📰 Check Point Zero-Days in Management Servers and VPNs Under Active Attack

CISA KEV Alert: Two critical Check Point zero-days (CVE-2026-93616 & CVE-2026-85102) are under active attack. Flaws in Management Servers & VPN gateways allow RCE. Patch immediately. #CyberSecurity #Vulnerability #CheckPoint #PatchNow

🔗 https://cyber.netsecops.io/articles/check-point-zero-days-cve-2026-93616-cve-2026-85102-under-active-attack/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 [CISA-2026:0922] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0922)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85102 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85102)
- Name: Check Point Multiple Products Improper Certificate Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102

⚠️ CVE-2026-93616 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93616)
- Name: Check Point Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000171/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93616

⚠️ CVE-2026-93952 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93952)
- Name: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Arista
- Product: VeloCloud Orchestrator
- Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93952

⚠️ CVE-2026-94127 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-94127)
- Name: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: F5
- Product: BIG-IP APM
- Notes: For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260922 #cisa20260922 #cve_2026_85102 #cve_2026_93616 #cve_2026_93952 #cve_2026_94127 #cve202685102 #cve202693616 #cve202693952 #cve202694127

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616

#CyberSecurity #ZeroDay #CheckPoint #Vulnerability #ActiveExploitation #PatchedOrPerish (3/3)

Meanwhile a second zero-day, CVE-2026-93616, materialized in Security Management with its own handful of pinpointed hits.

Policy dictates we inform you patches now exist for both CVE-2026-85102 and CVE-2026-93616. Policy does not require we feel bad about what happens next if you ignore them. Install both immediately.

Reward: Compliance logged. Outcome: your problem. (2/3)

Check Point has disclosed a zero-day (in Security Management Server) and marked an older bug also as exploited in the wild (in Site-to-Site VPN)

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

CVE ID: CVE-2026-85102
Vendor: Check Point
Product: Multiple Products
Date Added: 2026-09-22
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85102

Two Check Point critical vulnerabilities are now listed as exploited in the wild.

https://ifin.network/t/cve-2026-85102-and-93616-check-point-security-gateway-rce-path-traversal-exploited/853

#ThreatIntel #ThreatIntelligence #IFIN

An exploited Check Point VPN vulnerability allows remote code execution. Patch this Check Point VPN vulnerability now to block active in-the-wild attacks.

#CheckPoint #CVE202685102 #VPN #Cybersecurity #Infosec #ZeroDay

https://securityonline.info/checkpoint-vpn-vulnerability-cve-2026-85102/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-73547 - High (7.5)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73547/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

ManageEngine security vulnerabilities expose servers to remote code execution. Patch these OpManager vulnerabilities and CVE-2026-19599 to secure your network.

#ManageEngine #Cybersecurity #CVE202619599 #OpManager #Infosec #Vulnerability

https://securityonline.info/manageengine-security-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-19599: CRITICAL RCE in ManageEngine OpManager MSP (<12.8.711). Improper OS command neutralization enables remote command execution (CVSS 9.9). Upgrade to 12.8.711+ ASAP. https://radar.offseq.com/threat/cve-2026-19599-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-d62870fccbe1d229 #OffSeq #Vuln #InfoSec #RCE

ManageEngine security vulnerabilities expose servers to remote code execution. Patch these OpManager vulnerabilities and CVE-2026-19599 to secure your network.

#ManageEngine #Cybersecurity #CVE202619599 #OpManager #Infosec #Vulnerability

https://securityonline.info/manageengine-security-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-19599: CRITICAL RCE in ManageEngine OpManager MSP (<12.8.711). Improper OS command neutralization enables remote command execution (CVSS 9.9). Upgrade to 12.8.711+ ASAP. https://radar.offseq.com/threat/cve-2026-19599-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-d62870fccbe1d229 #OffSeq #Vuln #InfoSec #RCE

CVE-2026-18169: CRITICAL path traversal in IBM FTM for RedHat OpenShift 4.0.6.0 (CVSS 9.9) 🕵️‍♂️. Authenticated attackers can access sensitive info via symlink abuse. Restrict access & monitor logs. Patch status unknown. https://radar.offseq.com/threat/cve-2026-18169-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-871a1d481ef78ea0 #OffSeq #IBM #CVE202618169 #Infosec

🟠 CVE-2026-77322 - High (7.5)

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before Pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77322/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61714 - High (7.8)

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91809 - High (7.8)

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91809/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 Check Point Zero-Days in Management Servers and VPNs Under Active Attack

CISA KEV Alert: Two critical Check Point zero-days (CVE-2026-93616 & CVE-2026-85102) are under active attack. Flaws in Management Servers & VPN gateways allow RCE. Patch immediately. #CyberSecurity #Vulnerability #CheckPoint #PatchNow

🔗 https://cyber.netsecops.io/articles/check-point-zero-days-cve-2026-93616-cve-2026-85102-under-active-attack/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 New security advisory:

CVE-2026-93616 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-93616-check-point-management-server-exploited-in-the-wild-poc

by Yazoul AI

#CVE #VulnerabilityManagement #CyberSec

Check Point Emergency Alert: Critical Management Server Zero-Day Is Being Exploited in the Wild + Video

Check Point Emergency Alert: Critical Management Server Zero-Day Is Being Exploited in the Wild A Critical Warning for Security Teams Check Point has issued an urgent security warning after confirming exploitation of a critical vulnerability in its Security Management infrastructure. Tracked as CVE-2026-93616, the flaw carries a CVSS score of 9.8 and can allow an…

https://undercodenews.com/check-point-emergency-alert-critical-management-server-zero-day-is-being-exploited-in-the-wild-video/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0922] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0922)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85102 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85102)
- Name: Check Point Multiple Products Improper Certificate Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102

⚠️ CVE-2026-93616 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93616)
- Name: Check Point Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000171/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93616

⚠️ CVE-2026-93952 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93952)
- Name: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Arista
- Product: VeloCloud Orchestrator
- Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93952

⚠️ CVE-2026-94127 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-94127)
- Name: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: F5
- Product: BIG-IP APM
- Notes: For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260922 #cisa20260922 #cve_2026_85102 #cve_2026_93616 #cve_2026_93952 #cve_2026_94127 #cve202685102 #cve202693616 #cve202693952 #cve202694127

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616

#CyberSecurity #ZeroDay #CheckPoint #Vulnerability #ActiveExploitation #PatchedOrPerish (3/3)

Meanwhile a second zero-day, CVE-2026-93616, materialized in Security Management with its own handful of pinpointed hits.

Policy dictates we inform you patches now exist for both CVE-2026-85102 and CVE-2026-93616. Policy does not require we feel bad about what happens next if you ignore them. Install both immediately.

Reward: Compliance logged. Outcome: your problem. (2/3)

Check Point has disclosed a zero-day (in Security Management Server) and marked an older bug also as exploited in the wild (in Site-to-Site VPN)

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

CVE ID: CVE-2026-93616
Vendor: Check Point
Product: Multiple Products
Date Added: 2026-09-22
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-93616

🚨 Check Point patches Management Server zero-day exploited in attacks
⠀
Check Point has released fixes for CVE-2026-93616, a vulnerability that allows unauthenticated attackers to upload and execute arbitrary scripts on affected management servers.
⠀
The company says a small number of customers have already been attacked.
⠀
Affected products include:

• Security Management Server
• Multi-Domain Security Management Server
• Log Server
• Multi-Domain Log Server
• SmartEvent
⠀
The vulnerability carries a CVSS score of 9.8.
⠀
Check Point advises installing the applicable fixes, restricting management access to trusted IP addresses, and checking for signs of exploitation.
⠀
LivePatch Take 28/29 does not fix this vulnerability.

Source: https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/

A critical exploited Check Point Management vulnerability (CVE-2026-93616) allows attackers to execute arbitrary scripts. Secure your servers now.

