🟠 CVE-2026-82641 - High (8.6)

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Hackers Are Actively Exploiting a Critical Sangoma Switchvox Flaw to Deploy Reverse Shells + Video

A New Threat Is Turning Business Phone Systems Into Attack Platforms A vulnerability in Sangoma Switchvox has moved rapidly from security research into real-world exploitation, creating a serious warning for organizations that expose their VoIP management systems to the internet. Security researchers have observed attackers targeting CVE-2026-9586, a critical…

https://undercodenews.com/hackers-are-actively-exploiting-a-critical-sangoma-switchvox-flaw-to-deploy-reverse-shells-video/?utm_source=mastodon&utm_medium=jetpack_social

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can...

🔗️ [Bleepingcomputer] https://link.is.it/o3uhXX

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Hackers are actively exploiting a vulnerability in Sangoma Switchvox, CVE-2026-9586, to gain unauthorized access and deploy reverse shells on vulnerable devices, with around 4,000 exposed devices, mostly in the US, at risk. This security flaw allows attackers to inject malicious SQL code, making it crucial to update to Switchvox…

https://osintsights.com/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells?utm_source=mastodon&utm_medium=social

#Cve20269586 #Sangoma #Switchvox #SqlInjection #UnauthenticatedVulnerability

Sangoma Switchvox Under Attack: Critical CVE-2026-9586 Turns Internet-Exposed VoIP Systems Into Prime Targets + Video

Introduction: A Quiet VoIP Flaw Becomes a Live Cybersecurity Threat A vulnerability buried inside an enterprise phone-management platform has suddenly become a serious security concern for organizations around the world. CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox, is now being actively exploited in the…

https://undercodenews.com/sangoma-switchvox-under-attack-critical-cve-2026-9586-turns-internet-exposed-voip-systems-into-prime-targets-video/?utm_source=mastodon&utm_medium=jetpack_social

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-9586
Vendor: Sangoma
Product: Switchvox
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9586

Active exploitation attempts are targeting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition. A single crafted request enables arbitrary SQL execution on PostgreSQL and leads to remote code execution via reverse shell. Immediate patching and exposure review are critical. #Switchvox #SqlInjection #ThreatIntel

https://cyberworldops.eu/en/switchvox-under-attack-critical-sql-injection-installs-reverse-shell

Attackers Exploit Switchvox Flaw to Deploy Reverse Shells

A critical flaw in Sangoma Switchvox SMB Edition 8.3 can let attackers execute malicious code without credentials, giving them alarming control over your system. This unauthenticated SQL injection vulnerability, tracked as CVE-2026-9586, is a serious threat that demands immediate attention.

https://osintsights.com/attackers-exploit-switchvox-flaw-to-deploy-reverse-shells?utm_source=mastodon&utm_medium=social

#SqlInjection #SupplyChain #EmergingThreats #Cve20269586 #Switchvox

Critical Sangoma Switchvox Flaw Is Now Being Exploited: CVE-2026-9586 Gives Attackers a Direct Path to Remote Code Execution + Video

A Dangerous VoIP Vulnerability Has Moved From Disclosure to Active Exploitation Enterprise phone systems rarely receive the same attention as web servers, VPN appliances, or cloud infrastructure. Yet they can be just as valuable to attackers—and sometimes even more dangerous because they sit at the center of an organization's…

https://undercodenews.com/critical-sangoma-switchvox-flaw-is-now-being-exploited-cve-2026-9586-gives-attackers-a-direct-path-to-remote-code-execution-video/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-9586, a critical Sangoma Switchvox vulnerability, is exploited in the wild, giving unauthenticated attackers SQL injection and remote code execution.

#Sangoma #Switchvox #CVE20269586 #RCE #SQLInjection #VoIP #InfoSec #ExploitedInTheWild

https://securityonline.info/sangoma-switchvox-cve-2026-9586-rce/?utm_source=mastodon&utm_medium=jetpack_social

Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can...

