critical2 sourcesCVE-2026-63688 CVE-2026-63692 +5
Dell has released a security advisory addressing multiple security vulnerabilities in its Dell System Update (DSU) utility, which is widely used to manage firmware, BIOS, and driver updates across Dell PowerEdge servers. The utility runs on both Linux and Windows Server environments, naturally requiring elevated operating system permissions due to the low-level system updates it executes.
The most severe flaw addressed is CVE-2026-86360, a critical path traversal vulnerability boasting a CVSS score of 9.6 that affects all versions of DSU prior to 2.3.0.0. This flaw allows an unauthenticated remote attacker to traverse filesystem directories and achieve arbitrary code execution with full root privileges. Consequently, successful exploitation can result in the complete takeover of the host server and the underlying operating system.
Alongside this critical bug, Dell remediated four high-severity issues in DSU, including CVE-2026-86361 and CVE-2026-86362, which allow local privilege escalation via improper permission assignment and broken access controls. The release also resolves CVE-2026-63697, an improper certificate validation issue exploitable by privileged attackers for code execution, and CVE-2026-71168, a local low-privilege path traversal vulnerability.
All of these DSU vulnerabilities are resolved in version 2.3.0.0 or higher. Additionally, Dell published a simultaneous advisory resolving two maximum-severity 10.0 CVSS flaws, CVE-2026-63688 and CVE-2026-63692, in its Container Storage Modules (CSM) integration for Kubernetes, patched in CSM version 1.18.0.
Read more → about Dell Patches Critical Remote Root Execution Vulnerability in System Update Toolcritical6 sourcesCVE-2025-7775 CVE-2026-19490 +12
Citrix has released emergency security updates addressing eight vulnerabilities across customer-managed NetScaler ADC and NetScaler Gateway deployments, including two critical zero-day flaws tracked as CVE-2026-88771 and CVE-2026-88772. The patches arrived shortly after national cyber authorities, including the Dutch NCSC-NL and Australia's ACSC, began privately notifying administrators and advising them to shut down internet-facing NetScaler appliances immediately.
Both zero-day vulnerabilities enable unauthenticated threat actors to achieve remote code execution on target devices, sporting CVSS 4.0 scores of 9.5. Specifically, CVE-2026-88771 stems from improper input validation and affects all default configurations across NetScaler ADC and Gateway appliances without requiring special feature flags. The companion flaw, CVE-2026-88772, is a memory overflow vulnerability affecting systems where Datagram Transport Layer Security (DTLS) is enabled, which is configured on by default across VPN virtual servers.
The broader advisory also mitigates six additional flaws, ranging from HTTP request smuggling in CVE-2026-88773 (CVSS 9.3) to memory overflows and TCP initial sequence number prediction issues. In response to confirmed active exploitation, CISA updated its Known Exploited Vulnerabilities catalog and mandated that US federal agencies patch all vulnerable appliances under Binding Operational Directive 26-04 by September 30.
Remediation builds include NetScaler 14.1-73.37, 13.1-64.23, and corresponding updated FIPS and NDcPP packages, while unsupported releases such as versions 12.1 and 13.0 require immediate platform migration. Threat monitoring from Shadowserver currently detects over 23,000 reachable NetScaler IP addresses across the internet, underlining a massive attack surface for edge infrastructure. Citrix has published basic indicators of compromise through NetScaler Console, while simultaneously cautioning operators that these telemetry artifacts might be insufficient to identify sophisticated breaches.
Read more → about Citrix Patches Dual NetScaler Zero-Days Under Active Exploitation Following Emergency Shutdown Advisorieshigh3 sourcesCVE-2026-19949
A high-severity flaw tracked as CVE-2026-19949 affects the All-in-One WP Migration and Backup plugin by ServMask, an extension deployed on over 5 million active WordPress installations.
Assigned a CVSS score of 8.8, the bug is a second-order SQL injection vulnerability residing inside the plugin's `.wpress` archive restoration workflow.
When administrators restore or migrate an environment, the plugin modifies SQL dumps to adjust source URLs and table prefixes via its `replace_table_values()` function.