#CheckPoint #CVE202693616 #Cybersecurity #InfoSec #Vulnerability #RCE

https://securityonline.info/exploited-cve-2026-93616-checkpoint-scripts/?utm_source=mastodon&utm_medium=jetpack_social

Check Point Quantum Security Management is affected by CVE-2026-93616 (CRITICAL, CVSS 9.8): unauthenticated attackers can upload & execute scripts via path traversal. Restrict access & monitor activity until patch info is released. https://radar.offseq.com/threat/cve-2026-93616-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-4344dfa6a4d98182 #OffSeq #CheckPoint #CyberAlert

Fast FAC1203R Gigabit Edition v2.0.4 hit by CRITICAL stack-based buffer overflow (CVE-2026-96257). Remote, unauthenticated RCE possible. Exploit is public, no patch exists — restrict access to Device Discovery Service now. https://radar.offseq.com/threat/cve-2026-96257-stack-based-buffer-overflow-in-fast-fac1203r-gigabit-edition-4657d2bb397c7614 #OffSeq #CVE #Infosec

CVE-2026-19202: CRITICAL vuln in Google mcp-toolbox-sdk-python (v0 – 1.1.0). Shared cache flaw lets Google ID tokens be reused across audiences — risk of token replay & impersonation. Patch pending. Details: https://radar.offseq.com/threat/cve-2026-19202-cwe-524-use-of-a-shared-cache-with-insufficient-key-granularity-in-google-mcp-toolbox-9bc343c3bcd3d35b #OffSeq #infosec #CVE202619202 #Python

📰 F5 BIG-IP APM Zero-Day (CVE-2026-94127) Actively Exploited for RCE

F5 BIG-IP APM is being actively exploited via a critical RCE zero-day (CVE-2026-94127). CISA has added it to the KEV catalog, mandating an urgent patch. The flaw affects systems with a specific OAuth config. #F5 #BIGIP #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/f5-patches-critical-big-ip-apm-zero-day-cve-2026-94127-under-active-exploitation/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🔴 New security advisory:

CVE-2026-94127 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-94127-big-ip-apm-unauthenticated-rce-exploited-in-the-wild

by Yazoul AI

#InfoSec #PatchNow #InfoSecCommunity

F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks

F5가 BIG-IP Access Policy Manager(APM)의 OAuth Authorization Server 구성에서 원격 코드 실행(RCE)으로 악용 중인 제로데이 CVE-2026-94127 패치를 배포했다. 영향을 받는 환경은 APM 액세스 정책과 OAuth 프로파일을 가상 서버에 함께 설정한 경우이며, OAuth Client 또는 Resource Server로만 사용하는 배포는 영향 범위에서 제외된다. 관리자는 즉시 보안 업데이트를 적용하고...

https://www.bleepingcomputer.com/news/security/f5-warns-of-big-ip-apm-remote-code-execution-zero-day-exploited-in-attacks/

Critical F5 BIG-IP APM Zero-Day Exploited for Unauthenticated Remote Code Execution + Video

Introduction A critical vulnerability in F5 BIG-IP Access Policy Manager (APM) is now being exploited in the wild as a zero-day, according to warnings from F5 and the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Tracked as CVE-2026-94127, the flaw carries a CVSS score of 9.8 and can allow an unauthenticated attacker to execute code remotely. The vulnerability is…

https://undercodenews.com/critical-f5-big-ip-apm-zero-day-exploited-for-unauthenticated-remote-code-execution-video/?utm_source=mastodon&utm_medium=jetpack_social

🏆 New Achievement! Terms and Conditions of Your Own Destruction!

LOOTBOX DISCLAIMER: By operating F5 BIG-IP APM versions 21.1.0, 17.5.0–17.5.1, or 17.1.0–17.1.3, you have automatically entered our Unauthenticated Remote Code Execution Sweepstakes. Prizes are awarded via CVE-2026-94127, targeting the OAuth Authorization Server component. Odds of receiving a prize are classified as "active exploitation." The System does not guarantee prize desirability. (1/3)

F5 BIG-IP APM (OAuth Authorization Server) is facing a CRITICAL RCE zero-day, CVE-2026-94127, with active exploitation. Versions 21.1.0, 17.5.0 – 17.5.1, 17.1.0 – 17.1.3 affected. Apply hotfixes now. Details: https://radar.offseq.com/threat/critical-f5-big-ip-vulnerability-exploited-as-zero-day-024f528e7ee83eed #OffSeq #F5 #ZeroDay #Infosec

F5 BIG-IP Zero-Day Under Active Attack: Critical APM Flaw Enables Unauthenticated Remote Code Execution + Video

A Critical Vulnerability Has Become an Immediate Security Priority F5 has disclosed a critical vulnerability in BIG-IP Access Policy Manager (APM) that is already being exploited in the wild, creating an urgent patching situation for organizations using a specific OAuth configuration. Tracked as CVE-2026-94127, the vulnerability carries a CVSS v3.1 score of…

https://undercodenews.com/f5-big-ip-zero-day-under-active-attack-critical-apm-flaw-enables-unauthenticated-remote-code-execution-video/?utm_source=mastodon&utm_medium=jetpack_social

🏆 New Achievement! Terms and Conditions of Your Own Destruction!

LOOTBOX DISCLAIMER: By operating F5 BIG-IP APM versions 21.1.0, 17.5.0–17.5.1, or 17.1.0–17.1.3, you have automatically entered our Unauthenticated Remote Code Execution Sweepstakes. Prizes are awarded via CVE-2026-94127, targeting the OAuth Authorization Server component. Odds of receiving a prize are classified as "active exploitation." The System does not guarantee prize desirability. (1/3)

F5 BIG-IP APM (OAuth Authorization Server) is facing a CRITICAL RCE zero-day, CVE-2026-94127, with active exploitation. Versions 21.1.0, 17.5.0 – 17.5.1, 17.1.0 – 17.1.3 affected. Apply hotfixes now. Details: https://radar.offseq.com/threat/critical-f5-big-ip-vulnerability-exploited-as-zero-day-024f528e7ee83eed #OffSeq #F5 #ZeroDay #Infosec

F5 patched CVE-2026-94127, a heap-based buffer overflow in BIG-IP APM when operating as OAuth Authorization Server, enabling remote code execution. Active zero-day exploitation poses high risk of full appliance compromise. Patch immediately and review for crafted malicious traffic. #F5BigIp #ZeroDay #RemoteCodeExecution

https://cyberworldops.eu/en/actively-exploited-big-ip-apm-flaw-gives-remote-attackers-a-path-to

Der Hersteller F5 veröffentlichte ein Advisory zu einer ausgenutzten Zero-Day Schwachstelle in seinem Produkt BIG-IP Access Policy Manager (APM) zur sicheren Zugriffsteuerung und Anwendungszugriff: CVE-2026-94127, CVSS-Score 9.8/10 ("kritisch")

F5 gibt an, dass die Schwachstelle bereits aktiv ausgenutzt wird. IT-Sicherheitsverantwortliche sollten unverzüglich die Patchstände prüfen und, sofern erforderlich, die verfügbaren Engineering Hotfixes einspielen.

