Patch Tuesday May 2026

Patch Tuesday May 2026 Updates – Vulnerability Digest from Action1

This digest explains the most serious vulnerabilities in popular Windows software that have been patched over the past month.

For even more information, join our next Patch Tuesday webinar and visit our Patch Tuesday Watch page.

Microsoft Vulnerabilities

This Patch Tuesday from Microsoft includes 118 vulnerability fixes, with 16 rated critical and no publicly disclosed zero-day vulnerabilities. Although the absence of zero-days is a positive sign, the high number of critical vulnerabilities — particularly compared to recent months — means organizations should still move quickly to evaluate and deploy updates across affected systems.

CVE-2026-42898 – Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

“An attacker with only basic access can potentially turn a business application server into a remote execution platform.”

A critical remote code execution vulnerability exists in Microsoft Dynamics 365 On-Premises due to improper control of code generation. The flaw allows an authenticated attacker with low privileges to execute malicious code over the network by modifying process session data within Dynamics CRM. Because exploitation requires no user interaction and can impact systems beyond the vulnerable component’s original security scope, this vulnerability represents a serious enterprise risk.

CVSS Score: 9.9
SEVERITY: Critical
THREAT:
This vulnerability could allow authenticated attackers to remotely execute arbitrary code on affected Dynamics 365 servers. Successful exploitation may result in full server compromise, unauthorized access to business applications, theft of sensitive CRM records, disruption of operations, and lateral movement into connected enterprise systems.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild. Exploit Code Maturity is listed as Unproven, and the exploitability assessment is rated as “Exploitation Unlikely.”

TECHNICAL SUMMARY:
CVE-2026-42898 is caused by improper control of code generation, classified under CWE-94 Code Injection. An authenticated attacker with low privileges can modify the saved state of a Dynamics CRM process session and trigger the application to process maliciously crafted data. This can cause the server to unintentionally execute attacker-controlled code.
The vulnerability has a network attack vector with low attack complexity and does not require user interaction. The CVSS scope is marked as Changed, meaning successful exploitation can impact systems or resources outside the original security boundary managed by the vulnerable component. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY:
The affected product is Microsoft Dynamics 365 (on-premises) version 9.1. Exploitation requires a valid authenticated account with low privileges. Attackers can abuse manipulated process session data to trigger remote code execution on the server.

BUSINESS IMPACT:
Compromise of Dynamics 365 infrastructure can expose customer records, operational workflows, financial information, and integrated business systems. Since CRM environments often connect with identity services, databases, and enterprise applications, successful exploitation could lead to broader organizational compromise and operational disruption.

WORKAROUND:
No mitigations or workarounds are listed. Organizations should apply the official Microsoft security update associated with KB5078943 as soon as possible.

URGENCY:
This vulnerability demands immediate attention because it combines a Critical severity rating, network-based exploitation, no user interaction requirements, and high impact across confidentiality, integrity, and availability. Even though exploitation is currently assessed as unlikely, the low privilege requirement significantly lowers the barrier for attackers who already possess valid credentials.

CVE-2026-42831 – Microsoft Office Remote Code Execution Vulnerability

“A malicious Office file can turn one user click into full code execution on a workstation.”

A critical remote code execution vulnerability exists in Microsoft Office due to a heap-based buffer overflow. An unauthorized attacker could exploit this issue by sending a malicious Office file and convincing a user to open it. The Preview Pane is not an attack vector for this vulnerability.

CVSS Score: 7.8
SEVERITY: Critical
THREAT:
This vulnerability could allow an attacker to execute code locally on an affected system. Successful exploitation may lead to malware installation, data theft, workstation compromise, and possible movement deeper into the organization.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Unlikely.

TECHNICAL SUMMARY:
CVE-2026-42831 is caused by a heap-based buffer overflow in Microsoft Office. The flaw may allow malicious Office content to corrupt memory and execute attacker-controlled code on the local machine. Although the title uses “Remote Code Execution,” the CVSS attack vector is Local, meaning exploitation requires the malicious file to be opened locally by the user. User interaction is required, and Preview Pane exploitation is not supported.

