https://issues.chromium.org/issues/543557673 Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-87491
Vendor / project: Google
Product: Chromium V8
Name: Google Chromium V8 Out of Bounds Write Vulnerability
Added to catalogue: 2026-09-09
Description: Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-23
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87491
CWEs: CWE-787

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-09

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491

Advisories from CERTs

WID-SEC-W-2026-3238 csaf_certbund · published Sep 8, 2026, 10:00:00 PM · updated Sep 14, 2026, 10:00:00 PM · 6 products
Google Chrome / Microsoft Edge: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Ein Angreifer kann mehrere Schwachstellen in Google Chrome / Microsoft Edge ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Umgehung von Sicherheitsmaßnahmen, die Ausweitung von Berechtigungen, die Offenlegung sensibler Informationen, die Durchführung von XSS-Angriffen oder das Auslösen eines Denial-of-Service-Zustands ...
NCSC-2026-0354 csaf_ncscnl · published Sep 9, 2026, 9:43:39 AM · updated Sep 9, 2026, 9:43:39 AM · 1 products
Kwetsbaarheid verholpen in Google Chrome

Vendor advisories (2)

openSUSE-SU-2026:21858-1 csaf_opensuse · published Sep 16, 2026, 8:15:10 AM · updated Sep 17, 2026, 5:44:45 PM · 7 products
Security update for chromium
Security update for chromium
openSUSE-SU-2026:11750-1 csaf_opensuse · published Sep 11, 2026, 12:00:00 AM · updated Sep 17, 2026, 5:24:03 PM · 17 products
chromedriver-153.0.8010.36-1.1 on GA media
chromedriver-153.0.8010.36-1.1 on GA media

EUVD-2026-9438 CVE-2026-20079 · Cisco · exploited since 2026-09-09; KEV event 2026-09-09 · score 10.0

EUVD

EUVD ID

EUVD-2026-9438

Aliases

CVE-2026-20079, GHSA-mv8w-c2qv-cgrg

Description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

Assigner

cisco

Published

Mar 4, 2026, 5:17:35 PM

Updated

Sep 16, 2026, 8:08:37 PM

Exploited since

Sep 9, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

88.18

Products

Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.12
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.10
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.11
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.4.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.1.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.9
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.1.0.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.8
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.1.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.7
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.8.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.1.0.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.6
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.1.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.8.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.10
Cisco Secure Firewall Management Center (FMC) (Cisco) 10.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.1.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.11
Cisco Secure Firewall Management Center (FMC) (Cisco) 10.0.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.3.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.10.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.5
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.1.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.10.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.1.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.7.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.6
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.5.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.8
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.3.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.7
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.9
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.3
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.4
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.10.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.7
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.2
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.6.0
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.5.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.2.0.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.4.2.1
Cisco Secure Firewall Management Center (FMC) (Cisco) 7.0.6

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

NIST NVD

CVE

CVE-2026-20079

Status

Analyzed

Published

2026-03-04T18:16:24.230

Last modified

2026-09-16T17:17:16.340

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (psirt@cisco.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-288

Source

psirt@cisco.com

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 Vendor Advisory
http://seclists.org/fulldisclosure/2026/Aug/80 Exploit, Mailing List, Third Party Advisory
https://blog.talosintelligence.com/fmc-ongoing-exploitation/ Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-20079
Vendor / project: Cisco
Product: Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Name: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added to catalogue: 2026-09-09
Description: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-12
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20079
CWEs: CWE-288

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-09
CISA KEV added: 2026-09-09

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079

Advisories from CERTs

WID-SEC-W-2026-0610 csaf_certbund · published Mar 4, 2026, 11:00:00 PM · updated Mar 18, 2026, 11:00:00 PM · 2 products
Cisco Secure Firewall Management Center: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cisco Secure Firewall Management Center und Cisco Secure Firewall Threat Defense ausnutzen, um Root-Rechte zu erlangen, beliebigen Code mit Root-Rechten auszuführen, SQL-Injection durchzuführen und vertrauliche Daten offenzulegen sowie Daten zu manipulieren.
NCSC-2026-0076 csaf_ncscnl · published Mar 4, 2026, 8:49:12 PM · updated Sep 12, 2026, 8:52:01 AM · 2 products
Kwetsbaarheden verholpen in Cisco Secure Firewall Management Center

Vendor advisories (1)

cisco-sa-onprem-fmc-authbypass-5JPp45V2 csaf_cisco · published Mar 4, 2026, 4:00:00 PM · updated Sep 16, 2026, 4:03:19 PM · 9 products
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnera ...

EUVD-2026-49566 CVE-2026-42016 · JFrog · exploited since 2026-09-11; KEV event 2026-09-11 · score 8.1

EUVD

EUVD ID

EUVD-2026-49566

Aliases

CVE-2026-42016, GHSA-58cv-8cfm-c8r8

Description

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Assigner

JFROG

Published

Jul 27, 2026, 7:20:56 PM

Updated

Sep 12, 2026, 3:55:20 AM

Exploited since

Sep 11, 2026, 12:00:00 AM

Base score

8.1 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS (as last recorded)

8.64

Products

Artifactory (JFrog) 0 <7.133.11

References

NIST NVD

CVE

CVE-2026-42016

Status

Analyzed

Published

2026-07-27T20:16:39.613

Last modified

2026-09-12T04:16:32.483

Description

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Metrics

cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (reefs@jfrog.com)
cvssMetricV31 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-863

Source

reefs@jfrog.com

References

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases Release Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016 US Government Resource
https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 Third Party Advisory

CISA KEV catalogue

CVE: CVE-2026-42016
Vendor / project: JFrog
Product: Artifactory
Name: JFrog Artifactory Incorrect Authorization Vulnerability
Added to catalogue: 2026-09-11
Description: JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-25
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42016
CWEs: CWE-863

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-11

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016

Advisories from CERTs

NCSC-2026-0272 csaf_ncscnl · published Jul 31, 2026, 8:51:36 AM · updated Jul 31, 2026, 8:51:36 AM · 1 products
Kwetsbaarheden verholpen in JFrog Artifactory

EUVD-2026-57388 CVE-2026-42018 · JFrog · exploited since 2026-09-11; KEV event 2026-09-11 · score 7.5

EUVD

EUVD ID

EUVD-2026-57388

Aliases

CVE-2026-42018, GHSA-3q94-gprh-7pwm

Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Assigner

JFROG

Published

Aug 12, 2026, 5:43:21 PM

Updated

Oct 1, 2026, 6:06:26 PM

Exploited since

Sep 11, 2026, 12:00:00 AM

Base score

7.5 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (as last recorded)

9.81

Products

Artifactory (JFrog) 0 <7.111.20
Artifactory (JFrog) 7.133.0 <7.133.28
Artifactory (JFrog) 7.125.0 <7.125.19
Artifactory (JFrog) 7.117.0 <7.117.27
Artifactory (JFrog) 7.146.0 <7.146.8

References

NIST NVD

CVE

CVE-2026-42018

Status

Analyzed

Published

2026-08-12T18:17:29.473

Last modified

2026-10-01T19:17:20.413

Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Metrics

cvssMetricV31 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (reefs@jfrog.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-287

Source

reefs@jfrog.com

References

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases Release Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018 US Government Resource
https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 Third Party Advisory

CISA KEV catalogue

CVE: CVE-2026-42018
Vendor / project: JFrog
Product: Artifactory
Name: JFrog Artifactory Improper Authentication Vulnerability
Added to catalogue: 2026-09-11
Description: JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-25
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42018
CWEs: CWE-287

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-11

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018

EUVD-2026-74053 CVE-2026-84869 · ConnectWise · exploited since 2026-09-11; KEV event 2026-09-11 · score 9.9

EUVD

EUVD ID

EUVD-2026-74053

Aliases

CVE-2026-84869, GHSA-rc8v-f46m-jcgm

Description

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Assigner

ConnectWise

Published

Sep 8, 2026, 7:29:33 PM

Updated

Sep 12, 2026, 3:55:19 AM

Exploited since

Sep 11, 2026, 12:00:00 AM

Base score

9.9 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

0.92

Products

ScreenConnect (ConnectWise) All versions prior to 26.6.5

References

NIST NVD

CVE

CVE-2026-84869

Status

Analyzed

Published

2026-09-08T20:18:51.147

Last modified

2026-09-12T04:16:42.757

Description

Metrics

cvssMetricV31 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (7d616e1a-3288-43b1-a0dd-0a65d3e70a49)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-269, CWE-862

Source

7d616e1a-3288-43b1-a0dd-0a65d3e70a49

References

https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869 Third Party Advisory
https://www.connectwise.com/company/trust/advisories Vendor Advisory
https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869 US Government Resource
https://www.huntress.com/blog/rogue-screenconnect-installations Third Party Advisory

CISA KEV catalogue

CVE: CVE-2026-84869
Vendor / project: ConnectWise
Product: ScreenConnect
Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
Added to catalogue: 2026-09-11
Description: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-14
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869
CWEs: CWE-269, CWE-862

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-11

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869

Advisories from CERTs

WID-SEC-W-2026-3256 csaf_certbund · published Sep 8, 2026, 10:00:00 PM · updated Sep 9, 2026, 10:00:00 PM · 3 products
ConnectWise ScreenConnect: Schwachstelle ermöglicht Codeausführung
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in ConnectWise ScreenConnect ausnutzen, um Code auszuführen.

EUVD-2026-76779 CVE-2026-85706 · GitLab · exploited since 2026-09-11; KEV event 2026-09-11 · score 10.0 seen in honeypot

EUVD

EUVD ID

EUVD-2026-76779

Aliases

CVE-2026-85706, GHSA-f47w-mrg9-g9p2

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Assigner

GitLab

Published

Sep 12, 2026, 2:46:31 AM

Updated

Sep 23, 2026, 9:03:18 PM

Exploited since

Sep 11, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS (as last recorded)

92.96

Products

GitLab (GitLab) 19.1 <19.1.8
GitLab (GitLab) 19.3 <19.3.2
GitLab (GitLab) 19.0 <19.0.9
GitLab (GitLab) 18.7 <18.11.12
GitLab (GitLab) 19.2 <19.2.6

References

NIST NVD

CVE

CVE-2026-85706

Status

Analyzed

Published

2026-09-12T03:16:30.473

Last modified

2026-09-24T12:52:28.143

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (cve@gitlab.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-22

Source

cve@gitlab.com

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627748 Broken Link
https://hackerone.com/reports/3909881 Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706 Third Party Advisory, US Government Resource

CISA KEV catalogue

CVE: CVE-2026-85706
Vendor / project: GitLab
Product: Community Edition and Enterprise Edition
Name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Added to catalogue: 2026-09-11
Description: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-14
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706
CWEs: CWE-35

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-11

Honeypot sensors (Shadowserver, via EUVD)

CVE: CVE-2026-85706
Source: shadowserver
First seen: Oct 8, 2026, 3:00:00 AM
Trend (as last recorded): STEADY

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706

Advisories from CERTs

NCSC-2026-0367 csaf_ncscnl · published Sep 12, 2026, 8:15:31 AM · updated Sep 12, 2026, 8:15:31 AM · 2 products
Kwetsbaarheid verholpen in GitLab Community en Enterprise Editions

EUVD-2026-77625 CVE-2026-76461 · Cisco · exploited since 2026-09-14; KEV event 2026-09-14 · score 9.8

EUVD

EUVD ID

EUVD-2026-77625

Aliases

CVE-2026-76461, GHSA-jwpf-jww6-h6vr

Description

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Assigner

cisco

Published

Sep 14, 2026, 4:09:07 PM

Updated

Sep 18, 2026, 12:10:27 PM

Exploited since

Sep 14, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

28.27

Products

Cisco Secure Email (Cisco) 13.5.1-277
Cisco Secure Email (Cisco) 13.0.5-007
Cisco Secure Email (Cisco) 15.0.1-030
Cisco Secure Email (Cisco) 15.5.0-048
Cisco Secure Email (Cisco) 14.0.0-698
Cisco Secure Email (Cisco) 13.0.0-392
Cisco Secure Email (Cisco) 15.0.3-002
Cisco Secure Email (Cisco) 16.0.3-044
Cisco Secure Email (Cisco) 15.5.1-055
Cisco Secure Email (Cisco) 13.5.4-038
Cisco Secure Email (Cisco) 15.5.4-012
Cisco Secure Email (Cisco) 16.0.0-050
Cisco Secure Email (Cisco) 14.2.1-020
Cisco Secure Email (Cisco) 15.5.3-022
Cisco Secure Email (Cisco) 15.0.0-104
Cisco Secure Email (Cisco) 15.5.2-018
Cisco Secure Email (Cisco) 16.0.4-016
Cisco Secure Email (Cisco) 14.2.0-620
Cisco Secure Email (Cisco) 14.3.0-032
Cisco Secure Email (Cisco) 15.0.5-016
Cisco Secure Email (Cisco) 16.0.2-112
Cisco Secure Email (Cisco) 16.0.0-054
Cisco Secure Email (Cisco) 16.0.1-017

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

NIST NVD

CVE

CVE-2026-76461

Status

Analyzed

Published

2026-09-14T17:17:51.113

Last modified

2026-09-15T12:47:32.497

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (psirt@cisco.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-89

Source

psirt@cisco.com

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-76461
Vendor / project: Cisco
Product: Secure Email Gateway
Name: Cisco Secure Email Gateway SQL Injection Vulnerability
Added to catalogue: 2026-09-14
Description: Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-17
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76461
CWEs: CWE-89

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-14

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461

Advisories from CERTs

NCSC-2026-0368 csaf_ncscnl · published Sep 14, 2026, 6:27:05 PM · updated Sep 14, 2026, 6:27:05 PM · 1 products
Kwetsbaarheid verholpen in Cisco Secure Email Gateway

Vendor advisories (1)

cisco-sa-esa-inj-2bLVGmhX csaf_cisco · published Sep 14, 2026, 4:00:00 PM · updated Sep 17, 2026, 4:47:12 PM · 9 products
Cisco Secure Email Gateway SQL Injection Vulnerability
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that co ...