The parsing logic relies on a regular expression designed to locate quoted SQL strings, but it inspects only the single character preceding a quote rather than parsing full preceding backslash sequences.
Because trailing backslashes are mishandled, string boundaries break during the unescaping, substitution, and re-escaping pipeline, causing unescaped input to evaluate as raw executable SQL commands.
Unauthenticated attackers can plant malicious payloads in advance by submitting crafted trackbacks containing specific trailing backslashes and URLs to public blog posts.
WordPress core stores these trackback entries directly inside the database comments table without sanitizing the backslashes or rejecting the malicious payloads.
The exploit payload remains dormant until an administrator initiates a standard site backup export and subsequent restore cycle.
Once triggered by the restore routine, the injected SQL manipulates the database to expose the plugin's internal `ai1wm_secret_key` inside a publicly approved comment.
Attackers can query the public WordPress comments REST API to retrieve the leaked secret key and bypass authentication on the plugin's import endpoint.
With this access, attackers can upload a malicious `.wpress` archive bundled with a must-use plugin, triggering immediate PHP code execution on subsequent requests.
ServMask patched the flaw in version 7.110 on August 20, 2026, yet telemetry indicates that roughly 3.25 million sites remained unpatched weeks after release.
Read more → about Second-Order SQL Injection in All-in-One WP Migration Leaves Millions of WordPress Sites Open to RCEcritical3 sourcesCVE-2026-9586
Security researchers have detected active exploitation of a critical remote code execution vulnerability, tracked as CVE-2026-9586, affecting internet-exposed Sangoma Switchvox enterprise VoIP systems.
The flaw was initially discovered by researchers at Horizon3.ai and Security Risk Advisors alongside 11 other vulnerabilities, subsequently receiving patches in Switchvox version 8.4.0.2.
The underlying vulnerability resides within the unauthenticated `/pa` HTTP endpoint, which is processed by the Perl-based `PhoneAppsHandler.pm` component.
This endpoint parses XML-formatted phone notification payloads, verifying only whether the request begins with expected tags like `<PolycomIPPhone>` without properly sanitizing internal fields.
During processing, the application utilizes `XML::Simple::XMLin()` to extract the `PhoneIP` field and directly concatenates it into an unparameterized SQL statement enclosed in single quotes.
Because database operations execute under PostgreSQL superuser privileges, malicious actors can terminate the intended query and append arbitrary backend database commands to achieve remote system command execution.
Defenders monitoring honeypot networks observed opportunistic, internet-wide scanning deploying reverse shells via tools like Netcat, followed immediately by base64-encoded reconnaissance of running processes.
Subsequent activity from multiple sources has expanded beyond initial probing into automated secondary payloads, including cryptocurrency mining installations.
Shodan telemetry estimates roughly 4,000 Switchvox deployments remain directly exposed to the public internet, predominantly in the United States.
Administrators with appliance access can inspect `/var/log/switchvox/db-quirks.log` for anomalous query delimiters, shell invocations, or commands like `COPY ... TO PROGRAM`.
Organizations are strongly advised to apply version 8.4.0.2 immediately, restrict access to the `/pa` interface, and treat any unpatched public-facing instance as compromised.
Read more → about Sangoma Switchvox Hit by In-the-Wild Exploitation via Unauthenticated SQL Injection Flawcritical1 sourceCVE-2026-19766 CVE-2026-73700 +50
Hewlett Packard Enterprise has released security updates addressing 52 vulnerabilities across HPE Networking Fabric Composer deployments running versions 7.3.3 and earlier.
The massive batch of fixes includes two maximum-severity issues rated at CVSS 10.0 that allow unauthenticated remote attackers to take full control of the platform. The first critical flaw, tracked as `CVE-2026-76658`, stems from an authentication weakness inside the product's SSH daemon that allows arbitrary privileged command execution without requiring credentials or user interaction. The second CVSS 10.0 bug, identified as `CVE-2026-76657`, resides in the Fabric Composer API and lets remote attackers bypass authentication controls to gain administrative privileges.