EXPLOITABILITY:
Affected Microsoft Office versions are not listed in the provided data. Exploitation requires an attacker to send a malicious Office file and convince the user to open it.

BUSINESS IMPACT:
A successful exploit could compromise employee workstations, expose sensitive documents, enable credential theft, and support phishing-based intrusion campaigns. Office file attacks are especially dangerous because they blend into normal business communication.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft fix when available for the affected Office products.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and can lead to code execution through malicious Office documents. Even though exploitation is currently assessed as unlikely, Office-based attacks remain a common and effective entry point into enterprise environments.

CVE-2026-41103 – Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

“A broken SSO trust path can let an attacker walk into Jira or Confluence as someone they are not.”

A critical elevation of privilege vulnerability exists in the Microsoft SSO Plugin for Jira and Confluence due to incorrect implementation of an authentication algorithm. An unauthenticated attacker could send a specially crafted SSO response during login and trick the system into accepting a forged identity, allowing unauthorized access without proper Microsoft Entra ID authentication.

CVSS Score: 9.1
SEVERITY: Critical
THREAT:
This vulnerability could allow an attacker to bypass authentication and access Jira or Confluence as a valid user. Depending on the compromised account’s permissions, the attacker could view sensitive information, modify content, and perform unauthorized actions.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, but exploitation is assessed as More Likely.

TECHNICAL SUMMARY:
CVE-2026-41103 is caused by incorrect implementation of an authentication algorithm in the Microsoft SSO Plugin for Jira and Confluence. An attacker can exploit the flaw by sending a specially crafted SSO response during the login process. This forged response can cause the system to accept an unauthorized identity, allowing the attacker to sign in without authenticating through Microsoft Entra ID. The vulnerability is network-based, low complexity, requires no privileges, and needs no user interaction.

EXPLOITABILITY:
Affected software is the Microsoft SSO Plugin for Jira and Confluence. Exploitation does not require authentication or user interaction. A successful attacker can gain access as a valid Jira or Confluence user, limited by that user’s authorization level.

BUSINESS IMPACT:
Compromise of Jira or Confluence can expose project plans, engineering data, internal documentation, security procedures, customer information, and operational workflows. Attackers may also modify content, tamper with tickets, or abuse trusted collaboration systems to support further attacks.

WORKAROUND:
No workaround is listed. Apply the official Microsoft fix for the Microsoft SSO Plugin for Jira and Confluence.

URGENCY:
This vulnerability requires urgent attention because it is Critical, has a CVSS score of 9.1, requires no privileges or user interaction, and exploitation is considered More Likely. Authentication bypass flaws in collaboration platforms can quickly become high-impact enterprise incidents.

CVE-2026-41096 – Windows DNS Client Remote Code Execution Vulnerability

“A malicious DNS response should never be enough to hand over control of a Windows system.”

A critical remote code execution vulnerability exists in the Windows DNS Client due to a heap-based buffer overflow. An unauthenticated attacker could exploit the vulnerability by sending a specially crafted DNS response to a vulnerable system, potentially causing memory corruption and remote code execution without user interaction.

CVSS Score: 9.8
SEVERITY: Critical
THREAT:
This vulnerability could allow remote attackers to execute arbitrary code on affected Windows systems through malicious DNS responses. Successful exploitation may lead to complete system compromise, malware deployment, credential theft, lateral movement, or disruption of enterprise operations.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Unlikely.

TECHNICAL SUMMARY:
CVE-2026-41096 is caused by a heap-based buffer overflow in the Windows DNS Client. The vulnerability occurs when the DNS Client improperly processes specially crafted DNS responses, leading to memory corruption conditions. An attacker can exploit the flaw remotely over the network without authentication or user interaction. Under certain configurations, successful exploitation may allow execution of attacker-controlled code on the affected system.
The vulnerability affects confidentiality, integrity, and availability at a high level and carries a network attack vector with low attack complexity, making it particularly dangerous for enterprise environments.

EXPLOITABILITY:
Affected software is Microsoft Windows DNS Client. Exploitation requires an attacker to send a specially crafted DNS response to a vulnerable Windows system. No authentication or user interaction is required.