EUVD-2026-79004 CVE-2026-58704 · Google · exploited since 2026-09-16; KEV event 2026-09-16 · score 8.8

EUVD

EUVD ID

EUVD-2026-79004

Aliases

CVE-2026-58704, GHSA-chq2-jxgv-5vfw

Description

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Assigner

Google_Devices

Published

Sep 15, 2026, 6:34:37 PM

Updated

Oct 7, 2026, 6:14:21 PM

Exploited since

Sep 16, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

0.59

Products

Android (Google) Android kernel

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01

NIST NVD

CVE

CVE-2026-58704

Status

Analyzed

Published

2026-09-15T19:17:32.297

Last modified

2026-10-07T19:17:39.150

Description

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-285, CWE-693

Source

dsap-vuln-management@google.com

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-58704
Vendor / project: Google
Product: Pixel
Name: Google Pixel Improper Authorization Vulnerability
Added to catalogue: 2026-09-16
Description: Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-19
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-58704
CWEs: CWE-693

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-16

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704

EUVD-2026-81122 CVE-2026-76460 · Cisco · exploited since 2026-09-16; KEV event 2026-09-16 · score 10.0

EUVD

EUVD ID

EUVD-2026-81122

Aliases

CVE-2026-76460, GHSA-25wc-3w28-q6vw

Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Assigner

cisco

Published

Sep 16, 2026, 8:12:02 PM

Updated

Oct 7, 2026, 6:27:47 PM

Exploited since

Sep 16, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

14.03

Products

Cisco Identity Services Engine Software (Cisco) 3.3 Patch 2
Cisco ISE Passive Identity Connector (Cisco) 3.4.0
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 1
Cisco Identity Services Engine Software (Cisco) 3.5.0
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 11
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 8
Cisco Identity Services Engine Software (Cisco) 3.4 Patch 4
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 9
Cisco Identity Services Engine Software (Cisco) 3.5 Patch 2
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 4
Cisco Identity Services Engine Software (Cisco) 3.4 Patch 1
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 10
Cisco Identity Services Engine Software (Cisco) 3.1.0 p9
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 3
Cisco Identity Services Engine Software (Cisco) 3.2 Patch 8
Cisco Identity Services Engine Software (Cisco) 3.4 Patch 5
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 6
Cisco Identity Services Engine Software (Cisco) 3.2.0 p7
Cisco Identity Services Engine Software (Cisco) 3.4 Patch 6
Cisco Identity Services Engine Software (Cisco) 3.4 Patch 2
Cisco Identity Services Engine Software (Cisco) 3.1.0 p10
Cisco Identity Services Engine Software (Cisco) 3.5 Patch 1
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 5
Cisco Identity Services Engine Software (Cisco) 3.5 Patch 3
Cisco Identity Services Engine Software (Cisco) 3.1.0 p8
Cisco Identity Services Engine Software (Cisco) 3.3 Patch 7
Cisco Identity Services Engine Software (Cisco) 3.2 Patch 9
Cisco Identity Services Engine Software (Cisco) 3.4 Patch 3
Cisco Identity Services Engine Software (Cisco) 3.1.0 p11
Cisco Identity Services Engine Software (Cisco) 3.4.0
Cisco Identity Services Engine Software (Cisco) 3.2 Patch 10
Cisco ISE Passive Identity Connector (Cisco) 3.5.0

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

NIST NVD

CVE

CVE-2026-76460

Status

Analyzed

Published

2026-09-16T21:17:21.430

Last modified

2026-10-07T19:17:40.417

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (psirt@cisco.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-648

Source

psirt@cisco.com

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-76460
Vendor / project: Cisco
Product: Identity Services Engine
Name: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Added to catalogue: 2026-09-16
Description: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-19
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76460
CWEs: CWE-648

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-16

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460

Advisories from CERTs

NCSC-2026-0382 csaf_ncscnl · published Sep 17, 2026, 9:24:38 AM · updated Sep 17, 2026, 9:24:38 AM · 3 products
Kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE)

Vendor advisories (1)

cisco-sa-ISE-ABP-VNSW7Tn5 csaf_cisco · published Sep 16, 2026, 4:00:00 PM · updated Sep 16, 2026, 4:00:00 PM · 7 products
Cisco Identity Services Engine Authentication Bypass Vulnerability
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized ac ...

EUVD-2026-82595 CVE-2026-87886 · Acronis · exploited since 2026-09-16; KEV event 2026-09-16 · score 7.8

EUVD

EUVD ID

EUVD-2026-82595

Aliases

CVE-2026-87886, GHSA-hrq3-qgq7-jm9x

Description

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

Assigner

Acronis

Published

Sep 17, 2026, 10:57:18 PM

Updated

Sep 18, 2026, 2:33:42 PM

Exploited since

Sep 16, 2026, 12:00:00 AM

Base score

7.8 (CVSS 3.0)

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

0.23

Products

Acronis Backup extension for Plesk (Acronis) unspecified <1.8.11.638
Acronis Backup plugin for DirectAdmin (Acronis) unspecified <1.2.3.238
Acronis Backup plugin for cPanel & WHM (Acronis) unspecified <1.9.3.1021

References

https://security-advisory.acronis.com/advisories/SEC-10986

NIST NVD

CVE

CVE-2026-87886

Status

Analyzed

Published

2026-09-17T23:18:53.763

Last modified

2026-09-18T19:29:35.067

Description

Metrics

cvssMetricV30 7.8 HIGH CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (security@acronis.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-276

Source

security@acronis.com

References

https://security-advisory.acronis.com/advisories/SEC-10986 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-87886
Vendor / project: Acronis
Product: Backup
Name: Acronis Backup Incorrect Default Permissions Vulnerability
Added to catalogue: 2026-09-16
Description: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-19
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886
CWEs: CWE-276

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-16

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886

EUVD-2025-31542 CVE-2025-39682 · Linux · exploited since 2026-09-18; KEV event 2026-09-18 · score 9.8

EUVD

EUVD ID

EUVD-2025-31542

Aliases

CVE-2025-39682, GHSA-v2pf-75pf-9c5h

Description

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Assigner

Linux

Published

Sep 5, 2025, 5:20:48 PM

Updated

Oct 7, 2026, 5:56:14 PM

Exploited since

Sep 18, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

2.88

Products

Linux (Linux) patch: 6.1.149
Linux (Linux) patch: 0
Linux (Linux) 84c61fe1a75b4255df1e1e7c054c9e6d048da417 <c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677
Linux (Linux) patch: 6.17
Linux (Linux) 84c61fe1a75b4255df1e1e7c054c9e6d048da417 <3439c15ae91a517cf3c650ea15a8987699416ad9
Linux (Linux) 84c61fe1a75b4255df1e1e7c054c9e6d048da417 <2902c3ebcca52ca845c03182000e8d71d3a5196f
Linux (Linux) 84c61fe1a75b4255df1e1e7c054c9e6d048da417 <62708b9452f8eb77513115b17c4f8d1a22ebf843
Linux (Linux) 84c61fe1a75b4255df1e1e7c054c9e6d048da417 <29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e
Linux (Linux) patch: 6.12.44
Linux (Linux) patch: 6.6.103
Linux (Linux) 6.0
Linux (Linux) patch: 6.16.4

References

NIST NVD

CVE

CVE-2025-39682

Status

Analyzed

Published

2025-09-05T18:15:44.670

Last modified

2026-10-07T18:17:13.443

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-754, NVD-CWE-Other

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

References

https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f Patch
https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e Patch
https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9 Patch
https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 Patch
https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682 US Government Resource

CISA KEV catalogue

CVE: CVE-2025-39682
Vendor / project: Linux
Product: Kernel
Name: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Added to catalogue: 2026-09-18
Description: Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-21
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f; https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677; https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9; https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e; https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39682
CWEs: CWE-754

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-18

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682

Advisories from CERTs

WID-SEC-W-2025-1988 csaf_certbund · published Sep 7, 2025, 10:00:00 PM · updated Sep 20, 2026, 10:00:00 PM · 34 products
Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder nicht näher spezifizierte Auswirkungen zu erzielen.
NCSC-2026-0074 csaf_ncscnl · published Mar 3, 2026, 9:07:09 AM · updated Mar 3, 2026, 9:07:09 AM · 2 products
Kwetsbaarheden verholpen in Google Android en Samsung Mobile
ICSA-26-134-10 csaf_cisa · published May 12, 2026, 12:00:00 AM · updated May 14, 2026, 6:00:00 AM · 1 products
Siemens SIMATIC
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
NCSC-2026-0147 csaf_ncscnl · published May 13, 2026, 6:33:28 AM · updated May 13, 2026, 6:33:28 AM · 46 products
Kwetsbaarheden verholpen in Siemens-producten

Vendor advisories (77)

