CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on 18 September 2026 (catalog 2026.09.18), citing evidence of active exploitation. CVE-2025-39682 (NVD CVSS 3.1 9.8 Critical): improper check in the TLS receive path — zero-length records on rx_list can bypass intended recvmsg() record-type handling. CVE-2026-53266 (NVD 8.8 High): out-of-bounds write in ebtables SNAT ARP rewrite path. CVE-2025-39964 (NVD 7.8 High): race allowing concurrent writes to the same AF_ALG socket (crypto). CISA BOD 26-04 FCEB recommended due date 21 September 2026; ransomware use Unknown; forensic triage required per BOD notes. Distinct from the 18 Sep DirtyAH6/PPPoEject/TUNderflow/DiagSpill local-root quartet already on the desk. The Hacker News (19 Sep) reports Red Hat updated advisories acknowledging active exploitation / public exploits — apply distro kernel updates. Primary: CISA KEV; CVSS from NVD; secondary: THN / Red Hat CVE pages.
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability. Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
oss-security (18 September 2026) summarises four long-lived Linux kernel local privilege-escalation bugs nicknamed DirtyAH6 (CVE-2026-80844, xfrm/AH6 routing-header segments_left validation), PPPoEject (CVE-2026-68121, pppoe_sendmsg header pointer after dev_hard_header), TUNderflow (CVE-2026-81000, TUN/TAP oversized headroom underflow; CVSS 3.1 7.8), and DiagSpill (CVE-2026-74469, SCTP transport_count overflow; CVSS 3.1 8.8). First three LPEs generally need unprivileged user namespaces or specific capabilities; DiagSpill does not. Corruption in DirtyAH6 and DiagSpill can be remotely reachable only under very specific circumstances (oss-security). CVE records list stable-tree fixes and unaffected lines such as 5.10.269+/5.15.220+ (DirtyAH6), 5.10.270+/5.15.221+ (TUNderflow), 5.10.265+/5.15.216+ (PPPoEject/DiagSpill) among others — apply your distro’s kernel security updates rather than cherry-picking. No CVSS published yet in the CVE JSON for DirtyAH6 (CVE-2026-80844) at fetch time — do not invent. Primary: oss-security roundup; also MITRE CVE records / kernel stable commits.
Linux Kernel Out-of-Bounds Write Vulnerability. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Linux Kernel Race Condition Vulnerability. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). Primary: WordPress 7.1.1 release; research: pwn.ai; wire: The Hacker News 18 Sep 2026.
WordPress — 7.1.1 maintenance and security release (17 Sep 2026)
Microsoft Security Update Guide lists CVE-2026-85885 (NVD published 17 September 2026): command injection (CWE-77) in M365 Copilot allowing an authorized (low-privilege) attacker to elevate privileges over the network. Microsoft CVSS 3.1 base 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). NVD cveTags: exclusively-hosted-service — same September 2026 MSRC cloud-transparency release train as desk cards cve-2026-85887 (Copilot info disclosure 7.7) and cve-2026-85889 (Azure AI Foundry). Expect Microsoft’s hosted-service pattern: CVE published for transparency with mitigation already applied in the service (confirm on MSRC for customer action). Distinct CVE from 85887. Primary: MSRC; secondary: NVD.
Red Hat Product Security (public_date 17 September 2026) documents CVE-2026-92925 in Redis community: the cluster bus packet parser for PING/PONG/MEET fails to validate null-termination on string-carrying extensions (CWE-125), enabling a remote attacker on an adjacent network to craft a malicious packet and trigger an out-of-bounds read — sensitive-info disclosure or remote DoS. Red Hat CVSS 3.1 base 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H); threat severity Important; CISA SSVC notes exploitation none. Upstream fix referenced via redis/redis PR #15263 / commit 37894fae and release tag 8.10.0. Red Hat CVE page lists mixed product package states (Affected / Will not fix / Not affected) — check RH advisory for your workload. No in-the-wild claim in RH/NVD snippets this pass. Primary: Red Hat CVE; secondary: upstream 8.10.0 release / NVD.
Red Hat — CVE-2026-92925 Redis cluster bus OOB read (17 Sep 2026)
Microsoft Security Update Guide (September 2026 release; MSRC releaseDate 17 September 2026 PDT) published two exclusively-hosted Azure AI Foundry elevation-of-privilege CVEs for transparency. CVE-2026-85889 (Critical, Microsoft CVSS 3.1 base 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-306): missing authentication for a critical function allows an unauthenticated network attacker to elevate privileges. CVE-2026-85917 (Critical impact class / High base 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; CWE-918): SSRF allowing unauthenticated privilege elevation. Microsoft states both are already fully mitigated in the hosted service — no customer patch action; CVEs are for cloud transparency (aka.ms/MSRC-Cloud-CVEs). MSRC: publicly disclosed No; exploited No. NVD received records 17 September 2026. Primary: MSRC CVE-2026-85889; companion: MSRC CVE-2026-85917; NVD indexes both.
Microsoft Security Update Guide (September 2026; MSRC releaseDate 17 September 2026 PDT) lists CVE-2026-85887, an M365 Copilot information-disclosure vulnerability: incorrect permission assignment for a critical resource (CWE-732) lets an authorized (low-privilege) attacker disclose information over the network. Microsoft CVSS 3.1 base 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); MSRC severity Critical / impact Information Disclosure. Exclusively hosted service: Microsoft states the issue is already fully mitigated — no customer patch steps; CVE published for cloud transparency. MSRC: publicly disclosed No; exploited No. NVD received 18 September 2026 00:17 UTC. Distinct from Azure AI Foundry CVE-2026-85889/85917. Primary: MSRC; secondary: NVD.
MSRC — CVE-2026-85887 M365 Copilot information disclosure (17 Sep 2026)
CVE-2026-92838 (published ~17 September 2026 per Tenable) is a DLL hijacking issue in the GeoVision GV-Remote E-Map desktop application: one or more DLLs are loaded from an unsafe search path. A local attacker with write access to a directory searched before the legitimate library location can plant a malicious DLL and achieve code execution as the GV-Remote E-Map process. Tenable CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor cyber-security portal (geovision.com.tw/cyber_security.php) hosts GeoVision advisories; this CVE id was not visible as a labelled row on that index during the 18 September 2026 07:00 Perth desk pass — treat Tenable/CVE record as primary until a matching PDF advisory is linked. No public in-the-wild exploitation claim on the Tenable snippet reviewed. Relevance: physical-security / VMS operators running GeoVision Windows clients.
CVE-2026-81546 (published ~17 September 2026 per Tenable/NVD indexing) covers a stack-based buffer overflow in the Affinity by Canva application before the 3.3.0 September 2026 release: inadequate bounds checking when parsing Affinity document files. A crafted Affinity document opened by a user can lead to arbitrary code execution. Tenable lists CVSS 3.1 base score 7.7 (High). Australia relevance: Affinity is Canva’s creative suite (Canva is Australian-headquartered). Patch: upgrade Affinity by Canva to 3.3.0 or later. No public exploitation claim on the Tenable/NVD snippets reviewed this pass. Primary: CVE/NVD/Tenable record; treat vendor release notes as authoritative for build numbers when published.
Tenable — CVE-2026-81546 Affinity by Canva (indexed 17 Sep 2026)