👉️ https://www.bsi.bund.de/dok/1209384

CVE-2026-94127: Critical zero-day in F5 BIG-IP APM exploited for RCE on OAuth Authorization Servers. Patch urgently or use F5's iRule mitigation. Monitor for OAuth auth failures and TMM SIGABRTs. https://radar.offseq.com/threat/f5-patches-big-ip-apm-zero-day-flaw-exploited-in-rce-attacks-191545153729ae57 #OffSeq #F5 #ZeroDay #RCE #Vuln

🚨 [CISA-2026:0922] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0922)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85102 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85102)
- Name: Check Point Multiple Products Improper Certificate Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102

⚠️ CVE-2026-93616 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93616)
- Name: Check Point Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000171/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93616

⚠️ CVE-2026-93952 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93952)
- Name: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Arista
- Product: VeloCloud Orchestrator
- Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93952

⚠️ CVE-2026-94127 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-94127)
- Name: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: F5
- Product: BIG-IP APM
- Notes: For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260922 #cisa20260922 #cve_2026_85102 #cve_2026_93616 #cve_2026_93952 #cve_2026_94127 #cve202685102 #cve202693616 #cve202693952 #cve202694127

When it rains, it pours. F5 BIG-IP APM also has an exploited CVE!

https://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855

#ThreatIntel #ThreatIntelligence #IFIN

CVE ID: CVE-2026-94127
Vendor: F5
Product: BIG-IP APM
Date Added: 2026-09-22
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-94127

An exploited BIG-IP APM vulnerability tracked as CVE-2026-94127 allows RCE attacks. Secure your BIG-IP APM vulnerability deployments with new F5 hotfixes.

#F5 #BIGIP #CVE202694127 #Cybersecurity #InfoSec #RCE #Vulnerability

https://securityonline.info/big-ip-apm-vulnerability-cve-2026-94127/?utm_source=mastodon&utm_medium=jetpack_social

EITW 0day in F5 APM.

https://my.f5.com/manage/s/article/K000162605

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). (CVE-2026-94127)

This vulnerability allows an unauthenticated attacker to perform RCE. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.

🟠 CVE-2026-91811 - High (7.8)

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an app...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91811/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91818 - High (7.8)

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91818/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81657 - Critical (9.8)

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-80442 - Critical (9.9)

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confiden...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80442/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SolarWinds Fixes Critical Observability RCE Flaws That Could Enable Unauthenticated System Compromise

SolarWinds Releases Emergency Security Update SolarWinds has released Observability Self-Hosted 2026.2.3 to address two serious remote code execution vulnerabilities that could allow unauthenticated attackers to compromise affected deployments. Tracked as CVE-2026-28324 and CVE-2026-28325, the vulnerabilities carry CVSS scores of 9.8 and 8.8, respectively. Both were…

https://undercodenews.com/solarwinds-fixes-critical-observability-rce-flaws-that-could-enable-unauthenticated-system-compromise/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-18162: IBM FTM for RedHat OpenShift v4.0.6.0 has a CRITICAL code injection flaw (CVSS 9.8). Remote attackers can execute arbitrary code via improper input neutralization. No patch yet — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-18162-cwe-94-improper-control-of-generation-of-code-code-injection-in-ibm-financial-7385d789acb1bf6d #OffSeq #CVE202618162 #IBM #RCE

CVE-2026-18163 (CRITICAL, CVSS 9.8): IBM FTM for RedHat OpenShift v4.0.6.0 has a deserialization vulnerability enabling remote code execution without auth. Restrict access & monitor activity. Patch status unconfirmed. https://radar.offseq.com/threat/cve-2026-18163-cwe-502-deserialization-of-untrusted-data-in-ibm-financial-transaction-manager-ftm-for-0a85c82f9c689e03 #OffSeq #CVE202618163 #IBM #InfoSec 🛡️

Go hack more GitHub shit.

https://nvd.nist.gov/vuln/detail/cve-2026-77987

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

sev:CRIT 9.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA reports CVE-2026-88020, XSS in OpenPLC Runtime v3 6.1. Theft of an operator session cookie can enable state-changing requests and PLC-level control. Exposure of OT web interfaces significantly raises impact. #IcsSecurity #OtSecurity #Xss

https://cyberworldops.eu/en/openplc-web-flaw-could-turn-a-stolen-session-into-industrial-process

CISA reports CVE-2026-88020, XSS in OpenPLC Runtime v3 6.1. Theft of an operator session cookie can enable state-changing requests and PLC-level control. Exposure of OT web interfaces significantly raises impact. #IcsSecurity #OtSecurity #Xss

https://cyberworldops.eu/en/openplc-web-flaw-could-turn-a-stolen-session-into-industrial-process

🟠 CVE-2026-88419 - High (8.8)

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SolarWinds Fixes Critical Observability RCE Flaws That Could Enable Unauthenticated System Compromise

SolarWinds Releases Emergency Security Update SolarWinds has released Observability Self-Hosted 2026.2.3 to address two serious remote code execution vulnerabilities that could allow unauthenticated attackers to compromise affected deployments. Tracked as CVE-2026-28324 and CVE-2026-28325, the vulnerabilities carry CVSS scores of 9.8 and 8.8, respectively. Both were…

https://undercodenews.com/solarwinds-fixes-critical-observability-rce-flaws-that-could-enable-unauthenticated-system-compromise/?utm_source=mastodon&utm_medium=jetpack_social

SolarWinds Observability vulnerabilities allow RCE via CVE-2026-28324. Update to version 2026.2.3 to secure your monitoring infrastructure today.

#SolarWinds #Cybersecurity #CVE202628324 #CVE202628325 #RCE #Infosec

https://securityonline.info/solarwinds-observability-vulnerabilities-fixed/?utm_source=mastodon&utm_medium=jetpack_social

https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28324

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.

sev:CRIT 9.8 - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Go hack more MQTT shit.

https://nvd.nist.gov/vuln/detail/cve-2026-87121

🔴 CVE-2026-87121 - Critical (9.8)

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Arista Patches Actively Exploited VeloCloud Zero-Day as CISA Issues Urgent Warning + Video

A Critical Vulnerability Puts On-Premises VeloCloud Orchestrators Under Attack Arista Networks has released security updates for a maximum-severity zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments after confirming that attackers are actively exploiting the flaw in the wild. Tracked as CVE-2026-93952, the vulnerability is an improper input validation…

https://undercodenews.com/arista-patches-actively-exploited-velocloud-zero-day-as-cisa-issues-urgent-warning-video/?utm_source=mastodon&utm_medium=jetpack_social

Arista Disrupts Actively Exploited Zero-Day in VeloCloud Orchestrator

Arista Networks has sounded the alarm on a critical zero-day vulnerability, CVE-2026-93952, that's being actively exploited in the wild, allowing attackers to access sensitive internal functionality in VeloCloud Orchestrator. This severe flaw can be easily exploited with low complexity, making it a high-risk threat.

https://osintsights.com/arista-disrupts-actively-exploited-zero-day-in-velocloud-orchestrator?utm_source=mastodon&utm_medium=social

#ZeroDay #Cve202693952 #VelocloudOrchestrator #AristaNetworks #SupplyChain

Arista Warns of Actively Exploited VeloCloud Zero-Day With CVSS 100 Severity + Video

A Critical Vulnerability Has Been Confirmed Arista has released urgent security fixes for CVE-2026-93952, a critical vulnerability affecting VeloCloud Orchestrator (VCO) on-premises deployments. The company says the flaw is actively exploited in the wild, making this more than a theoretical security issue. Arista Networks The vulnerability carries a CVSS v3.1 score of 10.0, the highest…

https://undercodenews.com/arista-warns-of-actively-exploited-velocloud-zero-day-with-cvss-100-severity-video/?utm_source=mastodon&utm_medium=jetpack_social

Arista VeloCloud Orchestrator Hit by Actively Exploited CVSS 10 Zero-Day — Administrators Urged to Patch Immediately + Video

Critical Zero-Day Targets VeloCloud Management Infrastructure Arista Networks has released emergency security updates for a critical-severity zero-day vulnerability in on-premises VeloCloud Orchestrator (VCO), the centralized management platform used to configure, monitor, and orchestrate VeloCloud SD-WAN Edge devices. Tracked as CVE-2026-93952,…

https://undercodenews.com/arista-velocloud-orchestrator-hit-by-actively-exploited-cvss-10-zero-day-administrators-urged-to-patch-immediately-video/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-93952: CRITICAL zero-day in Arista VeloCloud Orchestrator (on-prem <5.2.3.16, <6.4.2.8) is actively exploited. Remote attackers can access privileged functions w/o creds. Patch now — review logs for signs of compromise. https://radar.offseq.com/threat/arista-urges-immediate-patching-of-exploited-vco-zero-day-0c28c2caa003025a #OffSeq #Arista #ZeroDay #Infosec

Arista confirmed active exploitation of a CVSS 10 VeloCloud Orchestrator vulnerability (CVE-2026-93952) affecting certificate-based SD-WAN setups. Patch now.