SUSE-SU-2026:20149-1 csaf_suse · published Jan 26, 2026, 11:24:31 AM · updated Jan 26, 2026, 11:24:31 AM · 5 products
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
SUSE-SU-2026:20382-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:57 PM · 3 products
Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:0171-1 csaf_suse · published Jan 19, 2026, 4:34:41 PM · updated Sep 16, 2026, 6:58:22 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 1 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel RT (Live Patch 1 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:0270-1 csaf_suse · published Jan 23, 2026, 10:33:38 AM · updated Sep 16, 2026, 7:00:24 PM · 4 products
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP6)
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP6)
SUSE-SU-2025:03601-1 csaf_suse · published Oct 15, 2025, 12:57:01 PM · updated Oct 15, 2025, 12:57:01 PM · 122 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20394-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:30:13 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20379-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:52 PM · 3 products
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:0148-1 csaf_suse · published Jan 17, 2026, 12:04:20 PM · updated Sep 16, 2026, 6:58:11 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 0 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel RT (Live Patch 0 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:20258-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:45 PM · 3 products
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
RHSA-2025:19223 csaf_redhat · published Oct 29, 2025, 12:20:39 AM · updated Sep 21, 2026, 1:00:15 PM · 20 products
Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:0283-1 csaf_suse · published Jan 23, 2026, 5:33:31 PM · updated Jan 23, 2026, 5:33:31 PM · 8 products
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:0284-1 csaf_suse · published Jan 23, 2026, 8:04:18 PM · updated Jan 23, 2026, 8:04:18 PM · 4 products
Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2025:20870-1 csaf_suse · published Oct 23, 2025, 4:01:09 PM · updated Sep 20, 2026, 6:19:37 PM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20256-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:43 PM · 3 products
Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20398-1 csaf_suse · published Jan 19, 2026, 3:31:57 PM · updated Sep 16, 2026, 7:30:17 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20396-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:30:15 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20261-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:49 PM · 3 products
Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2025:20994-1 csaf_suse · published Nov 6, 2025, 3:30:43 PM · updated Nov 6, 2025, 3:30:43 PM · 53 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:0202-1 csaf_suse · published Jan 21, 2026, 2:35:49 PM · updated Sep 16, 2026, 6:58:48 PM · 8 products
Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2025:20861-1 csaf_suse · published Oct 15, 2025, 3:17:40 PM · updated Oct 15, 2025, 3:17:40 PM · 18 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2025:03634-1 csaf_suse · published Oct 17, 2025, 2:32:52 PM · updated Oct 17, 2025, 2:32:52 PM · 27 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20399-1 csaf_suse · published Jan 19, 2026, 3:33:28 PM · updated Sep 16, 2026, 7:30:19 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise Micro 6.0)
openSUSE-SU-2025:20081-1 csaf_opensuse · published Nov 25, 2025, 7:35:00 AM · updated Sep 20, 2026, 9:47:48 PM · 235 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2025:03600-1 csaf_suse · published Oct 15, 2025, 12:54:53 PM · updated Oct 15, 2025, 12:54:53 PM · 128 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:0146-1 csaf_suse · published Jan 17, 2026, 11:33:35 AM · updated Sep 16, 2026, 6:58:08 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 3 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel RT (Live Patch 3 for SUSE Linux Enterprise 15 SP7)
RHSA-2025:16880 csaf_redhat · published Sep 29, 2025, 5:35:08 AM · updated Sep 21, 2026, 1:00:07 PM · 193 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:0144-1 csaf_suse · published Jan 17, 2026, 11:04:22 AM · updated Sep 16, 2026, 6:58:05 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 2 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel RT (Live Patch 2 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:20251-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:28:36 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
openSUSE-SU-2025-20081-1 csaf_opensuse · published Nov 25, 2025, 7:35:00 AM · updated Nov 25, 2025, 7:35:00 AM · 118 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2025:20851-1 csaf_suse · published Oct 15, 2025, 4:17:22 PM · updated Oct 15, 2025, 4:17:22 PM · 12 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2025:16904 csaf_redhat · published Sep 29, 2025, 8:02:17 AM · updated Sep 21, 2026, 1:00:10 PM · 195 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2025:03633-1 csaf_suse · published Oct 17, 2025, 2:32:41 PM · updated Oct 17, 2025, 2:32:41 PM · 26 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20164-1 csaf_suse · published Jan 26, 2026, 9:12:02 AM · updated Jan 26, 2026, 9:12:02 AM · 2 products
Security update for the Linux Kernel RT (Live Patch 0 for SUSE Linux Enterprise 16)
Security update for the Linux Kernel RT (Live Patch 0 for SUSE Linux Enterprise 16)
SUSE-SU-2025:21139-1 csaf_suse · published Nov 25, 2025, 7:34:57 AM · updated Sep 20, 2026, 6:23:06 PM · 103 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20392-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:30:10 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20248-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:28:31 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20253-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:28:39 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:0145-1 csaf_suse · published Jan 17, 2026, 11:04:25 AM · updated Sep 16, 2026, 6:58:07 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise 15 SP7)
msrc_CVE-2025-39682 csaf_microsoft · published Sep 2, 2025, 12:00:00 AM · updated Sep 7, 2025, 1:10:35 AM · 6 products
tls: fix handling of zero-length records on the rx_list
SUSE-SU-2026:20260-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:47 PM · 3 products
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20395-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:30:14 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 8 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2025:21074-1 csaf_suse · published Nov 25, 2025, 7:34:57 AM · updated Sep 20, 2026, 6:22:09 PM · 57 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20259-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:46 PM · 3 products
Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:0262-1 csaf_suse · published Jan 22, 2026, 4:33:41 PM · updated Sep 16, 2026, 7:00:11 PM · 4 products
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 15 SP6)
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 15 SP6)
SUSE-SU-2026:20249-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:28:32 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:0274-1 csaf_suse · published Jan 23, 2026, 12:04:25 PM · updated Sep 16, 2026, 7:00:26 PM · 13 products
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP6)
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP6)
SUSE-SU-2026:20264-1 csaf_suse · published Jan 19, 2026, 3:33:28 PM · updated Sep 16, 2026, 7:28:53 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2025:20996-1 csaf_suse · published Nov 6, 2025, 3:51:37 PM · updated Nov 6, 2025, 3:51:37 PM · 26 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20377-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:50 PM · 3 products
Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20257-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:44 PM · 3 products
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
SSA-032379 csaf_siemens · published May 12, 2026, 12:00:00 AM · updated May 12, 2026, 12:00:00 AM · 1 products
SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.0
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
SUSE-SU-2026:20400-1 csaf_suse · published Jan 19, 2026, 3:33:57 PM · updated Sep 16, 2026, 7:30:20 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20378-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:51 PM · 3 products
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20265-1 csaf_suse · published Jan 19, 2026, 3:33:57 PM · updated Sep 16, 2026, 7:28:54 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
RHSA-2025:19104 csaf_redhat · published Oct 27, 2025, 4:41:00 PM · updated Sep 21, 2026, 1:00:13 PM · 174 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:20266-1 csaf_suse · published Jan 19, 2026, 4:27:04 PM · updated Sep 16, 2026, 7:28:55 PM · 3 products
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20380-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:54 PM · 3 products
Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20393-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:30:12 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20252-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:28:37 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:0203-1 csaf_suse · published Jan 21, 2026, 1:04:03 PM · updated Sep 16, 2026, 6:58:49 PM · 4 products
Security update for the Linux Kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP6)
Security update for the Linux Kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP6)
SUSE-SU-2025:3725-1 csaf_suse · published Oct 22, 2025, 11:48:19 AM · updated Oct 22, 2025, 11:48:19 AM · 19 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20381-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:56 PM · 3 products
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20250-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:28:35 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 7 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20255-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:28:41 PM · 3 products
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2025:03602-1 csaf_suse · published Oct 15, 2025, 12:57:25 PM · updated Oct 15, 2025, 12:57:25 PM · 19 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:0209-1 csaf_suse · published Jan 21, 2026, 6:03:57 PM · updated Sep 16, 2026, 6:58:53 PM · 4 products
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 15 SP7)
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:0269-1 csaf_suse · published Jan 23, 2026, 10:04:12 AM · updated Sep 16, 2026, 7:00:22 PM · 4 products
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 15 SP6)
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 15 SP6)
SUSE-SU-2025:3751-1 csaf_suse · published Oct 23, 2025, 10:25:37 AM · updated Sep 20, 2026, 6:24:59 PM · 44 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20397-1 csaf_suse · published Jan 19, 2026, 3:28:20 PM · updated Sep 16, 2026, 7:30:16 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20376-1 csaf_suse · published Jan 19, 2026, 3:31:55 PM · updated Sep 16, 2026, 7:29:49 PM · 3 products
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2025:21179-1 csaf_suse · published Nov 25, 2025, 7:34:55 AM · updated Sep 20, 2026, 6:23:34 PM · 19 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20169-1 csaf_suse · published Jan 26, 2026, 11:24:31 AM · updated Jan 26, 2026, 11:24:31 AM · 4 products
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
SUSE-SU-2025:20898-1 csaf_suse · published Oct 23, 2025, 1:59:20 PM · updated Sep 20, 2026, 6:20:07 PM · 15 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20254-1 csaf_suse · published Jan 19, 2026, 3:31:57 PM · updated Sep 16, 2026, 7:28:40 PM · 2 products
Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20385-1 csaf_suse · published Jan 19, 2026, 4:27:04 PM · updated Sep 16, 2026, 7:30:01 PM · 3 products
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise Micro 6.0)
SUSE-SU-2026:20560-1 csaf_suse · published Nov 25, 2025, 7:34:57 AM · updated Sep 16, 2026, 7:32:51 PM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2025:19224 csaf_redhat · published Oct 29, 2025, 12:45:53 AM · updated Sep 21, 2026, 1:00:17 PM · 138 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

EUVD-2025-34068 CVE-2025-39964 · Linux · exploited since 2026-09-18; KEV event 2026-09-18 · score 7.8

EUVD

EUVD ID

EUVD-2025-34068

Aliases

CVE-2025-39964, GHSA-wr5g-mfhw-rpfj

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Assigner

Linux

Published

Oct 13, 2025, 1:48:30 PM

Updated

Sep 19, 2026, 3:56:17 AM

Exploited since

Sep 18, 2026, 12:00:00 AM

Base score

7.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

1.0

Products

Linux (Linux) patch: 6.6.108
Linux (Linux) patch: 6.17
Linux (Linux) patch: 0
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <9aee87da5572b3a14075f501752e209801160d3d
Linux (Linux) patch: 5.15.194
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <e4c1ec11132ec466f7362a95f36a506ce4dc08c9
Linux (Linux) patch: 6.16.9
Linux (Linux) patch: 6.1.154
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <7c4491b5644e3a3708f3dbd7591be0a570135b84
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <45bcf60fe49b37daab1acee57b27211ad1574042
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
Linux (Linux) patch: 5.10.245
Linux (Linux) patch: 6.12.49
Linux (Linux) 2.6.38
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
Linux (Linux) 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 <1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8

References

NIST NVD

CVE

CVE-2025-39964

Status

Analyzed

Published

2025-10-13T14:15:34.737

Last modified

2026-09-19T04:17:48.307

Description

Metrics

cvssMetricV31 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
cvssMetricV31 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (nvd@nist.gov)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-362

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

References

CISA KEV catalogue

CVE: CVE-2025-39964
Vendor / project: Linux
Product: Kernel
Name: Linux Kernel Race Condition Vulnerability
Added to catalogue: 2026-09-18
Description: Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-21
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9; https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8; https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84; https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d; https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042; https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39964
CWEs: CWE-362

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-18

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964

Advisories from CERTs

WID-SEC-W-2025-2268 csaf_certbund · published Oct 13, 2025, 10:00:00 PM · updated Sep 20, 2026, 10:00:00 PM · 14 products
Linux Kernel: Mehrere Schwachstellen
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Daten zu manipulieren oder einen Denial of Service herbeizuführen.
ICSA-26-209-04 csaf_cisa · published Jul 14, 2026, 12:00:00 AM · updated Jul 28, 2026, 6:00:00 AM · 5 products
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Vendor advisories (40)

RHSA-2026:71687 csaf_redhat · published Sep 24, 2026, 10:49:58 PM · updated Oct 2, 2026, 9:38:17 PM · 74 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:23528-1 csaf_suse · published Sep 8, 2026, 10:34:26 AM · updated Oct 2, 2026, 10:44:14 AM · 15 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:4120-1 csaf_suse · published Sep 10, 2026, 9:31:34 AM · updated Oct 2, 2026, 10:45:14 AM · 37 products
Security update for the Linux Kernel
Security update for the Linux Kernel
openSUSE-SU-2026:21555-1 csaf_opensuse · published Aug 12, 2026, 1:09:28 AM · updated Sep 30, 2026, 11:19:19 AM · 273 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71327 csaf_redhat · published Sep 24, 2026, 7:00:10 AM · updated Oct 1, 2026, 11:41:33 PM · 193 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:71606 csaf_redhat · published Sep 24, 2026, 1:07:21 PM · updated Oct 2, 2026, 9:38:17 PM · 20 products
Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:70403 csaf_redhat · published Sep 22, 2026, 8:09:45 PM · updated Oct 1, 2026, 11:41:16 PM · 18 products
Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:1041-1 csaf_suse · published Mar 25, 2026, 2:13:20 PM · updated Sep 16, 2026, 7:11:18 PM · 127 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:23477-1 csaf_suse · published Sep 8, 2026, 12:54:32 PM · updated Oct 2, 2026, 10:44:11 AM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71326 csaf_redhat · published Sep 24, 2026, 6:26:44 AM · updated Oct 1, 2026, 11:41:21 PM · 195 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:20838-1 csaf_suse · published Mar 25, 2026, 8:48:43 AM · updated Sep 16, 2026, 7:35:54 PM · 29 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:70459 csaf_redhat · published Sep 23, 2026, 10:26:13 PM · updated Oct 2, 2026, 9:33:57 PM · 194 products
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:71657 csaf_redhat · published Sep 24, 2026, 4:46:07 PM · updated Oct 2, 2026, 9:38:14 PM · 13 products
Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:20720-1 csaf_suse · published Mar 11, 2026, 4:03:14 PM · updated Sep 20, 2026, 6:36:42 PM · 23 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:23529-1 csaf_suse · published Sep 8, 2026, 11:00:17 AM · updated Oct 2, 2026, 10:44:15 AM · 35 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71565 csaf_redhat · published Sep 24, 2026, 11:08:19 AM · updated Oct 2, 2026, 9:38:10 PM · 98 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vuln ...
SSA-019113 csaf_siemens · published Jul 14, 2026, 12:00:00 AM · updated Sep 8, 2026, 12:00:00 AM · 5 products
SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products wher ...
SUSE-SU-2026:20667-1 csaf_suse · published Mar 11, 2026, 3:14:55 PM · updated Sep 16, 2026, 7:34:06 PM · 18 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71592 csaf_redhat · published Sep 24, 2026, 12:09:39 PM · updated Oct 2, 2026, 9:34:02 PM · 98 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vuln ...
RHSA-2026:71594 csaf_redhat · published Sep 24, 2026, 1:08:01 PM · updated Oct 2, 2026, 9:38:15 PM · 49 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from ...
SUSE-SU-2026:23481-1 csaf_suse · published Sep 8, 2026, 1:00:49 PM · updated Oct 2, 2026, 10:44:12 AM · 24 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:70402 csaf_redhat · published Sep 22, 2026, 9:24:45 PM · updated Oct 1, 2026, 11:41:15 PM · 101 products
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:71329 csaf_redhat · published Sep 24, 2026, 12:00:00 AM · updated Oct 2, 2026, 10:42:05 AM · 104 products
security update for kernel
security update for kernel
msrc_CVE-2025-39964 csaf_microsoft · published Oct 2, 2025, 12:00:00 AM · updated Oct 15, 2025, 1:01:33 AM · 5 products
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
SUSE-SU-2026:20845-1 csaf_suse · published Mar 24, 2026, 4:48:38 PM · updated Sep 30, 2026, 3:55:44 PM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71569 csaf_redhat · published Sep 24, 2026, 2:34:12 PM · updated Oct 2, 2026, 9:34:00 PM · 166 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:71601 csaf_redhat · published Sep 24, 2026, 2:19:52 PM · updated Oct 2, 2026, 9:38:12 PM · 138 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:73788 csaf_redhat · published Sep 30, 2026, 2:44:03 PM · updated Oct 2, 2026, 9:19:18 AM · 54 products
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux for NVIDIA. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:0962-1 csaf_suse · published Mar 23, 2026, 9:09:02 AM · updated Sep 16, 2026, 7:10:22 PM · 20 products
Security update for the Linux Kernel
Security update for the Linux Kernel
openSUSE-SU-2026:20416-1 csaf_opensuse · published Mar 25, 2026, 8:49:52 AM · updated Sep 17, 2026, 5:29:03 PM · 273 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:21284-1 csaf_suse · published Mar 25, 2026, 8:43:53 AM · updated Sep 16, 2026, 7:42:37 PM · 15 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20876-1 csaf_suse · published Mar 24, 2026, 4:48:29 PM · updated Sep 30, 2026, 3:55:45 PM · 15 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:1078-1 csaf_suse · published Mar 26, 2026, 12:43:07 PM · updated Sep 16, 2026, 7:11:54 PM · 88 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:72059 csaf_redhat · published Sep 25, 2026, 6:55:22 PM · updated Oct 2, 2026, 9:19:15 AM · 54 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for NVIDIA for RHEL 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:70498 csaf_redhat · published Sep 23, 2026, 5:09:36 AM · updated Oct 1, 2026, 11:41:15 PM · 197 products
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:20873-1 csaf_suse · published Mar 25, 2026, 8:52:20 AM · updated Sep 16, 2026, 7:36:28 PM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:4369-1 csaf_suse · published Oct 2, 2026, 12:46:28 PM · updated Oct 2, 2026, 5:47:42 PM · 103 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:1081-1 csaf_suse · published Mar 26, 2026, 1:23:51 PM · updated Mar 26, 2026, 1:23:51 PM · 144 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:20931-1 csaf_suse · published Mar 25, 2026, 8:48:43 AM · updated Sep 16, 2026, 7:37:33 PM · 59 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:4282-1 csaf_suse · published Sep 22, 2026, 8:34:06 AM · updated Sep 29, 2026, 8:21:10 AM · 88 products
Security update for the Linux Kernel
Security update for the Linux Kernel

