CyberStack

Latest cyber news, threats, security, and guidelines. Stack up.

Latest

Vulnerability
Published 2026-09-18
Verified 2026-09-19

Linux Kernel (CVE-2025-39682)

Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability. Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.

Product
Linux Kernel
Exploited in Australia?
unknown

Primary: NVD · Vendor: CISA KEV · CVE: CVE-2025-39682

vulnerabilities

Vulnerability
Published 2026-09-18
Verified 2026-09-19

Linux local-root quartet: DirtyAH6 / PPPoEject / TUNderflow / DiagSpill (oss-security)

oss-security (18 September 2026) summarises four long-lived Linux kernel local privilege-escalation bugs nicknamed DirtyAH6 (CVE-2026-80844, xfrm/AH6 routing-header segments_left validation), PPPoEject (CVE-2026-68121, pppoe_sendmsg header pointer after dev_hard_header), TUNderflow (CVE-2026-81000, TUN/TAP oversized headroom underflow; CVSS 3.1 7.8), and DiagSpill (CVE-2026-74469, SCTP transport_count overflow; CVSS 3.1 8.8). First three LPEs generally need unprivileged user namespaces or specific capabilities; DiagSpill does not. Corruption in DirtyAH6 and DiagSpill can be remotely reachable only under very specific circumstances (oss-security). CVE records list stable-tree fixes and unaffected lines such as 5.10.269+/5.15.220+ (DirtyAH6), 5.10.270+/5.15.221+ (TUNderflow), 5.10.265+/5.15.216+ (PPPoEject/DiagSpill) among others — apply your distro’s kernel security updates rather than cherry-picking. No CVSS published yet in the CVE JSON for DirtyAH6 (CVE-2026-80844) at fetch time — do not invent. Primary: oss-security roundup; also MITRE CVE records / kernel stable commits.

Product
Linux kernel (xfrm/AH6, PPPoE, TUN/TAP, SCTP)
Versions
Long-standing; fixed in multiple stable trees (examples from CVE: DirtyAH6 unaffected 5.10.269 / 5.15.220+; TUNderflow 5.10.270 / 5.15.221+; PPPoEject & DiagSpill 5.10.265 / 5.15.216+ — confirm against your distro advisory)
CVSS
(CVSS 3.1 High; DiagSpill CVE-2026-74469; TUNderflow/PPPoEject 7.8; DirtyAH6 unpublished at fetch)
Exploited in Australia?
unknown
Patch to
Install distribution kernel security updates that include the stable commits for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469; reboot into the new kernel.

Primary: oss-security — DirtyAH6 / PPPoEject / TUNderflow / DiagSpill (18 Sep 2026) · Vendor: CVE-2026-81000 (TUNderflow) — also 80844 / 68121 / 74469 on cve.org · CVE: CVE-2026-80844, CVE-2026-68121, CVE-2026-81000, CVE-2026-74469 · CVE-2026-74469 (DiagSpill) CVSS 8.8; see also CVE-2026-80844 / 68121

vulnerabilities network

Vulnerability
Published 2026-09-18
Verified 2026-09-19

Linux Kernel (CVE-2026-53266)

Linux Kernel Out-of-Bounds Write Vulnerability. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.

Product
Linux Kernel
Exploited in Australia?
unknown

Primary: NVD · Vendor: CISA KEV · CVE: CVE-2026-53266

vulnerabilities

Vulnerability
Published 2026-09-18
Verified 2026-09-19

Linux Kernel (CVE-2025-39964)

Linux Kernel Race Condition Vulnerability. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.

Product
Linux Kernel
Exploited in Australia?
unknown

Primary: NVD · Vendor: CISA KEV · CVE: CVE-2025-39964

vulnerabilities

Vulnerability
Published 2026-09-17
Verified 2026-09-19

WordPress Click2Shell: crafted admin theme-preview URL forces catalog theme install; chain to RCE (fixed 7.1.1)

WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). Primary: WordPress 7.1.1 release; research: pwn.ai; wire: The Hacker News 18 Sep 2026.

Product
WordPress core (theme install / preview); chain demo used Mobile Repair Zone theme 2.5.4
Versions
WordPress before 7.1.1 (core issue; security release backports through 4.7 branch where applicable)
CVSS
7.1 standalone / 9.3 chained (CVSS 3.1, pwn.ai researcher; no vendor score yet)
Exploited in Australia?
unknown
Patch to
Upgrade to WordPress 7.1.1 (or the matching security backport for your branch); automatic updates will pull it where enabled

Primary: WordPress — 7.1.1 maintenance and security release (17 Sep 2026) · Vendor: WordPress.org News — 7.1.1 · pwn.ai — Click2Shell research (also THN 18 Sep 2026)

vulnerabilities cloud

Vulnerability
Published 2026-09-17
Verified 2026-09-19

M365 Copilot command injection CVE-2026-85885 (CVSS 9.9); exclusively hosted / cloud-mitigated

Microsoft Security Update Guide lists CVE-2026-85885 (NVD published 17 September 2026): command injection (CWE-77) in M365 Copilot allowing an authorized (low-privilege) attacker to elevate privileges over the network. Microsoft CVSS 3.1 base 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). NVD cveTags: exclusively-hosted-service — same September 2026 MSRC cloud-transparency release train as desk cards cve-2026-85887 (Copilot info disclosure 7.7) and cve-2026-85889 (Azure AI Foundry). Expect Microsoft’s hosted-service pattern: CVE published for transparency with mitigation already applied in the service (confirm on MSRC for customer action). Distinct CVE from 85887. Primary: MSRC; secondary: NVD.

Product
Microsoft 365 Copilot (exclusively hosted cloud service)
Versions
Hosted M365 Copilot service (exclusively-hosted-service tag); confirm MSRC for any customer action
CVSS
(CVSS 3.1, Microsoft)
Exploited in Australia?
unknown
Patch to
Confirm MSRC — exclusively hosted; typically no customer patch if Microsoft states fully mitigated in service

Primary: MSRC — CVE-2026-85885 M365 Copilot command injection (Sep 2026) · Vendor: Microsoft Security Update Guide — M365 Copilot · CVE: CVE-2026-85885, CVE-2026-85887, CVE-2026-85889 · NVD — CVE-2026-85885 (exclusively-hosted-service)

vulnerabilities ai cloud

Vulnerability
Published 2026-09-17
Verified 2026-09-19

Redis cluster bus OOB read CVE-2026-92925 (CVSS 7.1); fix upstream 8.10.0

Red Hat Product Security (public_date 17 September 2026) documents CVE-2026-92925 in Redis community: the cluster bus packet parser for PING/PONG/MEET fails to validate null-termination on string-carrying extensions (CWE-125), enabling a remote attacker on an adjacent network to craft a malicious packet and trigger an out-of-bounds read — sensitive-info disclosure or remote DoS. Red Hat CVSS 3.1 base 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H); threat severity Important; CISA SSVC notes exploitation none. Upstream fix referenced via redis/redis PR #15263 / commit 37894fae and release tag 8.10.0. Red Hat CVE page lists mixed product package states (Affected / Will not fix / Not affected) — check RH advisory for your workload. No in-the-wild claim in RH/NVD snippets this pass. Primary: Red Hat CVE; secondary: upstream 8.10.0 release / NVD.