🔗️ [Bleepingcomputer] https://link.is.it/o3uhXX

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-9586
Vendor: Sangoma
Product: Switchvox
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9586

Active exploitation attempts are targeting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition. A single crafted request enables arbitrary SQL execution on PostgreSQL and leads to remote code execution via reverse shell. Immediate patching and exposure review are critical. #Switchvox #SqlInjection #ThreatIntel

https://cyberworldops.eu/en/switchvox-under-attack-critical-sql-injection-installs-reverse-shell

CVE-2026-9586, a critical Sangoma Switchvox vulnerability, is exploited in the wild, giving unauthenticated attackers SQL injection and remote code execution.

#Sangoma #Switchvox #CVE20269586 #RCE #SQLInjection #VoIP #InfoSec #ExploitedInTheWild

https://securityonline.info/sangoma-switchvox-cve-2026-9586-rce/?utm_source=mastodon&utm_medium=jetpack_social

Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

🔴 New security advisory:

CVE-2026-83548 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-83548-sma1000-ssrf-exploited-in-the-wild

by Yazoul AI

#InfoSec #ZeroDay #ThreatIntel

CVE ID: CVE-2026-83548
Vendor: SonicWall
Product: SMA1000 Appliances
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-83548

📰 SonicWall Warns of Two Actively Exploited Zero-Days in SMA1000

🚨 BREAKING: SonicWall warns of two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 appliances. Attackers chain the flaws for unauthenticated RCE. Patches are available and must be applied immediately. #ZeroDay #SonicWall #C...

🔗 https://cyber.netsecops.io/articles/sonicwall-sma1000-zero-day-vulnerabilities-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectent les SMA 1000 et permettent une SSRF ainsi que l'exécution de code arbitraire à distance.
Elles sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/

SonicWall Zero-Days Exploited in Wild, Firm Urges Immediate Patching

SonicWall is urging immediate patching for two zero-day vulnerabilities in its SMA1000 appliances, which are being actively exploited in the wild by hackers. The more critical flaw, CVE-2026-83548, has a severity rating of 10.0 and can be triggered without authentication, putting sensitive data at risk.

https://osintsights.com/sonicwall-zero-days-exploited-in-wild-firm-urges-immediate-patching?utm_source=mastodon&utm_medium=social

#ZeroDay #Sonicwall #Cve202683548 #SupplyChain #EmergingThreats

🏆 New Achievement! By Continuing to Use This Appliance, You Agree to Be Owned!

Please note that Section 2, Paragraph 4 of your SMA1000 user agreement has been updated. By failing to patch CVE-2026-83548 — a pre-authentication SSRF flaw scoring a perfect 10.0 CVSS in the Appliance Work Place interface — you consent to unauthenticated strangers poking around your network. (1/2)

Tiens, encore du #SonicWall SMA1000 ...

Deux nouvelles vulnérabilités 0-day, CVE-2026-83548 (CVSS 10) et CVE-2026-83549, activement exploitées.

La première permet une SSRF sans authentification, la seconde une injection de commandes/RCE. Les deux peuvent être chaînées pour arriver à une RCE sans authentification sur l'appliance.

Sont concernés les SMA1000 6210, 7210 et 8200v.

Pas de workaround : hotfix à appliquer au plus vite. ☹️

Et SonicWall dans la doc dédiée ne s’arrête pas au patch : recherche d’IoC recommandée et, si compromission détectée, re-image/redeploy de l’appliance + reset des mots de passe admin/utilisateurs et des tokens TOTP.

À noter : les SSL-VPN des firewalls SonicWall et la gamme SMA100 ne sont pas concernés.

Bref, si vous avez du SMA1000 exposé, ça mérite clairement un petit détour dans l’inventaire ce matin. 🙃

Advisory 🩹
👇
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

#CyberVeille

SonicWall confirmed active exploitation of two zero-days in SMA1000 appliances, including pre-auth SSRF CVE-2026-83548. Chained, the flaws allow unauthenticated remote command execution on SSL-VPN gateways. Operators should patch immediately and hunt for post-exploitation activity. #SonicWall #ZeroDay #InfoSec

https://cyberworldops.eu/en/sonicwall-sma1000-under-attack-two-zero-days-enable-ssrf-and-system

CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS.