Three other vulnerabilities carry critical severity ratings, encompassing adjacent-network authentication bypasses and remote code execution flaws under `CVE-2026-19766`, `CVE-2026-73700`, and `CVE-2026-73701`.
The broader advisory covers 24 high-severity, 17 medium-severity, and six low-severity vulnerabilities spanning SQL injection, arbitrary file writes, path traversal, broken access controls, and local privilege escalation. Many of these flaws allow attackers to execute code with root-level permissions or alter configuration states on systems managed by the fabric platform.
HPE's internal networking security researchers discovered the entire collection of vulnerabilities. As of the September 1 advisory release, the vendor stated that no public exploit code or active exploitation had been observed in the wild.
Organizations running affected deployments are advised to update the 7.3 release train to version 7.3.4 or upgrade directly to branch 7.4.0 or later. Unmaintained and end-of-support versions were not assessed and must be treated as vulnerable by default.
For environments unable to patch immediately, HPE recommends isolating CLI and web management interfaces onto dedicated Layer 2 segments or VLANs protected by strict Layer 3 firewall policies.
Read more → about HPE Fabric Composer Patches 52 Security Flaws Including Two Maximum-Severity RCE Bugscritical3 sourcesCVE-2025-3248 CVE-2026-0768 +6
Threat actors have started actively exploiting a critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-0768, within the open-source AI platform Langflow.
The flaw carries a CVSS score of 9.8 and resides in the code validator of the framework's custom component editor, affecting all versions up to 1.4.2.
Because user-supplied strings sent to the `validate` endpoint are processed without adequate sanitization, the application ultimately passed malicious input to an underlying `exec()` call, allowing arbitrary Python execution as root.
Cybersecurity intelligence firm VulnCheck initially captured attacks on its honeypot infrastructure in the United Kingdom, observing attempts surge from 50 over the weekend to roughly 360 hits by Monday.
Telemetry indicates that the attack traffic primarily originates from Russian IP space and focuses heavily on early reconnaissance and key exfiltration.
Adversaries are actively querying environment variables such as `LANGFLOW_SUPERUSER`, `OPENAI_API*`, `AWS_ACCESS*`, and `AWS_SECRET*` to harvest operational secrets.
Beyond environment dumps, the incoming exploit payloads inspect the size of `.bash_history`, examine `.ssh` folder configurations, and read the application secret key file located at `/root/.cache/langflow/secret_key`.
This incident follows an aggressive series of exploits targeting the platform throughout the year, including CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, and CVE-2026-0770.
While the original zero-day was reported via the Zero Day Initiative back in July 2025 and publicly disclosed in January 2026, researchers noted that the problematic `exec()` call was eliminated in version 1.10.1.
Security teams running self-hosted Langflow deployments are urged to update instances immediately to release 1.11.6 or later to defend against active exploitation.
Read more → about Zero-Day Exploit Wave Targets Langflow RCE Flaw to Scrape Cloud and AI API Keyshigh1 sourceCVE-2026-75604
On August 25, 2026, Vercel released security updates for Next.js, publishing versions 15.5.24 and 16.3.3 to resolve two critical unauthenticated remote code execution vulnerabilities. The first flaw carries a CVSS score of 9.5 and stems from an underlying dependency in the `sharp` image optimization package. Specifically, `sharp` delegates AVIF image decoding to the C library `libheif`, which suffers from a memory corruption bug. When processing a crafted AVIF file containing two transparency layers of differing depths, `libheif` allocates memory based on the first layer but writes the larger second layer data, resulting in an attacker-controlled heap overflow of approximately 16 KB. This issue affects any application invoking `heif_decode_image()` within vulnerable `libheif` builds. Within Next.js, this affects versions 10.0.0 through 15.5.23 and 16.x up to 16.3.2, though AVIF optimization is disabled by default in `next.config.js`. The second vulnerability, tracked as CVE-2026-75604 with a CVSS score of 9.0, is a directory traversal flaw leading to remote code execution on Windows environments. Exploitation requires three specific conditions: the deployment must run on a Windows file system, rely simultaneously on both the Pages Router and the App Router, and run without Cache Components enabled. Versions 13.4 through 15.5.23 and 16.0 through 16.3.2 are affected by the traversal issue. Vercel confirmed that applications deployed directly on their managed cloud platform are not exposed due to backend Linux environments and proactive disabling of AVIF optimization.