Product
Redis (community) — cluster bus / cluster mode
Versions
Redis community cluster-bus path prior to upstream 8.10.0 fix; Red Hat redis-consuming products: see RH CVE package_state (mixed)
CVSS
(CVSS 3.1, Red Hat Important)
Exploited in Australia?
unknown
Patch to
Upgrade Redis to upstream 8.10.0 or later (or apply vendor backport); review Red Hat errata for RH-packaged redis consumers

Primary: Red Hat — CVE-2026-92925 Redis cluster bus OOB read (17 Sep 2026) · Vendor: Redis upstream 8.10.0 release (fix referenced by RH) · CVE: CVE-2026-92925 · NVD — CVE-2026-92925; also redis/redis PR #15263

vulnerabilities network

Vulnerability
Published 2026-09-17
Verified 2026-09-19

Azure AI Foundry missing auth CVE-2026-85889 (CVSS 10.0) + SSRF CVE-2026-85917 (7.5); cloud-mitigated

Microsoft Security Update Guide (September 2026 release; MSRC releaseDate 17 September 2026 PDT) published two exclusively-hosted Azure AI Foundry elevation-of-privilege CVEs for transparency. CVE-2026-85889 (Critical, Microsoft CVSS 3.1 base 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-306): missing authentication for a critical function allows an unauthenticated network attacker to elevate privileges. CVE-2026-85917 (Critical impact class / High base 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; CWE-918): SSRF allowing unauthenticated privilege elevation. Microsoft states both are already fully mitigated in the hosted service — no customer patch action; CVEs are for cloud transparency (aka.ms/MSRC-Cloud-CVEs). MSRC: publicly disclosed No; exploited No. NVD received records 17 September 2026. Primary: MSRC CVE-2026-85889; companion: MSRC CVE-2026-85917; NVD indexes both.

Product
Microsoft Azure AI Foundry (exclusively hosted cloud service)
Versions
Hosted service (exclusively-hosted-service tag); not an on-prem build train — Microsoft states already fully mitigated
CVSS
(CVE-2026-85889); 7.5 (CVE-2026-85917) — CVSS 3.1 Microsoft
Exploited in Australia?
unknown
Patch to
No customer action — Microsoft states fully mitigated in the hosted Azure AI Foundry service (transparency CVE)

Primary: MSRC — CVE-2026-85889 Azure AI Foundry missing authentication (17 Sep 2026) · Vendor: Microsoft Security Update Guide — Azure AI Foundry · CVE: CVE-2026-85889, CVE-2026-85917 · MSRC — CVE-2026-85917 Azure AI Foundry SSRF (same release); also NVD

vulnerabilities ai cloud

Vulnerability
Published 2026-09-17
Verified 2026-09-19

M365 Copilot incorrect permissions CVE-2026-85887 (CVSS 7.7); cloud-mitigated info disclosure

Microsoft Security Update Guide (September 2026; MSRC releaseDate 17 September 2026 PDT) lists CVE-2026-85887, an M365 Copilot information-disclosure vulnerability: incorrect permission assignment for a critical resource (CWE-732) lets an authorized (low-privilege) attacker disclose information over the network. Microsoft CVSS 3.1 base 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); MSRC severity Critical / impact Information Disclosure. Exclusively hosted service: Microsoft states the issue is already fully mitigated — no customer patch steps; CVE published for cloud transparency. MSRC: publicly disclosed No; exploited No. NVD received 18 September 2026 00:17 UTC. Distinct from Azure AI Foundry CVE-2026-85889/85917. Primary: MSRC; secondary: NVD.

Product
Microsoft 365 Copilot (exclusively hosted cloud service)
Versions
Hosted M365 Copilot service; Microsoft states already fully mitigated (no on-prem build to patch)
CVSS
(CVSS 3.1, Microsoft High/Critical class)
Exploited in Australia?
unknown
Patch to
No customer action — Microsoft states fully mitigated in the hosted M365 Copilot service (transparency CVE)

Primary: MSRC — CVE-2026-85887 M365 Copilot information disclosure (17 Sep 2026) · Vendor: Microsoft Security Update Guide — M365 Copilot · CVE: CVE-2026-85887, CVE-2026-85889 · NVD — CVE-2026-85887 (received 18 Sep 2026)

vulnerabilities ai cloud

Vulnerability
Published 2026-09-17
Verified 2026-09-19

GeoVision GV-Remote E-Map DLL hijacking CVE-2026-92838 (CVSS 7.8)

CVE-2026-92838 (published ~17 September 2026 per Tenable) is a DLL hijacking issue in the GeoVision GV-Remote E-Map desktop application: one or more DLLs are loaded from an unsafe search path. A local attacker with write access to a directory searched before the legitimate library location can plant a malicious DLL and achieve code execution as the GV-Remote E-Map process. Tenable CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor cyber-security portal (geovision.com.tw/cyber_security.php) hosts GeoVision advisories; this CVE id was not visible as a labelled row on that index during the 18 September 2026 07:00 Perth desk pass — treat Tenable/CVE record as primary until a matching PDF advisory is linked. No public in-the-wild exploitation claim on the Tenable snippet reviewed. Relevance: physical-security / VMS operators running GeoVision Windows clients.

Product
GeoVision GV-Remote E-Map (Windows desktop)
Versions
Affected builds not enumerated on the Tenable snippet reviewed; check GeoVision cyber_security.php / product release notes for the fixed package
CVSS
Exploited in Australia?
unknown
Patch to
Apply the vendor-fixed GV-Remote E-Map build when published; restrict write access to application and working directories; do not run the client from world-writable paths.

Primary: Tenable — CVE-2026-92838 GeoVision GV-Remote E-Map (17 Sep 2026) · Vendor: GeoVision — Cyber Security advisories portal · CVE: CVE-2026-92838 · CVE.org — CVE-2026-92838

vulnerabilities ot ics

Vulnerability
Published 2026-09-17
Verified 2026-09-19

Affinity by Canva stack buffer overflow CVE-2026-81546 (CVSS 7.7 High); fix 3.3.0

CVE-2026-81546 (published ~17 September 2026 per Tenable/NVD indexing) covers a stack-based buffer overflow in the Affinity by Canva application before the 3.3.0 September 2026 release: inadequate bounds checking when parsing Affinity document files. A crafted Affinity document opened by a user can lead to arbitrary code execution. Tenable lists CVSS 3.1 base score 7.7 (High). Australia relevance: Affinity is Canva’s creative suite (Canva is Australian-headquartered). Patch: upgrade Affinity by Canva to 3.3.0 or later. No public exploitation claim on the Tenable/NVD snippets reviewed this pass. Primary: CVE/NVD/Tenable record; treat vendor release notes as authoritative for build numbers when published.

Product
Affinity by Canva (desktop creative suite)
Versions
Affected: before 3.3.0 (September 2026 release); fixed: 3.3.0+
CVSS
7.7
Exploited in Australia?
unknown
Patch to
Upgrade Affinity by Canva to 3.3.0 or later; treat untrusted .af* / Affinity documents as untrusted code until patched.

Primary: Tenable — CVE-2026-81546 Affinity by Canva (indexed 17 Sep 2026) · CVE: CVE-2026-81546 · NVD — CVE-2026-81546

vulnerabilities australia

Vulnerability
Published 2026-09-17
Verified 2026-09-19

Open vSwitch strips SKBFL_SHARED_FRAG — Dirty COW-class decrypt write (CVE-2026-90049/89487/80977)

Doyensec research post (17 September 2026) shows Open vSwitch’s kernel datapath can strip SKBFL_SHARED_FRAG from a still-forwarded packet, re-opening the Fragnesia Dirty COW-class primitive: an unprivileged user can cause in-place ESP decrypt over page-cache pages they may only read, writing attacker-chosen bytes into root-owned file page cache. Tracked as CVE-2026-90049, CVE-2026-89487 and CVE-2026-80977; reported to the Linux kernel security team and coordinated with OVS maintainers. Builds on prior Dirty Frag / Fragnesia work (including CVE-2026-43284 and CVE-2026-43500). Impact surface: virtualisation/container stacks using OVS (OpenStack Neutron, oVirt, Antrea/OVN-Kubernetes, libvirt bridges, etc.). Primary: Doyensec blog; await distro/kernel OVS package advisories for fixed revisions.