EUVD-2026-39217 CVE-2026-53266 · Linux · exploited since 2026-09-18; KEV event 2026-09-18 · score 8.8

EUVD

EUVD ID

EUVD-2026-39217

Aliases

CVE-2026-53266, GHSA-xmhg-rr34-2chj

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

Assigner

Linux

Published

Jun 25, 2026, 8:39:53 AM

Updated

Sep 19, 2026, 3:56:22 AM

Exploited since

Sep 18, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

0.83

Products

Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <afd64b59c3de9bbbdd3759e834fdc55cda716e0b
Linux (Linux) patch: 0
Linux (Linux) 5.4.73 <5.5
Linux (Linux) b7d23c2c87584eb429f115c078ed511be8b18e29
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <67ba971ae02514d85818fe0c32549ab4bfa3bf49
Linux (Linux) 5.9.2 <5.10
Linux (Linux) patch: 5.10.259
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <153ea96c806aea395daba907a4f88480b6ad5093
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <76280b78cc9f23bdc6438e10ad6dff148ef8375b
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5
Linux (Linux) 5.10
Linux (Linux) patch: 6.12.94
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <b18675263db1147c8e1cab625400c13a0d87bd2d
Linux (Linux) patch: 6.1.176
Linux (Linux) 2f3839075a5f8dcf116c1abe35b36b018ac62445
Linux (Linux) patch: 7.0.13
Linux (Linux) 51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b
Linux (Linux) patch: 7.1
Linux (Linux) 5.8.17 <5.9
Linux (Linux) patch: 6.6.143
Linux (Linux) patch: 5.15.210
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <b7e91939ba9be805a62a257fa4e227dffbb88fa0
Linux (Linux) patch: 6.18.36
Linux (Linux) 63137bc5882a1882c553d389fdeeeace86ee1741 <bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87

References

NIST NVD

CVE

CVE-2026-53266

Status

Analyzed

Published

2026-06-25T09:16:44.643

Last modified

2026-09-19T04:17:53.580

Description

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-787, NVD-CWE-noinfo

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

References

CISA KEV catalogue

CVE: CVE-2026-53266
Vendor / project: Linux
Product: Kernel
Name: Linux Kernel Out-of-Bounds Write Vulnerability
Added to catalogue: 2026-09-18
Description: Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-21
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87; https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b; https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0; https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b; https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093; https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d; https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5; https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-53266
CWEs: CWE-787

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-18

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266

Advisories from CERTs

WID-SEC-W-2026-2077 csaf_certbund · published Jun 24, 2026, 10:00:00 PM · updated Sep 20, 2026, 10:00:00 PM · 18 products
Linux Kernel: Mehrere Schwachstellen
Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen und weitere, nicht näher spezifizierte Auswirkungen zu erzielen.

Vendor advisories (27)

RHSA-2026:71233 csaf_redhat · published Sep 24, 2026, 5:12:34 AM · updated Oct 2, 2026, 9:34:04 PM · 197 products
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:22522-1 csaf_suse · published Jul 6, 2026, 1:11:38 PM · updated Sep 20, 2026, 6:39:55 PM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:73732 csaf_redhat · published Sep 30, 2026, 2:44:03 PM · updated Sep 30, 2026, 11:41:00 PM · 42 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
msrc_CVE-2026-53266 csaf_microsoft · published Jun 27, 2026, 1:06:23 AM · updated Jun 28, 2026, 1:58:40 AM · 4 products
netfilter: bridge: make ebt_snat ARP rewrite writable
RHSA-2026:71325 csaf_redhat · published Sep 24, 2026, 5:07:19 AM · updated Sep 30, 2026, 11:38:55 PM · 49 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from ...
RHSA-2026:71569 csaf_redhat · published Sep 24, 2026, 2:34:12 PM · updated Oct 2, 2026, 9:34:00 PM · 166 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:22835-1 csaf_suse · published Jul 21, 2026, 8:27:34 AM · updated Sep 16, 2026, 8:06:40 PM · 59 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:72059 csaf_redhat · published Sep 25, 2026, 6:55:22 PM · updated Oct 2, 2026, 9:19:15 AM · 54 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for NVIDIA for RHEL 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:71565 csaf_redhat · published Sep 24, 2026, 11:08:19 AM · updated Oct 2, 2026, 9:38:10 PM · 98 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vuln ...
SUSE-SU-2026:22666-1 csaf_suse · published Jul 6, 2026, 1:11:37 PM · updated Sep 16, 2026, 8:04:04 PM · 8 products
Security update for the Linux Kernel
Security update for the Linux Kernel
openSUSE-SU-2026:21388-1 csaf_opensuse · published Jul 21, 2026, 8:27:32 AM · updated Sep 17, 2026, 5:39:31 PM · 137 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:39083 csaf_redhat · published Jul 14, 2026, 6:09:06 AM · updated Oct 2, 2026, 9:31:31 PM · 101 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:22521-1 csaf_suse · published Jul 6, 2026, 1:11:36 PM · updated Sep 20, 2026, 6:39:54 PM · 19 products
Security update for the Linux Kernel
Security update for the Linux Kernel
SUSE-SU-2026:22769-1 csaf_suse · published Jul 21, 2026, 8:27:34 AM · updated Sep 16, 2026, 8:05:49 PM · 29 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71657 csaf_redhat · published Sep 24, 2026, 4:46:07 PM · updated Oct 2, 2026, 9:38:14 PM · 13 products
Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:22665-1 csaf_suse · published Jul 6, 2026, 1:11:35 PM · updated Sep 16, 2026, 8:04:03 PM · 15 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71326 csaf_redhat · published Sep 24, 2026, 6:26:44 AM · updated Oct 1, 2026, 11:41:21 PM · 195 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:71687 csaf_redhat · published Sep 24, 2026, 10:49:58 PM · updated Oct 2, 2026, 9:38:17 PM · 74 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:70797 csaf_redhat · published Sep 23, 2026, 3:08:57 PM · updated Sep 30, 2026, 11:38:53 PM · 98 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vuln ...
RHSA-2026:71327 csaf_redhat · published Sep 24, 2026, 7:00:10 AM · updated Oct 1, 2026, 11:41:33 PM · 193 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2026:36645 csaf_redhat · published Jul 8, 2026, 2:02:54 PM · updated Sep 30, 2026, 11:25:04 PM · 191 products
Red Hat Security Advisory: kernel update
An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:22812-1 csaf_suse · published Jul 21, 2026, 8:27:33 AM · updated Sep 16, 2026, 8:06:24 PM · 10 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71606 csaf_redhat · published Sep 24, 2026, 1:07:21 PM · updated Oct 2, 2026, 9:38:17 PM · 20 products
Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:22742-1 csaf_suse · published Jul 21, 2026, 8:27:34 AM · updated Sep 16, 2026, 8:05:24 PM · 9 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:39082 csaf_redhat · published Jul 14, 2026, 5:39:50 AM · updated Oct 2, 2026, 9:31:31 PM · 18 products
Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SUSE-SU-2026:2799-1 csaf_suse · published Jul 8, 2026, 2:58:16 PM · updated Sep 17, 2026, 4:28:35 PM · 37 products
Security update for the Linux Kernel
Security update for the Linux Kernel
RHSA-2026:71601 csaf_redhat · published Sep 24, 2026, 2:19:52 PM · updated Oct 2, 2026, 9:38:12 PM · 138 products
Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

EUVD-2026-37030 CVE-2026-7273 · Zyxel · exploited since 2026-09-21; KEV event 2026-09-21 · score 8.8

EUVD

EUVD ID

EUVD-2026-37030

Aliases

CVE-2026-7273, GHSA-rrv4-8jq5-8j78

Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Assigner

Zyxel

Published

Jun 16, 2026, 2:20:29 AM

Updated

Sep 22, 2026, 3:55:39 AM

Exploited since

Sep 21, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

2.5

Products

GS1900-24EP firmware (Zyxel) ≤ 2.90(ABTO.1)C0
GS1900-24HPv2 firmware (Zyxel) ≤ 2.90(ABTP.1)C0
GS1900-16 firmware (Zyxel) ≤ 2.90(AAHJ.1)C0
GS1900-8HP firmware (Zyxel) ≤ 2.90(AAHI.1)C0
GS1900-48HPv2 firmware (Zyxel) ≤ 2.90(ABTQ.1)C0
GS1900-24E firmware (Zyxel) ≤ 2.90(AAHK.1)C0
GS1900-24 firmware (Zyxel) ≤ 2.90(AAHL.1)C0
GS1900-48 firmware (Zyxel) ≤ 2.90(AAHN.1)C0
GS1900-8 Firmware (Zyxel) ≤ 2.90(AAHH.1)C0
GS1900-10HP firmware (Zyxel) ≤ 2.90(AAZI.1)C0

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

NIST NVD

CVE

CVE-2026-7273

Status

Analyzed

Published

2026-06-16T03:16:13.557

Last modified

2026-09-22T12:10:51.067

Description

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (security@zyxel.com.tw)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-121

Source

security@zyxel.com.tw

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273 Third Party Advisory, US Government Resource
https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation Exploit, Third Party Advisory

CISA KEV catalogue

CVE: CVE-2026-7273
Vendor / project: Zyxel
Product: GS1900 Series Switches
Name: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Added to catalogue: 2026-09-21
Description: Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-24
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-7273
CWEs: CWE-121

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-21

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273

EUVD-2026-75009 CVE-2026-85102 · checkpoint · exploited since 2026-09-22; KEV event 2026-09-22 · score 9.8

EUVD

EUVD ID

EUVD-2026-75009

Aliases

CVE-2026-85102, GHSA-3fvr-5gg9-225m

Description

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Assigner

checkpoint

Published

Sep 9, 2026, 1:00:31 PM

Updated

Sep 23, 2026, 3:55:34 AM

Exploited since

Sep 22, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

7.55

Products

Quantum Security Gateway (checkpoint) R82.10 with Jumbo Hotfix Take 43 or below
Quantum Security Gateway (checkpoint) R81.20 with Jumbo Hotfix Take 165 or below
Quantum Security Gateway (checkpoint) R82 with Jumbo Hotfix Take 125 or below

