CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 21 September 2026 (catalogVersion 2026.09.21; FCEB due 24 September 2026; forensic triage required under BOD 26-04). Zyxel’s security advisory (16 June 2026) documents a stack-based buffer overflow (CWE-121) in the CGI program of GS1900 series switch firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands. NVD (Zyxel as CVSS source) scores CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVD description cites GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0. Vendor patch table maps each GS1900 SKU from 2.90(.*).1)C0 and earlier to fixed 2.90(.*).2)C0 builds (e.g. GS1900-48HPv2 → 2.90(ABTQ.2)C0; GS1900-8 → 2.90(AAHH.2)C0). Known ransomware campaign use: Unknown per CISA. Australia relevance: GS1900 is a common SMB/managed-access switch line — patch LAN-management exposure.
D-Link Security Announcement SAP10516 (published 18 September 2026; last updated 21 September 2026) confirms it is investigating two critical flaws reported against DIR-822A firmware A_101. CVE-2026-86296 is a stack-based buffer overflow in udhcpcd (strcpy in udhcpcd/serverpacket.c): network-reachable, no authentication, no user interaction; CNA/VulDB publish CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 10.0; a public proof-of-concept is reported. Companion CVE-2026-86510 is an out-of-bounds write in L2TP Control Message Parser tunnel_set_params (CVSS 3.1 9.9 / CVSS 4.0 9.4 per vendor write-up); low privileges, no user interaction. Both statuses: Under Investigation — D-Link has not yet confirmed full hardware-revision scope or a remediation build. (sources: D-Link SAP10516; CVE.report)
CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on 18 September 2026, citing active exploitation. CVE-2025-39682 (CVSS 3.1 9.8 Critical, Linux kernel CNA): improper check in the TLS receive path — zero-length records on rx_list can bypass intended recvmsg() record-type handling. CVE-2026-53266 (CVSS 3.1 8.8, Linux kernel CNA): out-of-bounds write in ebtables SNAT ARP rewrite path. CVE-2025-39964 (CVSS 3.1 7.8, Linux kernel CNA; NVD scores it 5.5, according to Red Hat's CVE page): AF_ALG race allowing concurrent writes to the same crypto socket, leaving inconsistent socket state (CWE-362). UPDATE 25 September 2026 — IDNsec / Muhammad Alifa Ramdhan (STAR Labs; kernelCTF US$113,337): retrospective shows CVE-2025-39964 can escalate a local user to root and escape a Docker container via scatterlist/usercopy oracle → core_pattern overwrite. Upstream fix adds exclusive write ownership on af_alg_sendmsg. The kernel CNA's CVE record lists the first fixed stable releases as 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9, and 6.17 (distribution kernels may carry the fix under other version numbers). CISA BOD 26-04 FCEB due 21 September 2026; ransomware use Unknown; forensic triage required. Distinct from DirtyAH6/PPPoEject/TUNderflow/DiagSpill local-root quartet. (sources: CISA KEV; IDNsec) Correction (29 Oct 2026): the fixed kernel versions came from a Cybersecurity News report that is not linked and were each one release too high; they now follow the Linux kernel CNA's CVE record. The CVSS scores were credited to NVD but are the kernel CNA's; NVD scores CVE-2025-39964 at 5.5, according to Red Hat. The unlinked Cybersecurity News reference was removed. (source: CVE.org (Linux kernel CNA); Red Hat)
oss-security (18 September 2026) summarises four long-lived Linux kernel local privilege-escalation bugs nicknamed DirtyAH6 (CVE-2026-80844, xfrm/AH6 routing-header segments_left validation), PPPoEject (CVE-2026-68121, pppoe_sendmsg header pointer after dev_hard_header), TUNderflow (CVE-2026-81000, TUN/TAP oversized headroom underflow; CVSS 3.1 7.8), and DiagSpill (CVE-2026-74469, SCTP transport_count overflow; CVSS 3.1 8.8). First three LPEs generally need unprivileged user namespaces or specific capabilities; DiagSpill does not. Corruption in DirtyAH6 and DiagSpill can be remotely reachable only under very specific circumstances (oss-security). CVE records list stable-tree fixes and unaffected lines such as 5.10.269+/5.15.220+ (DirtyAH6), 5.10.270+/5.15.221+ (TUNderflow), 5.10.265+/5.15.216+ (PPPoEject/DiagSpill) among others — apply your distro’s kernel security updates rather than cherry-picking. No CVSS published yet in the CVE JSON for DirtyAH6 (CVE-2026-80844) at fetch time — do not invent. (sources: oss-security roundup; MITRE CVE records)
WordPress 7.1.1 (17 September 2026) fixes an unauthenticated stored XSS in core wpautop() that Patchstack tracks as CVE-2026-93485 (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and industry coverage dubs Comment2Shell. An anonymous visitor submits a comment with a line break inside an allowed HTML attribute; comment sanitisation (wp_kses) accepts it, then display-time reformatting turns the payload into a live event handler. When a logged-in administrator later opens the page, the script runs in their browser session and can upload a malicious plugin (web shell) — server RCE requires that admin session and a theme that renders comments in the vulnerable path (block themes / compatible classic themes). WordPress wording: exploitable “subject to comment approval”; Patchstack notes moderation is not a security control (default first-comment hold can be bypassed). No in-the-wild exploitation claimed; not on CISA KEV. Affected: WordPress 4.7 through 7.1 before the 17 Sep security builds. Fixed: 7.1.1, 7.0.5, 6.9.8, and matching backports through 4.7.36. (sources: WordPress 7.1.1 release; Patchstack analysis) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Patchstack)
