AWS Security Bulletin 2026-115-AWS (Publication 22 September 2026 10:00 AM PDT) documents CVE-2026-94384: missing authorization in Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) sfExecuteAWSService before 5.26. Any IAM principal with lambda:InvokeFunction on the function can escalate and call AWS APIs allowed by the function's privileged execution role even when their own IAM policy denies those actions — the Lambda becomes a privileged parameter-dispatch proxy. Amazon CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); CVSS 4.0 6.4 Medium. Affected SAR app versions 5.15 through <5.26 (CSN also cites through 5.24.16). Remediation: upgrade to 5.26 or later; after setup delete or disable sfExecuteAWSService, or restrict InvokeFunction to the intended CTI Adapter IAM user only. Credit: Chang Li (Xidian University) via CVD. (sources: AWS bulletin 2026-115-AWS; CVE.report)
Adobe Connect security update APSB26-150 (CVE records published 22 September 2026) fixes nine defects including six Critical issues enabling arbitrary code execution / privilege escalation: CVE-2026-75682 (SQLi, Adobe CVSS 3.1 9.9), CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698 (SQLi / XSS / improper input validation family), plus High path-traversal, certificate-validation and XSS issues. Affected: Adobe Connect 12.11 and Android Mobile App 4.4. Unaffected/fixed: Connect 12.11.1 and 12.12; Android app 4.5. Priority 2 (apply within 30 days). Adobe states no known in-the-wild exploitation for these flaws. Same Tuesday drop also shipped AEM Forms JEE APSB26-151 (separate card).
cPanel support advisory (22 September 2026) documents CVE-2026-87899: an authenticated cPanel account holder can escalate through CalDAV/CardDAV functionality to code execution as root and full server control. Affects cPanel/WHM v120 or later; patched in 11.134.0.57+, 11.136.0.41+, 11.138.0.8+. CISA's ADP entry on the CVE record lists exploitation as none. Credited to Ali Mustafa (rz1027). (sources: cPanel support CVE-2026-87899; CVE record CVE-2026-87899) UPDATE (24 Oct 2026): The CVE record (HackerOne as CNA) scores CVE-2026-87899 at 9.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). (source: CVE record CVE-2026-87899) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: CVE record CVE-2026-87899)
Vercel GitHub advisory GHSA-vcvr-r3jv-pc5j (published 22 September 2026; CVE-2026-94545) documents remote code execution in the Node.js ImageResponse implementation from next/og when apps pass attacker-controlled values into SVG content, attributes, or styles. Vercel rates Critical with CVSS 4.0 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Affected: Next.js >=16.2.0 <16.3.6 on the Node.js runtime (default). Not affected per the advisory: the Edge ImageResponse implementation, and apps that do not pass attacker-controlled values into SVG. Patched: 16.3.6 (22 Sep). Inventory routes importing ImageResponse from next/og that echo request/URL input into SVG; prefer not placing untrusted input in SVG title/attrs/styles until patched. The advisory does not report in-the-wild exploitation. (source: Vercel advisory on GitHub) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Vercel advisory on GitHub)
Google's Chrome Releases blog promoted Chrome 154 to the stable channel on 22 September 2026 (154.0.8037.57 for Linux; 154.0.8037.57/.58 for Windows and Mac) with 108 security fixes, including Critical ANGLE, GPU, WebGL and ServiceWorker bugs (examples: CVE-2026-95350, 95281, 95284, 95357, 95322, 95349, 95329). UPDATE (29 Sep 2026): a further Stable Channel Update for Desktop rolled out 154.0.8037.92/.93 for Windows and Mac and 154.0.8037.92 for Linux with 32 more security fixes, including Critical CVE-2026-102331 (buffer overflow in ANGLE) and High Mojo, V8, GPU, WebGPU and use-after-free bugs (e.g. CVE-2026-102317, 102299, 102323, 102326, 102328). Google says access to bug details may be kept restricted until a majority of users are updated. (source: Chrome Releases) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; the line about Firefox ESR releases, which only SecurityWeek gave on this card, is removed, and the card date stays 22 September 2026, Google's date. (source: Chrome Releases)
UPDATE 23–24 Sep 2026: BleepingComputer reports threat actors moved from probing to exploiting CVE-2026-87902 to write files that execute shell commands when accessed. Patchstack saw first malicious requests at 17:44 UTC on 22 September 2026 (under five hours after WordPress 7.1.2 shipped), then ~10× traffic increase delivering payloads. Flaw: unauthenticated get_page_template() path traversal to include a chosen readable local .php outside active theme dirs; RCE needs theme top-level page-* dir plus a readable include target (e.g. pearcmd.php with register_argc_argv). WordPress/GHSA rate Critical (~9.2 CVSS 4.0 UI; NVD/CISA secondary CVSS 3.1 8.1 High). Official PHP Docker image and default cPanel on PHP <8.5 called out. Fix: 7.1.2 with backports through eligible branches to 4.7 (pre-4.6 unfixed). Distinct from click2shell/comment2shell (7.1.1). UPDATE 25 Sep 2026: CISA added CVE-2026-87902 to KEV (dateAdded 2026-09-25). (sources: WordPress 7.1.2; GHSA-7hp8-65ch-5whp; BleepingComputer)
F5 (CVE published 22 September 2026; advisory K000162605) documents CVE-2026-94127: when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server and BIG-IP APM is configured as an OAuth Authorization Server, specific malicious traffic can lead to unauthenticated remote code execution. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization-server profiles) are not affected. Data-plane issue (no control-plane exposure); Appliance mode is also vulnerable. F5 CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 Critical. CISA added CVE-2026-94127 to KEV on 22 September 2026 (due 25 September 2026; forensic triage under BOD 26-04); known ransomware campaign use Unknown. Temporary mitigation: vendor-provided iRule, then install final vendor hotfixes. (source: NVD)