#VeloCloud #Arista #CVE202693952 #SDWAN #Vulnerability #CyberSecurity

https://meterpreter.org/arista-velocloud-orchestrator-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Completing our tour of new known-exploited vulns today, here is Arista's perfect-10.

https://ifin.network/t/arista-cve-2026-93952-auth-bypass-exploited-in-the-wild/856

#ThreatIntel #ThreatIntelligence #IFIN

🚨 [CISA-2026:0922] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0922)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85102 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85102)
- Name: Check Point Multiple Products Improper Certificate Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102

⚠️ CVE-2026-93616 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93616)
- Name: Check Point Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Check Point
- Product: Multiple Products
- Notes: https://support.checkpoint.com/results/sk/sk1000171/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93616

⚠️ CVE-2026-93952 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93952)
- Name: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Arista
- Product: VeloCloud Orchestrator
- Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93952

⚠️ CVE-2026-94127 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-94127)
- Name: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: F5
- Product: BIG-IP APM
- Notes: For temporary mitigation to allow for proactive forensic triage, apply the vendor-provided iRule. Once completed, install the final vendor patch as soon as possible. For more information please see: https://my.f5.com/manage/s/article/K000162605 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-94127

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260922 #cisa20260922 #cve_2026_85102 #cve_2026_93616 #cve_2026_93952 #cve_2026_94127 #cve202685102 #cve202693616 #cve202693952 #cve202694127

CVE ID: CVE-2026-93952
Vendor: Arista
Product: VeloCloud Orchestrator
Date Added: 2026-09-22
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-93952

Arista disclosed active exploitation of CVE-2026-93952, a CVSS 10.0 unauthenticated flaw in on-prem VeloCloud Orchestrator with certificate authentication enabled. Compromise of the management plane risks full SD-WAN Edge control and lateral movement. Isolate exposed instances and hunt for abuse. #VeloCloud #ThreatIntel #InfoSec

https://cyberworldops.eu/en/active-attacks-target-certificate-enabled-velocloud-orchestrator

🏆 New Achievement! Exceeds Expectations (Except Security)!

Thank you for joining us for your annual review, Arista VeloCloud Orchestrator team. Uptime? Stellar. Throughput? Impressive. Unauthorized remote access granted to unauthenticated strangers due to CVE-2026-93952, a CVSS 10.0 critical improper-input-validation flaw currently being actively exploited in the wild? That's a "needs improvement," and frankly it drags down the whole scorecard.

Full system compromise is on the table. (1/2)

CVE-2026-93952 (CRITICAL, CVSS 10) impacts Arista VeloCloud Orchestrator (On-Prem) via improper input validation. Remote, unauthenticated access may lead to full system compromise. Patch urgently. https://radar.offseq.com/threat/cve-2026-93952-cwe-20-improper-input-validation-in-arista-networks-velocloud-orchestrator-vco-on-prem-25dafe8f246f1077 #OffSeq #CVE #infosec #Vulnerability

An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop active attacks.

#VeloCloud #Arista #CVE202693952 #ZeroDay #Cybersecurity #Infosec

https://securityonline.info/velocloud-vulnerability-cve-2026-93952/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patched 20 CVEs in ISE (12 critical), 18 in FMC (8 critical) and 6 in Nexus Dashboard. Three ISE flaws CVE-2026-20282, CVE-2026-20283 and CVE-2026-20284 are exploited, allowing takeover of identity and firewall management. Patch immediately and hunt for compromise. #CiscoSecurity #NetworkSecurity #VulnManagement

https://cyberworldops.eu/en/cisco-fixes-critical-ise-fmc-and-nexus-dashboard-flaws-as-exploited

🟠 CVE-2026-94540 - High (7.7)

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local servi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94501 - High (8.8)

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94501/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94626 - High (7.5)

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggreg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94626/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

An exploited WordPress RCE vulnerability (CVE-2026-87902) is under attack. Details and PoC exploit code are public. Patch your sites now.

#WordPress #CVE202687902 #RCE #Cybersecurity #Infosec #ZeroDay

https://securityonline.info/exploited-wordpress-rce-vulnerability-poc/?utm_source=mastodon&utm_medium=jetpack_social

WordPress 712 Emergency Update Fixes Critical RCE Vulnerability Affecting Versions Back to 47

WordPress has released version 7.1.2, a security update addressing a critical vulnerability that could allow an unauthenticated remote attacker to execute arbitrary PHP code on vulnerable websites under specific server and theme configurations. Tracked as CVE-2026-87902 and GHSA-7hp8-65ch-5whp, the vulnerability has received a CVSS v4 score of 9.2, placing it firmly in the…

https://undercodenews.com/wordpress-712-emergency-update-fixes-critical-rce-vulnerability-affecting-versions-back-to-47/?utm_source=mastodon&utm_medium=jetpack_social

An exploited WordPress RCE vulnerability (CVE-2026-87902) is under attack. Details and PoC exploit code are public. Patch your sites now.

#WordPress #CVE202687902 #RCE #Cybersecurity #Infosec #ZeroDay

https://securityonline.info/exploited-wordpress-rce-vulnerability-poc/?utm_source=mastodon&utm_medium=jetpack_social

WordPress unauthenticated LFI to RCE PoC https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab

新内容：《WordPress 爆出 9.2 分严重安全漏洞｜CVE-2026-87902》
https://www.appinn.com/wordpress-cve-2026-87902-critical-vulnerability/
2026年9月23日，WordPress 爆出 9.2 分的严重安全漏洞，攻击者无需登录即可在服务器上运行代码。漏洞编号 CVE-2026-87902，请务必升级至最新版本 7.1.2。@appinn 根据 W3Techs 2026 年 9 月 22 日的最新统计，全球约 40.2% 的网站都在使用

WordPress patched a critical unauthenticated path traversal vulnerability (CVE-2026-87902, GHSA-7hp8-65ch-5whp, CVSS 9.2) in its page-template resolution function get_page_template(), discovered and responsibly disclosed by Robert Ressl. Under specific preconditions, such as an active theme with a top level directory starting with "page-" and a readable local PHP file usable for the pearcmd.php PEAR RCE chain, an attacker could achieve remote code execution with no authentication. WordPress 7.1.2 fixes the issue, and the patch has been backported to every supported branch back to 4.7.37, so all sites should update immediately.

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

#InfoSec #WordPress #Vulnerability #CVE

WordPress 7.1.2 patches a critical WordPress RCE vulnerability (CVE-2026-87902). Update your site to prevent conditional remote code execution.

#WordPress #CVE202687902 #RCE #Cybersecurity #Infosec #WordPressSecurity

https://securityonline.info/wordpress-rce-vulnerability-cve-2026-87902/?utm_source=mastodon&utm_medium=jetpack_social

Service notice: all hosted/maintained WP websites have been updated to the latest minor version of your current major branch (security release, CVE-2026-87902). No action needed from you!

I don't host or maintain your website? Be sure to update your WordPress ASAP. This one is critical.

Release notes → https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

#WordPress #Security #Critical #Cyberia

🟠 CVE-2026-88407 - High (7.5)

An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88407/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88409 - High (8.8)

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Exim 4.100.1 patches a serious Exim vulnerability set: Proxy Protocol heap flaws, a GnuTLS use-after-free, and SMTP smuggling (CVE-2026-94054). Upgrade now.