SolarWinds Trust Center advisory CVE-2026-28326 (first published 17 September 2026) documents an unauthenticated remote code execution flaw in Access Rights Manager (ARM) stemming from a hard-coded static key. CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network). Affected: ARM 2026.2 and all previous versions. Fixed: ARM 2026.2.1. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. (source: SolarWinds Trust Center) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: SolarWinds)
SolarWinds — CVE-2026-28326 ARM unauthenticated RCE (17 Sep 2026)
WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). (sources: WordPress 7.1.1 release; pwn.ai) Correction (02 Nov 2026): removed The Hacker News as a source. (source: pwn.ai)
WordPress — 7.1.1 maintenance and security release (17 Sep 2026)
Microsoft Security Update Guide lists CVE-2026-85885 (NVD published 17 September 2026): command injection (CWE-77) in M365 Copilot allowing an authorized (low-privilege) attacker to elevate privileges over the network. Microsoft CVSS 3.1 base 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). NVD cveTags: exclusively-hosted-service — same September 2026 MSRC cloud-transparency release train as cards cve-2026-85887 (Copilot info disclosure 7.7) and cve-2026-85889 (Azure AI Foundry). Expect Microsoft’s hosted-service pattern: CVE published for transparency with mitigation already applied in the service (confirm on MSRC for customer action). Distinct CVE from 85887. (sources: MSRC; NVD)
Red Hat Product Security (public_date 17 September 2026) documents CVE-2026-92925 in Redis community: the cluster bus packet parser for PING/PONG/MEET fails to validate null-termination on string-carrying extensions (CWE-125), enabling a remote attacker on an adjacent network to craft a malicious packet and trigger an out-of-bounds read — sensitive-info disclosure or remote DoS. Red Hat CVSS 3.1 base 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H); threat severity Important; CISA SSVC notes exploitation none. Upstream fix referenced via redis/redis PR #15263 / commit 37894fae and release tag 8.10.0. Red Hat CVE page lists mixed product package states (Affected / Will not fix / Not affected) — check RH advisory for your workload. No in-the-wild claim in RH/NVD snippets this pass. (sources: Red Hat CVE; Redis upstream 8.10.0 release; NVD)
Red Hat — CVE-2026-92925 Redis cluster bus OOB read (17 Sep 2026)
Microsoft Security Update Guide (September 2026 release; MSRC releaseDate 17 September 2026 PDT) published two exclusively-hosted Azure AI Foundry elevation-of-privilege CVEs for transparency. CVE-2026-85889 (Critical, Microsoft CVSS 3.1 base 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-306): missing authentication for a critical function allows an unauthenticated network attacker to elevate privileges. CVE-2026-85917 (Critical impact class / High base 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; CWE-918): SSRF allowing unauthenticated privilege elevation. Microsoft states both are already fully mitigated in the hosted service — no customer patch action; CVEs are for cloud transparency (aka.ms/MSRC-Cloud-CVEs). MSRC: publicly disclosed No; exploited No. NVD received records 17 September 2026. (sources: MSRC CVE-2026-85889; MSRC CVE-2026-85917)
Microsoft Security Update Guide (September 2026; MSRC releaseDate 17 September 2026 PDT) lists CVE-2026-85887, an M365 Copilot information-disclosure vulnerability: incorrect permission assignment for a critical resource (CWE-732) lets an authorized (low-privilege) attacker disclose information over the network. Microsoft CVSS 3.1 base 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); MSRC severity Critical / impact Information Disclosure. Exclusively hosted service: Microsoft states the issue is already fully mitigated — no customer patch steps; CVE published for cloud transparency. MSRC: publicly disclosed No; exploited No. NVD received 18 September 2026 00:17 UTC. Distinct from Azure AI Foundry CVE-2026-85889/85917. (sources: MSRC; NVD)
MSRC — CVE-2026-85887 M365 Copilot information disclosure (17 Sep 2026)
CVE-2026-92838 (published ~17 September 2026 per Tenable) is a DLL hijacking issue in the GeoVision GV-Remote E-Map desktop application: one or more DLLs are loaded from an unsafe search path. A local attacker with write access to a directory searched before the legitimate library location can plant a malicious DLL and achieve code execution as the GV-Remote E-Map process. Tenable CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public in-the-wild exploitation claim on the Tenable snippet reviewed. Relevance: physical-security / VMS operators running GeoVision Windows clients.