Product
Open vSwitch kernel datapath (openvswitch.ko) / Linux networking
Versions
Affected OVS/kernel builds prior to coordinated fixes for CVE-2026-90049 / CVE-2026-89487 / CVE-2026-80977 (exact package versions per distro advisory)
Exploited in Australia?
unknown
Patch to
Apply vendor/distro kernel and openvswitch updates once published for CVE-2026-90049/89487/80977; until then restrict untrusted local users on OVS hosts and monitor kernel security ML

Primary: Doyensec — OVS shared-frag / Fragnesia re-open (17 Sep 2026) · Vendor: Open vSwitch project · CVE: CVE-2026-90049, CVE-2026-89487, CVE-2026-80977, CVE-2026-43284, CVE-2026-43500 · Talkback — linked Doyensec OVS post (desk wire)

vulnerabilities network cloud

Vulnerability
Published 2026-09-16
Verified 2026-09-19

Check Point Security Management/Log Server login stack overflow CVE-2026-91843 (CVSS 9.8); LivePatch

Check Point advisory sk1000155 (disclosed 16 September 2026; NVD published same day) documents CVE-2026-91843, a stack overflow (CWE-121) in the unauthenticated login process on Security Management and Log Servers. Check Point CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker without credentials can run arbitrary code as root over the network; Check Point states the vulnerable path runs through the Trusted Clients setting (hosts allowed to connect via SmartConsole). Vendor and CISA SSVC: no indication of in-the-wild exploitation; not in KEV as of mid-September catalog checks. Affected branches by Jumbo Hotfix Take (or older): R82.20 (apply Take 29+), R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below; R81.10/R81/R80.x End of Support (ticket Check Point for fix or upgrade). Standalone, Log Server, and Multi-Domain deployments also vulnerable per vendor confirmation (THN update 18 Sep). Smart-1 Cloud hosted management is not affected (fix already deployed). Remediation: LivePatch per sk1000155; customers with automatic updates (sk175504) already protected. Distinct from desk card checkpoint-vpn-cert-20260910 (VPN CVE-2026-85102/85103). Primary: Check Point sk1000155; secondary: NVD / Censys advisory.

Product
Check Point Quantum Security Management Server, Log Server, Multi-Domain / standalone management
Versions
R82.20 before LivePatch Take 29; R82.10 Jumbo Take ≤44; R82 Take ≤126; R81.20 Take ≤166; R81.10/R81/R80.x EOS — see sk1000155. Smart-1 Cloud not affected.
CVSS
(CVSS 3.1, Check Point Critical)
Exploited in Australia?
unknown
Patch to
Apply LivePatch from sk1000155 (Takes: R82.20 T29+, R82.10 T28+, R82 T28+, R81.20 T28+); enable automatic updates (sk175504); restrict Trusted Clients; EOS branches: upgrade or open Check Point support ticket

Primary: Check Point sk1000155 — CVE-2026-91843 Security Management/Log Server (16 Sep 2026) · Vendor: Check Point Support — sk1000155 LivePatch · CVE: CVE-2026-91843, CVE-2026-85102 · NVD — CVE-2026-91843; also Censys advisory / CheckMates notice

vulnerabilities network

Vulnerability
Published 2026-09-16
Verified 2026-09-19

Apple containerization RegistryClient realm hijack CVE-2026-65388 (CVSS 7.5); credential disclosure

CVE-2026-65388 (GHSA-mx96-5vvg-x2mg; Apple/containerization Swift package) covers RegistryClient following the WWW-Authenticate realm without validating host or scheme. A remote attacker who controls a container registry can redirect the client’s token request to an attacker-chosen host and disclose the victim’s registry credentials. GitHub advisory severity Moderate; published on the advisory 30 August 2026; Tenable/NVD indexing lists CVE published ~16 September 2026 with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). GHSA lists affected versions ≤ 0.41.0 and patched versions > 0.41.0; Tenable text says the issue is addressed in containerization 0.41.0 — confirm the exact fixed build against GHSA before closing. No public exploitation claim on the Tenable/GHSA material reviewed this pass. Australia relevance: Apple container tooling / Mac container workflows pulling from untrusted registries.

Product
Apple containerization (Swift package apple/containerization) RegistryClient
Versions
Affected: ≤ 0.41.0 per GHSA; patched: > 0.41.0 per GHSA (confirm build; Tenable cites 0.41.0)
CVSS
Exploited in Australia?
unknown
Patch to
Upgrade apple/containerization to a GHSA-listed patched build (> 0.41.0); avoid pulling images/auth from untrusted registries until patched.

Primary: GitHub Advisory GHSA-mx96-5vvg-x2mg — apple/containerization (CVE-2026-65388) · Vendor: Apple containerization — GHSA-mx96-5vvg-x2mg · CVE: CVE-2026-65388 · Tenable — CVE-2026-65388 (CVSS 7.5 High)

vulnerabilities cloud

Vulnerability
Published 2026-09-16
Verified 2026-09-19

Unbound DNSSEC validator heap overflow CVE-2026-81642 (Critical, CVSS 9.1); fix 1.26.1

NLnet Labs advisory dated 16 September 2026 (covered by The Hacker News 17 Sep) assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI; NVD still awaiting analysis per THN). Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption). NLnet Labs reports no known exploitation; CISA exploitation “none” on disclosure day per THN. Primary: NLnet Labs CVE-2026-81642.txt / security advisories; wire: THN 17 Sep 2026.

Product
NLnet Labs Unbound DNS resolver (DNSSEC validator)
Versions
Affected: up to and including 1.26.0; fixed: 1.26.1 (or vendor-packaged rebuilds with NLnet Labs patches)
CVSS
Exploited in Australia?
unknown
Patch to
Upgrade Unbound to 1.26.1 or later; if blocked, apply NLnet Labs patch_CVE-2026-81642_with.diff (or combined 1.26.1 patch) and rebuild; prioritise public recursive resolvers with DNSSEC validation

Primary: NLnet Labs — CVE-2026-81642 (Unbound DNSKEY digest overflow) · Vendor: NLnet Labs — Unbound security advisories · CVE: CVE-2026-81642, CVE-2026-82717 · THN — Unbound DNSSEC RCE via malicious zone (17 Sep 2026)

vulnerabilities network

Vulnerability
Published 2026-09-16
Verified 2026-09-19

ISC BIND 9: 14 DoS flaws (7 high); fix 9.21.26 / 9.20.29 — CVE-2026-77692 unauth DoH crash

ISC published BIND 9 security advisories dated 16 September 2026 covering 14 denial-of-service vulnerabilities (SecurityWeek: seven high-severity). High CVEs include CVE-2026-80274, CVE-2026-76163, CVE-2026-19666 (use-after-free in query_addnoqnameproof() via DNS64 filter64; ISC CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CVE-2026-81563, CVE-2026-77692 (unauthenticated remote named crash via a single crafted DoH SIG(0) request then premature connection close; ISC CVSS 7.5), CVE-2026-19667, and CVE-2026-81736. Triggers include mismatched NOQNAME proof, QTYPE TKEY queries, malformed authoritative answers, SVCB/HTTPS AliasMode records, crafted DoH, and oversized negative answers. ISC states it is not aware of exploitation of the resolved bugs. Fixed builds: BIND 9.21.26 and 9.20.29 (per SecurityWeek quoting ISC). Primary: ISC KB advisories; wire: SecurityWeek 17 Sep 2026.

Product
ISC BIND 9 (named DNS server)
Versions
Affected lines prior to fixed releases; fixed: BIND 9.21.26 and 9.20.29 (SecurityWeek / ISC)
CVSS
Exploited in Australia?
unknown
Patch to
Upgrade BIND to 9.21.26 or 9.20.29 (or later supported fixed builds); prioritise DoH-exposed resolvers for CVE-2026-77692

Primary: ISC KB — all BIND advisories (incl. 16 Sep 2026 set) · Vendor: ISC — CVE-2026-77692 (unauth DoH SIG(0) named crash) · CVE: CVE-2026-77692, CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-19667, CVE-2026-81736 · SecurityWeek — ISC BIND 9 14 DoS flaws (17 Sep 2026)

vulnerabilities network

Vulnerability
Published 2026-09-16
Verified 2026-09-19

Flock ALPR cameras: aged Android/Linux build plus hard-coded API key to mint device credentials

Micah Lee (16 September 2026; dataset from DDoSecrets / stegan0gram field extraction, also covered by 404 Media and Wired) analyses firmware from an in-use Flock Safety automatic licence-plate reader (ALPR) camera. The unit ran a modified Android 8.1 build dated 5 June 2025 on Linux 3.18.71 — far past vendor/Google support — and ships multiple Flock apps. Lee documents a hard-coded x-api-key in an app used to request device credentials from hpnotiq.flocksafety.com (MAC-address keyed), with returned credentials stored in plaintext and usable to mint bearer tokens via device-login.flocksafety.com. Lee lists older public Android/kernel CVEs the patch level likely predates but does not claim live exploitation tests on this hardware. Flock gave a statement to 404 Media/Wired (per Lee). No CVE assigned in the write-up. Primary: Micah Lee analysis; context: DDoSecrets dataset.