BUSINESS IMPACT:
Because DNS is a core networking service used across enterprise environments, exploitation could impact a large number of systems rapidly. Successful attacks may lead to widespread endpoint compromise, ransomware deployment, credential harvesting, and operational disruption across corporate networks.

WORKAROUND:
No workarounds or mitigations are listed in the provided information. Organizations should apply the official Microsoft security update as quickly as possible.

URGENCY:
This vulnerability requires immediate attention because it combines a Critical severity rating, network-based attack vector, no authentication requirements, no user interaction, and a CVSS score of 9.8. DNS-related vulnerabilities are especially dangerous because they target foundational network services that are broadly exposed across enterprise infrastructure.

CVE-2026-41089 – Windows Netlogon Remote Code Execution Vulnerability

“A vulnerable domain controller can turn one crafted network request into a direct path toward enterprise compromise.”
A critical remote code execution vulnerability exists in Windows Netlogon due to a stack-based buffer overflow. An unauthenticated attacker could send a specially crafted network request to a Windows server acting as a domain controller, causing Netlogon to improperly process the request and potentially execute attacker-controlled code.

CVSS Score: 9.8
SEVERITY: Critical
THREAT:
This vulnerability could allow an unauthenticated attacker to remotely execute code on an affected domain controller. Successful exploitation may lead to domain-level compromise, credential theft, malware deployment, lateral movement, and major disruption of authentication services.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-41089 is caused by a stack-based buffer overflow in Windows Netlogon. The vulnerability occurs when Netlogon improperly handles a specially crafted network request sent to a Windows server acting as a domain controller. Because the attack vector is network-based and requires no privileges or user interaction, successful exploitation could allow remote code execution on a highly sensitive authentication system.

EXPLOITABILITY:
Affected software is Windows Netlogon on Windows servers acting as domain controllers. Exploitation requires sending a specially crafted network request to the vulnerable domain controller. No sign-in, prior access, or user interaction is required.

BUSINESS IMPACT:
Domain controllers are core identity infrastructure. A successful exploit could compromise authentication, expose credentials, enable broad lateral movement, and disrupt access to business-critical systems. This could lead to ransomware deployment, data theft, and widespread operational outage.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update as quickly as possible.

URGENCY:
This vulnerability requires urgent action because it is Critical, has a CVSS score of 9.8, targets domain controllers, and requires no authentication or user interaction. Even though exploitation is assessed as Less Likely, the potential impact is severe.

CVE-2026-40403 – Windows Graphics Component Remote Code Execution Vulnerability

“A compromise inside a virtualized environment should never become a bridge into the host operating system.”

A critical remote code execution vulnerability exists in the Windows Graphics Component (Win32K – GRFX) due to a heap-based buffer overflow. The flaw allows an authenticated attacker with low privileges to execute code locally and potentially escape a contained execution environment, including scenarios involving guest virtual machines attacking the host operating system.

CVSS Score: 8.8
SEVERITY: Critical
THREAT:
This vulnerability could allow an attacker with local access to execute arbitrary code and potentially break out of isolated execution environments. Successful exploitation may lead to compromise of the host operating system, unauthorized access to sensitive systems, and broader infrastructure impact.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-40403 is caused by a heap-based buffer overflow in Windows Win32K – GRFX. The vulnerability allows an authenticated attacker to execute code locally by exploiting improper memory handling within the graphics component. The CVSS scope is marked as Changed, meaning successful exploitation can impact systems outside the original security boundary.
Microsoft states that the vulnerability could lead to a contained execution environment escape. An attacker who gains access to a local guest virtual machine could potentially exploit the flaw to attack the host operating system. The vulnerable endpoint is only accessible over the local VM interface because external communication is blocked.

EXPLOITABILITY:
Affected software is the Windows Graphics Component (Win32K – GRFX). Exploitation requires local access and low privileges. Attackers may abuse the flaw from a guest VM environment to target the host OS.