#Exim #EximVulnerability #SMTPsmuggling #ProxyProtocol #MailServerSecurity #CVE202694054

https://securityonline.info/exim-4-100-1-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

ZTE SmartHome Account Takeover: Password Reset Without Verification Code. 4 CVEs, 100K+ Android Downloads - CVE-2026-86553 https://minanagehsalalma.github.io/zte-smartlife-app-pwned/

🟠 CVE-2026-11726 - High (8.1)

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-11727 - High (8.1)

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85279 - High (8.6)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New advisory

CRITICAL: CVE-2026-84388: Fortinet Fortipam Chrome Extension: https://app.opencve.io/cve/?vendor=fortinet&product=fortipam_chrome_extension #Fortinet #Chrome #infosec #vulnerability

🟠 CVE-2026-88411 - High (7.5)

Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89275 - Critical (10)

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93345 - High (7.5)

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REA...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-94099 | Netcore NBR200V2 (1.3.241127.071246): CRITICAL command injection via restore.cgi (QUERY_STRING). Remote exploit, no patch, vendor silent. Isolate devices & monitor logs. https://radar.offseq.com/threat/cve-2026-94099-command-injection-in-netcore-nbr200v2-adc35b079f75e0e5 #OffSeq #Netcore #CVE202694099 #infosec

🔴 CVE-2026-94099 - Critical (9.9)

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERY_STRING results in comman...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94099/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81180 SysReptor: authed users chain Ghostscript image processing with a GnuPG temp-dir race to inject Python into app code, leading to RCE. CVSS 8.8, no patch yet. Restrict uploads and isolate temp dirs until a fix https://www.valtersit.com/cve/CVE-2026-81180/ #CVE #infosec #SysReptor

🟠 CVE-2026-81180 - High (8.8)

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-57227 Suricata MQTT parser DoS, CVSS 7.5. Unbounded PUBREC/PUBREL floods grow transaction state until CPU and memory exhaust. No patch confirmed yet. Update Suricata immediately. https://www.valtersit.com/cve/CVE-2026-57227/ #CVE #infosec #Suricata

Technical details and a PoC for the D-Link DAP-1360 vulnerability (CVE-2026-95675) are public. Learn how this unauthenticated flaw impacts legacy routers.

#DLink #DAP1360 #CVE202695675 #RCE #RouterSecurity #Cybersecurity

https://securityonline.info/d-link-dap-1360-vulnerability-poc/?utm_source=mastodon&utm_medium=jetpack_social

NVIDIA patched critical NVIDIA Infrastructure Controller vulnerabilities across Linux builds. Learn how CVE-2026-65113 impacts systems and update now.

#NVIDIA #Cybersecurity #CVE202665113 #LinuxSecurity #Infosec #DataCenter

https://securityonline.info/nvidia-infrastructure-controller-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-88406 - High (7.5)

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-09-14 - 2026-09-14)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 478
- High: 2067
- Medium: 1314
- Low: 307
- None: 680

Status:
- : 35
- Analyzed: 339
- Awaiting Analysis: 1126
- Deferred: 1117
- Modified: 32
- Received: 1943
- Rejected: 28
- Undergoing Analysis: 226

CISA KEVs:
- CISA-2026:0914 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0914)
- CISA-2026:0916 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0916)
- CISA-2026:0918 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0918)

Top CNAs:
- kernel.org: 878
- Oracle: 634
- GitHub, Inc.: 587
- VulnCheck: 434
- Apple Inc.: 246
- VulDB: 243
- IBM Corporation: 174
- WPScan: 151
- Wordfence: 128
- MITRE: 106

Top Affected Products:
- UNKNOWN: 3691
- Apple Macos: 214
- Apple Iphone Os: 132
- Apple Ipados: 132
- Apple Visionos: 95
- Apple Watchos: 81
- Apple Tvos: 78
- Oracle Hyperion Financial Management: 70
- Google Android: 47
- Google Chrome: 46

Top EPSS Score:
- CVE-2026-76698 - 4.11 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76698)
- CVE-2026-89308 - 2.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-89308)
- CVE-2026-90702 - 2.80 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-90702)
- CVE-2026-90703 - 2.80 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-90703)
- CVE-2026-92398 - 2.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-92398)
- CVE-2026-92397 - 2.30 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-92397)
- CVE-2026-27560 - 2.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27560)
- CVE-2026-27561 - 2.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27561)
- CVE-2026-27562 - 2.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27562)
- CVE-2026-90847 - 2.18 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-90847)

#ZEN #SecDB #InfoSec

🟠 CVE-2026-73512 - High (7.5)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73512/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

ManageEngine ADSelfService Plus Vulnerability Lets Attackers Execute Code as SYSTEM Before Windows Login + Video

A Critical Weakness at the Windows Sign-In Screen ManageEngine has addressed a high-severity remote code execution vulnerability in ADSelfService Plus that could allow an attacker with physical access to a Windows computer to execute arbitrary code with NT AUTHORITY\SYSTEM privileges—even before a legitimate user signs in. Tracked as CVE-2026-74849, the…

https://undercodenews.com/manageengine-adselfservice-plus-vulnerability-lets-attackers-execute-code-as-system-before-windows-login-video/?utm_source=mastodon&utm_medium=jetpack_social

A critical ManageEngine ADSelfService Plus vulnerability (CVE-2026-74849) allows system compromise. Update to build 7001 to secure your endpoints.

#ManageEngine #ADSelfServicePlus #CVE202674849 #Cybersecurity #Infosec #RCE

https://securityonline.info/manageengine-adselfservice-plus-vulnerability-cve-2026-74849/?utm_source=mastodon&utm_medium=jetpack_social

Qualcomm Snapdragon devices hit by CRITICAL CVE-2026-25254: improper authorization in SocketIO allows unauthenticated RCE. No patch yet; monitor advisories and review exposure. CVSS 9.8. https://radar.offseq.com/threat/cve-2026-25254-cwe-285-improper-authorization-in-qualcomm-inc-snapdragon-b8f8f52a617468af #OffSeq #CVE202625254 #Snapdragon #Infosec #Vuln

Zyxel GS1900 Switches Targeted by Chinese Threat Actor in Data Theft Campaign

Zyxel GS1900 series switches are under active exploitation by a Chinese threat actor using a high-severity buffer overflow (CVE-2026-7273) to steal sensitive data from nearly 1,000 devices worldwide. The campaign has compromised government records and relies on unpatched firmware and default credentials to gain system control.

**If you have Zyxel GS1900 series switches, make sure their management interface is isolated from the internet, accessible from trusted networks only and all default passwords are changed. Then update the firmware to version 2.90(xxxx.2)C0 or later ASAP and check the switches for signs of breach. Attackers are actively exploiting this flaw.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/zyxel-gs1900-switches-targeted-by-chinese-threat-actor-in-data-theft-campaign-y-6-z-t-u/gD2P6Ple2L

Zyxel GS1900 Switches Targeted by Chinese Threat Actor in Data Theft Campaign

Zyxel GS1900 series switches are under active exploitation by a Chinese threat actor using a high-severity buffer overflow (CVE-2026-7273) to steal sensitive data from nearly 1,000 devices worldwide. The campaign has compromised government records and relies on unpatched firmware and default credentials to gain system control.

