Doyensec research post (17 September 2026) shows Open vSwitch’s kernel datapath can strip SKBFL_SHARED_FRAG from a still-forwarded packet, re-opening the Fragnesia Dirty COW-class primitive: an unprivileged user can cause in-place ESP decrypt over page-cache pages they may only read, writing attacker-chosen bytes into root-owned file page cache. Tracked as CVE-2026-90049, CVE-2026-89487 and CVE-2026-80977; reported to the Linux kernel security team and coordinated with OVS maintainers. Builds on prior Dirty Frag / Fragnesia work (including CVE-2026-43284 and CVE-2026-43500). Impact surface: virtualisation/container stacks using OVS (OpenStack Neutron, oVirt, Antrea/OVN-Kubernetes, libvirt bridges, etc.). Primary: Doyensec blog; await distro/kernel OVS package advisories for fixed revisions.
Check Point advisory sk1000155 (disclosed 16 September 2026; NVD published same day) documents CVE-2026-91843, a stack overflow (CWE-121) in the unauthenticated login process on Security Management and Log Servers. Check Point CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker without credentials can run arbitrary code as root over the network; Check Point states the vulnerable path runs through the Trusted Clients setting (hosts allowed to connect via SmartConsole). Vendor and CISA SSVC: no indication of in-the-wild exploitation; not in KEV as of mid-September catalog checks. Affected branches by Jumbo Hotfix Take (or older): R82.20 (apply Take 29+), R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below; R81.10/R81/R80.x End of Support (ticket Check Point for fix or upgrade). Standalone, Log Server, and Multi-Domain deployments also vulnerable per vendor confirmation (THN update 18 Sep). Smart-1 Cloud hosted management is not affected (fix already deployed). Remediation: LivePatch per sk1000155; customers with automatic updates (sk175504) already protected. Distinct from desk card checkpoint-vpn-cert-20260910 (VPN CVE-2026-85102/85103). Primary: Check Point sk1000155; secondary: NVD / Censys advisory.
Check Point sk1000155 — CVE-2026-91843 Security Management/Log Server (16 Sep 2026)
CVE-2026-65388 (GHSA-mx96-5vvg-x2mg; Apple/containerization Swift package) covers RegistryClient following the WWW-Authenticate realm without validating host or scheme. A remote attacker who controls a container registry can redirect the client’s token request to an attacker-chosen host and disclose the victim’s registry credentials. GitHub advisory severity Moderate; published on the advisory 30 August 2026; Tenable/NVD indexing lists CVE published ~16 September 2026 with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). GHSA lists affected versions ≤ 0.41.0 and patched versions > 0.41.0; Tenable text says the issue is addressed in containerization 0.41.0 — confirm the exact fixed build against GHSA before closing. No public exploitation claim on the Tenable/GHSA material reviewed this pass. Australia relevance: Apple container tooling / Mac container workflows pulling from untrusted registries.
NLnet Labs advisory dated 16 September 2026 (covered by The Hacker News 17 Sep) assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI; NVD still awaiting analysis per THN). Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption). NLnet Labs reports no known exploitation; CISA exploitation “none” on disclosure day per THN. Primary: NLnet Labs CVE-2026-81642.txt / security advisories; wire: THN 17 Sep 2026.
ISC published BIND 9 security advisories dated 16 September 2026 covering 14 denial-of-service vulnerabilities (SecurityWeek: seven high-severity). High CVEs include CVE-2026-80274, CVE-2026-76163, CVE-2026-19666 (use-after-free in query_addnoqnameproof() via DNS64 filter64; ISC CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CVE-2026-81563, CVE-2026-77692 (unauthenticated remote named crash via a single crafted DoH SIG(0) request then premature connection close; ISC CVSS 7.5), CVE-2026-19667, and CVE-2026-81736. Triggers include mismatched NOQNAME proof, QTYPE TKEY queries, malformed authoritative answers, SVCB/HTTPS AliasMode records, crafted DoH, and oversized negative answers. ISC states it is not aware of exploitation of the resolved bugs. Fixed builds: BIND 9.21.26 and 9.20.29 (per SecurityWeek quoting ISC). Primary: ISC KB advisories; wire: SecurityWeek 17 Sep 2026.
Micah Lee (16 September 2026; dataset from DDoSecrets / stegan0gram field extraction, also covered by 404 Media and Wired) analyses firmware from an in-use Flock Safety automatic licence-plate reader (ALPR) camera. The unit ran a modified Android 8.1 build dated 5 June 2025 on Linux 3.18.71 — far past vendor/Google support — and ships multiple Flock apps. Lee documents a hard-coded x-api-key in an app used to request device credentials from hpnotiq.flocksafety.com (MAC-address keyed), with returned credentials stored in plaintext and usable to mint bearer tokens via device-login.flocksafety.com. Lee lists older public Android/kernel CVEs the patch level likely predates but does not claim live exploitation tests on this hardware. Flock gave a statement to 404 Media/Wired (per Lee). No CVE assigned in the write-up. Primary: Micah Lee analysis; context: DDoSecrets dataset.