Product
Flock Safety ALPR / surveillance cameras (Android-based firmware)
Versions
Analysed image: Android 8.1 build 2025-06-05; Linux 3.18.71 (one field unit)
Exploited in Australia?
unknown
Patch to
Operators of Flock (or similar) ALPR estates: demand current supported OS/firmware, rotate any exposed device API keys/credentials, restrict camera management planes; do not reuse leaked keys from public research

Primary: Micah Lee — Flock cameras hard-coded credentials (16 Sep 2026) · 404 Media — Flock camera software / ALPR dataset context (with Wired)

tech ot ics network

Vulnerability
Published 2026-09-16
Verified 2026-09-19

Cisco ISE / ISE-PIC API auth bypass CVE-2026-76460 (CVSS 10.0); zero-day exploited; CISA KEV

Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5 (first published 16 September 2026 16:00 GMT) covers CVE-2026-76460, a maximum-severity authentication bypass in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of configuration. Insufficient authentication control on an API endpoint lets an unauthenticated remote attacker send a crafted request and bypass the web-based management interface to gain unauthorised device access; Cisco notes successful exploitation may yield root command execution and that on-box evidence can be removed afterward. Cisco CVSS 3.1 base 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); CWE-648; Bug CSCww39530. No workarounds; temporary mitigation: infrastructure ACLs restricting management/control-plane traffic to the device. Fixed software: ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, 3.1 Patch 12. Cisco PSIRT is aware of active exploitation; CISA added CVE-2026-76460 to KEV on 16 September 2026 (same alert also added Acronis CVE-2026-87886). Same-day Cisco ISE/ISE-PIC criticals including CVE-2026-76423 are noted as related context, not separate desk cards — only 76460 has claimed in-the-wild use in the PSIRT advisory. Hunt ise-kong/access.log for suspicious usernames and correlate off-box network/firewall logs. Primary: Cisco PSIRT; wires: BleepingComputer / SecurityWeek 17 Sep 2026.

Product
Cisco Identity Services Engine (ISE); Cisco ISE Passive Identity Connector (ISE-PIC)
Versions
Affected ISE/ISE-PIC 3.1–3.5 lines prior to fixed patches; fix: 3.5 Patch 4 / 3.4 Patch 7 / 3.3 Patch 12 / 3.2 Patch 11 / 3.1 Patch 12
CVSS
Exploited in Australia?
unknown
Patch to
Upgrade ISE/ISE-PIC to listed fixed patches immediately; until then restrict management plane with iACLs; hunt access.log / off-box logs for abuse

Primary: Cisco PSIRT cisco-sa-ISE-ABP-VNSW7Tn5 (CVE-2026-76460, 16 Sep 2026) · Vendor: Cisco Security Advisory — ISE authentication bypass · CVE: CVE-2026-76460, CVE-2026-87886, CVE-2026-76423 · BleepingComputer (17 Sep 2026); also SecurityWeek; CISA KEV alert 16 Sep

vulnerabilities identity network

Vulnerability
Published 2026-09-16
Verified 2026-09-19

BragJack: one extension hijacks built-in AI agents in Chrome, Edge, Comet, Opera Neon, Claude

Forever Security (16 September 2026; also The Hacker News) documents BragJack: a research technique where a malicious Chromium extension with common page-modify and declarativeNetRequest permissions injects into the trusted origin the browser AI "body" listens to, then commands the built-in assistant. Affected demos: Gemini Live in Chrome (CVE-2026-0628, CVSS 8.8 per CISA score cited by researchers; fixed in Chrome 143.0.7499.192, Jan 2026), Microsoft Edge (CVE-2026-55945, CVSS 4.2; fixed in Edge 150.0.4078.48, 2 Jul 2026), Perplexity Comet, Opera Neon, and Claude in Chrome (latter three without CVE; vendor bounty acknowledgements claimed). Impacts vary by product (agent hijack, local file read, camera/mic on Chrome). Researcher demos only — not reported in the wild; requires the attacker's extension already installed. Primary: Forever Security; wire: The Hacker News.

Product
Built-in browser AI assistants (Chrome Gemini Live; Edge; Perplexity Comet; Opera Neon; Claude in Chrome)
Versions
Chrome fixed CVE-2026-0628 in 143.0.7499.192; Edge fixed CVE-2026-55945 in 150.0.4078.48; Comet/Opera Neon/Claude in Chrome: see vendor guidance / Forever Security write-up
CVSS
8.8 (CVE-2026-0628, CISA-scored per Forever Security); 4.2 (CVE-2026-55945)
Exploited in Australia?
unknown
Patch to
Update Chrome/Edge to fixed builds; restrict extension install (allow lists); treat browser AI agent surfaces as high-privilege; review Forever Security mitigations

Primary: Forever Security — BragJack research (16 Sep 2026) · Vendor: Forever Security · CVE: CVE-2026-0628, CVE-2026-55945 · The Hacker News — AI assistant extension hijack (16 Sep 2026)

ai identity

Vulnerability
Published 2026-09-16
Verified 2026-09-19

The Events Calendar (WordPress): two unauth RCE chains (CVE-2026-78159, CVE-2026-78006); CVSS 9.8

Wordfence/Defiant (wired by SecurityWeek 16 September 2026) documents two critical unauthenticated remote-code-execution chains in StellarWP The Events Calendar plugin (~600k+ installs; ~240k on vulnerable branches per SW). CVE-2026-78159 (CVSS 9.8): unauthenticated code injection via insufficient validation when processing single-event HTML/comment area — patched in 6.17.3.1 (25 August 2026). CVE-2026-78006 (CVSS 9.8): unauthenticated PHP object injection when event comments are enabled/visible — payload reaches the vulnerable path before moderation; patched in 6.17.4.1 (10 September 2026). Both can fully compromise the WordPress site. Update to 6.17.4.1 or later. Primary research: Wordfence Argus blog (URL may be bot-gated); wire: SecurityWeek.

Product
The Events Calendar (WordPress plugin; StellarWP)
Versions
Prior to 6.17.3.1 (CVE-2026-78159); prior to 6.17.4.1 (CVE-2026-78006)
CVSS
9.8
Exploited in Australia?
unknown
Patch to
6.17.4.1 or later

Primary: Wordfence — The Events Calendar unauth RCE chains · Vendor: StellarWP / The Events Calendar · CVE: CVE-2026-78159, CVE-2026-78006 · SecurityWeek — Events Calendar RCE (16 Sep 2026)

vulnerabilities cloud

Vulnerability
Published 2026-09-16
Verified 2026-09-19

WSO2 API Manager JWT auth bypass CVE-2026-5430 (CVSS 9.8/10.0); active exploitation attempts (watchTowr)

WSO2 security advisory WSO2-2026-5328 / CVE-2026-5430 (published 3 May 2026; Critical): JWT authentication can be bypassed when a token is signed with an unsupported algorithm, allowing unauthorized access and potential administrative account takeover. Vendor CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); single-tenant deployments adjusted to 9.8 (S:U). Affected: WSO2 API Manager 4.1.0–4.6.0; API Control Plane 4.5.0/4.6.0; Traffic Manager 4.5.0/4.6.0; Universal Gateway 4.5.0/4.6.0. The Hacker News (16 September 2026) cites watchTowr honeypot telemetry capturing forged admin JWTs on 13 September 2026 — active in-the-wild exploitation attempts. Support subscription holders: apply stated update levels (e.g. API Manager 4.6.0 UL 21, 4.5.0 UL 57, 4.4.0 UL 72, 4.3.0 UL 108, 4.2.0 UL 197, 4.1.0 UL 257; Control Plane/Traffic Manager/Universal Gateway levels on the advisory). Community: GitHub fixes carbon-apimgt PR 13752 and product-apim PR 14167, or migrate to an unaffected release. Credits: Hacktron Team. Primary: WSO2 WSO2-2026-5328; wire: The Hacker News / watchTowr.