**If you have Zyxel GS1900 series switches, make sure their management interface is isolated from the internet, accessible from trusted networks only and all default passwords are changed. Then update the firmware to version 2.90(xxxx.2)C0 or later ASAP and check the switches for signs of breach. Attackers are actively exploiting this flaw.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/zyxel-gs1900-switches-targeted-by-chinese-threat-actor-in-data-theft-campaign-y-6-z-t-u/gD2P6Ple2L

The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating system (OS) command execution. https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html

CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 CGI handling, to KEV on Sept 21, 2026 after confirmed active exploitation. Unauthenticated LAN HTTP requests can yield OS command execution, risking switch takeover and lateral movement. #Zyxel #KnownExploitedVulnerabilities #NetworkSecurity

https://cyberworldops.eu/en/actively-exploited-zyxel-switch-flaw-triggers-three-day-federal-patch

Zyxel GS1900 switches (CVE-2026-7273) and Veeam Agent for Microsoft Windows (CVE-2026-32996) are under active exploitation. The former allows unauthenticated LAN command execution via CGI buffer overflow, the latter enables SYSTEM-level access on endpoints. Both expand persistence and backup tampering risk. #Zyxel #Veeam #ThreatIntel #VulnManagement

https://cyberworldops.eu/en/active-attacks-put-zyxel-switches-and-veeam-protected-windows

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-7273 – Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Analyze the executive impact of CVE-2026-7273 with our strategic Zyxel CSUITE brief, covering zero-trust network segmentation, asset risk assessment, and CISA compliance....

https://thecybermind.co/18gk

🚨 [CISA-2026:0921] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0921)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-7273 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-7273)
- Name: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zyxel
- Product: GS1900 Series Switches
- Notes: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-7273

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260921 #cisa20260921 #cve_2026_7273 #cve20267273

CVE ID: CVE-2026-7273
Vendor: Zyxel
Product: GS1900 Series Switches
Date Added: 2026-09-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7273

Privilege escalation (CRITICAL, CVE-2026-13355) in Meta Box Frontend Submission <=4.5.6 & User Profile <=3.11.0 lets unauthenticated attackers gain admin on WordPress. Patch status TBD — restrict plugin use & monitor activity. Details: https://radar.offseq.com/threat/cve-2026-13355-cwe-269-improper-privilege-management-in-meta-box-meta-box-frontend-submission-7d7ee5c391cbe4a8 #OffSeq #WordPress #CVE2026_13355

LiquidWeb Give Tributes <=2.3.1 is vulnerable (CVE-2026-19658, CRITICAL) to PHP Object Injection via unsafe deserialization. Only exploitable if a POP chain is present from other plugins/themes. Mitigate by disabling "Allow Multiple Recipients" or enabling eCard msg. https://radar.offseq.com/threat/cve-2026-19658-cwe-502-deserialization-of-untrusted-data-in-liquidweb-give-tributes-10b75c50779a09c2 #OffSeq #WordPress #CVE202619658

sev:CRIT bypass of CVE-2026-47065 in Apache MINA.

https://nvd.nist.gov/vuln/detail/cve-2026-94301

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

CVE-2026-94493 (CRITICAL, CVSS 10) in Gigatech PDV5701 1.0.31_240305_112640: WebSocket Service has missing authentication. Remote exploit is public, no vendor fix. Isolate devices, monitor for attacks. https://radar.offseq.com/threat/cve-2026-94493-missing-authentication-in-gigatech-pdv5701-0475e74be58ba45f #OffSeq #CVE #IoTSecurity

🟠 CVE-2026-94627 - High (7.5)

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by subm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94425 - High (8.8)

A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94425/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-94425 (CRITICAL, CVSS 9.3) hits Moore Threads MTT S80 Driver v340.150 🛡️. Improper privilege management in IOCTL Handler allows local escalation. No patch yet. Limit local access & monitor! https://radar.offseq.com/threat/cve-2026-94425-improper-privilege-management-in-moore-threads-mtt-s80-driver-package-4eb3a6d262c0dea2 #OffSeq #Vuln #PrivilegeEscalation #Infosec

🟠 CVE-2026-94624 - High (7.5)

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94623 - High (7.5)

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94623/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Canonical Patches Critical Trust Store Poisoning Flaw in ADSys

Canonical patched a critical vulnerability (CVE-2026-12249) in ADSys that allows attackers to poison the Ubuntu system trust store by intercepting unencrypted certificate enrollment requests. This flaw enables persistent decryption of TLS traffic and full compromise of encrypted communications on affected hosts.

**If you manage Ubuntu machines connected to Active Directory through ADSys, update ADSys to version 0.16.3 or later on all of them. Oder versions fetch certificates over unencrypted HTTP and let an attacker plant a fake root certificate that exposes all encrypted traffic on the machine. After updating, check each machine's trusted certificates for any unfamiliar root certificates and remove them, since a machine that was already compromised stays exposed even after the patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/canonical-patches-critical-trust-store-poisoning-flaw-in-adsys-e-j-r-d-v/gD2P6Ple2L

🟠 CVE-2026-81469 - High (7.8)

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81469/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94497 - High (8.3)

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifier...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94497/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94424 - High (8.8)

A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94411 - High (8.8)

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77560 - High (8.1)

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to byp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94142 - High (8.8)

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argum...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

BioStar Temp Monitor Utility v1.2.1806.2200 hit by CRITICAL CVE-2026-94142 (CVSS 9.3): write-what-where flaw in IOCTL handler. Local attackers can write arbitrary memory. No patch — restrict access. Details: https://radar.offseq.com/threat/cve-2026-94142-write-what-where-condition-in-biostar-temperature-monitor-utility-b89c455f336372e0 #OffSeq #CVE202694142 #infosec #vuln

D-Link warns of two major bugs with public POCs

CVE-2026-86296: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10516

POC: https://tzh00203.notion.site/D-Link-DIR-822A-Stack-Overflow-in-udhcpd-TR-111-Option-125-Parsing-33cb5c52018a80238b80e89e7c7c68f0

CVE-2026-93958: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10518

POC: https://github.com/FoundTL/D-Link-R95-BE9500

CVE-2026-68928: Acode for Android exported TerminalService lets any installed app run arbitrary shell commands via MSG_EXEC. CVSS 8.6. No patch yet - restrict or update now. https://www.valtersit.com/cve/CVE-2026-68928/ #CVE #Android #infosec

Exploit released for unpatched Ubuntu kernel flaw that lets containers root the host (CVE-2026-80521)

https://thecybersecguru.com/news/cve-2026-80521-ubuntu-kernel-container-escape/

Ubuntu Linux Flaw Exposed, Enabling Host-Root Container Escape

A newly discovered Linux kernel flaw, CVE-2026-80521, can allow code running inside a container to gain root access on the host, posing a significant security risk. This alarming vulnerability is just one of nearly 5,700 Linux kernel CVEs published in 2026, a record high.

https://osintsights.com/ubuntu-linux-flaw-exposed-enabling-host-root-container-escape?utm_source=mastodon&utm_medium=social

#LinuxKernelFlaw #UbuntuLinux #Cve202680521 #ContainerSecurity #HostrootContainerEscape

Linux Kernel Container Escape Warning: Unpatched AF_UNIX Flaw Comes With a Working Ubuntu Exploit + Video

A newly disclosed Linux kernel vulnerability is putting containerized workloads under renewed scrutiny after researchers demonstrated that an attacker operating inside a container can potentially escape isolation and obtain root-level control over the host. Tracked as CVE-2026-80521, the vulnerability is a use-after-free condition in the Linux kernel's AF_UNIX…

https://undercodenews.com/linux-kernel-container-escape-warning-unpatched-af_unix-flaw-comes-with-a-working-ubuntu-exploit-video/?utm_source=mastodon&utm_medium=jetpack_social

Exploit released for unpatched Ubuntu kernel flaw that lets containers root the host (CVE-2026-80521)

https://thecybersecguru.com/news/cve-2026-80521-ubuntu-kernel-container-escape/

🔴 CVE-2026-92701 - Critical (9.1)