Read more → about Vercel Patches Pair of Unauthenticated RCE Flaws in Next.js Image Processing and Windows Routingcritical1 sourceCVE-2026-18431
A critical vulnerability tracked as CVE-2026-18431 with a 9.8 CVSS score enables unauthenticated remote code execution on WordPress instances running the Avada theme. The exploit ties together six distinct flaws spanning authorization, input validation, trust-boundary, and file-handling weaknesses into a zero-click attack path. Successful exploitation allows an attacker to execute arbitrary PHP code directly on the target host. This level of access enables complete site takeover, database exfiltration, malware deployment, malicious redirects, and the creation of rogue administrator accounts. The vulnerability impacts Avada versions up to 7.16 alongside Fusion Builder plugin versions up to 3.16. While both components are strictly required to trigger the full exploit chain, Fusion Builder is a mandatory plugin bundled with the Avada theme. Consequently, all sites using the Avada theme ship with the necessary dependencies and remain vulnerable. Defiant's Wordfence team discovered and reproduced the issue using an automated agentic framework named Argus, which also developed functional proof-of-concept exploit code. ThemeFusion resolved the flaws by issuing patches in Avada version 7.16.1 and Fusion Builder version 3.16.1. Full technical details are currently withheld by researchers to allow system administrators time to apply the updates.
Read more → about Critical Exploit Chain in Avada Theme and Fusion Builder Unlocks Unauthenticated RCEcritical1 sourceCVE-2026-66747 CVE-2026-74232 +1
Security researchers at VulnCheck discovered two undocumented factory-installed implants running inside firmware produced by Shenzhen Zhibotong Electronics (ZBT). Tracked as CVE-2026-74232 and CVE-2026-74233, both vulnerabilities allow unauthenticated remote attackers to execute arbitrary shell commands with root privileges. The first backdoor, dubbed SPEAKINGSTONE, operates as a daemon named `yunmgrd` and periodically dials out to command-and-control servers via UDP port 10000. Because it initiates outbound traffic, SPEAKINGSTONE cleanly bypasses local NAT and egress filtering to enable DNS hijacking, PPPoE credential theft, and reverse SSH tunnels. When researchers sinkholed its hardcoded backup domain, nearly 400 unique devices immediately beaconed in, representing only a fraction of affected deployments. The second implant, DARKLANTERN, runs as `infosrvd` on UDP port 9992 with an open stock firewall rule accepting inbound WAN connections. Authentication on `infosrvd` is fundamentally broken, relying on a static salt and a wildcard MAC address bypass. Internet-wide scans discovered at least 203 exposed DARKLANTERN instances across 22 countries spanning dozens of hardware models. These flaws follow an earlier backdoor found in ZBT hardware, designated ENDLESSDOORS (CVE-2026-66747). Because ZBT acts as an OEM for numerous white-label brands, identifying impacted hardware requires inspecting MAC address prefixes like `78:A3:51` and `F8:5E:3C` rather than the vendor branding on the chassis.
Read more → about Factory Implants in White-Labeled ZBT Routers Expose Thousands of Devices to Unauthenticated Remote Rootcritical1 sourceCVE-2026-77537 CVE-2026-77545 +3
Ubiquiti released a major security advisory addressing 22 vulnerabilities across nearly its entire product stack. The impacted software includes UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, and the core UniFi OS platform. Out of the 22 addressed flaws, 21 carry a critical severity rating, with three vulnerabilities scoring a maximum CVSS rating of 10.0. Specifically, CVE-2026-77537 enables unauthenticated network attackers to execute arbitrary commands on the UniFi Protect host due to poor input validation. A related unauthenticated command injection bug, tracked as CVE-2026-77554, affects the UniFi Talk application. For the underlying operating platform, CVE-2026-77550 allows attackers to bypass authentication on UniFi OS instances via improper neutralization of CRLF sequences. Another notable vulnerability, CVE-2026-77545, carries a 9.0 CVSS score and stems from leftover active debugging code in UniFi OS. Additionally, CVE-2026-77549 presents another authentication bypass condition linked to CRLF handling. Ubiquiti indicated that these bugs are easily exploitable across local or remote networks without user interaction, though active in-the-wild exploitation was not confirmed prior to patch publication. Fixed software releases have been deployed across all affected product lines, requiring administrators to update to versions such as UniFi Network Application 10.5.67 and UniFi OS Server 5.1.37.