Product
WSO2 API Manager / API Control Plane / Traffic Manager / Universal Gateway
Versions
API Manager 4.1.0–4.6.0; API Control Plane 4.5.0–4.6.0; Traffic Manager 4.5.0–4.6.0; Universal Gateway 4.5.0–4.6.0
CVSS
(CVSS 3.1, WSO2 multi-tenant); 9.8 single-tenant
Exploited in Australia?
unknown
Patch to
Apply WSO2 Updates to advisory update levels (or higher); community: carbon-apimgt PR 13752 / product-apim PR 14167; or migrate to latest unaffected version; rotate exposed API credentials if compromise suspected

Primary: WSO2-2026-5328 / CVE-2026-5430 (vendor advisory) · Vendor: WSO2 Security Advisory · CVE: CVE-2026-5430 · The Hacker News — watchTowr active exploitation attempts (16 Sep 2026)

vulnerabilities cloud

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Docker Sandboxes macOS virtio-fs escape CVE-2026-77179 (CVSS 9.4) + UDS relay CVE-2026-79994 (8.7); fix 0.42.0

Docker security announcements (Sandboxes 0.42.0; NVD received CVE-2026-77179 on 15 September 2026) document two sandbox-escape flaws. CVE-2026-77179 (Critical, Docker CVSS 4.0 base 9.4): on macOS the virtio-fs host server followed symlinks when reopening an unlinked file from a stored path, so malicious guest code (e.g. a compromised AI coding agent inside sbx) could escape the shared project workspace and read/modify arbitrary host files as the VMM user — potentially host code execution. Affects Sandboxes 0.28.0 up to but not including 0.42.0 on macOS. Companion CVE-2026-79994 (High, CVSS 4.0 8.7): guest-to-host Unix-domain socket relay TOCTOU symlink race; affects 0.37.0 through 0.41.9. Both fixed in 0.42.0 (release notes / sbx-releases tag). Docker reports no exploitation; CISA SSVC exploitation none; not in KEV at wire check. Workaround if unable to upgrade: use clone mode and avoid additional host mounts. Category vulnerabilities with AI-agent sandbox tag. Primary: Docker security announcements; secondary: NVD / GitHub sbx-releases v0.42.0.

Product
Docker Sandboxes (sbx) — AI coding-agent VMs; macOS virtio-fs host path (77179)
Versions
CVE-2026-77179: 0.28.0 ≤ ver < 0.42.0 on macOS. CVE-2026-79994: 0.37.0–0.41.9. Fixed: 0.42.0+
CVSS
(CVE-2026-77179 CVSS 4.0); 8.7 (CVE-2026-79994 CVSS 4.0)
Exploited in Australia?
unknown
Patch to
Upgrade Docker Sandboxes to 0.42.0 or later; if blocked, use clone mode and avoid extra host mounts per Docker advisory

Primary: Docker — Sandboxes 0.42.0 security update (CVE-2026-77179 / CVE-2026-79994) · Vendor: docker/sbx-releases — v0.42.0 · CVE: CVE-2026-77179, CVE-2026-79994 · NVD — CVE-2026-77179; companion CVE-2026-79994

vulnerabilities ai cloud

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Issabel Framework hard-coded JWT → unauth OS command exec (CVE-2026-89026); CVSS 9.8/9.3; exploited

VulnCheck advisory (15 September 2026) covers CVE-2026-89026 in Issabel Framework (web UI for Issabel PBX / Asterisk). Before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd the pbxapi index.php embeds a hard-coded HS256 JWT signing key identical on every install (CWE-321). Unauthenticated attackers forge bearer tokens and call /pbxapi/manager/originate with the System application parameter so Asterisk runs arbitrary OS commands as the Asterisk user. VulnCheck rates CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N); The Hacker News cites CVSS 3.1 9.8. Patch (1 August 2026) replaces the hard-coded key with a key from /etc/issabel.conf. Shadowserver first observed exploitation on 9 September 2026; scale/actors not detailed. Apply the patched framework commit or later; rotate any JWT material that relied on the shared key. Primary: VulnCheck advisory; wire: The Hacker News 16 Sep 2026.

Product
Issabel Framework (Issabel PBX / Asterisk pbxapi)
Versions
Framework before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd (hard-coded JWT in pbxapi index.php)
CVSS
(CVSS 3.1 per THN); 9.3 (CVSS 4.0, VulnCheck)
Exploited in Australia?
unknown
Patch to
Issabel Framework at/after commit b97dbaf0b71c1c36f841e672b664afbeb02773bd; ensure JWT key is unique per host via /etc/issabel.conf

Primary: VulnCheck — Issabel Framework hard-coded JWT RCE (CVE-2026-89026) · Vendor: IssabelFoundation/framework — patch commit b97dbaf (1 Aug 2026) · CVE: CVE-2026-89026 · The Hacker News — Issabel Framework exploitation (16 Sep 2026)

vulnerabilities network identity

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Parallels Desktop ParaShells LPE to root (CVE-2026-90894); fix in 27.0.0 — Intel Macs cannot install

JFrog (15 September 2026) documents ParaShells: an unprivileged local user on macOS can get root via Parallels Desktop's prl_disp_service (world-writable Unix socket, weak local-client auth, appliance-extract argument injection into tar --use-compress-program). Lab-proven on Desktop 26.4.0 build 57513 (Apple silicon); treat installs that still expose the same InstallAppliance extract template and dispatcher socket as in scope. CVE-2026-90894. Fixed in Parallels Desktop 27.0.0 (JFrog: fix shipped 1 Sep; CVE/blog 14–15 Sep). THN notes Intel Macs cannot install Desktop 27 — those hosts need interim local-account lockdown / vendor guidance. No in-the-wild exploitation reported by JFrog. Primary: JFrog research blog.

Product
Parallels Desktop for Mac
Versions
Verified vulnerable 26.4.0 (build 57513); treat same-class IPC as in scope until 27.0.0
Exploited in Australia?
unknown
Patch to
Parallels Desktop 27.0.0+ (Intel Macs: cannot install 27 — apply interim local lockdown per JFrog/vendor)

Primary: JFrog — ParaShells / Parallels Desktop root shell · Vendor: Parallels · CVE: CVE-2026-90894 · The Hacker News — Parallels Desktop (16 Sep 2026)

vulnerabilities

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Google Pixel Cellular Modem EoP CVE-2026-58704 (CVSS 8.0); limited targeted exploitation

Google’s September 2026 Pixel update (patch level 2026-09-05) addresses CVE-2026-58704 in the Cellular Modem: improper authorization / logic error enabling remote (proximal/adjacent) privilege escalation with low privileges, no user interaction. NVD (published 15 September 2026; Google as source) scores CVSS 3.1 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). BleepingComputer (16 September 2026) cites Google’s Pixel bulletin warning of indications the flaw “may be under limited, targeted exploitation.” Same bulletin set covers 110 Pixel issues including additional critical/high RCE and privilege-escalation fixes. Distinct from desk card android-september-2026-bulletin (AOSP OEM bulletin). Apply Pixel Security update to 2026-09-05+. Primary: NVD CVE-2026-58704; wire: BleepingComputer; vendor bulletin URL (may require Google developer sign-in).

