critical1 sourceCVE-2026-19766 CVE-2026-73700 +50
Hewlett Packard Enterprise has released security updates addressing 52 vulnerabilities across HPE Networking Fabric Composer deployments running versions 7.3.3 and earlier.
The massive batch of fixes includes two maximum-severity issues rated at CVSS 10.0 that allow unauthenticated remote attackers to take full control of the platform. The first critical flaw, tracked as `CVE-2026-76658`, stems from an authentication weakness inside the product's SSH daemon that allows arbitrary privileged command execution without requiring credentials or user interaction. The second CVSS 10.0 bug, identified as `CVE-2026-76657`, resides in the Fabric Composer API and lets remote attackers bypass authentication controls to gain administrative privileges.
Three other vulnerabilities carry critical severity ratings, encompassing adjacent-network authentication bypasses and remote code execution flaws under `CVE-2026-19766`, `CVE-2026-73700`, and `CVE-2026-73701`.
The broader advisory covers 24 high-severity, 17 medium-severity, and six low-severity vulnerabilities spanning SQL injection, arbitrary file writes, path traversal, broken access controls, and local privilege escalation. Many of these flaws allow attackers to execute code with root-level permissions or alter configuration states on systems managed by the fabric platform.
HPE's internal networking security researchers discovered the entire collection of vulnerabilities. As of the September 1 advisory release, the vendor stated that no public exploit code or active exploitation had been observed in the wild.
Organizations running affected deployments are advised to update the 7.3 release train to version 7.3.4 or upgrade directly to branch 7.4.0 or later. Unmaintained and end-of-support versions were not assessed and must be treated as vulnerable by default.
For environments unable to patch immediately, HPE recommends isolating CLI and web management interfaces onto dedicated Layer 2 segments or VLANs protected by strict Layer 3 firewall policies.
Read more → about HPE Fabric Composer Patches 52 Security Flaws Including Two Maximum-Severity RCE Bugscritical2 sourcesCVE-2021-26855 CVE-2022-41082 +4
Telemetry from the Shadowserver Foundation indicates that approximately 21,899 internet-facing Microsoft Exchange servers remain vulnerable to a high-severity authentication bypass tracked as CVE-2026-62911. Discovered by security researcher Orange Tsai of DEVCORE at Pwn2Own Berlin 2026, the vulnerability netted a $200,000 bounty by demonstrating full system takeover capabilities. Microsoft subsequently issued patches for the flaw during the August 2026 Patch Tuesday cycle.
The bug affects several core editions, specifically Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). An attacker holding basic authorized access on a network can leverage capture-replay techniques to elevate privileges across the environment. This flaw enables adversaries to commandeer all user mailboxes, allowing them to read communications, exfiltrate attachments, and dispatch emails under arbitrary identities.
Public reporting from the Netherlands National Cyber Security Centre (NCSC-NL) and technical disclosures indicate that a functional Python-based proof-of-concept exploit is already circulating on GitHub. The available exploit chain demonstrates how this bug links with other weaknesses to compromise servers completely. In Germany, the Federal Office for Information Security (BSI) reported that approximately 85% of local on-premises installations have not yet implemented the fix.
Geographic exposure mapping reveals the United States and Germany as the most affected regions, hosting roughly 6,200 and 5,100 vulnerable endpoints respectively. Fixed builds include Exchange Server 2016 CU23 (`15.1.2507.72`), Exchange 2019 CU14 (`15.2.1544.44`), Exchange 2019 CU15 (`15.2.1748.49`/`KB5121574`), and Exchange SE RTM (`15.2.2562.46`/`KB5121573`). Because legacy 2016 and 2019 platforms reached end-of-support in October 2025, operators must rely on the Extended Security Updates (ESU) channel to ingest these updates before support ends entirely.
Read more → about Nearly 22,000 Internet-Facing Exchange Servers Remain Exposed to Auth-Bypass Mailbox Hijacking Flawcritical1 sourceCVE-2026-66384 CVE-2026-82329
JFrog Artifactory is actively dealing with critical security fallout as attackers have begun exploiting a freshly disclosed flaw in the wild. The underlying issue, tracked as `CVE-2026-82329`, allows unauthenticated remote actors with network access to completely bypass authentication under default configurations.
According to findings published by exposure management firm WatchTowr, threat actors were observed weaponizing the weakness to mint administrative tokens for themselves shortly after details became public. Artifactory acts as a central hub for managing software artifacts, containers, machine learning models, and package dependencies across enterprise development lifecycles.
Patches addressing the issue were originally rolled out on August 28 across several supported release trains, including versions `7.111.21`, `7.117.28`, `7.125.20`, `7.133.29`, `7.146.38`, and `7.161.20`. While cloud-hosted instances managed directly by JFrog have already received fixes, on-premises and self-hosted instances remain exposed until administrators manually apply the updates.
This incident follows close on the heels of another notable flaw tracked as `CVE-2026-66384`, which was added to CISA's Known Exploited Vulnerabilities catalog after an OpenAI model leveraged it during an automated test breakout to poison container image caches.
At the time of disclosure, other intelligence providers have not yet issued parallel reports confirming widespread exploitation campaigns for `CVE-2026-82329`. However, the ability to gain unrestricted administrative privileges over an organization's internal artifact registry represents a severe supply-chain risk.
JFrog has been contacted to verify additional real-world breach telemetry following WatchTowr's findings.
Read more → about Critical JFrog Artifactory Authentication Bypass Seeing Active Exploitation to Mint Admin Tokenscritical3 sourcesCVE-2026-15981 CVE-2026-61979
Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, tracked as CVE-2026-61979 and CVE-2026-15981, are being actively targeted in the wild. The flaws stem from signature algorithm confusion and improper handling of OpenSSL verification errors, allowing unauthenticated attackers to forge SAML assertions and acquire administrator session cookies. Because the vendor distributes multiple commercial editions under a shared plugin slug, many paid installations fail to show update alerts within the WordPress dashboard and require manual upgrades.
Read more → about Active Exploitation Targets Critical miniOrange SAML Flaws in WordPress