References

https://support.checkpoint.com/results/sk/sk1000117

NIST NVD

CVE

CVE-2026-85102

Status

Analyzed

Published

2026-09-09T13:20:43.793

Last modified

2026-09-23T18:22:07.453

Description

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (cve@checkpoint.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-295

Source

cve@checkpoint.com

References

https://support.checkpoint.com/results/sk/sk1000117 Mitigation, Patch, Vendor Advisory
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-85102
Vendor / project: Check Point
Product: Multiple Products
Name: Check Point Multiple Products Improper Certificate Validation Vulnerability
Added to catalogue: 2026-09-22
Description: Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-25
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102
CWEs: CWE-295

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-22
CISA KEV added: 2026-09-22

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102

Advisories from CERTs

WID-SEC-W-2026-3305 csaf_certbund · published Sep 9, 2026, 10:00:00 PM · updated Sep 22, 2026, 10:00:00 PM · 20 products
Check Point Security Gateway, Spark Firewall und Security Management: Mehrere Schwachstellen ermöglichen Codeausführung
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Security Gateway, Check Point Spark Firewall und Check Point Security Management ausnutzen, um beliebigen Programmcode auszuführen.
NCSC-2026-0365 csaf_ncscnl · published Sep 10, 2026, 9:12:56 AM · updated Sep 23, 2026, 8:28:31 AM · 2 products
Kwetsbaarheden verholpen in Check Point VPN-producten

EUVD-2026-84296 CVE-2026-93952 · Arista Networks · exploited since 2026-09-22; KEV event 2026-09-22 · score 9.5

EUVD

EUVD ID

EUVD-2026-84296

Aliases

CVE-2026-93952, GHSA-fqhw-f6hf-cq3w

Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Assigner

Arista

Published

Sep 22, 2026, 7:37:24 AM

Updated

Sep 23, 2026, 3:55:40 AM

Exploited since

Sep 22, 2026, 12:00:00 AM

Base score

9.5 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (as last recorded)

1.06

Products

VeloCloud Orchestrator (VCO) On-Prem (Arista Networks) 6.1.0 ≤6.1.3.7
VeloCloud Orchestrator (VCO) On-Prem (Arista Networks) 5.2.0 ≤5.2.3.15
VeloCloud Orchestrator (VCO) On-Prem (Arista Networks) 6.4.0 ≤6.4.2.7
VeloCloud Orchestrator (VCO) On-Prem (Arista Networks) 7.0.0 ≤7.0.0.2

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

NIST NVD

CVE

CVE-2026-93952

Status

Analyzed

Published

2026-09-22T08:16:43.047

Last modified

2026-09-23T14:32:12.417

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (psirt@arista.com)
cvssMetricV40 9.5 CRITICAL CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (psirt@arista.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-20

Source

psirt@arista.com

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-93952
Vendor / project: Arista
Product: VeloCloud Orchestrator
Name: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Added to catalogue: 2026-09-22
Description: Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-25
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93952
CWEs: CWE-20

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-22
CISA KEV added: 2026-09-22

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952

Advisories from CERTs

NCSC-2026-0385 csaf_ncscnl · published Sep 22, 2026, 2:34:34 PM · updated Sep 22, 2026, 2:34:34 PM · 2 products
Kwetsbaarheid verholpen in VeloCloud Orchestrator (VCO) on-premises

EUVD-2026-84375 CVE-2026-93616 · checkpoint · exploited since 2026-09-22; KEV event 2026-09-22 · score 9.8 seen in honeypot

EUVD

EUVD ID

EUVD-2026-84375

Aliases

CVE-2026-93616, GHSA-x5gq-4cxx-rf2r

Description

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Assigner

checkpoint

Published

Sep 22, 2026, 12:59:01 PM

Updated

Sep 23, 2026, 3:55:59 AM

Exploited since

Sep 22, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

19.65

Products

Quantum Security Management (checkpoint) R82 with Jumbo Hotfix Take 126 or below
Quantum Security Management (checkpoint) R81 (EOS)
Quantum Security Management (checkpoint) R80.40 (EOS)
Quantum Security Management (checkpoint) R82.20 with no Jumbo Hotfix
Quantum Security Management (checkpoint) R80.20 (EOS)
Quantum Security Management (checkpoint) R81.10 (EOS) with Jumbo Hotfix Take 190 or below
Quantum Security Management (checkpoint) R80 (EOS)
Quantum Security Management (checkpoint) R82.10 with Jumbo Hotfix Take 44 or below
Quantum Security Management (checkpoint) R81.20 with Jumbo Hotfix Take 166 or below
Quantum Security Management (checkpoint) R80.30 (EOS)
Quantum Security Management (checkpoint) R80.10 (EOS)

References

https://support.checkpoint.com/results/sk/sk1000171

NIST NVD

CVE

CVE-2026-93616

Status

Analyzed

Published

2026-09-22T13:17:11.963

Last modified

2026-09-23T16:38:38.987

Description

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (cve@checkpoint.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-22

Source

cve@checkpoint.com

References

https://support.checkpoint.com/results/sk/sk1000171 Mitigation, Patch, Vendor Advisory
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-93616
Vendor / project: Check Point
Product: Multiple Products
Name: Check Point Multiple Products Path Traversal Vulnerability
Added to catalogue: 2026-09-22
Description: Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-25
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://support.checkpoint.com/results/sk/sk1000171/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93616
CWEs: CWE-22

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-22
CISA KEV added: 2026-09-22

Honeypot sensors (Shadowserver, via EUVD)

CVE: CVE-2026-93616
Source: shadowserver
First seen: Sep 26, 2026, 3:00:00 AM
Trend (as last recorded): STEADY

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616

Advisories from CERTs

NCSC-2026-0387 csaf_ncscnl · published Sep 23, 2026, 7:06:02 AM · updated Sep 23, 2026, 7:06:02 AM · 1 products
Kwetsbaarheid verholpen in Check Point Security Management en Log Servers

EUVD-2026-84427 CVE-2026-94127 · F5 · exploited since 2026-09-22; KEV event 2026-09-22 · score 9.3

EUVD

EUVD ID

EUVD-2026-84427

Aliases

CVE-2026-94127, GHSA-qppv-6jrg-hxq4

Description

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Assigner

Published

Sep 22, 2026, 2:17:42 PM

Updated

Sep 23, 2026, 3:55:44 AM

Exploited since

Sep 22, 2026, 12:00:00 AM

Base score

9.3 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS (as last recorded)

2.23

Products

BIG-IP (F5) 17.5.0 <Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
BIG-IP (F5) 17.1.0 <Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
BIG-IP (F5) 21.1.0 <Hotfix-BIGIP-21.1.0.2.0.30.22-ENG

References

https://my.f5.com/manage/s/article/K000162605

NIST NVD

CVE

CVE-2026-94127

Status

Analyzed

Published

2026-09-22T15:17:24.313

Last modified

2026-09-23T14:32:07.910

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (f5sirt@f5.com)
cvssMetricV40 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (f5sirt@f5.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-122

Source

f5sirt@f5.com

References

https://my.f5.com/manage/s/article/K000162605 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-94127
Vendor / project: F5
Product: BIG-IP APM
Name: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
Added to catalogue: 2026-09-22
Description: F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-25
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127
CWEs: CWE-122

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-22
CISA KEV added: 2026-09-22

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127

Advisories from CERTs

NCSC-2026-0386 csaf_ncscnl · published Sep 22, 2026, 2:39:41 PM · updated Sep 23, 2026, 1:41:38 PM · 1 products
Kwetsbaarheid verholpen in F5 Networks BIG-IP Access Policy Manager

EUVD-2026-84555 CVE-2026-87902 · WordPress · exploited since 2026-09-23; KEV event 2026-09-23, 2026-09-25 · score 8.1 SRP candidate (indication only)

EUVD

EUVD ID

EUVD-2026-84555

Aliases

CVE-2026-87902

Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Assigner

hackerone

Published

Sep 22, 2026, 4:44:15 PM

Updated

Sep 26, 2026, 3:55:51 AM

Exploited since

Sep 23, 2026, 12:00:00 AM

Base score

8.1 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

45.5

Products

WordPress (WordPress Foundation) 0 <7.1.2

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

NIST NVD

CVE

CVE-2026-87902

Status

Analyzed

Published

2026-09-22T17:17:28.310

Last modified

2026-09-28T12:20:54.040

Description

Metrics

cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-98

Source

support@hackerone.com

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp Vendor Advisory
https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-87902
Vendor / project: WordPress
Product: Core
Name: WordPress Core Remote File Inclusion Vulnerability
Added to catalogue: 2026-09-25
Description: WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-28
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902
CWEs: CWE-98

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-23
CISA KEV added: 2026-09-25

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902

Advisories from CERTs

NCSC-2026-0389 csaf_ncscnl · published Sep 23, 2026, 11:47:46 AM · updated Sep 24, 2026, 9:14:33 AM · 1 products
Kwetsbaarheid verholpen in WordPress

EUVD-2026-53822 CVE-2026-5430 · WSO2 · exploited since 2026-09-24; KEV event 2026-09-24 · score 10.0

EUVD

EUVD ID

EUVD-2026-53822

Aliases

CVE-2026-5430, GHSA-j7vh-5w8q-4m4x

Description

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

Assigner

WSO2

Published

Aug 6, 2026, 7:33:28 AM

Updated

Sep 25, 2026, 3:55:16 AM

Exploited since

Sep 24, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

0.59

Products

WSO2 Carbon API Manager Rest API Utility (WSO2) 9.30.67 <9.30.67.167
WSO2 API Manager (WSO2) 4.1.0 <4.1.0.257
WSO2 Carbon API Manager Rest API Utility (WSO2) 9.32.147 <9.32.147.59
WSO2 Carbon API Manager Rest API Utility (WSO2) 9.29.120 <9.29.120.236
WSO2 API Control Plane (WSO2) 4.5.0 <4.5.0.58
WSO2 API Manager (WSO2) 4.2.0 <4.2.0.197
WSO2 API Manager (WSO2) 4.3.0 <4.3.0.108
WSO2 Carbon API Manager Rest API Utility (WSO2) 9.31.86 <9.31.86.158
WSO2 Carbon API Manager Rest API Utility (WSO2) 9.20.74 <9.20.74.401
WSO2 Universal Gateway (WSO2) 4.5.0 <4.5.0.57
WSO2 Universal Gateway (WSO2) 4.6.0 <4.6.0.21
WSO2 API Manager (WSO2) 4.5.0 <4.5.0.57
WSO2 API Control Plane (WSO2) 4.6.0 <4.6.0.22
WSO2 API Manager (WSO2) 4.4.0 <4.4.0.72
WSO2 Traffic Manager (WSO2) 4.5.0 <4.5.0.56
WSO2 Carbon API Manager Rest API Utility (WSO2) 9.28.116 <9.28.116.417
WSO2 API Manager (WSO2) 4.6.0 <4.6.0.21
WSO2 Traffic Manager (WSO2) 4.6.0 <4.6.0.21

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/

NIST NVD

CVE

CVE-2026-5430

Status

Analyzed

Published

2026-08-06T08:16:33.240

Last modified

2026-09-25T12:53:05.517

Description

Metrics

cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (ed10eef1-636d-4fbe-9993-6890dfa878f8)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-347

Source

ed10eef1-636d-4fbe-9993-6890dfa878f8

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-5430
Vendor / project: WSO2
Product: Multiple Products
Name: WSO2 Multiple Products Path Traversal Vulnerability
Added to catalogue: 2026-09-24
Description: WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-27
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-5430
CWEs: CWE-347

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-24

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430

EUVD-2026-56844 CVE-2026-71362 · Adobe · exploited since 2026-09-24; KEV event 2026-09-24 · score 9.1

EUVD

EUVD ID

EUVD-2026-56844

Aliases

CVE-2026-71362, GHSA-f58v-hxr9-8947

Description

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Assigner

adobe

Published

Aug 11, 2026, 5:52:48 PM

Updated

Sep 25, 2026, 3:55:15 AM

Exploited since

Sep 24, 2026, 12:00:00 AM

Base score

9.1 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS (as last recorded)

87.51

Products

Adobe Commerce (Adobe) 0 ≤2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
Magento Open Source (Magento) 0 ≤2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
Adobe Commerce B2B (Adobe) 0 ≤1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul

References

https://helpx.adobe.com/security/products/magento/apsb26-92.html

NIST NVD

CVE

CVE-2026-71362

Status

Analyzed

Published

2026-08-11T18:18:21.610

Last modified

2026-09-25T12:53:15.757

Description

Metrics

cvssMetricV31 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (psirt@adobe.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-863

Source

psirt@adobe.com

References

https://helpx.adobe.com/security/products/magento/apsb26-92.html Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-71362
Vendor / project: Adobe
Product: Commerce and Magento
Name: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Added to catalogue: 2026-09-24
Description: Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-27
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://helpx.adobe.com/security/products/magento/apsb26-92.html ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-71362
CWEs: CWE-863

