CVE-2026-61500 (CVE record published 13 July 2026; GHSA-xxrm-3f86-v97j): Rejetto HTTP File Server (HFS) 3.0.0 through 3.2.0 derives the Koa/keygrip session-cookie signing key from non-cryptographic Math.random() and leaks outputs of the same V8 xorshift128+ PRNG to clients during loginSrp1. A remote attacker can collect a small number of login responses, reconstruct PRNG state, recover the signing key, forge an administrator session cookie, and reach RCE via the server_code / administrative API custom-endpoint path. CVSS 3.1 9.8 Critical and CVSS 4.0 9.3 Critical (CVE record). Fixed in HFS 3.2.1 (GitHub release / commit). UPDATE 30 Sep 2026: Horizon3 Attack Research details how Anthropic Mythos (with a custom harness) rediscovered and fully chained the issue — including Z3-based PRNG state recovery and a working exploit path — as an agentic vulnerability-research case study. (sources: GitHub Advisory GHSA-xxrm-3f86-v97j; rejetto/hfs) Updated 6 Oct 2026 (BleepingComputer, 5 October US time; 4:20 am 6 October Perth): BleepingComputer advises users to upgrade to 3.2.1 or, ideally, the latest stable release, 3.3.4, as soon as possible. No vendor, CISA or other source Cyberstack can cite has confirmed exploitation in the wild; CVE-2026-61500 was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026. No Australian exploitation reports. Correction (26 Oct 2026): reports that exploitation attempts began on 1 October from a China-based actor, that a single China Telecom IP address probed honeypots in Japan and the United States, and that this is the second Rejetto HFS flaw exploited in the wild have been removed: BleepingComputer attributes them to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms them. An unlinked SecurityWeek credit has also been removed. The CVSS scores are credited to the CVE record, now linked. (source: CVE record; BleepingComputer) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: GitHub Advisory; rejetto/hfs on GitHub; BleepingComputer; CVE record)
BerriAI LiteLLM GitHub security advisory GHSA-7hp6-4w63-5g45 (published 30 September 2026; Critical CVSS 3.1 9.9; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) — authenticated internal_user can escalate to proxy_admin and execute arbitrary commands. Root cause: one encryption key seals secrets at rest and mints session tokens. Attacker requests a new API key with crafted metadata containing a forged admin credential as the “secret”; proxy encrypts and returns it; presenting that value as a bearer token decrypts to a trusted admin identity, including MCP stdio command execution. Default-config exploitable on versions later than 1.91.0; 1.87.0–1.90.x only if EXPERIMENTAL_UI_LOGIN=true. Patched: 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 (per advisory ranges). Interim: EXPERIMENTAL_UI_LOGIN=false (disables vulnerable path; breaks CLI SSO / Claude Code gateway login). Credit: Hoa X. Nguyen (OPSWAT Unit 515). (source: GitHub advisory)
Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuU (first published 30 September 2026 13:00 GMT) covers CVE-2026-76504 (CVSS 3.1 9.8 Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Cisco Catalyst SD-WAN Manager API session-based authentication. Improper URI encoding lets an unauthenticated remote attacker bypass an authentication rule and access the API as the admin user (default netadmin). Affects Catalyst SD-WAN Manager regardless of configuration. Cisco PSIRT became aware of active exploitation in September 2026 (found via TAC case); no public victim count or actor named. Fixed trains: earlier than 20.9 → migrate; 20.9.10.1; 20.12.8.2; 20.15.6.1; 20.18.4.1; 26.1.2.1; 26.2.1. Cisco SD-WAN Cloud (Cisco Managed) already remediated in 20.15.605 (no customer action). No workaround; until patched restrict Manager from untrusted/internet networks and follow Catalyst SD-WAN Hardening Guide. Hunt j_security_check (incl. URI-encoded variants such as /%6a_security_check) in serviceproxy-access.log and vmanage-server.log, especially viptela-reserved- users. (source: Cisco) UPDATE 1 Oct 2026: CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog on 30 September 2026 (US date), describing a hex-encoding flaw in URI handling that could let an unauthenticated remote attacker access the system with admin privileges; federal (FCEB) remediation due 3 Oct 2026. (source: CISA KEV) Correction (02 Nov 2026): removed The Hacker News as a source; the KEV listing date now follows CISA's catalog (30 September, US date). (source: Cisco; CISA KEV)