BUSINESS IMPACT:
Virtualization and isolation technologies are heavily relied upon in enterprise and cloud environments. A successful escape from a contained environment could undermine host security controls, expose sensitive workloads, and create opportunities for attackers to move between systems that were expected to remain isolated.

WORKAROUND:
No mitigations or workarounds are listed. Organizations should apply the official Microsoft security update as soon as possible.

URGENCY:
This vulnerability should be treated as a high-priority issue because it affects virtualization and isolation boundaries, requires only low privileges, and could enable guest-to-host compromise scenarios. Even though exploitation is assessed as Less Likely, containment escape vulnerabilities carry significant security implications in enterprise and cloud environments.

CVE-2026-40402 – Windows Hyper-V Elevation of Privilege Vulnerability

“A guest VM should never become the doorway to SYSTEM-level control of the Hyper-V host.”

A critical elevation of privilege vulnerability exists in Windows Hyper-V due to a use-after-free flaw. An attacker could exploit this issue from a guest VM and cross the security boundary into the Hyper-V host environment. Successful exploitation could allow the attacker to gain SYSTEM privileges.

CVSS Score: 9.3
SEVERITY: Critical
THREAT:
This vulnerability could allow an attacker operating from a Hyper-V guest environment to elevate privileges on the host. Successful exploitation may lead to SYSTEM-level access, host compromise, data exposure, tampering, and potential impact to other virtualized workloads.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-40402 is caused by a use-after-free condition in Windows Hyper-V. The issue allows a guest VM to force the Hyper-V host kernel to read from an arbitrary, potentially invalid address. In most cases, this may result in a denial of service through a host bugcheck. However, Microsoft notes that reads involving memory-mapped device registers tied to hardware attached to the host may trigger device-specific side effects that could compromise host security. The CVSS scope is Changed because exploitation can cross from the guest VM security boundary into the Hyper-V host environment.

EXPLOITABILITY:
Affected software is Windows Hyper-V. Exploitation is local from the guest VM context, requires no privileges, and requires no user interaction. A successful attacker could gain SYSTEM privileges on the Hyper-V host.

BUSINESS IMPACT:
A Hyper-V host compromise can expose multiple virtual machines and sensitive workloads at once. This may lead to tenant boundary violations, business service disruption, data theft, and loss of trust in virtualized infrastructure.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update as soon as possible.

URGENCY:
This vulnerability should be prioritized because it is Critical, has a CVSS score of 9.3, requires no privileges or user interaction, and can cross the guest-to-host security boundary. Hyper-V hosts supporting critical workloads should be patched quickly.

CVE-2026-40367 – Microsoft Word Remote Code Execution Vulnerability

“A document preview should never become a silent trigger for code execution.”
A critical remote code execution vulnerability exists in Microsoft Word due to an untrusted pointer dereference flaw. An unauthorized attacker could exploit the vulnerability to execute code locally, and the Preview Pane is confirmed as an attack vector, increasing the risk of exposure through routine document handling.

CVSS Score: 8.4
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers to execute arbitrary code on affected systems through malicious Word content. Successful exploitation may lead to malware deployment, theft of sensitive information, workstation compromise, and further movement inside the enterprise environment.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Unlikely.

TECHNICAL SUMMARY:
CVE-2026-40367 is caused by an untrusted pointer dereference in Microsoft Office Word. Improper handling of memory references may allow specially crafted Word content to trigger execution of attacker-controlled code on the local system. Although the title references remote code execution, the CVSS attack vector is Local because the malicious content must be processed locally by the target system.
The Preview Pane is confirmed as an attack vector, meaning exploitation may occur during document preview operations without requiring the document to be fully opened in the traditional manner.

EXPLOITABILITY:
Affected software is Microsoft Office Word. Exploitation requires malicious Word content to be processed locally. No privileges or user interaction are required according to the CVSS metrics, and the Preview Pane can trigger the vulnerability.

BUSINESS IMPACT:
Word documents remain one of the most common business file formats exchanged through email and collaboration platforms. A successful exploit could compromise employee systems, expose confidential data, enable credential theft, and create an entry point for broader enterprise attacks.