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body policy before quote valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92701/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Web to Print Online Designer plugin (v1.7.0 – 2.14.9) hit by CRITICAL CVE-2026-82187: unauthenticated attackers can upload & execute arbitrary files (incl. PHP), leading to RCE. Upgrade to 2.15.0+ ASAP. https://radar.offseq.com/threat/cve-2026-82187-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-web-to-print-online-designer-b337972e4836e68c #OffSeq #WordPress #CVE202682187 #RCE

🟠 CVE-2026-87067 - High (8.5)

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-94097 - Critical (10)

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

BioStar BIOS Update Utility 1.9.7.3 hit by CRITICAL CVE-2026-94146: local write-what-where bug in BSMEM64_W10.sys (IOCTL handler). Exploit public; vendor silent. Restrict local access immediately. https://radar.offseq.com/threat/cve-2026-94146-write-what-where-condition-in-biostar-bios-update-utility-47de5318713632c6 #OffSeq #CVE202694146 #bios #infosec

BioStar VIVID LED DJ 4.0.2411.1500 hit by CRITICAL CVE-2026-94128: write-what-where in BS_LED64.sys allows local attackers arbitrary memory writes. No patch — restrict local access, monitor updates. https://radar.offseq.com/threat/cve-2026-94128-write-what-where-condition-in-biostar-vivid-led-dj-0b3addc35127e852 #OffSeq #Vuln #CVE202694128 #PrivilegeEscalation

🟠 CVE-2026-94128 - High (8.8)

A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Netcore NBR200V2 (v1.3.241127.071246) hit by CRITICAL CVE-2026-94101 buffer overflow in /usr/bin/routerd. Remote code exec possible. Public exploit, no patch. Restrict remote access ASAP. https://radar.offseq.com/threat/cve-2026-94101-buffer-overflow-in-netcore-nbr200v2-21b7762bd81c815b #OffSeq #Netcore #RouterSecurity #Infosec

🔴 CVE-2026-94101 - Critical (9.9)

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possib...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94129 - High (8.8)

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress results in write-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-94129 (CRITICAL, CVSS 9.3) impacts BioStar VALKYRIE AURORA 2.10.2411.0800: local write-what-where in IOCTL Handler (BS_RVSIO64.sys) enables privilege escalation. No patch, public exploit exists. Limit local access. https://radar.offseq.com/threat/cve-2026-94129-write-what-where-condition-in-biostar-valkyrie-aurora-a023aa581f42ad11 #OffSeq #CVE #infosec

🔴 CVE-2026-94100 - Critical (9.9)

A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Netcore NBR200V2 v1.3.241127.071246 has a CRITICAL buffer overflow (CVE-2026-94100) in WAN VLAN config. Remotely exploitable, public exploit out. Restrict access — no patch yet. https://radar.offseq.com/threat/cve-2026-94100-buffer-overflow-in-netcore-nbr200v2-9ab8800727104374 #OffSeq #Netcore #CVE202694100 #Infosec

🔴 CVE-2026-94098 - Critical (9.1)

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94098/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-94096 - Critical (9.9)

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94096/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Netcore NBR200V2 (v1.3.241127.071246) hit by CRITICAL (CVSS 9.4) command injection (CVE-2026-94096) in /usr/bin/network_tools. Remote exploit is public, no patch. Isolate devices and monitor traffic. https://radar.offseq.com/threat/cve-2026-94096-command-injection-in-netcore-nbr200v2-73f6afc059a1e2bc #OffSeq #CVE202694096 #Netcore #Infosec

🔴 CVE-2026-94095 - Critical (9.9)

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument ur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94095/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-94089 - Critical (10)

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94036 - High (8.8)

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85017 - High (7.5)

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85017/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-87839 - High (7.5)

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87839/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RE: https://infosec.exchange/@suricata/117309241594395404

https://nvd.nist.gov/vuln/detail/cve-2026-94083

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

https://nvd.nist.gov/vuln/detail/cve-2026-94084

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Suricata Patches Flaws Allowing Network Monitoring Bypass

Suricata 8.0.7 fixes two vulnerabilities (CVE-2026-94084 and CVE-2026-94083) that allow unauthenticated attackers to crash the IDS/IPS engine. These flaws exploit the HTTP/2 and DoH2 parsers to create a monitoring blind spot for network bypass.

**If you run Suricata for network monitoring, update it to version 8.0.7 ASAP. Older versions can be crashed remotely, leaving your network unmonitored and your attack detection blind. Until you patch, closely monitor that the Suricata service is actually running, because an unexpected stop may mean someone is already attacking you.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/suricata-patches-flaws-allowing-network-monitoring-bypass-k-i-m-z-m/gD2P6Ple2L

RE: https://infosec.exchange/@suricata/117309241594395404

https://nvd.nist.gov/vuln/detail/cve-2026-94083

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

https://nvd.nist.gov/vuln/detail/cve-2026-94084

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Suricata Patches Flaws Allowing Network Monitoring Bypass

Suricata 8.0.7 fixes two vulnerabilities (CVE-2026-94084 and CVE-2026-94083) that allow unauthenticated attackers to crash the IDS/IPS engine. These flaws exploit the HTTP/2 and DoH2 parsers to create a monitoring blind spot for network bypass.

**If you run Suricata for network monitoring, update it to version 8.0.7 ASAP. Older versions can be crashed remotely, leaving your network unmonitored and your attack detection blind. Until you patch, closely monitor that the Suricata service is actually running, because an unexpected stop may mean someone is already attacking you.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/suricata-patches-flaws-allowing-network-monitoring-bypass-k-i-m-z-m/gD2P6Ple2L

Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today.

#WordPress #CVE202693485 #StoredXSS #RCE #Cybersecurity #Infosec

https://securityonline.info/wordpress-stored-xss-poc/?utm_source=mastodon&utm_medium=jetpack_social

Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today.

#WordPress #CVE202693485 #StoredXSS #RCE #Cybersecurity #Infosec

https://securityonline.info/wordpress-stored-xss-poc/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-61821 - High (8.5)

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty sch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61818 - High (8.5)

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SEL...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61818/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2025-39964 – Linux Kernel Race Condition Vulnerability

Analyze the mechanics of CVE-2025-39964 with our technical Linux TSUITE brief, covering AF_ALG race conditions, CrowdStrike CQL queries, and endpoint hardening....

https://thecybermind.co/dxag

CISA added CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 to its KEV catalog after exploitation was reported. The flaws affect TLS, AF_ALG, and ebtables SNAT, with CVSS scores up to 9.8, making rapid exposure assessment and patch validation essential. #LinuxSecurity #VulnerabilityManagement #KEV

https://cyberworldops.eu/en/three-exploited-linux-kernel-flaws-trigger-immediate-cisa-patch

🟠 CVE-2026-81626 - High (8.6)

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81626/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-84071: IBM Guardium Data Protection 12.2 OS command injection in Universal Connector plugin upload. Auth attacker can run commands as root. CVSS 7.2, no patch yet. Restrict access and monitor. https://www.valtersit.com/cve/CVE-2026-84071/ #CVE #infosec #IBM

🔴 CVE-2026-75878 - Critical (9.1)

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75878/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81656 - High (8.8)

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resultin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-11716 - High (7.5)

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-11725 - High (8.8)

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17619 - High (8.6)

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17619/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA added CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 to its KEV catalog after exploitation was reported. The flaws affect TLS, AF_ALG, and ebtables SNAT, with CVSS scores up to 9.8, making rapid exposure assessment and patch validation essential. #LinuxSecurity #VulnerabilityManagement #KEV

https://cyberworldops.eu/en/three-exploited-linux-kernel-flaws-trigger-immediate-cisa-patch

🟠 CVE-2026-81179 - High (8.1)

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 [VULN] Alerte sécurité : deux vulnérabilités majeures menacent vos NAS Synology - CVE-2026-13684 CVE-2026-13639

Huit vulnérabilités viennent d'être identifiées dans le système d'exploitation DiskStation Manager de Synology, dont deux atteignent un score de gravité maximal de 9.8. Ces failles critiques permettent à des attaquants distants de lire, d'écrire ou d'effacer vos fichiers sans aucune…

🔗 https://www.generation-nt.com/actualites/alerte-securite-vulnerabilites-majeures-serveurs-2081523
💬 discussion : https://infosec.pub/post/52624526
#Vulnérabilité #CVE #Cyberveille

🟠 CVE-2026-93749 - High (7.5)

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event lo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93748 - High (7.5)

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can reques...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical MongoDB driver vulnerabilities, including CVE-2026-93762, expose systems to data loss and DoS. Learn about these flaws and patch immediately.