CVE-2026-50610 (CVE.org record updated 17 September 2026; Intrinsec public write-up 29 September 2026) is a local privilege-escalation flaw in the Acer System Monitoring component shipped with NitroSense and PredatorSense. Insufficient access control on a privileged Windows service (AcerSysHardwareService / systemmonitoring_hardware_service_ named pipe writable by Authenticated Users) lets an authenticated local user trigger unauthorized registry modifications as SYSTEM (CWE-284). Intrinsec’s research chain writes a utilman debugger value and obtains NT AUTHORITY\SYSTEM from the login-screen accessibility path. CVE.org CVSS 4.0 7.4 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U); product status lists affected through 1.0.19.2. Intrinsec notes tested AcerSysHardwareService.exe builds 1.0.1018.13 / 1.0.1019.0 (NitroSense 5.1.361 engine). Vendor remediation pointer: Acer Community KB article 19877 (apply Acer advisory update or disable/uninstall the affected service). No wild exploitation stated. (sources: CVE.org; Intrinsec)
CVE.org — CVE-2026-50610 Acer System Monitoring improper access control / LPE
CISA ICS advisory ICSA-26-272-06 (29 September 2026) assigns CVE-2026-84411 (CVSS 3.1 9.8 / CVSS 4.0 9.3 Critical) to MikroTik RouterOS web management: an integer underflow (CWE-191) in HTTP request body handling reachable before authentication lets an unauthenticated network attacker achieve arbitrary code execution as root or denial of service with a single crafted request. Affected: RouterOS <7.24. CISA remediation text: MikroTik recommends update to RouterOS 7.24 or later (download mikrotik.com/download). CISA: no known public exploitation specifically targeting this CVE at publication. Until patched: keep web management off the internet; firewall-isolate management planes; prefer VPN for remote admin. (sources: CISA ICSA-26-272-06; BleepingComputer)
Mozilla advisory MFSA 2026-97, announced on 29 September 2026, lists the security vulnerabilities fixed in Firefox 157 and rates its overall impact high. Mozilla says it no longer rolls internally identified memory safety bugs into a single CVE and now issues an advisory for every individual bug; the advisory lists 76 CVEs, 38 rated high, 29 moderate and 9 low. High-impact items include sandbox escapes and use-after-free bugs in the DOM (Content Processes, Core & HTML, Navigation), Graphics (including WebGPU and WebRender), JavaScript WebAssembly, Widget and XUL components (examples: CVE-2026-100758, 100760, 100762, 100770, 100775, 100778, 100781, 100786, 100787). The advisory does not say any of the flaws is exploited. On the same day Mozilla published companion advisories for Firefox ESR 153.4 (MFSA 2026-100), Firefox ESR 140.17 (MFSA 2026-99) and Firefox ESR 115.42 (MFSA 2026-98). (source: Mozilla) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; the issue counts now come from Mozilla's own advisory, the ESR advisory numbers are corrected (2026-98, 2026-99 and 2026-100), and the card date stays 29 September 2026, Mozilla's date. (source: Mozilla)
WatchGuard PSIRT (published 29–30 September 2026; SecurityWeek 30 Sep) released a Fireware OS security train fixing 15 issues. Critical: CVE-2026-86131 (CVSS v4 9.2) — code injection in BOVPN over TLS client configuration handling lets an attacker who controls the remote VPN server execute commands as root on the connecting Firebox. Fixed in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21 (T15/T35). The same trains also address high-severity pre-auth RCE/DoS (including fingerd stack overflow CVE-2026-81433, spamd overflow CVE-2026-18145, iked underflows, samld deserialization), SSLVPN SAML auth bypass CVE-2026-86101, WebUI path traversal CVE-2026-13224, wgagent DoS, and related. Vendor: not aware of in-the-wild exploitation of 86131. (sources: WatchGuard PSIRT; CVE.report)
TeamViewer security bulletin TV-2026-1010 (29 September 2026; Important; CVSS up to 8.8 High) patches five flaws in TeamViewer Full Client, Host and related services across TeamViewer Remote / Tensor / ONE. Highest: CVE-2026-92370 (CVSS 3.1 8.8) — improper access control lets a remote attacker on the session path bypass user-configured permission settings during session establishment and perform denied actions that may lead to remote code execution (Windows/Linux/macOS). Also: CVE-2026-19743 (7.8) local IPC path validation → arbitrary file write as SYSTEM/root (Win/Linux/macOS); CVE-2026-92368 (7.8) heap overflow in .tvs session-recording playback (Linux/macOS); CVE-2026-92369 (7.3) Windows installer rollback TOCTOU → SYSTEM; CVE-2026-92371 (7.0) Linux Cloud Session Recording path race. Fixed in TeamViewer Clients 15.82 and supported maintenance/legacy trains. Vendor: no public exploit code or in-the-wild exploitation known. (sources: TeamViewer TV-2026-1010; BleepingComputer)
Apache MINA SSHD maintainers (oss-security, 29 September 2026; CVE records published 30 Sep) disclose critical flaws in the optional sshd-ldap component plus related SFTP memory issues, fixed in 2.20.0 and 3.0.0-M6. CVE-2026-94053 (CVSS 3.1 9.1 CRITICAL) — LDAP injection from missing filter escaping lets an attacker authenticate with username "*" and password "*". CVE-2026-94052 (CVSS 3.1 9.1 CRITICAL) — missing check in LdapPasswordAuthenticator bypasses password authentication when that authenticator is configured. Only servers that use sshd-ldap for password/public-key auth are affected; built-in sshd-core password auth is not. Also: CVE-2026-94029 (CVSS 3.1 6.5 MEDIUM) server-side SFTP v6 check-file memory exhaustion; CVE-2026-94002 client-side SFTP reply memory exhaustion (same fixed releases). Credit: Dilrevx, Ho1aAs. (sources: Apache oss-security; CVE.report)
OpenSSL's security advisory dated 29 September 2026 covers 14 vulnerabilities: one High, one Moderate and twelve Low. High: CVE-2026-84782, in DTLS retransmission, where OpenSSL can read past a handshake message buffer and/or corrupt suspended-write state when a mid-message WANT_WRITE write is interrupted by the retransmit timer, disclosing leftover heap bytes to the peer as plaintext handshake data or crashing the process; it affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 and was reported on 17 August by Laurent Gaffie (secorizon.com). Moderate: CVE-2026-84783, a use-after-free in the X.509 extension cache on first concurrent use of the same certificate by several threads, in OpenSSL 4.0 only, reported by Tim Becker (Xint.io). The twelve Low issues include CRL distribution point memory use (CVE-2026-35189), QUIC amplification, reassembly, stream metadata, flow-control and RETIRE_CONNECTION_ID backlog issues (CVE-2026-35191, CVE-2026-42772, CVE-2026-54873, CVE-2026-75804, CVE-2026-84784), timing side channels in non-NIST elliptic curves and SM2 signatures (CVE-2026-54872, CVE-2026-77696), SM2 on ARM64/RISC-V (CVE-2026-54875), an out-of-bounds access in SSL_set_SSL_CTX (CVE-2026-72897), a CMP NULL dereference (CVE-2026-75805) and a denial of service from undersized DTLS 1.2 AEAD records (CVE-2026-75806). Fixed releases are 4.0.3, 3.6.5, 3.5.9 and 3.4.8, with 3.0.23, 1.1.1zj and 1.0.2zs for premium support customers. OpenSSL rates severity as High, Moderate or Low and gives no CVSS score. (source: OpenSSL) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; every detail now comes from OpenSSL's advisory, and the card date stays 29 September 2026, the advisory's date. (source: OpenSSL)
Bishop Fox advisory (29 September 2026) details two vulnerabilities in Zilliz Attu 2.6.5 — the GUI admin tool for the Milvus vector database used in AI/ML stacks. Missing authentication (Bishop Fox: Critical) in the Playground feature lets unauthenticated attackers proxy arbitrary HTTP/HTTPS requests through an exposed Attu instance. Insecure input validation (Bishop Fox: High) bypasses private-IP blocking (DNS resolve vs host-header split), enabling requests to internal addresses and cloud metadata endpoints. Combined in a typical Milvus+Attu Amazon EKS deployment, Bishop Fox demonstrated administrative access to the Kubernetes namespace hosting Attu (and possible wider cloud impact depending on service-account permissions). No CVE identifiers assigned in the advisory. Vendor: Attu 2.6.x is no longer maintained and will not receive a 2.6.5 patch; upgrade to Attu 3.0.0 (released 3 Sep 2026; substantial rewrite). Bishop Fox could not reproduce either issue on 3.0.0. If upgrade is delayed: restrict network access, put Attu behind an authenticating reverse proxy, and tightly scope the Attu pod’s Kubernetes service-account permissions. Cyberstack does not reproduce the chain. (sources: Bishop Fox; Zilliz Attu v3.0.0 release)
IBM's security bulletin for DataPower Gateway, first published on 28 September 2026, fixes 36 CVEs; the CVE records went public on 8 October 2026. DataPower is a security and integration gateway often placed at the network edge in front of APIs, web services and mainframe systems. Flaws rated CVSS 9.8 include CVE-2026-16340 (out-of-bounds write in the RFC 2047 encoded-word parser allowing a remote attacker to run code), CVE-2026-15762 (out-of-bounds write allowing remote code execution), CVE-2026-14269 (heap-based buffer overflow letting an unauthenticated remote attacker run code), CVE-2026-14502 (a remote attacker can gain administrative access because empty passwords are not rejected during LDAP authentication) and buffer overflows CVE-2026-14991 and CVE-2026-14992 (IBM's text for CVE-2026-14991 describes a local user). Affected: 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6CD 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. IBM lists no workarounds, flags known issue DT499224, and reports no exploitation. (source: IBM)
IBM — Security Bulletin: IBM DataPower Gateway multiple vulnerabilities (28 Sep 2026; CVE records published 8 Oct 2026)