#SonicWall #SMA1000 #CVE202683548 #SSRF #PreAuth #VPNsecurity #InfoSec #ExploitedInTheWild

https://securityonline.info/sonicwall-sma1000-cve-2026-83548-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-83548
Vendor: SonicWall
Product: SMA1000 Appliances
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectent les SMA 1000 et permettent une SSRF ainsi que l'exécution de code arbitraire à distance.
Elles sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/

🏆 New Achievement! By Continuing to Use This Appliance, You Agree to Be Owned!

Please note that Section 2, Paragraph 4 of your SMA1000 user agreement has been updated. By failing to patch CVE-2026-83548 — a pre-authentication SSRF flaw scoring a perfect 10.0 CVSS in the Appliance Work Place interface — you consent to unauthenticated strangers poking around your network. (1/2)

Tiens, encore du #SonicWall SMA1000 ...

Deux nouvelles vulnérabilités 0-day, CVE-2026-83548 (CVSS 10) et CVE-2026-83549, activement exploitées.

La première permet une SSRF sans authentification, la seconde une injection de commandes/RCE. Les deux peuvent être chaînées pour arriver à une RCE sans authentification sur l'appliance.

Sont concernés les SMA1000 6210, 7210 et 8200v.

Pas de workaround : hotfix à appliquer au plus vite. ☹️

Et SonicWall dans la doc dédiée ne s’arrête pas au patch : recherche d’IoC recommandée et, si compromission détectée, re-image/redeploy de l’appliance + reset des mots de passe admin/utilisateurs et des tokens TOTP.

À noter : les SSL-VPN des firewalls SonicWall et la gamme SMA100 ne sont pas concernés.

Bref, si vous avez du SMA1000 exposé, ça mérite clairement un petit détour dans l’inventaire ce matin. 🙃

Advisory 🩹
👇
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

#CyberVeille

SonicWall confirmed active exploitation of two zero-days in SMA1000 appliances, including pre-auth SSRF CVE-2026-83548. Chained, the flaws allow unauthenticated remote command execution on SSL-VPN gateways. Operators should patch immediately and hunt for post-exploitation activity. #SonicWall #ZeroDay #InfoSec

https://cyberworldops.eu/en/sonicwall-sma1000-under-attack-two-zero-days-enable-ssrf-and-system

CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS.

#SonicWall #SMA1000 #CVE202683548 #SSRF #PreAuth #VPNsecurity #InfoSec #ExploitedInTheWild

https://securityonline.info/sonicwall-sma1000-cve-2026-83548-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-84372 - Critical (9.8)

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggrega...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84372 - Critical (9.8)

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggrega...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84292 - High (7.5)

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84292 - High (7.5)

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

🟠 CVE-2026-84382 - High (7.5)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded piec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84382/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84382 - High (7.5)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded piec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84382/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84381 - High (8.1)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84381 - High (8.1)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49832 - High (8)

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Veloci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49832 - High (8)

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Veloci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19117 - Critical (9.8)

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as
that user. This issue affects on-premises deployments only.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Credential managers are so hot right now. Here's Delinea's on-prem offering.

https://nvd.nist.gov/vuln/detail/cve-2026-19117

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

🔴 CVE-2026-19117 - Critical (9.8)

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as
that user. This issue affects on-premises deployments only.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Credential managers are so hot right now. Here's Delinea's on-prem offering.

https://nvd.nist.gov/vuln/detail/cve-2026-19117

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

New security advisories.