WORKAROUND:
No mitigations or workarounds are listed. Microsoft states that all applicable update packages for affected software should be installed.

URGENCY:
This vulnerability should be treated as a high-priority patching item because it is rated Critical and the Preview Pane is an attack vector. Preview-based exploitation paths reduce the amount of user interaction normally required and increase enterprise exposure to malicious document attacks.

CVE-2026-40366 – Microsoft Word Remote Code Execution Vulnerability

“A simple document preview can become a code execution path when memory is reused unsafely.”

A critical remote code execution vulnerability exists in Microsoft Word due to a use-after-free flaw. An unauthorized attacker could exploit the issue to execute code locally when malicious Word content is processed. The Preview Pane is confirmed as an attack vector, increasing risk during routine file handling.
CVSS Score: 8.4
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers to execute arbitrary code on affected systems through malicious Word documents. Successful exploitation may lead to malware installation, data theft, workstation compromise, and further movement inside the organization.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-40366 is caused by a use-after-free condition in Microsoft Office Word. The vulnerability occurs when Word improperly handles memory after it has been freed, which may allow specially crafted content to trigger execution of attacker-controlled code. Although the title uses “Remote Code Execution,” the CVSS attack vector is Local because the malicious content must be processed on the target system. The Preview Pane is an attack vector, meaning document preview behavior may expose users to exploitation.

EXPLOITABILITY:
Affected software is Microsoft Office Word. Exploitation requires malicious Word content to be processed locally. No privileges or user interaction are required according to the CVSS metrics, and the Preview Pane can be used as an attack vector.

BUSINESS IMPACT:
A successful exploit could compromise employee endpoints, expose sensitive documents, support credential theft, and give attackers a foothold for broader enterprise intrusion. Word files are commonly shared by email and collaboration tools, making this vulnerability especially relevant to phishing and document-based attacks.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and includes Preview Pane exposure. Even though exploitation is assessed as Less Likely, document preview attack paths reduce user decision points and increase risk from malicious files.

CVE-2026-40365 – Microsoft SharePoint Server Remote Code Execution Vulnerability

“A low-privileged SharePoint account should never become a pathway to remote code execution on the server.”

A critical remote code execution vulnerability exists in Microsoft SharePoint Server due to insufficient granularity of access control. An authenticated attacker with low privileges, such as a Site Owner role, could exploit the flaw to inject and execute arbitrary code remotely on the SharePoint Server.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
This vulnerability could allow authenticated attackers to remotely execute arbitrary code on affected SharePoint servers. Successful exploitation may lead to server compromise, unauthorized access to business data, malware deployment, and disruption of collaboration services.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-40365 is caused by insufficient granularity of access control in Microsoft Office SharePoint. The vulnerability allows an authenticated attacker with low privileges to write arbitrary code and trigger remote execution on the SharePoint Server. Microsoft states that a user with at least Site Owner permissions could exploit the flaw in a network-based attack.
The vulnerability has a network attack vector, low attack complexity, requires low privileges, and does not require user interaction. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY:
Affected software is Microsoft SharePoint Server, including SharePoint Server 2016 and SharePoint Enterprise Server 2016 using the same KB update. Exploitation requires an authenticated account with at least Site Owner privileges.

BUSINESS IMPACT:
SharePoint environments often store sensitive documents, internal communications, project data, and business workflows. A successful compromise could expose confidential information, disrupt collaboration platforms, and provide attackers with a foothold inside the enterprise network.

WORKAROUND:
No mitigations or workarounds are listed. Organizations should apply the official Microsoft security update for affected SharePoint environments as soon as possible.

URGENCY:
This vulnerability should be treated as a high-priority patching issue because it enables remote code execution on SharePoint servers using only low-level authenticated access. Collaboration platforms are frequently targeted because they contain valuable business data and often integrate with broader enterprise systems.

CVE-2026-40364 – Microsoft Word Remote Code Execution Vulnerability

“A Word document preview can become an attack path before the user ever fully opens the file.”