#MongoDB #Cybersecurity #Vulnerability #Infosec #CVE

https://securityonline.info/mongodb-driver-vulnerabilities-cve/?utm_source=mastodon&utm_medium=jetpack_social

🚨 RAPID RESPONSE: IBM MQ Pre-Authentication RCE [CVE-2026-10747]

A critical heap buffer overflow in IBM MQ could allow remote code execution before authentication. CVSS: 10.0.

Censys ARC observes IBM MQ web consoles on 120 hosts and 149 web properties Internet-wide. These numbers indicate IBM MQ presence, not confirmed vulnerable systems.

IBM has released fixes for affected MQ Server and MQ Appliance versions. No public PoC or reported active exploitation is known at this time.

Read the full analysis for affected versions, Internet observations, and remediation guidance. https://censys.com/advisory/cve-2026-10747/

#CensysARC #IBMMQ #Cybersecurity #Vulnerability

Critical IBM MQ vulnerabilities allow remote code execution. Learn how CVE-2026-10747 and CVE-2026-10858 hit 10.0 CVSS and require urgent patching.

#IBMMQ #CVE202610747 #CVE202610858 #Cybersecurity #Infosec

https://securityonline.info/ibm-mq-vulnerabilities-cve-2026-10747/?utm_source=mastodon&utm_medium=jetpack_social

Critical IBM MQ vulnerabilities allow remote code execution. Learn how CVE-2026-10747 and CVE-2026-10858 hit 10.0 CVSS and require urgent patching.

#IBMMQ #CVE202610747 #CVE202610858 #Cybersecurity #Infosec

https://securityonline.info/ibm-mq-vulnerabilities-cve-2026-10747/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-85058 - High (7.5)

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When ano...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85058/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91127 - High (8.2)

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91127/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-53266 – Linux Kernel Out-of-Bounds Write Vulnerability

Analyze the executive impact of CVE-2026-53266 with our strategic Linux CSUITE brief, covering kernel out-of-bounds write risks, compliance assurance, and board-level risk communication....

https://thecybermind.co/n7ln

CISA added CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 to its KEV catalog after exploitation was reported. The flaws affect TLS, AF_ALG, and ebtables SNAT, with CVSS scores up to 9.8, making rapid exposure assessment and patch validation essential. #LinuxSecurity #VulnerabilityManagement #KEV

https://cyberworldops.eu/en/three-exploited-linux-kernel-flaws-trigger-immediate-cisa-patch

Cisco patched 20 CVEs in ISE (12 critical), 18 in FMC (8 critical) and 6 in Nexus Dashboard. Three ISE flaws CVE-2026-20282, CVE-2026-20283 and CVE-2026-20284 are exploited, allowing takeover of identity and firewall management. Patch immediately and hunt for compromise. #CiscoSecurity #NetworkSecurity #VulnManagement

https://cyberworldops.eu/en/cisco-fixes-critical-ise-fmc-and-nexus-dashboard-flaws-as-exploited

📢 [VULN] Alerte sécurité : deux vulnérabilités majeures menacent vos NAS Synology - CVE-2026-13684 CVE-2026-13639

Huit vulnérabilités viennent d'être identifiées dans le système d'exploitation DiskStation Manager de Synology, dont deux atteignent un score de gravité maximal de 9.8. Ces failles critiques permettent à des attaquants distants de lire, d'écrire ou d'effacer vos fichiers sans aucune…

🔗 https://www.generation-nt.com/actualites/alerte-securite-vulnerabilites-majeures-serveurs-2081523
💬 discussion : https://infosec.pub/post/52624526
#Vulnérabilité #CVE #Cyberveille

CVE-2026-85889 in Microsoft's Azure AI Foundry enabled unauthorized privilege escalation at the highest possible severity rating, discovered by researcher Rémy Marot and quietly fixed before a single attacker could find it in the wild.

The good news — and do write this down — no customer action is required. Microsoft has fully mitigated the issue on their end. This concludes the portion of the training where you feel relief. Please do not grow accustomed to it. (2/3)

Cisco patched 20 CVEs in ISE (12 critical), 18 in FMC (8 critical) and 6 in Nexus Dashboard. Three ISE flaws CVE-2026-20282, CVE-2026-20283 and CVE-2026-20284 are exploited, allowing takeover of identity and firewall management. Patch immediately and hunt for compromise. #CiscoSecurity #NetworkSecurity #VulnManagement

https://cyberworldops.eu/en/cisco-fixes-critical-ise-fmc-and-nexus-dashboard-flaws-as-exploited

Broadcom has a long list of advisories addressing some critical vulnerabilities, among others https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco:

This addresses high-severity CVE-2024-20260, first published in October.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdvirtual-dos-MuenGnYR @TalosSecurity #Cisco #infosec #vulnerability

Broadcom has a long list of advisories addressing some critical vulnerabilities, among others https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco:

This addresses high-severity CVE-2024-20260, first published in October.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdvirtual-dos-MuenGnYR @TalosSecurity #Cisco #infosec #vulnerability

Docker Sandboxes 0.42.0 security update: CVE-2026-77179 and CVE-2026-79994 #devopsish https://docs.docker.com/security/security-announcements/#docker-sandboxes-0420-security-update-cve-2026-77179-and-cve-2026-79994

📈 CVE Published in last 7 days (2026-09-14 - 2026-09-14)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 478
- High: 2067
- Medium: 1314
- Low: 307
- None: 680

Status:
- : 35
- Analyzed: 339
- Awaiting Analysis: 1126
- Deferred: 1117
- Modified: 32
- Received: 1943
- Rejected: 28
- Undergoing Analysis: 226

CISA KEVs:
- CISA-2026:0914 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0914)
- CISA-2026:0916 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0916)
- CISA-2026:0918 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0918)

Top CNAs:
- kernel.org: 878
- Oracle: 634
- GitHub, Inc.: 587
- VulnCheck: 434
- Apple Inc.: 246
- VulDB: 243
- IBM Corporation: 174
- WPScan: 151
- Wordfence: 128
- MITRE: 106

Top Affected Products:
- UNKNOWN: 3691
- Apple Macos: 214
- Apple Iphone Os: 132
- Apple Ipados: 132
- Apple Visionos: 95
- Apple Watchos: 81
- Apple Tvos: 78
- Oracle Hyperion Financial Management: 70
- Google Android: 47
- Google Chrome: 46

Top EPSS Score:
- CVE-2026-76698 - 4.11 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76698)
- CVE-2026-89308 - 2.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-89308)
- CVE-2026-90702 - 2.80 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-90702)
- CVE-2026-90703 - 2.80 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-90703)
- CVE-2026-92398 - 2.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-92398)
- CVE-2026-92397 - 2.30 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-92397)
- CVE-2026-27560 - 2.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27560)
- CVE-2026-27561 - 2.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27561)
- CVE-2026-27562 - 2.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27562)
- CVE-2026-90847 - 2.18 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-90847)

#ZEN #SecDB #InfoSec

📈 CVE Published in last 7 days (2026-09-14 - 2026-09-14)
See more at https://secdb.nttzen.cloud/dashboard