Broadcom has addressed several vulnerabilities,two of them critical https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco: Five advisories, two of them addressing critical vulnerabilities:

- CRITICAL: CVE-2026-20212: Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

- CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM

More: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

I am fortunate enough to not know anything about NGINX JavaScript ( hashtag blessed ) but if you do, this might be of interest.

https://nvd.nist.gov/vuln/detail/cve-2026-78689

Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control. Impact This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

I am fortunate enough to not know anything about NGINX JavaScript ( hashtag blessed ) but if you do, this might be of interest.

https://nvd.nist.gov/vuln/detail/cve-2026-78689

Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control. Impact This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

⚠️ New security advisory:

CVE-2026-83549 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-83549-sma1000-amc-command-injection-exploited

by Yazoul AI

#CVE #PatchNow #InfoSecCommunity

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-83549
Vendor: SonicWall
Product: SMA1000 Appliances
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-83549

📰 SonicWall Warns of Two Actively Exploited Zero-Days in SMA1000

🚨 BREAKING: SonicWall warns of two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 appliances. Attackers chain the flaws for unauthenticated RCE. Patches are available and must be applied immediately. #ZeroDay #SonicWall #C...

🔗 https://cyber.netsecops.io/articles/sonicwall-sma1000-zero-day-vulnerabilities-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectent les SMA 1000 et permettent une SSRF ainsi que l'exécution de code arbitraire à distance.
Elles sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/

By also ignoring CVE-2026-83549, an OS command injection flaw in the AMC component, you further agree to let those same strangers chain both bugs together for full remote code execution. SonicWall has confirmed active exploitation in the wild. Ransomware gangs find SonicWall products particularly cozy real estate.

To opt out of these terms, patch your SMA1000 immediately.

Reward: You've received the Binding Arbitration Curse — your incidents are now non-disputable.

#ZeroDay #SonicWall (2/2)

Tiens, encore du #SonicWall SMA1000 ...

Deux nouvelles vulnérabilités 0-day, CVE-2026-83548 (CVSS 10) et CVE-2026-83549, activement exploitées.

La première permet une SSRF sans authentification, la seconde une injection de commandes/RCE. Les deux peuvent être chaînées pour arriver à une RCE sans authentification sur l'appliance.

Sont concernés les SMA1000 6210, 7210 et 8200v.

Pas de workaround : hotfix à appliquer au plus vite. ☹️

Et SonicWall dans la doc dédiée ne s’arrête pas au patch : recherche d’IoC recommandée et, si compromission détectée, re-image/redeploy de l’appliance + reset des mots de passe admin/utilisateurs et des tokens TOTP.

À noter : les SSL-VPN des firewalls SonicWall et la gamme SMA100 ne sont pas concernés.

Bref, si vous avez du SMA1000 exposé, ça mérite clairement un petit détour dans l’inventaire ce matin. 🙃

Advisory 🩹
👇
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

#CyberVeille

🟠 CVE-2026-83549 - High (7.8)

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-83549
Vendor: SonicWall
Product: SMA1000 Appliances
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectent les SMA 1000 et permettent une SSRF ainsi que l'exécution de code arbitraire à distance.
Elles sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/

By also ignoring CVE-2026-83549, an OS command injection flaw in the AMC component, you further agree to let those same strangers chain both bugs together for full remote code execution. SonicWall has confirmed active exploitation in the wild. Ransomware gangs find SonicWall products particularly cozy real estate.

To opt out of these terms, patch your SMA1000 immediately.

Reward: You've received the Binding Arbitration Curse — your incidents are now non-disputable.

#ZeroDay #SonicWall (2/2)

Tiens, encore du #SonicWall SMA1000 ...

Deux nouvelles vulnérabilités 0-day, CVE-2026-83548 (CVSS 10) et CVE-2026-83549, activement exploitées.

La première permet une SSRF sans authentification, la seconde une injection de commandes/RCE. Les deux peuvent être chaînées pour arriver à une RCE sans authentification sur l'appliance.

Sont concernés les SMA1000 6210, 7210 et 8200v.

Pas de workaround : hotfix à appliquer au plus vite. ☹️

Et SonicWall dans la doc dédiée ne s’arrête pas au patch : recherche d’IoC recommandée et, si compromission détectée, re-image/redeploy de l’appliance + reset des mots de passe admin/utilisateurs et des tokens TOTP.