Check Point sk1000171 (approved/created 20 September 2026; last modified 22 September 2026; CVE published 22 Sep) documents CVE-2026-93616: directory traversal plus file upload lets an unauthenticated attacker upload and execute arbitrary scripts on Quantum Security Management / Multi-Domain / Log Server / Multi-Domain Log Server / SmartEvent. Check Point CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-22. Vendor states the vulnerability is exploited in the wild and a handful of customers have been attacked. Smart-1 Cloud already patched; firewall appliances / Spark not affected. LivePatch Take 28/29 does not fix this issue (no LivePatch for this fix). (sources: Check Point sk1000171; CVE.report)
Check Point sk1000171 — CVE-2026-93616 Management Server path traversal (22 Sep 2026)
Arista Security Advisory 0183 (CVE published 22 September 2026) documents CVE-2026-93952 in on-premises VeloCloud Orchestrator (VCO): a remote attacker with network access to the VCO web interface and the public part of an Edge authentication certificate may reach privileged internal functionality and impact the VCO host when certificate-based Edge→VCO authentication is configured. Arista/CNA CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 9.5; Arista states the issue was discovered externally and is known to be actively exploited. Hosted/Dedicated VCO already patched. On-prem trains: 5.2.3.15 and earlier → fix 5.2.3.16+; 6.4.2.7 and earlier → fix 6.4.2.8+; 6.1.3.7 and earlier and 7.0.0.2 and earlier — no fix listed as of 22 Sep 2026 (Arista says supported-train fixes forthcoming). Distinct from July exploited VCO CVE-2026-16812. (sources: Arista SA-0183 URL; CVE.report) Correction (02 Nov 2026): removed The Hacker News as a source. (source: CVE.report)
BleepingComputer (Sergiu Gatlan; coverage of weekend disclosure) reports security researcher Abdelhamid Naceri (MSNightmare / Nightmare Eclipse) released BigDiskBuster, a local proof-of-concept that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates while it runs. The tool watches Defender Platform/Definition Updates directories on the C: volume and starves the installer by creating a hidden delete-on-close temp file sized to remaining free space, with worker threads reclaiming capacity if files change; it may also open MRT.exe with restrictive sharing to interfere with staging. No CVE assigned in the BleepingComputer write-up; Microsoft initially had not commented. PoC: github.com/MSNightmare/BigDiskBuster. Correction (24 Oct 2026): BleepingComputer's article, updated 26 September, carries a Microsoft statement that Microsoft Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity; Microsoft did not say a CVE had been assigned and told customers to keep Defender security intelligence and platform updates current. (source: BleepingComputer) Correction (25 Oct 2026; revised 27 Oct 2026): the card date is 22 September 2026, the date BleepingComputer's report visibly shows (it describes the disclosure as happening over the weekend). A repository-creation time taken from GitHub API metadata has been removed because that page could not be read. A Cyber Security News link dated 21 September has been removed because we can no longer read that site, so its date could not be checked. (source: BleepingComputer)
BleepingComputer — New Windows Defender zero-day blocks antivirus updates (BigDiskBuster)
IBM Security Bulletin ibm17288641 (node 7288641; Initial Publish 21 September 2026; Modified 21 Sep) addresses a large set of vulnerabilities in Financial Transaction Manager (FTM) for Red Hat OpenShift. Highest scores: CVE-2026-18169 CVSS 9.9 (authenticated symlink/path validation → sensitive data / integrity, scope changed), CVE-2026-18163 CVSS 9.8 (unauth remote deserialization RCE), CVE-2026-18162 CVSS 9.8 (unauth code injection via JS Function constructor), plus further Critical/High issues (e.g. CVE-2026-17635 9.1 HTTP security-header misconfig; CVE-2026-18872 9.3 stored XSS; CVE-2026-17645 9.1 priv escalation). Affected: FTM for OpenShift 4.0.6.0 through 4.0.10.0 (incl. 4.0.6.0 iFix6 / Operator 4.4.6+20260807.081800). Remediation: upgrade to FTM 4.0.11.0. No exploitation-in-the-wild claim in the bulletin. (sources: IBM bulletin; CVE.report)
IBM Security Bulletin — FTM for Red Hat OpenShift multiple vulnerabilities (21 Sep 2026)
Red Hat CVE-2026-75939 (published 21 September 2026): openshift/oc-mirror incorrectly verifies PGP release-image signatures by checking for signature errors before the entire signed body is processed, enabling a verification bypass. A remote attacker who can intercept/manipulate traffic to the signature endpoint can craft a PGP message with a valid Red Hat release key ID but a forged signature so oc-mirror accepts and mirrors a malicious release payload into a disconnected/air-gapped registry. Red Hat CVSS 3.1 7.4 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), CWE-347. (sources: Red Hat CVE page; CVE.report) UPDATE (26 Oct 2026): the CVE record (Red Hat, updated 15 October) now lists erratum RHSA-2026:79039, which fixes the oc-mirror-plugin-rhel9 container for OpenShift Container Platform 4.18. (source: CVE record CVE-2026-75939)
Red Hat — CVE-2026-75939 oc-mirror PGP verification bypass