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-24

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362

Advisories from CERTs

WID-SEC-W-2026-2768 csaf_certbund · published Aug 11, 2026, 10:00:00 PM · updated Aug 12, 2026, 10:00:00 PM · 5 products
Adobe Magento: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um seine Privilegien zu erhöhen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

EUVD-2026-56431 CVE-2026-65660 · Microsoft · exploited since 2026-09-25; KEV event 2026-09-25 · score 8.8

EUVD

EUVD ID

EUVD-2026-56431

Aliases

CVE-2026-65660, GHSA-r94x-x846-rxqx

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Assigner

microsoft

Published

Aug 11, 2026, 5:04:55 PM

Updated

Oct 8, 2026, 6:11:15 PM

Exploited since

Sep 25, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS (as last recorded)

2.1

Products

Microsoft SharePoint Server 2019 (Microsoft) 16.0.0 <16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016 (Microsoft) 16.0.0 <16.0.5565.1001
Microsoft SharePoint Server Subscription Edition (Microsoft) 16.0.0 <16.0.19725.20522

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660

NIST NVD

CVE

CVE-2026-65660

Status

Analyzed

Published

2026-08-11T17:18:54.080

Last modified

2026-09-26T04:17:45.630

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (secure@microsoft.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-94

Source

secure@microsoft.com

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 Patch, Vendor Advisory
https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-65660
Vendor / project: Microsoft
Product: SharePoint
Name: Microsoft SharePoint Code Injection Vulnerability
Added to catalogue: 2026-09-25
Description: Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-28
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-65660
CWEs: CWE-94

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-25
CISA KEV added: 2026-09-25

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660

Advisories from CERTs

NCSC-2026-0286 csaf_ncscnl · published Aug 11, 2026, 7:57:03 PM · updated Aug 11, 2026, 7:57:03 PM · 34 products
Kwetsbaarheden verholpen in Microsoft Office

Vendor advisories (1)

msrc_CVE-2026-65660 csaf_microsoft · published Aug 11, 2026, 7:00:00 AM · updated Aug 27, 2026, 7:00:00 AM · 6 products
Microsoft SharePoint Server Remote Code Execution Vulnerability

EUVD-2026-72027 CVE-2026-67279 · MikroTik · exploited since 2026-09-25; KEV event 2026-09-25, 2026-09-27 · score 6.9

EUVD

EUVD ID

EUVD-2026-72027

Aliases

CVE-2026-67279, GHSA-pqp3-gjgf-83cf

Description

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Assigner

CERT-PL

Published

Sep 5, 2026, 8:00:57 PM

Updated

Sep 26, 2026, 3:55:45 AM

Exploited since

Sep 25, 2026, 12:00:00 AM

Base score

6.9 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS (as last recorded)

1.03

Products

RouterOS (MikroTik) 7.24 <7.24.2
RouterOS (MikroTik) 6.0.0 <6.49.21
RouterOS (MikroTik) 7.0.0 <7.23.4

References

NIST NVD

CVE

CVE-2026-67279

Status

Analyzed

Published

2026-09-05T20:17:18.390

Last modified

2026-09-26T04:17:47.273

Description

Metrics

cvssMetricV31 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (nvd@nist.gov)
cvssMetricV40 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (cvd@cert.pl)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-841

Source

cvd@cert.pl

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Mitigation, Third Party Advisory
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 Release Notes
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ Exploit, Third Party Advisory
https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-67279
Vendor / project: MikroTik
Product: RouterOS
Name: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Added to catalogue: 2026-09-25
Description: Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-28
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://mikrotik.com/supportsec/september-2026-vulnerability/?utm_source=chatgpt.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67279
CWEs: CWE-841

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-27
CISA KEV added: 2026-09-25

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

Vendor advisories (1)

openSUSE-SU-2026:11737-1 csaf_opensuse · published Sep 9, 2026, 12:00:00 AM · updated Sep 17, 2026, 5:23:46 PM · 5 products
sshamble-0.3.12-1.1 on GA media
sshamble-0.3.12-1.1 on GA media

EUVD-2026-75010 CVE-2026-85103 · checkpoint · exploited since 2026-09-25; KEV event 2026-09-25 · score 9.8 not in CISA KEV SRP candidate (indication only)

EUVD

EUVD ID

EUVD-2026-75010

Aliases

CVE-2026-85103, GHSA-g4cm-76f6-qvmc

Description

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Assigner

checkpoint

Published

Sep 9, 2026, 1:00:42 PM

Updated

Sep 10, 2026, 3:56:41 AM

Exploited since

Sep 25, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

3.65

Products

Quantum Security Gateway (checkpoint) R82.10 with Jumbo Hotfix Take 43 or below
Quantum Security Management (checkpoint) R82.10 with Jumbo Hotfix Take 43 or below
Quantum Security Management (checkpoint) R81.20 with Jumbo Hotfix Take 165 or below
Quantum Security Gateway (checkpoint) R82 with Jumbo Hotfix Take 125 or below
Quantum Security Gateway (checkpoint) R81.20 with Jumbo Hotfix Take 165 or below
Quantum Security Management (checkpoint) R82 with Jumbo Hotfix Take 125 or below

References

https://support.checkpoint.com/results/sk/sk1000118

NIST NVD

CVE

CVE-2026-85103

Status

Awaiting Analysis

Published

2026-09-09T13:20:43.997

Last modified

2026-09-10T04:18:18.390

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (cve@checkpoint.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-122

Source

cve@checkpoint.com

References

https://support.checkpoint.com/results/sk/sk1000118

CISA KEV catalogue

Not in the CISA catalogue. Another source flagged this entry as exploited.

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-25
CISA KEV added: not listed

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

No CERT links in the records.

Advisories from CERTs

WID-SEC-W-2026-3305 csaf_certbund · published Sep 9, 2026, 10:00:00 PM · updated Sep 22, 2026, 10:00:00 PM · 20 products
Check Point Security Gateway, Spark Firewall und Security Management: Mehrere Schwachstellen ermöglichen Codeausführung
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Security Gateway, Check Point Spark Firewall und Check Point Security Management ausnutzen, um beliebigen Programmcode auszuführen.
NCSC-2026-0365 csaf_ncscnl · published Sep 10, 2026, 9:12:56 AM · updated Sep 23, 2026, 8:28:31 AM · 2 products
Kwetsbaarheden verholpen in Check Point VPN-producten

EUVD-2026-87958 CVE-2026-88771 · Citrix NetScaler · exploited since 2026-09-27; KEV event 2026-09-27 · score 9.5 seen in honeypot

EUVD

EUVD ID

EUVD-2026-87958

Aliases

CVE-2026-88771, GHSA-mx58-p288-86qp

Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Assigner

NetScaler

Published

Sep 27, 2026, 4:02:07 PM

Updated

Sep 29, 2026, 3:55:15 AM

Exploited since

Sep 27, 2026, 12:00:00 AM

Base score

9.5 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (as last recorded)

1.06

Products

Gateway (NetScaler) 0 <13.1-64.23
ADC (NetScaler) 0 <14.1-73.37 FIPS
Gateway (NetScaler) 0 <14.1-73.37
ADC (NetScaler) 0 <14.1-73.37
ADC (NetScaler) 0 <13.1.37.279 FIPS and NDcPP
ADC (NetScaler) 0 <13.1-64.23

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

NIST NVD

CVE

CVE-2026-88771

Status

Analyzed

Published

2026-09-27T17:16:56.260

Last modified

2026-09-29T04:18:01.603

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.5 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-20

Source

50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-88771
Vendor / project: Citrix
Product: NetScaler
Name: Citrix NetScaler Improper Input Validation Vulnerability
Added to catalogue: 2026-09-27
Description: Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-30
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772
CWEs: CWE-119

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-27
CISA KEV added: 2026-09-27

Honeypot sensors (Shadowserver, via EUVD)

CVE: CVE-2026-88771
Source: shadowserver
First seen: Sep 29, 2026, 3:00:00 AM
Last seen (as last recorded): Oct 13, 2026, 7:12:23 AM
Last 24 h (as last recorded): 1839 connections, 11 unique IPs
Averages 7d / 30d / 90d: 14.0 / 10.0 / 3.0
Trend (as last recorded): UPTICK
Product: Citrix NetScaler ADC and NetScaler Gateway
Class: app-delivery-controller

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771

Advisories from CERTs

NCSC-2026-0394 csaf_ncscnl · published Sep 27, 2026, 4:55:29 PM · updated Sep 30, 2026, 8:38:43 AM · 2 products
Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway

EUVD-2026-87959 CVE-2026-88772 · Citrix NetScaler · exploited since 2026-09-27; KEV event 2026-09-27 · score 9.5

EUVD

EUVD ID

EUVD-2026-87959

Aliases

CVE-2026-88772, GHSA-h5xm-pf48-4c32

Description

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

Assigner

NetScaler

Published

Sep 27, 2026, 4:09:56 PM

Updated

Sep 28, 2026, 3:55:42 AM

Exploited since

Sep 27, 2026, 12:00:00 AM

Base score

9.5 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (as last recorded)

1.3

Products

ADC (NetScaler) 0 <14.1-73.37
ADC (NetScaler) 0 <13.1-64.23
ADC (NetScaler) 0 <13.1.37.279 FIPS and NDcPP
Gateway (NetScaler) 0 <13.1-64.23
ADC (NetScaler) 0 <14.1-73.37 FIPS
Gateway (NetScaler) 0 <14.1-73.37

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778

NIST NVD

CVE

CVE-2026-88772

Status

Analyzed

Published

2026-09-27T17:16:56.390

Last modified

2026-09-28T12:26:47.670

Description

Metrics

cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.5 CRITICAL CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-119

Source

50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

References

CISA KEV catalogue

CVE: CVE-2026-88772
Vendor / project: Citrix
Product: NetScaler
Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Added to catalogue: 2026-09-27
Description: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-09-30
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772
CWEs: CWE-119

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-27
CISA KEV added: 2026-09-27

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772

Advisories from CERTs

NCSC-2026-0394 csaf_ncscnl · published Sep 27, 2026, 4:55:29 PM · updated Sep 30, 2026, 8:38:43 AM · 2 products
Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway

EUVD-2026-88445 CVE-2026-86950 · Apple · exploited since 2026-09-29; KEV event 2026-09-29 · score 8.8

EUVD

EUVD ID

EUVD-2026-88445

Aliases

CVE-2026-86950, GHSA-3cf3-h799-fjvq

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Assigner

apple

Published

Sep 28, 2026, 7:13:52 PM

Updated

Oct 1, 2026, 5:15:57 PM

Exploited since

Sep 29, 2026, 12:00:00 AM

Base score

8.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (as last recorded)

1.24

Products

macOS (Apple) 0 <15.8.1
macOS (Apple) 0 <26.7.1
iOS and iPadOS (Apple) 0 <26.7.1

References

NIST NVD

CVE

CVE-2026-86950

Status

Analyzed

Published

2026-09-28T20:17:11.193

Last modified

2026-10-01T18:17:28.430

Description

Metrics

cvssMetricV31 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-787

Source

product-security@apple.com

References

https://support.apple.com/en-us/149226 Release Notes, Vendor Advisory
https://support.apple.com/en-us/149228 Release Notes, Vendor Advisory
https://support.apple.com/en-us/149229 Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2026/Sep/89 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2026/Sep/90 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2026/Sep/91 Mailing List, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-86950
Vendor / project: Apple
Product: Multiple Products
Name: Apple Multiple Products Out-of-Bounds Write Vulnerability
Added to catalogue: 2026-09-29
Description: Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-13
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://support.apple.com/en-us/149226 ; https://support.apple.com/en-us/149228 ; https://support.apple.com/en-us/149229 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86950
CWEs: CWE-787

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-29

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950

Advisories from CERTs

NCSC-2026-0397 csaf_ncscnl · published Oct 1, 2026, 10:35:52 AM · updated Oct 1, 2026, 10:35:52 AM · 1 products
Kwetsbaarheid verholpen in Apple CoreGraphics

EUVD-2026-89950 CVE-2026-76504 · Cisco · exploited since 2026-09-30; KEV event 2026-09-30 · score 9.8 seen in honeypot