À noter : les SSL-VPN des firewalls SonicWall et la gamme SMA100 ne sont pas concernés.

Bref, si vous avez du SMA1000 exposé, ça mérite clairement un petit détour dans l’inventaire ce matin. 🙃

Advisory 🩹
👇
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

#CyberVeille

🟠 CVE-2026-83549 - High (7.8)

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73773 - High (7.5)

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73773/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73773 - High (7.5)

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73773/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-82329
Vendor: JFrog
Product: Artifactory
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-82329

📰 Critical JFrog Artifactory Auth Bypass Flaw Under Active Exploit

Critical auth bypass flaw (CVE-2026-82329) in self-hosted JFrog Artifactory is actively exploited. Attackers can gain admin access, posing a severe software supply chain risk. Patch immediately! #JFrog #Artifactory #CyberSecurity #CVE

🔗 https://cyber.netsecops.io/articles/critical-jfrog-artifactory-flaw-under-active-exploitation/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide...

🔗️ [Bleepingcomputer] https://link.is.it/GGGBsY

Hackers exploit JFrog flaw to forge admin tokens

Hackers are actively exploiting a critical flaw in JFrog Artifactory, CVE-2026-82329, to gain admin access and forge tokens, putting your entire system at risk. This authentication bypass vulnerability can allow attackers to elevate their permissions and automatically gain access to trusted and sensitive data.

https://osintsights.com/hackers-exploit-jfrog-flaw-to-forge-admin-tokens?utm_source=mastodon&utm_medium=social

#Cve202682329 #Jfrog #JfrogArtifactory #AuthenticationBypass #AdminTokenForgery

Angreifer nutzen derzeit eine kritische Schwachstelle in JFrog Artifactory (CVE-2026-82329) aktiv aus. Die Sicherheitslücke erlaubt das Umgehen der Authentifizierung, wodurch unberechtigte administrative Token erstellt werden können. Betroffene Betreiber müssen umgehend die bereitgestellten Software-Aktualisierungen einspielen und bestehende Tokens prüfen.

#InfoSec #CyberSecurity #ITSecurity #Vulnerability #JFrog

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens

JFrog Artifactory is facing active exploitation of a critical authentication bypass (CVE-2026-82329) that allows unauthenticated attackers to mint administrator tokens and compromise software supply chains.

**If you run self-managed JFrog Artifactory, update to version 7.161.20 ASAP. Attackers are already exploiting this flaw to take full admin control. Primary systems at risk are internet facing self-hosted Artifactory instances. Cloud-hosted instances managed by JFrog are not affected.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-jfrog-artifactory-flaw-to-mint-admin-tokens-f-g-f-4-3/gD2P6Ple2L

Critical JFrog Artifactory Flaw Is Being Exploited After Patching — CVE-2026-82329 Puts Software Supply Chains at Risk + Video

A Dangerous Race Between Disclosure and Exploitation A critical vulnerability in JFrog Artifactory has rapidly moved from a newly disclosed security weakness to an apparent real-world exploitation concern. CVE-2026-82329, rated 9.8 Critical, can potentially allow an unauthenticated attacker with network access to obtain administrative…

https://undercodenews.com/critical-jfrog-artifactory-flaw-is-being-exploited-after-patching-cve-2026-82329-puts-software-supply-chains-at-risk-video/?utm_source=mastodon&utm_medium=jetpack_social

Geopolitical tensions persist between the U.S. and Iran regarding actions in the Strait of Hormuz (Sept 1, 2026). On the cybersecurity front, critical infrastructure, including Midwest water utilities, faces new ransomware attacks. Additionally, a severe authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory is actively being exploited. OpenAI has issued a stark warning regarding the escalating threat of AI-enabled cyberattacks.