A critical remote code execution vulnerability exists in Microsoft Word due to type confusion, use of uninitialized resource, and heap-based buffer overflow weaknesses. An unauthorized attacker could exploit the vulnerability to execute code locally when malicious Word content is processed. The Preview Pane is confirmed as an attack vector.

CVSS Score: 8.4
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers to execute arbitrary code on affected systems through malicious Word content. Successful exploitation may lead to endpoint compromise, malware execution, data theft, and further movement across the organization.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, but exploitation is assessed as More Likely.

TECHNICAL SUMMARY:
CVE-2026-40364 involves improper access of a resource using an incompatible type, also known as type confusion, in Microsoft Office Word. The vulnerability also includes use of uninitialized resource and heap-based buffer overflow weaknesses. These memory handling issues may allow specially crafted Word content to corrupt memory and execute attacker-controlled code locally. Although the title uses “Remote Code Execution,” the CVSS attack vector is Local because the malicious content must be processed on the target machine. The Preview Pane is an attack vector.

EXPLOITABILITY:
Affected software is Microsoft Office Word. Exploitation requires malicious Word content to be processed locally, including through the Preview Pane. No privileges or user interaction are required according to the CVSS metrics.

BUSINESS IMPACT:
A successful exploit could compromise user workstations, expose sensitive documents, enable credential theft, and provide attackers with a foothold inside the enterprise. Because Word documents are frequently shared through email, collaboration tools, and websites, this vulnerability is well suited for phishing and document-based attacks.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update.

URGENCY:
This vulnerability should be prioritized because it is Critical, Preview Pane is an attack vector, and exploitation is assessed as More Likely. Document-based vulnerabilities can spread quickly through normal business workflows and may require very little user involvement.

CVE-2026-40363 – Microsoft Office Remote Code Execution Vulnerability

“A malicious Office document can become an invisible attack trigger when even preview actions expose vulnerable memory handling.”

A critical remote code execution vulnerability exists in Microsoft Office due to a heap-based buffer overflow. An unauthorized attacker could exploit the flaw to execute code locally when specially crafted Office content is processed. The Preview Pane is confirmed as an attack vector, increasing exposure during normal document handling activities.
CVSS Score: 8.4
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers to execute arbitrary code on affected systems through malicious Office files. Successful exploitation may lead to malware deployment, credential theft, data exposure, endpoint compromise, and broader enterprise intrusion.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited in the wild. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-40363 is caused by a heap-based buffer overflow in Microsoft Office. Improper memory handling may allow specially crafted Office content to corrupt memory and execute attacker-controlled code on the local system. Although the title references remote code execution, the CVSS attack vector is Local because exploitation occurs when malicious content is processed locally by the target machine.
The Preview Pane is confirmed as an attack vector, meaning exploitation may occur during preview operations without requiring a document to be fully opened in the traditional manner.

EXPLOITABILITY:
Affected software is Microsoft Office. Exploitation requires malicious Office content to be processed locally, including through the Preview Pane. No privileges or user interaction are required according to the CVSS metrics.

BUSINESS IMPACT:
Office-based vulnerabilities remain highly effective because Office documents are deeply integrated into business communication and collaboration. A successful exploit could compromise employee workstations, expose sensitive business information, and provide attackers with an initial foothold inside enterprise environments.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update for affected Office products.

URGENCY:
This vulnerability should be treated as a high-priority patching item because it is Critical and the Preview Pane is an attack vector. Even though exploitation is currently assessed as Less Likely, preview-based document attacks reduce normal user warning signs and increase the likelihood of accidental exposure.

CVE-2026-40361 – Microsoft Word Remote Code Execution Vulnerability

“A Word preview can become a quiet launch point for attacker-controlled code.”

A critical remote code execution vulnerability exists in Microsoft Word due to a use-after-free flaw. An unauthorized attacker could exploit the issue to execute code locally when malicious Word content is processed. The Preview Pane is confirmed as an attack vector, and exploitation is assessed as More Likely.

CVSS Score: 8.4
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers to execute arbitrary code through malicious Word content. Successful exploitation may lead to endpoint compromise, malware execution, sensitive data theft, and broader access inside the organization.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, but exploitation is assessed as More Likely.

TECHNICAL SUMMARY:
CVE-2026-40361 is caused by a use-after-free condition in Microsoft Office Word. The flaw occurs when Word improperly handles memory after it has been freed, which can allow specially crafted content to trigger code execution on the local system. Although the title says remote code execution, the CVSS attack vector is Local because the malicious content must be processed locally. The Preview Pane is an attack vector, which increases risk during routine document preview activity.

EXPLOITABILITY:
Affected software is Microsoft Office Word. Exploitation requires malicious Word content to be processed locally, including through the Preview Pane. No privileges or user interaction are required according to the CVSS metrics.

BUSINESS IMPACT:
A successful exploit could compromise employee workstations, expose confidential documents, enable credential theft, and provide attackers with an entry point into the enterprise. Word files are commonly shared through email and collaboration tools, making this vulnerability highly relevant to phishing-based attacks.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update.

URGENCY:
This vulnerability should be prioritized because it is Critical, the Preview Pane is an attack vector, and exploitation is assessed as More Likely. Document-based attacks can move quickly through normal business workflows and may require very little user involvement.

CVE-2026-40358 – Microsoft Office Remote Code Execution Vulnerability

“A routine document preview can become the moment an attacker gains code execution on a business device.”
A critical remote code execution vulnerability exists in Microsoft Office due to a use-after-free flaw. An unauthorized attacker could exploit the vulnerability to execute code locally when malicious Office content is processed. The Preview Pane is confirmed as an attack vector, increasing exposure during normal document handling activities.

CVSS Score: 8.4
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers to execute arbitrary code on affected systems through specially crafted Office files. Successful exploitation may result in malware installation, credential theft, exposure of sensitive business information, and compromise of employee workstations.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.
TECHNICAL SUMMARY:
CVE-2026-40358 is caused by a use-after-free condition in Microsoft Office. The vulnerability occurs when Office improperly handles memory after it has been freed, potentially allowing specially crafted content to trigger execution of attacker-controlled code on the local system. Although the title refers to remote code execution, the CVSS attack vector is Local because the malicious content must be processed on the target machine.
The Preview Pane is confirmed as an attack vector, meaning exploitation may occur during preview operations without requiring the user to fully open the document.

EXPLOITABILITY:
Affected software is Microsoft Office. Exploitation requires malicious Office content to be processed locally, including through the Preview Pane. No privileges or user interaction are required according to the CVSS metrics.

BUSINESS IMPACT:
Office applications are deeply integrated into everyday business communication and collaboration. A successful exploit could compromise endpoints, expose confidential information, support phishing campaigns, and provide attackers with an initial foothold inside enterprise networks.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update for affected Office products.

URGENCY:
This vulnerability should be prioritized because it is Critical and the Preview Pane is an attack vector. Even though exploitation is currently assessed as Less Likely, document preview attack paths increase exposure and reduce the amount of user interaction normally required.

CVE-2026-35421 – Windows GDI Remote Code Execution Vulnerability

“A crafted image file can turn normal graphics processing into a path for code execution.”
A critical remote code execution vulnerability exists in Windows GDI due to a heap-based buffer overflow. An unauthorized attacker could exploit the flaw locally if a user opens or processes a specially crafted Enhanced Metafile file using Microsoft Paint.

CVSS Score: 7.8
SEVERITY: Critical
THREAT:
This vulnerability could allow an attacker to execute code on an affected system through malicious EMF content. Successful exploitation may lead to malware execution, data theft, workstation compromise, and further movement inside the organization.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Unlikely.

TECHNICAL SUMMARY:
CVE-2026-35421 is caused by a heap-based buffer overflow in Windows GDI. The vulnerability is triggered when specially crafted Enhanced Metafile content is opened or processed using Microsoft Paint, causing the affected Windows graphics component to mishandle memory. Although the title uses “Remote Code Execution,” the CVSS attack vector is Local because the malicious file must be processed on the target machine. User interaction is required.

EXPLOITABILITY:
Affected software is Windows GDI. Exploitation requires a user to open or process a specially crafted EMF file using Microsoft Paint. No privileges are required, but user interaction is required.