Micah Lee — Flock cameras hard-coded credentials (16 Sep 2026)
Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5 (first published 16 September 2026 16:00 GMT) covers CVE-2026-76460, a maximum-severity authentication bypass in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of configuration. Insufficient authentication control on an API endpoint lets an unauthenticated remote attacker send a crafted request and bypass the web-based management interface to gain unauthorised device access; Cisco notes successful exploitation may yield root command execution and that on-box evidence can be removed afterward. Cisco CVSS 3.1 base 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); CWE-648; Bug CSCww39530. No workarounds; temporary mitigation: infrastructure ACLs restricting management/control-plane traffic to the device. Fixed software: ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, 3.1 Patch 12. Cisco PSIRT is aware of active exploitation; CISA added CVE-2026-76460 to KEV on 16 September 2026 (same alert also added Acronis CVE-2026-87886). Same-day Cisco ISE/ISE-PIC criticals including CVE-2026-76423 are noted as related context, not separate desk cards — only 76460 has claimed in-the-wild use in the PSIRT advisory. Hunt ise-kong/access.log for suspicious usernames and correlate off-box network/firewall logs. Primary: Cisco PSIRT; wires: BleepingComputer / SecurityWeek 17 Sep 2026.
Forever Security (16 September 2026; also The Hacker News) documents BragJack: a research technique where a malicious Chromium extension with common page-modify and declarativeNetRequest permissions injects into the trusted origin the browser AI "body" listens to, then commands the built-in assistant. Affected demos: Gemini Live in Chrome (CVE-2026-0628, CVSS 8.8 per CISA score cited by researchers; fixed in Chrome 143.0.7499.192, Jan 2026), Microsoft Edge (CVE-2026-55945, CVSS 4.2; fixed in Edge 150.0.4078.48, 2 Jul 2026), Perplexity Comet, Opera Neon, and Claude in Chrome (latter three without CVE; vendor bounty acknowledgements claimed). Impacts vary by product (agent hijack, local file read, camera/mic on Chrome). Researcher demos only — not reported in the wild; requires the attacker's extension already installed. Primary: Forever Security; wire: The Hacker News.
Forever Security — BragJack research (16 Sep 2026)
Wordfence/Defiant (wired by SecurityWeek 16 September 2026) documents two critical unauthenticated remote-code-execution chains in StellarWP The Events Calendar plugin (~600k+ installs; ~240k on vulnerable branches per SW). CVE-2026-78159 (CVSS 9.8): unauthenticated code injection via insufficient validation when processing single-event HTML/comment area — patched in 6.17.3.1 (25 August 2026). CVE-2026-78006 (CVSS 9.8): unauthenticated PHP object injection when event comments are enabled/visible — payload reaches the vulnerable path before moderation; patched in 6.17.4.1 (10 September 2026). Both can fully compromise the WordPress site. Update to 6.17.4.1 or later. Primary research: Wordfence Argus blog (URL may be bot-gated); wire: SecurityWeek.
WSO2 security advisory WSO2-2026-5328 / CVE-2026-5430 (published 3 May 2026; Critical): JWT authentication can be bypassed when a token is signed with an unsupported algorithm, allowing unauthorized access and potential administrative account takeover. Vendor CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); single-tenant deployments adjusted to 9.8 (S:U). Affected: WSO2 API Manager 4.1.0–4.6.0; API Control Plane 4.5.0/4.6.0; Traffic Manager 4.5.0/4.6.0; Universal Gateway 4.5.0/4.6.0. The Hacker News (16 September 2026) cites watchTowr honeypot telemetry capturing forged admin JWTs on 13 September 2026 — active in-the-wild exploitation attempts. Support subscription holders: apply stated update levels (e.g. API Manager 4.6.0 UL 21, 4.5.0 UL 57, 4.4.0 UL 72, 4.3.0 UL 108, 4.2.0 UL 197, 4.1.0 UL 257; Control Plane/Traffic Manager/Universal Gateway levels on the advisory). Community: GitHub fixes carbon-apimgt PR 13752 and product-apim PR 14167, or migrate to an unaffected release. Credits: Hacktron Team. Primary: WSO2 WSO2-2026-5328; wire: The Hacker News / watchTowr.
Docker security announcements (Sandboxes 0.42.0; NVD received CVE-2026-77179 on 15 September 2026) document two sandbox-escape flaws. CVE-2026-77179 (Critical, Docker CVSS 4.0 base 9.4): on macOS the virtio-fs host server followed symlinks when reopening an unlinked file from a stored path, so malicious guest code (e.g. a compromised AI coding agent inside sbx) could escape the shared project workspace and read/modify arbitrary host files as the VMM user — potentially host code execution. Affects Sandboxes 0.28.0 up to but not including 0.42.0 on macOS. Companion CVE-2026-79994 (High, CVSS 4.0 8.7): guest-to-host Unix-domain socket relay TOCTOU symlink race; affects 0.37.0 through 0.41.9. Both fixed in 0.42.0 (release notes / sbx-releases tag). Docker reports no exploitation; CISA SSVC exploitation none; not in KEV at wire check. Workaround if unable to upgrade: use clone mode and avoid additional host mounts. Category vulnerabilities with AI-agent sandbox tag. Primary: Docker security announcements; secondary: NVD / GitHub sbx-releases v0.42.0.
VulnCheck advisory (15 September 2026) covers CVE-2026-89026 in Issabel Framework (web UI for Issabel PBX / Asterisk). Before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd the pbxapi index.php embeds a hard-coded HS256 JWT signing key identical on every install (CWE-321). Unauthenticated attackers forge bearer tokens and call /pbxapi/manager/originate with the System application parameter so Asterisk runs arbitrary OS commands as the Asterisk user. VulnCheck rates CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N); The Hacker News cites CVSS 3.1 9.8. Patch (1 August 2026) replaces the hard-coded key with a key from /etc/issabel.conf. Shadowserver first observed exploitation on 9 September 2026; scale/actors not detailed. Apply the patched framework commit or later; rotate any JWT material that relied on the shared key. Primary: VulnCheck advisory; wire: The Hacker News 16 Sep 2026.