#AnonNews_irc #Cybersecurity #Anonymous #News

Critical JFrog Artifactory Flaw Is Already Under Attack, Putting Software Supply Chains in the Crosshairs + Video

A Dangerous Race Against Time A critical vulnerability in JFrog Artifactory has moved from public disclosure to real-world exploitation with startling speed. CVE-2026-82329, rated CVSS 9.8, allows an unauthenticated attacker to bypass authentication on vulnerable self-hosted Artifactory deployments and potentially obtain administrator-level access. That…

https://undercodenews.com/critical-jfrog-artifactory-flaw-is-already-under-attack-putting-software-supply-chains-in-the-crosshairs-video/?utm_source=mastodon&utm_medium=jetpack_social

Attackers Exploit JFrog Artifactory Flaw to Mint Admin Tokens

A critical flaw in JFrog Artifactory, known as CVE-2026-82329, allows attackers to easily gain admin access without needing authentication or user interaction, posing a huge risk to affected instances. This near-maximum-score vulnerability has already been patched in Artifactory version 7.161.20.

https://osintsights.com/attackers-exploit-jfrog-artifactory-flaw-to-mint-admin-tokens?utm_source=mastodon&utm_medium=social

#JfrogArtifactory #Cve202682329 #AuthenticationBypass #SupplyChain #EmergingThreats

📰 Critical JFrog Artifactory Auth Bypass Flaw Under Active Exploit

Critical auth bypass flaw (CVE-2026-82329) in self-hosted JFrog Artifactory is actively exploited. Attackers can gain admin access, posing a severe software supply chain risk. Patch immediately! #JFrog #Artifactory #CyberSecurity #CVE

🔗 https://cyber.netsecops.io/articles/critical-jfrog-artifactory-flaw-under-active-exploitation/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

New.

WatchTower, on X:

"WatchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens."

More:

Security Week: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ @SecurityWeek #vulnerability #infosec

🏆 New Achievement! Admin Tokens: A Self-Service Experience!

The System, acting in its capacity as counsel for the prosecution, hereby submits Exhibit A: CVE-2026-82329, a CVSS 9.8 authentication bypass in JFrog Artifactory, patched August 28. Per WatchTowr's testimony, unknown attackers were, within days of public disclosure, "minting themselves admin tokens" via default configurations — no credentials required. Your Honor, the defendant did knowingly operate an unpatched instance. (1/2)

JFrog Artifactory is affected by critical CVE-2026-82329 (CVSS 9.8) allowing unauthenticated remote attackers to create administrative tokens via default configurations. With reports of active exploitation, this enables full system takeover and severe software supply chain compromise. Immediate patching is essential. #JFrog #SupplyChainSecurity #VulnerabilityManagement

https://cyberworldops.eu/en/jfrog-artifactory-critical-flaw-allows-unauthenticated-creation-of

A critical Artifactory authentication bypass flaw (CVE-2026-82329) is exploited in the wild, letting attackers obtain administrative privileges.

#Artifactory #CVE202682329 #CyberSecurity #AuthenticationBypass #Exploit

https://securityonline.info/cve-2026-82329-exploited-admin-privileges/?utm_source=mastodon&utm_medium=jetpack_social

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-82329
Vendor: JFrog
Product: Artifactory
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-82329

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide...

🔗️ [Bleepingcomputer] https://link.is.it/GGGBsY

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens

JFrog Artifactory is facing active exploitation of a critical authentication bypass (CVE-2026-82329) that allows unauthenticated attackers to mint administrator tokens and compromise software supply chains.

**If you run self-managed JFrog Artifactory, update to version 7.161.20 ASAP. Attackers are already exploiting this flaw to take full admin control. Primary systems at risk are internet facing self-hosted Artifactory instances. Cloud-hosted instances managed by JFrog are not affected.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-jfrog-artifactory-flaw-to-mint-admin-tokens-f-g-f-4-3/gD2P6Ple2L

Geopolitical tensions persist between the U.S. and Iran regarding actions in the Strait of Hormuz (Sept 1, 2026). On the cybersecurity front, critical infrastructure, including Midwest water utilities, faces new ransomware attacks. Additionally, a severe authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory is actively being exploited. OpenAI has issued a stark warning regarding the escalating threat of AI-enabled cyberattacks.