Product
Google Pixel (Cellular Modem / Android kernel per NVD affected data)
Versions
Affected Pixel builds before security patch level 2026-09-05; all supported Google Pixel devices receive the update per vendor/wire
CVSS
(CVSS 3.1, NVD secondary)
Exploited in Australia?
unknown
Patch to
Install Pixel Security update to patch level 2026-09-05 or newer (Settings > Security & privacy > System & updates > Security update)

Primary: NVD — CVE-2026-58704 (published 15 Sep 2026) · Vendor: Google Pixel security bulletin (Sep 2026 / 2026-09-05 patch level) · CVE: CVE-2026-58704 · BleepingComputer — Pixel zero-day CVE-2026-58704 (16 Sep 2026)

vulnerabilities network

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Chrome 153.0.8010.47/.48 (42 fixes) and Firefox 156 (MFSA 2026-90); no in-wild claim

Google Stable Channel Update for Desktop (15 September 2026) promotes Chrome to 153.0.8010.47/.48 (Windows/Mac) and 153.0.8010.47 (Linux) with 42 security fixes. Critical entries include CVE-2026-91726 (OOB read in WebGL), CVE-2026-91721 (UAF in Internals), and CVE-2026-91749 (UAF in Workers), plus numerous High UAFs, race conditions, and related issues. Distinct from desk card cve-2026-87491 (Chrome 153.0.8010.36/.37 V8 OOB-write 0-day on 8 Sep). Mozilla MFSA 2026-90 (announced 15 September 2026) ships Firefox 156 with individual CVEs for high-impact bugs (privilege escalation / UAF / WebGL boundary issues among others; Thunderbird 156 / ESR trains also updated per SecurityWeek). Neither vendor claims exploitation in the wild for this batch. SecurityWeek (16 Sep) summarised ~115 combined defects. Primary: Chrome Releases + Mozilla MFSA 2026-90.

Product
Google Chrome; Mozilla Firefox (and related Thunderbird/ESR builds per MFSA family)
Versions
Chrome prior to 153.0.8010.47/.48 (Win/Mac) / 153.0.8010.47 (Linux); Firefox prior to 156
Exploited in Australia?
unknown
Patch to
Update Chrome to 153.0.8010.47/.48 (or newer); update Firefox to 156 (and Thunderbird/ESR builds listed in related MFSAs)

Primary: Chrome Releases — Stable desktop 153.0.8010.47/.48 (15 Sep 2026) · Vendor: Mozilla MFSA 2026-90 — Firefox 156 (15 Sep 2026) · CVE: CVE-2026-91726, CVE-2026-91721, CVE-2026-91749, CVE-2026-87491 · SecurityWeek — Chrome/Firefox 115 vulns (16 Sep 2026)

vulnerabilities network

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Oracle September 2026 CSPU: 673 new patches; Access Manager and OID LDAP at CVSS 10.0

Oracle Critical Security Patch Update advisory — September 2026 (Rev 1, 15 September 2026) contains 673 new security patches across product families. SecurityWeek (16 September 2026) notes the matrices cover on the order of 800+ CVE IDs including third-party component fixes, with more than 100 critical-severity issues and over 240 remotely exploitable without authentication. Largest batches include Oracle E-Business Suite, Fusion Middleware, and Hyperion. Notable CVSS 10.0 entries include Oracle Access Manager Authentication Engine CVE-2026-71133 (HTTP, unauthenticated network, versions 12.2.1.4.0 and 14.1.2.1.0) and Oracle Internet Directory OID LDAP Server CVE-2026-83059 (LDAP, unauthenticated network, 12.2.1.4.0 and 14.1.2.1.0). Oracle again warns of exploitation attempts against already-patched issues where customers delayed applying updates; no claim in the advisory that these September flaws are exploited in the wild. Apply the September 2026 CSPU for each product family you run. Distinct from desk card oracle-cspu-20260818. Primary: Oracle CSPU September 2026; wire: SecurityWeek 16 Sep.

Product
Oracle product families in the September 2026 CSPU (incl. E-Business Suite, Fusion Middleware, Hyperion, Access Manager, OID, Database Server, Java SE, others)
Versions
See September 2026 CSPU risk matrices; e.g. Access Manager 12.2.1.4.0 / 14.1.2.1.0; OID 12.2.1.4.0 / 14.1.2.1.0 among others
CVSS
Up to (CVE-2026-71133 Access Manager; CVE-2026-83059 OID LDAP, Oracle)
Exploited in Australia?
unknown
Patch to
September 2026 Critical Security Patch Update for each affected product family; prioritise unauthenticated network 9.8–10.0 matrix rows

Primary: Oracle CSPU September 2026 (Rev 1, 15 Sep 2026) · Vendor: Oracle (vendor) · CVE: CVE-2026-71133, CVE-2026-83059 · SecurityWeek — Oracle September 2026 CSPU (16 Sep 2026)

vulnerabilities cloud

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Acronis Backup plugin for cPanel/WHM and Plesk: Linux LPE CVE-2026-87886 (CVSS 7.8); limited in-the-wild exploitation

Acronis security advisory SEC-10986 / update UPD-2609-3d72-20a7 (wired by BleepingComputer 15 September 2026) covers CVE-2026-87886, a high-severity Linux local privilege escalation in Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Acronis assigns severity 7.8. A low-privileged attacker can raise privileges on a vulnerable Linux host without user interaction; further exploit detail withheld while patches propagate. Acronis says exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM plugin deployments (assessment based on a single report from a potentially affected customer; no public IoCs released). Affected: cPanel & WHM plugin builds earlier than 1.9.3.1021 (fixed 1.9.3 HF3); Plesk extension builds earlier than 1.8.11.638 (fixed 1.8.11). Apply those updates immediately. Primary: Acronis SEC-10986; wire: BleepingComputer 15 Sep. UPDATE 16 September 2026: CISA added CVE-2026-87886 to KEV (same alert as Cisco ISE CVE-2026-76460). Distinct from desk card cve-2026-60004 (Gitea / Red Heron).

Product
Acronis Backup plugin for cPanel & WHM; Acronis Backup extension for Plesk
Versions
cPanel/WHM plugin < 1.9.3.1021 (fix 1.9.3 HF3); Plesk extension < 1.8.11.638 (fix 1.8.11)
CVSS
7.8
Exploited in Australia?
unknown
Patch to
cPanel/WHM plugin 1.9.3 HF3 (build 1.9.3.1021+); Plesk extension 1.8.11+

Primary: Acronis SEC-10986 — CVE-2026-87886 · Vendor: Acronis update UPD-2609-3d72-20a7 · CVE: CVE-2026-87886, CVE-2026-76460, CVE-2026-60004 · BleepingComputer — Acronis cPanel/Plesk backup plugin LPE (15 Sep 2026)

vulnerabilities cloud

Vulnerability
Published 2026-09-15
Verified 2026-09-19

WooCommerce Wholesale Lead Capture: unauth file upload to PHP webshell (CVE-2026-27540); actively exploited

BleepingComputer (15 September 2026) relays Wordfence/Defiant telemetry that attackers are actively exploiting CVE-2026-27540 in the premium WooCommerce Wholesale Lead Capture WordPress plugin. Unauthenticated AJAX action wwlc_file_upload_handler accepts a user-controlled file_settings allowlist, letting attackers permit .php uploads and drop webshells (researcher: Teemu Saarentaus). Affected: versions 2.0.3.1 and older; fixed in 2.0.3.2 (released 20 February). Wordfence reports 100,000+ blocked attacks with spikes around 4–17 June, 1 July, and 30 August 2026; The Hacker News (16 September) cites CVSS 9.8 and lists recent attacker IPs (including 92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209 and IPv6 2a0f:85c1:840:5389::1). Hunt admin-ajax.php calls to wwlc_file_upload_handler, unexpected PHP under uploads (e.g. shell.php), and unknown admin accounts; upgrade to 2.0.3.2+. Primary wire: BleepingComputer; UPDATE 17 Sep: CVSS + IoCs from THN/Wordfence.