Read more → about Ubiquiti Patches 22 Vulnerabilities Across UniFi Ecosystem, Including Three Max-Severity Flawscritical1 sourceCVE-2026-32201 CVE-2026-45659 +3
Threat actors are actively attempting to chain two critical Microsoft SharePoint vulnerabilities to achieve remote code execution on unpatched deployments. The initial stage relies on `CVE-2026-55040`, an authentication bypass situated within the server's JWT token validation pipeline. This bypass allows unauthenticated attackers to spoof actions as regular SharePoint site users or administrative accounts. Following this access, attackers pivot to `CVE-2026-63520`, a flaw located in the Business Connectivity Services component, which facilitates full remote code execution. Proof-of-concept exploits for both vulnerabilities were published independently during August. Rapid7 disclosed exploit code for the authentication bypass on August 11, which was weaponized within 24 hours. A separate researcher later released exploit material for the BCS vulnerability on August 24. Telemetry from Defused revealed active probing of this exact two-stage chain inside honeypot environments by late August. Probing activity included initial JWT manipulation followed by heavy administrative enumeration directed at the Business Data Catalog sink. Data from Shadowserver indicates over 8,700 SharePoint servers remain directly reachable from the public internet. CISA previously mandated federal agencies to mitigate the authentication bypass, while also noting that older SharePoint bugs like `CVE-2026-45659` are already being abused by ransomware operators.
Read more → about Active In-the-Wild Chaining of SharePoint Auth Bypass and BCS Flaws Enables Remote Code Executioncritical2 sourcesCVE-2024-4879 CVE-2024-5178 +6
ServiceNow released security updates addressing four vulnerabilities in its AI Platform (formerly the Now Platform), including three maximum-severity flaws carrying a perfect 10.0 CVSS score. The trio of critical flaws comprises CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Specifically, CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API enabling unauthenticated remote code execution and data tampering. CVE-2026-18886 involves improper access control in the system configuration image upload processor that allows unauthenticated actors to modify data and escalate privileges. Meanwhile, CVE-2026-74820 allows unauthenticated attackers to execute arbitrary SQL queries against the underlying database via a dynamic schema ORDER BY clause. Each of these three vulnerabilities is network-reachable with low attack complexity, requiring no prior privileges or user interaction. Alongside these, ServiceNow addressed CVE-2026-6876, a high-severity sandbox escape rated at 8.7 that allows arbitrary code execution. Affected major releases include Xanadu, Yokohama, Zurich, and Australia, spanning various patch and hotfix levels. ServiceNow has deployed automatic patches across its hosted cloud instances, but operators managing self-hosted infrastructure must deploy the fixes manually. While ServiceNow reported no known active exploitation for these specific flaws at publication time, prior platform flaws have frequently been targeted in the wild.
Read more → about ServiceNow drops urgent updates for trio of critical 10.0 flaws and sandbox escapecritical2 sourcesCVE-2017-10271 CVE-2020-14882 +2
CISA has added a critical remote code execution vulnerability in Oracle HTTP Server and the WebLogic Server Proxy plugin, tracked as CVE-2026-21962, to its Known Exploited Vulnerabilities catalog. The max-severity flaw allows unauthenticated network access and has been actively exploited in the wild since January. Federal civilian agencies have been given a tight deadline to apply the patches released by Oracle earlier this year.
Read more → about CISA Orders Urgent Patching for Actively Exploited Oracle WebLogic Flaw