#AnonNews_irc #Cybersecurity #Anonymous #News

New.

WatchTower, on X:

"WatchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens."

More:

Security Week: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ @SecurityWeek #vulnerability #infosec

🏆 New Achievement! Admin Tokens: A Self-Service Experience!

The System, acting in its capacity as counsel for the prosecution, hereby submits Exhibit A: CVE-2026-82329, a CVSS 9.8 authentication bypass in JFrog Artifactory, patched August 28. Per WatchTowr's testimony, unknown attackers were, within days of public disclosure, "minting themselves admin tokens" via default configurations — no credentials required. Your Honor, the defendant did knowingly operate an unpatched instance. (1/2)

JFrog Artifactory is affected by critical CVE-2026-82329 (CVSS 9.8) allowing unauthenticated remote attackers to create administrative tokens via default configurations. With reports of active exploitation, this enables full system takeover and severe software supply chain compromise. Immediate patching is essential. #JFrog #SupplyChainSecurity #VulnerabilityManagement

https://cyberworldops.eu/en/jfrog-artifactory-critical-flaw-allows-unauthenticated-creation-of

A critical Artifactory authentication bypass flaw (CVE-2026-82329) is exploited in the wild, letting attackers obtain administrative privileges.

#Artifactory #CVE202682329 #CyberSecurity #AuthenticationBypass #Exploit

https://securityonline.info/cve-2026-82329-exploited-admin-privileges/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-66786 - Critical (9.1)

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66786 - Critical (9.1)

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-53649 - Critical (9.6)

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multip...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-53649 - Critical (9.6)

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multip...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-48710
Vendor: Kludex
Product: Starlette
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48710

Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.

- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549

- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548

- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586

- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329

- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869

- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710

- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability

🚨 [CISA-2026:0902] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0902)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48710 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48710)
- Name: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kludex
- Product: Starlette
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

⚠️ CVE-2026-49869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-49869)
- Name: Kestra OSS OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Kestra
- Product: Kestra OSS
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869

⚠️ CVE-2026-59822 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-59822)
- Name: BerriAI LiteLLM Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BerriAI
- Product: LiteLLM
- Notes: https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59822

⚠️ CVE-2026-82329 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82329)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82329

⚠️ CVE-2026-83548 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83548)
- Name: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

⚠️ CVE-2026-83549 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-83549)
- Name: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: SonicWall
- Product: SMA1000 Appliances
- Notes: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549

⚠️ CVE-2026-9586 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-9586)
- Name: Sangoma Switchvox SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Sangoma
- Product: Switchvox
- Notes: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-9586

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260902 #cisa20260902 #cve_2026_48710 #cve_2026_49869 #cve_2026_59822 #cve_2026_82329 #cve_2026_83548 #cve_2026_83549 #cve_2026_9586 #cve202648710 #cve202649869 #cve202659822 #cve202682329 #cve202683548 #cve202683549 #cve20269586

CVE ID: CVE-2026-48710
Vendor: Kludex
Product: Starlette
Date Added: 2026-09-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48710

🟠 CVE-2026-79755 - High (8)

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79755 - High (8)

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84715 - High (8.8)

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted reques...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84715 - High (8.8)

FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify their own permission records. A subuser with minimal permissions can send a crafted reques...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-08-24 - 2026-08-24)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 344
- High: 991
- Medium: 799
- Low: 122
- None: 461

Status:
- : 20
- Analyzed: 271
- Awaiting Analysis: 296
- Deferred: 627
- Received: 1129
- Rejected: 180
- Undergoing Analysis: 194

CISA KEVs:
- CISA-2026:0825 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0825)
- CISA-2026:0824 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0824)
- CISA-2026:0826 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0826)
- CISA-2026:0827 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0827)

Top CNAs:
- VulnCheck: 424
- Chrome: 328
- MITRE: 228
- kernel.org: 228
- GitHub, Inc.: 216
- Intel Corporation: 147
- WPScan: 94
- Patchstack: 94
- VMware: 90
- VulDB: 90