Product
WooCommerce Wholesale Lead Capture (WordPress premium plugin)
Versions
≤ 2.0.3.1 affected; fixed 2.0.3.2 (20 Feb release per wire)
CVSS
9.8
Exploited in Australia?
unknown
Patch to
Upgrade WooCommerce Wholesale Lead Capture to 2.0.3.2 or later; block Wordfence-listed attacker IPs; audit uploads and admin-ajax wwlc_file_upload_handler hits

Primary: BleepingComputer — WooCommerce Wholesale Lead Capture CVE-2026-27540 (15 Sep 2026) · CVE: CVE-2026-27540 · The Hacker News — WooCommerce Wholesale webshells / CVSS 9.8 (16 Sep 2026)

vulnerabilities cloud

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Microsoft Windows Shell RCE (CVE-2026-69829); CVSS 9.8 — WASOC 20260915001

WA Cyber Security Unit advisory 20260915001 (15 September 2026, TLP:CLEAR) highlights CVE-2026-69829, a Critical remote code execution flaw in Microsoft Windows Shell with CVSS 9.8. WASOC states successful exploitation could allow an unauthenticated attacker to execute arbitrary code and potentially fully compromise affected systems. Affected products/versions are as listed by Microsoft on the MSRC update-guide entry for CVE-2026-69829 (JS-rendered; versions not mirrored here beyond vendor listing). WASOC reports no exploitation observed on Western Australian Government networks at time of writing and recommends applying Microsoft’s fixes per normal patch timeframes. Primary: Microsoft MSRC CVE-2026-69829; AU wire: WASOC 20260915001.

Product
Microsoft Windows Shell
Versions
Vendor-listed products and versions on MSRC CVE-2026-69829 (WASOC points administrators there)
CVSS
9.8
Exploited in Australia?
no
Patch to
Apply Microsoft security updates for CVE-2026-69829 per MSRC; prioritise internet-facing and high-value Windows endpoints/servers

Primary: Microsoft MSRC — CVE-2026-69829 (Windows Shell RCE) · Vendor: Microsoft Security Update Guide · CVE: CVE-2026-69829 · WASOC 20260915001 — Windows Shell RCE (15 Sep 2026)

vulnerabilities australia

Vulnerability
Published 2026-09-15
Verified 2026-09-19

Canonical LXD: multiple critical flaws allow root command execution on host (WASOC 20260915003); CVSS 9.9

WA Cyber Security Unit advisory 20260915003 (15 September 2026, TLP:CLEAR) relays Canonical LXD updates for eight Critical issues (CVE-2026-66897, CVE-2026-66898, CVE-2026-63300, CVE-2026-63299, CVE-2026-63297, CVE-2026-63296, CVE-2026-63294, CVE-2026-62420), each listed at CVSS 9.9. Successful exploitation can let a remote attacker achieve root command execution on the LXD host. Affected lines per WASOC: LXD 6.x prior to 6.10; 5.21.x prior to 5.21.7; 5.0.x prior to 5.0.9; all versions prior to 4.0.13. Canonical GitHub advisory GHSA-q39m-8fx9-42fv (CVE-2026-66897 example) documents instance template path traversal to arbitrary host file write as root, with patched versions including 4.0.13, 5.0.9, 5.21.7, 6.9-ab8fad2, and 6.10; related LXD GHSAs cover further path-traversal / privilege issues in the same wave. WASOC reports no exploitation observed on Western Australian Government networks at time of writing. Patch to vendor-fixed LXD builds; review Canonical LXD security advisories for the full set. Primary: Canonical LXD GHSA index; AU wire: WASOC 20260915003.

Product
Canonical LXD
Versions
6.x prior to 6.10; 5.21.x prior to 5.21.7; 5.0.x prior to 5.0.9; all versions prior to 4.0.13 (WASOC). Example GHSA-q39m patched: 4.0.13, 5.0.9, 5.21.7, 6.9-ab8fad2, 6.10
CVSS
9.9
Exploited in Australia?
no
Patch to
Upgrade LXD to 6.10 / 5.21.7 / 5.0.9 / 4.0.13 (or newer vendor-fixed builds); apply all related Canonical LXD GHSAs in this wave

Primary: Canonical LXD GitHub Security Advisories (patched 4.0.13 / 5.0.9 / 5.21.7 / 6.10) · Vendor: Canonical LXD security advisories · CVE: CVE-2026-66897, CVE-2026-66898, CVE-2026-63300, CVE-2026-63299, CVE-2026-63297, CVE-2026-63296, CVE-2026-63294, CVE-2026-62420 · WASOC 20260915003 — Canonical LXD root command execution (15 Sep 2026)

vulnerabilities australia cloud

Vulnerability
Published 2026-09-14
Verified 2026-09-19

LiteSpeed Web Server Enterprise: critical privilege escalation to root on shared hosts (fix 6.3.7)

cPanel Security advisory (14 September 2026) warns of a critical privilege-escalation flaw in LiteSpeed Web Server Enterprise: on shared-hosting servers a malicious low-privilege website user could gain root-level access, bypassing account isolation including CageFS, and access or alter other sites and the server. Affected: LiteSpeed Web Server Enterprise prior to v6.3.7. Fix: upgrade to 6.3.7 or later. cPanel/LiteSpeed publish the forced update command /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 (auto-update may lag; as of THN 15 Sep, download page still listed 6.3.6 as stable). LiteSpeed store announcement for 6.3.7 (11 September 2026) lists three security changes (lscgid auth, internal redirect URL validation, block internal-use env vars from .htaccess) without naming a CVE or privilege-escalation root cause; neither cPanel nor LiteSpeed assigned a public CVE or CVSS for this Enterprise web-server issue as of 15 September 2026 desk check. Advisory does not state in-the-wild exploitation for this Enterprise flaw (distinct from earlier actively exploited LiteSpeed cPanel-plugin issues CVE-2026-48172 and CVE-2026-54420 already on this desk). OpenLiteSpeed not named in the cPanel advisory. Primary: cPanel; vendor release: LiteSpeed 6.3.7 announcement; wire: The Hacker News (15 Sep 2026).

Product
LiteSpeed Web Server Enterprise (shared hosting / cPanel stacks; CageFS isolation)
Versions
Enterprise prior to 6.3.7; fixed in 6.3.7+
Exploited in Australia?
unknown
Patch to
Force-upgrade LiteSpeed Enterprise to 6.3.7+ via /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7; resume follow_stable afterward per LiteSpeed docs; no vendor workaround published

Primary: cPanel — LiteSpeed Enterprise security advisory (14 Sep 2026) · Vendor: LiteSpeed — Web Server v6.3.7 announcement (11 Sep 2026) · CVE: CVE-2026-48172, CVE-2026-54420 · The Hacker News (15 Sep 2026)

tech cloud identity

Vulnerability
Published 2026-09-14
Verified 2026-09-19

n8n AI Agents: Project Viewer node-exec (CVE-2026-65015) and MCP credential leak (CVE-2026-59207)

Antonio De Turris (deturris.io, 14 September 2026) details two authorization bypasses in n8n’s AI Agents feature. CVE-2026-65015: a read-only Project Viewer can instruct an agent’s run_node_tool to execute arbitrary n8n nodes (including HTTP Request) with the project’s credentials; if Execute Command is enabled on self-hosted, that path can reach host command execution. Affected: all versions before 2.29.8, plus 2.30.0; fixed in 2.29.8 and 2.30.1. GitHub GHSA-x5vx-c2c8-m3w9 rates High (CVSS 4.0 overall 7.2). CVE-2026-59207: the agent MCP client sends credential headers without enforcing “Allowed HTTP Request Domains”, so a use-only credential holder can point MCP at an attacker host and exfiltrate the secret. Affected: all before 2.27.4, plus 2.28.0; fixed in 2.27.4 and 2.28.1. GHSA-h44j-f5r5-ph73 High (CVSS 4.0 overall 7.1). Reported June 2026; vendor advisories published with the fixes. Primary: researcher writeup; vendor: n8n GitHub security advisories.

Product
n8n (self-hosted / Enterprise project AI Agents; MCP connector)
Versions
CVE-2026-65015: <2.29.8 and 2.30.0 (fix 2.29.8 / 2.30.1). CVE-2026-59207: <2.27.4 and 2.28.0 (fix 2.27.4 / 2.28.1)
CVSS
(CVE-2026-65015 GHSA); 7.1 (CVE-2026-59207 GHSA)
Exploited in Australia?
unknown
Patch to
Upgrade n8n to 2.30.1+ (or 2.29.8+ on 2.29 train); keep Execute Command disabled unless required; review Project Viewer membership and MCP credential bindings

Primary: De Turris — n8n AI Agents authorization bypasses (14 Sep 2026) · Vendor: n8n GHSA-x5vx-c2c8-m3w9 (CVE-2026-65015) · CVE: CVE-2026-65015, CVE-2026-59207 · n8n GHSA-h44j-f5r5-ph73 (CVE-2026-59207)

tech ai cloud identity

Vulnerability
Published 2026-09-14
Verified 2026-09-19

IBM Db2 Mirror for i web GUI: Silent Signal pre-auth chain to Liberty JSP RCE and QSECOFR

Silent Signal (14 September 2026) documents a pre-authentication vulnerability chain in the IBM Db2 Mirror for i web interface (Db2MirrorServlet on the IBM i administrative Liberty instance; lab IBM i V7R5, GUI WAR build timestamp late 2025). The write-up describes how authentication/validation filters can be confused, enabling unauthenticated reach into powerful admin features (arbitrary file read via log/trace viewers, attacker-influenced writes into an expanded WAR path that becomes JSP execution in Liberty, then a native helper crossing to QSECOFR on the local IBM i system). No CVE identifier is assigned in the post; the author withholds exploit/JSP payload bodies and frames the piece as vulnerability mechanics plus hardening guidance. Confirm IBM PSIRT/bulletin status for your Db2 Mirror for i / IBM i web stack build before declaring patched. Primary: Silent Signal; no separate vendor bulletin URL confirmed at desk time.

Product
IBM Db2 Mirror for i (web GUI / Liberty on IBM i)
Versions
Tested on IBM i V7R5 with a late-2025 Db2 Mirror GUI WAR; exact fixed PTF/build not stated in the write-up — verify against IBM security notices for your release
Exploited in Australia?
unknown
Patch to
IBM i admins: restrict Db2 Mirror / admin Liberty exposure; apply current IBM security PTFs for Db2 Mirror for i and related web stack; review auth filters and expanded-WAR write paths per Silent Signal guidance

Primary: Silent Signal — Db2 Mirror for i pre-auth RCE chain (14 Sep 2026) · Talkback index (wire discovery 15 Sep 2026 desk pass)

vulnerabilities identity network

Vulnerability
Published 2026-09-14
Verified 2026-09-19

Cisco Secure Email Gateway AsyncOS SQL injection to root (CVE-2026-76461); exploited; CVSS 9.8

Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhX (14 September 2026) covers CVE-2026-76461, a Critical SQL injection in email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway (physical and virtual, any configuration). Unauthenticated remote attackers can send a crafted email with malicious SQL statements and gain command execution as root on the underlying OS. Cisco CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-89; Bug CSCwu56234. Not affected: Secure Email and Web Manager, Secure Web Appliance. Cisco PSIRT became aware of active exploitation in September 2026; Cloud customers with detected malicious activity were contacted directly; Cloud fleet already upgraded to 16.5.0-780. IoC guidance: grep mail_logs for suspicious SQL (example COPY.*TO PROGRAM); also review external network/firewall logs because root access can erase on-box evidence. No workarounds. Fixed AsyncOS: 15.5 and earlier → 15.5.5-014; 16.0 → 16.0.4-302; 16.5 → 16.5.0-780 (Cisco strongly recommends 16.5.0-780). CISA added CVE-2026-76461 to KEV with FCEB remediation due 17 September 2026 (wire: BleepingComputer / THN 15 Sep). Same-day Cisco also shipped other critical SEG/SEWM fixes (CVE-2026-76440/76441/20353/76443) without claimed in-the-wild use — covered here only as context, not separate desk cards. Primary: Cisco PSIRT; wires: BleepingComputer, The Hacker News, SecurityWeek (15 Sep 2026).

Product
Cisco Secure Email Gateway (AsyncOS; physical and virtual appliances)
Versions
AsyncOS 15.5 and earlier (fix 15.5.5-014); 16.0 (fix 16.0.4-302); 16.5 (fix 16.5.0-780). Secure Email Cloud already on 16.5.0-780 per Cisco
CVSS
Exploited in Australia?
unknown
Patch to
Upgrade AsyncOS to 15.5.5-014 / 16.0.4-302 / 16.5.0-780 (prefer 16.5.0-780); hunt mail_logs SQL IoCs and off-box network anomalies; if compromised, rebuild virtual appliances / engage TAC for physical

Primary: Cisco PSIRT cisco-sa-esa-inj-2bLVGmhX (CVE-2026-76461, 14 Sep 2026) · Vendor: Cisco Security Advisory — Secure Email Gateway SQL injection · CVE: CVE-2026-76461, CVE-2026-76440 · BleepingComputer (15 Sep 2026); also THN / SecurityWeek

vulnerabilities network cloud

Vulnerability
Published 2026-09-14
Verified 2026-09-19

Apple iOS/iPadOS 27, macOS Tahoe 26.7 / Sequoia 15.8, Safari 27 security content (14 Sep 2026)

Apple published security-content pages dated 14 September 2026 for major releases including iOS 27 and iPadOS 27 (support.apple.com/en-us/149034; 100+ CVE entries on that page alone), macOS Tahoe 26.7 (149042), macOS Sequoia 15.8 (149043), Safari 27 (149039), plus tvOS/watchOS/visionOS 27 and macOS Golden Gate 27. Highlighted iOS 27 entries (Apple does not publish CVSS): sandbox breakout CVE-2026-65354; sandboxed app to kernel privileges CVE-2026-84607; WebKit universal cross-site scripting via crafted webarchive CVE-2026-86898; ImageIO/remote code-execution class issues including CVE-2026-65414; privileged-network IPSec authentication bypass CVE-2026-65329 (also listed on earlier 26.6.x content). No “actively exploited” callouts observed on the fetched iOS 27 page. UPDATE 16 September 2026 desk: macOS Golden Gate 27 security content (support.apple.com/en-us/149035) re-fetched — 200+ CVE entries on that page alone; SecurityWeek wire summarised ~200 fixes across the iOS 27 / Golden Gate 27 family. Primary remains Apple iOS/iPadOS 27; Golden Gate URL retained as secondary. Separate from prior desk card apple-ios-2661-20260817.

Product
Apple iOS, iPadOS, macOS Tahoe/Sequoia, Safari (also tvOS/watchOS/visionOS 27)
Versions
iPhone 11 and later; listed iPad models; macOS Tahoe 26.7 / Sequoia 15.8; Safari 27 on Sequoia/Tahoe
Exploited in Australia?
unknown
Patch to
iOS/iPadOS 27 (or current security update for your train); macOS Tahoe 26.7 / Sequoia 15.8; Safari 27

Primary: Apple: iOS 27 and iPadOS 27 security content (14 Sep 2026) · Vendor: Apple security releases index · CVE: CVE-2026-65354, CVE-2026-84607, CVE-2026-86898, CVE-2026-65414, CVE-2026-65329 · Apple: macOS Golden Gate 27 security content (200+ CVEs on page)

vulnerabilities

Vulnerability
Published 2026-09-14
Verified 2026-09-19

Vite CVE-2026-39364: mass scanning of exposed dev servers for AWS/Azure secrets

F5 Labs Sensor Intel (11 September 2026; BleepingComputer 14 September) reports a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6–7 April 2026). GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811. Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. Primary: F5 Labs; vendor: GitHub advisory; secondary: BleepingComputer.

Product
Vite (npm frontend tooling / development server)
Versions
Affected 7.1.0–7.3.1 and 8.0.0–8.0.4 (vite-plus ≤0.1.15); requires network-exposed dev server (--host/server.host)
CVSS
(CVSS 4.0, GitHub); F5 also cites 7.5 High
Exploited in Australia?
unknown
Patch to
Upgrade to Vite 7.3.2 / 8.0.5 (or latest patched on your branch); remove public exposure of port 5173 /@fs/; rotate AWS/Azure/.env/Terraform secrets if exposed

Primary: F5 Labs — Cloud Takeover: exposed Vite (CVE-2026-39364) (11 Sep 2026) · Vendor: GitHub — Vite GHSA-v2wj-q39q-566r / CVE-2026-39364 · CVE: CVE-2026-39364, CVE-2025-30208, CVE-2025-31125, CVE-2024-45811 · BleepingComputer (14 Sep 2026)

tech cloud