EUVD

EUVD ID

EUVD-2026-89950

Aliases

CVE-2026-76504, GHSA-xqjc-v467-8fvf

Description

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

Assigner

cisco

Published

Sep 30, 2026, 1:04:32 PM

Updated

Oct 2, 2026, 11:23:29 PM

Exploited since

Sep 30, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

1.58

Products

Cisco Catalyst SD-WAN Manager (Cisco) 20.15.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.6_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.20
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.9.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 18.2.0
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.2.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.6.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.2.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.5.1.0.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.3_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.1EFT2
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5.1
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.21
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.6.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.11
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.4_LI_ Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.6
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.10.1.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.2_937
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.3_ LI _Images
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.25
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.7.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.10.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.1.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.7.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.9
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2.13
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.4.0.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2_937
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.12
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.6.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.14.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.7.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4_Monthly_ES5
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.4.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.10.0.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.11.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.18
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.3
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2.14
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2.1_930
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.7.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.10
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.8.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.4.0.9
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.7.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.2.0.02
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2_929
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.5
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.501_ES
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.6.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.14
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 26.2.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2.1_927
Cisco Catalyst SD-WAN Manager (Cisco) 20.10.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.3_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.2.8
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.401
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.19
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.6.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.6.1.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2.21
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.14
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.5.0.9
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.302
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.2.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.11
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.51
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.7.1_LI _Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.2.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.9
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.2.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5.3_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.25
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.6.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.25
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.5_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 26.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.5.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.6
Cisco Catalyst SD-WAN Manager (Cisco) 19.1.0
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.32
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.16.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.7.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.2.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.13.1
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.16
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.0
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.5.0.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.19
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.1.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.14
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.2.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.8_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.29
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.0
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.2.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.16.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.9.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.4_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.8.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.2.3
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.0
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.4.1.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1.1.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.40
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.3_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.41
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.813
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.097
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2.0.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.0.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.9_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.8.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.2.0.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.8.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2.0.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.11.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.3_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.5.0.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2_925
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.9.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.29
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.1.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.9.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.4.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.1.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.17
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.1.10
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.5
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.2.8
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.1.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.5.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.13
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.1.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4.1.3
Cisco Catalyst SD-WAN Manager (Cisco) 19.0.1a
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.17
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.8.2.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2_928
Cisco Catalyst SD-WAN Manager (Cisco) 20.5.1.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.8
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.46
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.4.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.14.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.4_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.18
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.2.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.33
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.26
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.6
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.31
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.4.0.19
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.2.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.7
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3_LI_ Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.7.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1.0.01
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.20
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.10
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.18
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.10.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.32
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.4.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.9
Cisco Catalyst SD-WAN Manager (Cisco) 20.13.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.16
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.6.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.24
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.6_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.23
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.5.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.0.18.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.2.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.5
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.6.0.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.4.0.21
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.6.0.5_PSIRTAUG
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4.0.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.8.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.47
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2.16
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.4.1.6
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.8.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.7_LI _Images
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.0.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.10.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.11.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 19.0.0
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.5.0.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.45
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.23
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.099
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.3.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.11.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.24
Cisco Catalyst SD-WAN Manager (Cisco) 20.7.1.0.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.1.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.31
Cisco Catalyst SD-WAN Manager (Cisco) 20.7.1EFT2
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.2.1.01
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.10
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.7.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.11
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.5
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.3_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.1_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.2.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.27
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.5.1.10
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4.0.03
Cisco Catalyst SD-WAN Manager (Cisco) 18.4.303
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.0.18.3
Cisco Catalyst SD-WAN Manager (Cisco) 26.1.1.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.26
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.6_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 17.2.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.814
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.8_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.0.6
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.5.3
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.7
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.4
Cisco Catalyst SD-WAN Manager (Cisco) 20.4.1.0.02
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.098
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.38
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.4.0.5_PSIRTAUG
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.18.4_LI_Imagess
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2.7
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.9
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.929
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.7.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.3.0.4
Cisco Catalyst SD-WAN Manager (Cisco) 18.3.3
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.5.2_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.15.4.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.3.0.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.6.3.0.39
Cisco Catalyst SD-WAN Manager (Cisco) 20.9.10_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.7_LI_Images
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.5.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.1.12
Cisco Catalyst SD-WAN Manager (Cisco) 19.2.1
Cisco Catalyst SD-WAN Manager (Cisco) 19.3.0
Cisco Catalyst SD-WAN Manager (Cisco) 20.3.4.1.2
Cisco Catalyst SD-WAN Manager (Cisco) 20.7.1
Cisco Catalyst SD-WAN Manager (Cisco) 20.12.501

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

NIST NVD

CVE

CVE-2026-76504

Status

Analyzed

Published

2026-09-30T13:17:20.247

Last modified

2026-10-03T00:16:39.140

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (psirt@cisco.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-177

Source

psirt@cisco.com

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-76504
Vendor / project: Cisco
Product: Catalyst SD-WAN Manager
Name: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Added to catalogue: 2026-09-30
Description: Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-03
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76504
CWEs: CWE-177

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-09-30

Honeypot sensors (Shadowserver, via EUVD)

CVE: CVE-2026-76504
Source: shadowserver
First seen: Oct 9, 2026, 3:00:00 AM
Trend (as last recorded): STEADY

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504

Advisories from CERTs

NCSC-2026-0395 csaf_ncscnl · published Sep 30, 2026, 2:43:36 PM · updated Sep 30, 2026, 2:43:36 PM · 1 products
Kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager

Vendor advisories (1)

cisco-sa-sdwan-webauth-xr8beuuU csaf_cisco · published Sep 30, 2026, 1:00:00 PM · updated Oct 2, 2026, 11:18:42 PM · 27 products
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a spe ...

EUVD-2026-90080 CVE-2026-102489 · Zammad GmbH · exploited since 2026-09-30; KEV event 2026-09-30, 2026-10-02 · score 8.7 SRP candidate (indication only)

EUVD

EUVD ID

EUVD-2026-90080

Aliases

CVE-2026-102489, GHSA-xmw5-m2wg-4243

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Assigner

DIVD

Published

Sep 30, 2026, 4:21:19 PM

Updated

Oct 10, 2026, 3:55:20 AM

Exploited since

Sep 30, 2026, 12:00:00 AM

Base score

8.7 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C

EPSS (as last recorded)

1.26

Products

Zammad (Zammad) 6.3.0 <6.5.4

References

NIST NVD

CVE

CVE-2026-102489

Status

Analyzed

Published

2026-09-30T17:16:40.550

Last modified

2026-10-10T04:18:08.040

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X (csirt@divd.nl)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-384

Source

csirt@divd.nl

References

https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 Vendor Advisory
https://csirt.divd.nl/CVE-2026-102489 Third Party Advisory
https://csirt.divd.nl/DIVD-2026-00015 Third Party Advisory
https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-102489
Vendor / project: Zammad GmbH
Product: Zammad
Name: Zammad GmbH Zammad Session Fixation Vulnerability
Added to catalogue: 2026-10-02
Description: Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489
CWEs: CWE-384

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-30
CISA KEV added: 2026-10-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489
DIVD CSIRT: https://csirt.divd.nl/CVE-2026-102489
DIVD CSIRT: https://csirt.divd.nl/DIVD-2026-00015

Advisories from CERTs

WID-SEC-W-2026-3694 csaf_certbund · published Sep 30, 2026, 10:00:00 PM · updated Oct 1, 2026, 10:00:00 PM · 2 products
Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen und um Root-Rechte zu erlangen.
NCSC-2026-0396 csaf_ncscnl · published Sep 30, 2026, 5:31:14 PM · updated Sep 30, 2026, 5:31:14 PM · 1 products
Kwetsbaarheden aangetroffen in Zammad

EUVD-2026-90081 CVE-2026-102490 · Zammad GmbH · exploited since 2026-09-30; KEV event 2026-09-30, 2026-10-02 · score 8.5 SRP candidate (indication only)

EUVD

EUVD ID

EUVD-2026-90081

Aliases

CVE-2026-102490, GHSA-hgff-g8g3-4xr8

Description

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

Assigner

DIVD

Published

Sep 30, 2026, 4:21:20 PM

Updated

Oct 8, 2026, 7:55:53 PM

Exploited since

Sep 30, 2026, 12:00:00 AM

Base score

8.5 (CVSS 4.0)

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D

EPSS (as last recorded)

0.58

Products

Zammad (Zammad) 1.5.0 <7.2.2

References

NIST NVD

CVE

CVE-2026-102490

Status

Modified

Published

2026-09-30T17:16:40.707

Last modified

2026-10-08T20:17:29.167

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV40 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X (csirt@divd.nl)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-269

Source

csirt@divd.nl

References

https://csirt.divd.nl/CVE-2026-102490 Third Party Advisory
https://csirt.divd.nl/DIVD-2026-00015 Third Party Advisory
https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq
https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-102490
Vendor / project: Zammad GmbH
Product: Zammad
Name: Zammad GmbH Zammad Improper Privilege Management Vulnerability
Added to catalogue: 2026-10-02
Description: Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-05
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102490
CWEs: CWE-269

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-09-30
CISA KEV added: 2026-10-02

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490
DIVD CSIRT: https://csirt.divd.nl/CVE-2026-102490
DIVD CSIRT: https://csirt.divd.nl/DIVD-2026-00015

Advisories from CERTs

NCSC-2026-0396 csaf_ncscnl · published Sep 30, 2026, 5:31:14 PM · updated Sep 30, 2026, 5:31:14 PM · 1 products
Kwetsbaarheden aangetroffen in Zammad
WID-SEC-W-2026-3694 csaf_certbund · published Sep 30, 2026, 10:00:00 PM · updated Oct 1, 2026, 10:00:00 PM · 2 products
Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen und um Root-Rechte zu erlangen.

EUVD-2026-91042 CVE-2026-104286 · Fortinet · exploited since 2026-10-01; KEV event 2026-10-01 · score 9.8

EUVD

EUVD ID

EUVD-2026-91042

Aliases

CVE-2026-104286, GHSA-6gxc-3vv7-7w24

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Assigner

fortinet

Published

Oct 1, 2026, 7:17:38 PM

Updated

Oct 7, 2026, 5:59:34 PM

Exploited since

Oct 1, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

EPSS (as last recorded)

2.2

Products

FortiMail (Fortinet) 7.6.0 ≤7.6.5
FortiMail (Fortinet) 7.0.0 ≤7.0.9
FortiMail (Fortinet) 8.0.0
FortiMail (Fortinet) 7.2.0 ≤7.2.9
FortiMail (Fortinet) 7.4.0 ≤7.4.6

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-175

NIST NVD

CVE

CVE-2026-104286

Status

Analyzed

Published

2026-10-01T20:17:24.010

Last modified

2026-10-07T18:17:15.240

Description

Metrics

cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (psirt@fortinet.com)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-22

Source

psirt@fortinet.com

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-175 Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286 US Government Resource

CISA KEV catalogue

CVE: CVE-2026-104286
Vendor / project: Fortinet
Product: FortiMail
Name: Fortinet FortiMail Path Traversal Vulnerability
Added to catalogue: 2026-10-01
Description: Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-04
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286
CWEs: CWE-22, CWE-158

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-10-01
CISA KEV added: 2026-10-01

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286

Advisories from CERTs

NCSC-2026-0398 csaf_ncscnl · published Oct 2, 2026, 7:21:47 AM · updated Oct 2, 2026, 7:21:47 AM · 1 products
Kwetsbaarheid verholpen in Fortinet FortiMail

EUVD-2026-92065 CVE-2026-88779 · NetScaler · exploited since 2026-10-02; KEV event 2026-10-02, 2026-10-04 · score 8.7 SRP candidate (indication only)

EUVD

EUVD ID

EUVD-2026-92065

Aliases

CVE-2026-88779, GHSA-56r3-m27m-8p62

Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

Assigner

NetScaler

Published

Oct 4, 2026, 2:35:35 AM

Updated

Oct 5, 2026, 3:55:38 AM

Exploited since

Oct 2, 2026, 12:00:00 AM

Base score

8.7 (CVSS 4.0)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS (as last recorded)

0.28

Products

ADC (NetScaler) 0 <14.1-73.41 FIPS
ADC (NetScaler) 0 <14.1-73.41
ADC (NetScaler) 0 <13.1-64.28
ADC (NetScaler) 0 <13.1-37.282
Gateway (NetScaler) 0 <14.1-73.41
Gateway (NetScaler) 0 <13.1-64.28

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

NIST NVD

CVE

CVE-2026-88779

Status

Received

Published

2026-10-04T04:16:43.680

Last modified

2026-10-05T04:17:08.547

Description

Metrics

cvssMetricV40 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-119

Source

50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

References

CISA KEV catalogue

CVE: CVE-2026-88779
Vendor / project: Citrix
Product: NetScaler
Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Added to catalogue: 2026-10-04
Description: Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-07
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 ; https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88779
CWEs: CWE-119

KEV catalogues (per source, via EUVD)

EU KEV added: 2026-10-02
CISA KEV added: 2026-10-04

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779

EUVD-2015-3352 CVE-2015-3306 · n/a · exploited since 2026-10-08; KEV event 2026-10-08 · score 10.0

EUVD

EUVD ID

EUVD-2015-3352

Aliases

CVE-2015-3306, GHSA-4mfj-5wr8-x32q

Description

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Assigner

mitre

Published

May 18, 2015, 3:00:00 PM

Updated

Oct 9, 2026, 4:02:13 PM

Exploited since

Oct 8, 2026, 12:00:00 AM

Base score

10.0 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (as last recorded)

98.03

Products

n/a (n/a) n/a

References

NIST NVD

CVE

CVE-2015-3306

Status

Analyzed

Published

2015-05-18T15:59:10.743

Last modified

2026-10-09T16:17:18.210

Description

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Metrics

cvssMetricV2 10.0 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C (nvd@nist.gov)
cvssMetricV31 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-284

Source

cve@mitre.org

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html Broken Link, Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html Exploit, VDB Entry
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html Exploit, VDB Entry
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html Exploit, VDB Entry
http://www.debian.org/security/2015/dsa-3263 Mailing List, Third Party Advisory
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec Third Party Advisory
http://www.securityfocus.com/bid/74238 Third Party Advisory
https://www.exploit-db.com/exploits/36742/ Exploit
https://www.exploit-db.com/exploits/36803/ Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html Broken Link, Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html Exploit, VDB Entry
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html Exploit, VDB Entry
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html Exploit, VDB Entry
http://www.debian.org/security/2015/dsa-3263 Mailing List, Third Party Advisory
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec Third Party Advisory
http://www.securityfocus.com/bid/74238 Third Party Advisory
https://www.exploit-db.com/exploits/36742/ Exploit
https://www.exploit-db.com/exploits/36803/ Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306 US Government Resource

CISA KEV catalogue

CVE: CVE-2015-3306
Vendor / project: ProFTPD
Product: ProFTPD
Name: ProFTPD Improper Access Control Vulnerability
Added to catalogue: 2026-10-08
Description: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306
CWEs: CWE-284

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-10-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306

Vendor advisories (1)

openSUSE-SU-2024:10048-1 csaf_opensuse · published Jun 15, 2024, 12:00:00 AM · updated Sep 20, 2026, 7:51:18 PM · 73 products
proftpd-1.3.5b-2.5 on GA media
proftpd-1.3.5b-2.5 on GA media

EUVD-2015-5432 CVE-2015-5477 · n/a · exploited since 2026-10-08; KEV event 2026-10-08 · score 7.5

EUVD

EUVD ID

EUVD-2015-5432

Aliases

CVE-2015-5477, GHSA-4622-vjcx-p39j

Description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Assigner

mitre

Published

Jul 29, 2015, 2:00:00 PM

Updated

Oct 9, 2026, 3:55:29 AM

Exploited since

Oct 8, 2026, 12:00:00 AM

Base score

7.5 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (as last recorded)

91.81

Products

n/a (n/a) n/a

References

NIST NVD

CVE

CVE-2015-5477

Status

Analyzed

Published

2015-07-29T14:59:05.397

Last modified

2026-10-09T19:12:37.977

Description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Metrics

cvssMetricV2 7.8 HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C (nvd@nist.gov)
cvssMetricV31 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-19, CWE-617

Source

cve@mitre.org

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718 Mitigation, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144000632319155&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144017354030745&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144181171013996&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144294073801304&w=2 Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2015-1513.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1514.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1515.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0078.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0079.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3319 Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
http://www.securityfocus.com/bid/76092 Third Party Advisory
http://www.securitytracker.com/id/1033100 Broken Link
http://www.ubuntu.com/usn/USN-2693-1 Third Party Advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415 Third Party Advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480 Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918 Third Party Advisory
https://kb.isc.org/article/AA-01272 Patch, Vendor Advisory, Broken Link
https://kb.isc.org/article/AA-01305 Broken Link
https://kb.isc.org/article/AA-01306 Broken Link
https://kb.isc.org/article/AA-01307 Broken Link
https://kb.isc.org/article/AA-01438 Broken Link
https://kb.juniper.net/JSA10783 Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10126 Broken Link
https://security.gentoo.org/glsa/201510-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20160114-0001/ Third Party Advisory
https://support.apple.com/kb/HT205032 Third Party Advisory
https://www.exploit-db.com/exploits/37721/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37723/ Third Party Advisory, VDB Entry
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718 Mitigation, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144000632319155&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144017354030745&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144181171013996&w=2 Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144294073801304&w=2 Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/132926/BIND-TKEY-Query-Denial-Of-Service.html Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2015-1513.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1514.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1515.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0078.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0079.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3319 Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
http://www.securityfocus.com/bid/76092 Third Party Advisory
http://www.securitytracker.com/id/1033100 Broken Link
http://www.ubuntu.com/usn/USN-2693-1 Third Party Advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415 Third Party Advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480 Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918 Third Party Advisory
https://kb.isc.org/article/AA-01272 Patch, Vendor Advisory, Broken Link
https://kb.isc.org/article/AA-01305 Broken Link
https://kb.isc.org/article/AA-01306 Broken Link
https://kb.isc.org/article/AA-01307 Broken Link
https://kb.isc.org/article/AA-01438 Broken Link
https://kb.juniper.net/JSA10783 Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10126 Broken Link
https://security.gentoo.org/glsa/201510-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20160114-0001/ Third Party Advisory
https://support.apple.com/kb/HT205032 Third Party Advisory
https://www.exploit-db.com/exploits/37721/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/37723/ Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477 US Government Resource

CISA KEV catalogue

CVE: CVE-2015-5477
Vendor / project: ISC
Product: BIND
Name: ISC BIND Data Processing Errors Vulnerability
Added to catalogue: 2026-10-08
Description: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): No
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 ; https://access.redhat.com/errata/RHSA-2015:1513.html; https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-5477
CWEs: CWE-19

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-10-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477

Advisories from CERTs

WID-SEC-W-2025-1181 csaf_certbund · published Jul 28, 2015, 10:00:00 PM · updated May 29, 2025, 10:00:00 PM · 34 products
Internet Systems Consortium BIND: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuführen.

Vendor advisories (9)

openSUSE-SU-2024:10467-1 csaf_opensuse · published Jun 15, 2024, 12:00:00 AM · updated Sep 20, 2026, 7:59:27 PM · 249 products
bind-9.10.3P4-21.1 on GA media
bind-9.10.3P4-21.1 on GA media
SUSE-SU-2015:1304-1 csaf_suse · published Jul 28, 2015, 1:37:03 PM · updated Sep 20, 2026, 12:04:58 PM · 83 products
Security update for bind
Security update for bind
RHSA-2015:1515 csaf_redhat · published Jul 28, 2015, 10:53:56 PM · updated Jun 27, 2026, 8:56:32 AM · 39 products
Red Hat Security Advisory: bind97 security update
Updated bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
SUSE-SU-2015:1305-1 csaf_suse · published Jul 28, 2015, 1:36:49 PM · updated Sep 20, 2026, 12:04:59 PM · 41 products
Security update for bind
Security update for bind
RHSA-2016:0079 csaf_redhat · published Jan 28, 2016, 1:45:17 PM · updated Jun 27, 2026, 8:59:16 AM · 39 products
Red Hat Security Advisory: bind security update
Updated bind packages that fix three security issues are now available for Red Hat Enterprise Linux 6.6 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
SUSE-SU-2015:1316-1 csaf_suse · published Jul 28, 2015, 1:36:51 PM · updated Sep 20, 2026, 12:05:00 PM · 45 products
Security update for bind
Security update for bind
RHSA-2016:0078 csaf_redhat · published Jan 28, 2016, 1:27:03 PM · updated Jun 27, 2026, 8:56:29 AM · 26 products
Red Hat Security Advisory: bind security update
Updated bind packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.4 and 6.5 Advanced Update Support. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section ...
RHSA-2015:1513 csaf_redhat · published Jul 28, 2015, 12:00:00 AM · updated Sep 20, 2026, 10:54:43 AM · 111 products
security update for bind
security update for bind
RHSA-2015:1514 csaf_redhat · published Jul 28, 2015, 10:59:26 PM · updated Jun 27, 2026, 8:56:28 AM · 57 products
Red Hat Security Advisory: bind security update
Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

EUVD-2021-26539 CVE-2021-3199 · n/a · exploited since 2026-10-08; KEV event 2026-10-08 · score 9.8

EUVD

EUVD ID

EUVD-2021-26539

Aliases

CVE-2021-3199, GHSA-vm8r-r39c-96c6

Description

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Assigner

mitre

Published

Jan 22, 2021, 2:41:34 AM

Updated

Oct 9, 2026, 3:55:31 AM

Exploited since

Oct 8, 2026, 12:00:00 AM

Base score

9.8 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

14.55

Products

n/a (n/a) n/a

References

NIST NVD

CVE

CVE-2021-3199

Status

Analyzed

Published

2021-01-26T18:16:28.507

Last modified

2026-10-09T14:20:47.350

Description

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Metrics

cvssMetricV2 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P (nvd@nist.gov)
cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV31 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-22

Source

cve@mitre.org

References

https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 Release Notes, Third Party Advisory
https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 Release Notes, Third Party Advisory
https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199 US Government Resource

CISA KEV catalogue

CVE: CVE-2021-3199
Vendor / project: ONLYOFFICE
Product: Docs
Name: ONLYOFFICE Docs Server Path Traversal Vulnerability
Added to catalogue: 2026-10-08
Description: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-3199
CWEs: CWE-22

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-10-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199

EUVD-2022-3161 CVE-2016-3081 · n/a · exploited since 2026-10-08; KEV event 2026-10-08 · score 8.1

EUVD

EUVD ID

EUVD-2022-3161

Aliases

CVE-2016-3081, GHSA-8c6j-ffmf-q6vm

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Assigner

redhat

Published

Apr 26, 2016, 2:00:00 PM

Updated

Oct 9, 2026, 3:55:30 AM

Exploited since

Oct 8, 2026, 12:00:00 AM

Base score

8.1 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

94.51

Products

n/a (n/a) n/a

References

NIST NVD

CVE

CVE-2016-3081

Status

Analyzed

Published

2016-04-26T14:59:02.207

Last modified

2026-10-09T14:43:05.703

Description

Metrics

cvssMetricV2 9.3 HIGH AV:N/AC:M/Au:N/C:C/I:C/A:C (nvd@nist.gov)
cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (nvd@nist.gov)
cvssMetricV31 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-77

Source

secalert@redhat.com

References

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory, Broken Link
http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
http://www.securityfocus.com/bid/87327 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
https://www.exploit-db.com/exploits/39756/ Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html Exploit, Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party Advisory, Broken Link
http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
http://www.securityfocus.com/bid/87327 Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035665 Third Party Advisory, VDB Entry
https://struts.apache.org/docs/s2-032.html Patch, Vendor Advisory
https://www.exploit-db.com/exploits/39756/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 US Government Resource

CISA KEV catalogue

CVE: CVE-2016-3081
Vendor / project: Apache
Product: Struts
Name: Apache Struts Command Injection Vulnerability
Added to catalogue: 2026-10-08
Description: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081
CWEs: CWE-77

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-10-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081

EUVD-2023-1342 CVE-2023-22894 · n/a · exploited since 2026-10-08; KEV event 2026-10-08 · score 7.2

EUVD

EUVD ID

EUVD-2023-1342

Aliases

CVE-2023-22894, GHSA-jjqf-j4w7-92w8

Description

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Assigner

mitre

Published

Apr 19, 2023, 12:00:00 AM

Updated

Oct 9, 2026, 3:55:26 AM

Exploited since

Oct 8, 2026, 12:00:00 AM

Base score

7.2 (CVSS 3.1)

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (as last recorded)

3.43

Products

n/a (n/a) n/a

References

NIST NVD

CVE

CVE-2023-22894

Status

Analyzed

Published

2023-04-19T16:15:07.303

Last modified

2026-10-09T14:20:41.113

Description

Metrics

cvssMetricV31 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (nvd@nist.gov)
cvssMetricV31 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (134c704f-9b21-4f2e-91b3-4a467353bcc0)
ssvcV203 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weaknesses

CWE-312

Source

cve@mitre.org

References

https://github.com/strapi/strapi/releases Release Notes
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve Exploit, Vendor Advisory
https://www.ghostccamm.com/blog/multi_strapi_vulns/ Exploit, Third Party Advisory
https://github.com/strapi/strapi/releases Release Notes
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve Exploit, Vendor Advisory
https://www.ghostccamm.com/blog/multi_strapi_vulns/ Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894 US Government Resource

CISA KEV catalogue

CVE: CVE-2023-22894
Vendor / project: Strapi
Product: Strapi
Name: Strapi Cleartext Storage of Sensitive Information Vulnerability
Added to catalogue: 2026-10-08
Description: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due: 2026-10-11
Known ransomware use: Unknown
Forensic triage (BOD 26-04): Yes
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve ; https://github.com/strapi/strapi/releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-22894
CWEs: CWE-312

KEV catalogues (per source, via EUVD)

EU KEV added: not listed
CISA KEV added: 2026-10-08

Honeypot sensors (Shadowserver, via EUVD)

Not seen by the honeypot sensors.

CERT and CSIRT

CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894