Top Affected Products:
- UNKNOWN: 2182
- Google Chrome: 218
- Draytek Vigorswitch G2100 Firmware: 29
- Draytek Vigorswitch G2540xs Firmware: 29
- Draytek Vigorswitch Q2121x Firmware: 29
- Draytek Vigorswitch Pq2121x Firmware: 29
- Draytek Vigorswitch Q2200x Firmware: 29
- Draytek Vigorswitch G2280x Firmware: 29
- Draytek Vigorswitch Pq2200xb Firmware: 29
- Draytek Vigorswitch P1282 Firmware: 29

Top EPSS Score:
- CVE-2026-60004 - 84.55 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-60004)
- CVE-2026-47864 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47864)
- CVE-2026-71921 - 3.25 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71921)
- CVE-2026-71914 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71914)
- CVE-2026-71905 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71905)
- CVE-2026-71906 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71906)
- CVE-2026-71907 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71907)
- CVE-2026-71908 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71908)
- CVE-2026-71909 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71909)
- CVE-2026-71910 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71910)

#ZEN #SecDB #InfoSec

🟠 CVE-2026-73782 - High (8.8)

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73782/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73782 - High (8.8)

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73782/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-73780 - High CSRF vulnerability in AOS-CX switch web interface allows arbitrary input execution. CVSS 8.3. Restrict web UI access immediately. #CVE #Aruba #infosec

https://www.valtersit.com/cve/CVE-2026-73780/

🟠 CVE-2026-79750 - High (7.7)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical HPE Fabric Composer vulnerabilities, including CVE-2026-76657, allow remote code execution. Update to version 7.4.0 now to secure your network.

#HPE #FabricComposer #Vulnerability #Cybersecurity #CVE202676657

https://securityonline.info/hpe-fabric-composer-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Critical HPE Fabric Composer vulnerabilities, including CVE-2026-76657, allow remote code execution. Update to version 7.4.0 now to secure your network.

#HPE #FabricComposer #Vulnerability #Cybersecurity #CVE202676657

https://securityonline.info/hpe-fabric-composer-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Vuln or bugdoor?

https://nvd.nist.gov/vuln/detail/cve-2026-76658

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

Vuln or bugdoor?

https://nvd.nist.gov/vuln/detail/cve-2026-76658

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

🟠 CVE-2026-84702 - High (7.5)

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84702/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84702 - High (7.5)

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84702/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14982 - High (8.1)

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14982 - High (8.1)

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://nvd.nist.gov/vuln/detail/cve-2026-84795

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

Seems like a pretty limited scope but it's still interesting to see that sev:CRIT in the CVE when the advisory says sev:MED:

https://github.com/craftcms/cms/security/advisories/GHSA-242m-9wq7-vhwq

https://nvd.nist.gov/vuln/detail/cve-2026-84795

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

Seems like a pretty limited scope but it's still interesting to see that sev:CRIT in the CVE when the advisory says sev:MED:

https://github.com/craftcms/cms/security/advisories/GHSA-242m-9wq7-vhwq

🟠 CVE-2025-46418 - High (7.6)

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-46418 - High (7.6)

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google patched critical Google Chrome vulnerabilities, including CVE-2026-84353. Update your browser now to block potential remote attacks.

#GoogleChrome #Cybersecurity #Vulnerability #ChromeUpdate #CVE202684353

https://securityonline.info/google-chrome-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Google patched critical Google Chrome vulnerabilities, including CVE-2026-84353. Update your browser now to block potential remote attacks.

#GoogleChrome #Cybersecurity #Vulnerability #ChromeUpdate #CVE202684353

https://securityonline.info/google-chrome-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-14828 - High (8.8)

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14828/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14828 - High (8.8)

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14828/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78657 - Critical (9.8)

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78657 - Critical (9.8)

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9055 - Critical (9.8)

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the cus...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9055 - Critical (9.8)

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the cus...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14357 - High (8.8)

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14357 - High (8.8)

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82393 - High (7.5)

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack