BleepingComputer (3 September 2026) reports Hewlett Packard Enterprise patched a critical buffer-overflow remote code execution issue in ArubaOS-CX, tracked as CVE-2026-73749: an unauthenticated remote attacker can send crafted packets to an affected daemon and execute code with elevated privileges. HPE security bulletin hpesbnw05134en_us lists fixed builds by branch: 10.18.0001 → 10.18.1002+; 10.17.1021 and earlier → 10.17.1030+; 10.16.1051 and earlier → 10.16.1060+; 10.13.1180 and earlier → 10.13.1190+; 10.10.1180 and earlier → 10.10.1181+ (10.10.1181 is End of Maintenance and receives only critical internal fixes). The same bulletin covers about 23 further issues; Bleeping citing HPE places several authenticated management flaws (including CVE-2026-73750/73751/73752 and related) in the high range around 8.1–8.8. WA SOC advisory 20260909002 (9 September 2026, TLP:CLEAR) covers the same CVE-2026-73749 RCE (CVSS 9.8 Critical), lists the same fixed branches, and states it has not received reports of exploitation on Western Australian Government networks at the time of writing. Upgrade AOS-CX switches to the fixed release for your branch; restrict management-plane exposure until patched.
BleepingComputer (3 September 2026), citing Wordfence, reports active exploitation of CVE-2026-32475 in Elementor Pro for WordPress. Faulty validation of file-upload arrays in Elementor Pro forms (versions 4.2.1 and earlier) lets an attacker submit an empty first array element and a malicious PHP file as the second, so later files skip validation. The payload lands under /wp-content/uploads/elementor/forms/ and can be fetched to run commands. Elementor shipped 4.2.2 on 19 August 2026, the same day exploitation began according to Wordfence. Wordfence reported more than 190,000 blocked exploitation attempts between 19 and 23 August. Exploitation needs a published Elementor Pro Form widget with at least one File Upload field. Patchstack disclosed the issue earlier. Upgrade Elementor Pro to 4.2.2 or later; review uploads under elementor/forms for unexpected PHP; keep WAF rules current. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: BleepingComputer)
Marimo GHSA-2679-6mx9-h9xc / NVD: CVE-2026-39987 is a pre-authentication RCE in the reactive Python notebook server. The /terminal/ws WebSocket lacks auth, giving an unauthenticated attacker a full PTY shell. NVD: versions prior to 0.23.0 affected; CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CVSS 4.0 9.3 also published. Exploit-DB 52673 (2 Sep 2026) shipped a public PoC (cited ≤0.20.4). UPDATE 15 September 2026 (Sysdig Threat Research): Sysdig observed a skilled human operator exploit this CVE, pivoting from Marimo to AWS Secrets Manager then an SSH bastion in eight seconds with a hand-rolled Python toolkit (850+ interactive commands over a nine-hour session; source IP 172.236.12.17). Upgrade to 0.23.0+; never expose Marimo terminal WebSockets to the internet. (sources: Marimo GHSA-2679-6mx9-h9xc; NVD; Sysdig) UPDATE (26 Oct 2026): CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog on 23 April 2026, with a 7 May due date for US federal agencies. Marimo's GitHub advisory rates it Critical and lists 0.23.0 as the patched version. (source: CISA KEV catalog; Marimo GitHub advisory) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Sysdig)
Exploit-DB entry 52676 (dated 2 September 2026) packages a Metasploit module for CVE-2026-29053: crafted Ghost CMS themes can execute arbitrary code on the host. The module lists affected releases from 0.7.2 through 6.19.0 and notes that for versions 5.105.0–5.130.5 and 6.0.0–6.10.3 it can also leverage a related 2FA bypass (CVE-2026-22594). Endor Labs write-up GHSA-cgc2-rcrh-qr5x is cited as the research reference. Upgrade Ghost past the fixed releases; restrict who can upload themes; review installed themes for unexpected Handlebars templates.
Cisco published a batch of security advisories on 2 September 2026. Two medium-severity flaws in Cisco Secure Email S/MIME decryption, CVE-2026-20354 and CVE-2026-20355 (Cisco CVSS 5.9 each), are due to insufficient validation of message integrity: Cisco says an attacker using a machine-in-the-middle technique to intercept and modify traffic between email gateways could obtain plaintext content from the encrypted communication. Cisco says that at the time of publication the flaws affected Secure Email devices running AsyncOS 16.5.0 or earlier with S/MIME configured for communication between email gateways, that a public announcement of the flaws is available, and that it is not aware of any malicious use. In the same publication, Cisco's notice lists the IOS XR Software Security Hardening Release for September 2026 (CVE-2026-20274 to CVE-2026-20280; Critical, CVSS 9.8), a Nexus 9000 Series Switches Silicon One remote code execution flaw (CVE-2026-20212; Critical, CVSS 9.8) and a high-severity SIP denial-of-service flaw in Desk Phone 9800, IP Phone 7800 and 8800 and Video Phone 8875 (CVE-2026-20281; CVSS 7.5), and recommends upgrading to the fixed software indicated in each advisory. (sources: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY; Cisco's publication notice) Apply available IOS XR, Nexus and phone fixes; for Secure Email, Cisco says there are no workarounds and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases. Correction (25 Oct 2026): Cisco's advisory (version 1.1, updated 8 September) says there are no workarounds for CVE-2026-20354 and CVE-2026-20355 and refers customers to bug IDs CSCwu28362 and CSCwu28364 for fixed releases; the earlier advice to apply workarounds from the advisory was wrong and has been removed. (source: Cisco Security Advisory cisco-sa-esa-smime-disc-dzw4rEdY) Correction (26 Oct 2026): CVSS scores and fix status are now credited to Cisco's advisory and publication notice. An unlinked SecurityWeek summary and wording that came from it (the flaws described as unpatched, 'no fix at disclosure', and descriptions of the IOS XR flaw classes and the Nexus attack path) have been removed. (source: Cisco)
BerriAI LiteLLM GHSA-7488-6r32-c95q (CVE-2026-59822) is High: the MCP Streamable HTTP auth path could let an unauthenticated attacker establish an MCP session with an arbitrary Bearer token when OAuth2 passthrough fallback replaced failed key validation with an empty UserAPIKeyAuth object, exposing configured MCP tools and connected services. Affected versions before 1.84.0; fixed in 1.84.0. GHSA publishes CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N; The GitHub advisory rates it High, 8.8. CISA added the CVE to KEV on evidence of active exploitation. Upgrade to 1.84.0+ or disable/block /mcp/ until patched. Correction (02 Nov 2026): removed The Hacker News as a source. (source: GitHub GHSA-7488-6r32-c95q)
Kestra GHSA-5vc5-wxxq-3fjx (CVE-2026-49869) is Critical: AuthenticationFilter whitelists any path whose last segment is configs via endsWith("/configs"), so unauthenticated callers can hit flow/execution APIs and, with default script plugins, achieve remote code execution as root in the worker container. GHSA CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0). Affected through 1.3.20; patched in 1.0.45 and 1.3.21. CISA added it to KEV on 2 September 2026. Upgrade Kestra OSS immediately; do not expose the webserver to untrusted networks until patched.
Kludex Starlette GHSA-86qp-5c8j-p5mr (CVE-2026-48710) is an HTTP request/response path confusion: affected builds rebuild request.url from an unvalidated Host header, so a malformed Host can make request.url.path differ from the path the router actually dispatched. Middleware that authorises on request.url.path can be bypassed. GHSA rates Moderate; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5). Affected through 1.0.0; patched in 1.0.1. CISA added it to the KEV catalog on 2 September 2026 based on evidence of active exploitation. Upgrade Starlette (and FastAPI stacks that pin it) to 1.0.1 or later; ensure front-end proxies reject malformed Host headers.
SonicWall's CVE records, published on 2 September 2026 (Perth time) and pointing to advisory SNWLID-2026-0016, describe two flaws in SMA1000 appliances. CVE-2026-83548 is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface, caused by an unintended alternate access path, that could let a remote unauthenticated attacker reach sensitive functionality and perform unauthorised operations; CISA's ADP enrichment in the record scores it CVSS 3.1 10.0, and the record credits Adam Babis of SonicWall PSIRT with finding it. CVE-2026-83549 is a post-authentication OS command injection in the SMA1000 Appliance Management Console (AMC) that in specific conditions could let an authenticated administrator execute arbitrary OS commands, resulting in remote code execution; CISA's ADP enrichment in the record scores it CVSS 3.1 7.8 (AV:L). Both records list SMA1000 platform-hotfix 12.4.3-03453 and 12.5.0-02835 and older versions as affected. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2 September 2026 (US time). (sources: CVE records CVE-2026-83548 and CVE-2026-83549; CISA) Correction (01 Nov 2026): removed the SecurityWeek credit, which this desk cannot read, and the details that came only from SecurityWeek or SonicWall's advisory page, which did not load for the desk (affected models, fixed hotfix builds, the chaining and zero-day claims and the list of products not affected); the card now rests on SonicWall's CVE records and CISA. (source: CVE-2026-83548 record) Correction (1 Nov 2026): the card said SonicWall scored the two flaws; SonicWall's CVE records carry no CVSS score, and the 10.0 and 7.8 scores come from CISA's ADP enrichment in those records, so they are now credited to CISA. (source: CVE-2026-83548 and CVE-2026-83549 records (cve.org))
CVE-2026-83548 record (SonicWall CNA; published 2 Sep 2026)
According to the CVE record published on 1 September 2026 (02:07 UTC; 10:07 am Perth; HackerOne CNA), CVE-2026-65643 is an eval injection (CWE-95) in cPanel 11.138.0.0 and earlier that allows remote authenticated users to execute arbitrary code as root. The record lists cPanel as affected before 11.110.0.141, from 11.112.0.0 before 11.134.0.53, from 11.136.0.0 before 11.136.0.37, from 11.138.0.0 before 11.138.0.2 and from 11.138.1.0 before 11.138.1.7, and rates it CVSS 4.0 8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). CISA's enrichment of the record lists proof-of-concept exploitation, not active exploitation. cPanel's own advisory, linked here, returns 403 to Cyberstack. This is not the April login bypass (CVE-2026-41940), which is already on Cyberstack. (source: CVE record) Correction (27 Oct 2026): removed details that came only from cPanel's advisory, which Cyberstack cannot read: the parked- and addon-domain file-creation mechanism, the WP Squared product name, the line that all supported versions are affected, and the advisory's statements on scoring and exploitation; the CVE record's CVSS 4.0 score is now given. The card date has moved from 27 August to 1 September 2026, the Perth date of the CVE record (1 September, 02:07 UTC; 10:07 am Perth (AWST)). (source: CVE.org)
CISA published ICS advisories ICSA-26-244-01 and ICSA-26-244-03 for Rockwell Automation products, both with a release date of 1 September 2026. ICSA-26-244-01 covers RSLinx Classic version 4.50 and earlier: four vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) let a crafted CIP packet crash the RSLinx Classic service, which then has to be restarted; CVE-2026-9621 and CVE-2026-9622 are rated CVSS 3.1 8.6 (High) and CVSS 4.0 9.2 (Critical), and the other two CVSS 3.1 7.5 and CVSS 4.0 8.7; the fix is version 4.60. ICSA-26-244-03 covers CVE-2026-9637 (CWE-119) in ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 controllers at V33 and earlier, V34.011 to V34.014, V35.011 to V35.013 and V36.011 to V36.012, where exploitation causes a major nonrecoverable fault (MNRF) that needs a power cycle; it is rated CVSS 3.1 7.5 and CVSS 4.0 8.7, with fixes in V37.011, V34.015, V35.014 and V36.013. For both advisories CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it. (source: CISA) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; this card now covers only the two CISA advisories we have read (it previously listed other Rockwell products from SecurityWeek), and the card date moves from 2 to 1 September 2026, the CISA release date. (source: CISA)
Mozilla's advisory MFSA 2026-82 (announced 1 September 2026) lists 29 vulnerabilities fixed in Firefox 155, with an overall impact of high; Mozilla rates 13 of them high, 7 moderate and 9 low. They include sandbox escapes due to use-after-free in the DOM: Navigation (CVE-2026-84119) and DOM: Security (CVE-2026-84121) components, a privilege escalation due to use-after-free in Graphics: WebGPU (CVE-2026-84123), use-after-free flaws in the JavaScript: GC (CVE-2026-84118) and Audio/Video components, and internally found memory-safety bugs that Mozilla says showed evidence of memory corruption and that it presumes could have been exploited with enough effort. Mozilla does not say any of them is being exploited in the wild. (source: Mozilla MFSA 2026-82)
Mozilla MFSA 2026-82 — Security Vulnerabilities fixed in Firefox 155 (1 Sep 2026)