BUSINESS IMPACT:
A successful exploit could compromise employee endpoints, expose sensitive files, and give attackers a foothold for broader attacks. Malicious image-based files can be delivered through email, downloads, or file shares, making user-targeted attacks a realistic concern.

WORKAROUND:
No mitigations or workarounds are listed. Apply the official Microsoft security update.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and can lead to code execution through crafted graphics content. Even though exploitation is assessed as Unlikely, file-based attacks remain a common way to target users.

CVE-2026-32161 – Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability

“A nearby attacker on the same wireless network should never be able to turn WiFi traffic into remote code execution.”

A critical remote code execution vulnerability exists in the Windows Native WiFi Miniport Driver due to a race condition and use-after-free flaw. An unauthorized attacker on the same network segment could exploit the vulnerability under specific timing and network conditions to execute code on affected systems.
CVSS Score: 7.5
SEVERITY: Critical
THREAT:
This vulnerability could allow attackers on the same local or virtual network segment to remotely execute arbitrary code on vulnerable Windows systems. Successful exploitation may lead to endpoint compromise, malware deployment, credential theft, and disruption of wireless-connected environments.

EXPLOITS:
At the time of publication, Microsoft reports that the vulnerability was not publicly disclosed and was not exploited. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Less Likely.

TECHNICAL SUMMARY:
CVE-2026-32161 is caused by concurrent execution using shared resources with improper synchronization, commonly known as a race condition, along with a use-after-free flaw in the Windows Native WiFi Miniport Driver. The vulnerability occurs when the driver improperly handles memory and synchronization during wireless network operations. An attacker on the same network segment may exploit favorable timing conditions to trigger memory corruption and execute attacker-controlled code.
The attack vector is Adjacent, meaning exploitation is limited to systems connected to the same network segment, switch, or virtual network as the attacker. Microsoft notes that exploitation requires specific network configurations and timing conditions, making reliable exploitation more difficult.

EXPLOITABILITY:
Affected software is the Windows Native WiFi Miniport Driver. Exploitation requires the attacker to be on the same network segment as the target system. No privileges or user interaction are required.

BUSINESS IMPACT:
Wireless infrastructure vulnerabilities can expose enterprise endpoints, roaming devices, and remote work environments to compromise. Successful exploitation may allow attackers to gain footholds within local network segments and potentially move deeper into enterprise systems.

WORKAROUND:
No mitigations or workarounds are listed. Organizations should apply the official Microsoft security update as soon as possible.

URGENCY:
This vulnerability should be prioritized for wireless-enabled enterprise systems because it allows remote code execution without authentication or user interaction. Although exploitation requires adjacent network access and complex timing conditions, wireless attack paths remain attractive targets in shared office, campus, and public network environments.

CVE-2026-40372 – ASP.NET Core Elevation of Privilege Vulnerability

“When signature validation breaks, attackers don’t need credentials—they can manufacture trust and rise straight to SYSTEM-level control.”

This vulnerability in ASP.NET Core arises from improper verification of cryptographic signatures within the Data Protection component. Under specific conditions—particularly in non-Windows environments using affected package versions—an attacker can craft malicious payloads that bypass integrity checks. This allows unauthorized privilege escalation over the network without requiring authentication or user interaction, potentially granting SYSTEM-level access and enabling sensitive data exposure or tampering.

CVSS Score: 9.1

SEVERITY: Critical

THREAT: This flaw undermines one of the most fundamental security guarantees—data integrity. If attackers can forge trusted payloads, they can impersonate users, escalate privileges, and manipulate application behavior without detection. The risk is especially severe because exploitation requires no prior access and can be executed remotely.

EXPLOITS:
No public exploits or proof-of-concept code are currently confirmed. The vulnerability is not publicly disclosed as exploited, and exploitation is considered less likely at this stage. However, the simplicity of the attack vector and lack of required privileges increase the likelihood of future weaponization.

TECHNICAL SUMMARY:
The vulnerability is caused by improper verification of cryptographic signatures (CWE-347) in the ASP.NET Core Data Protection library, specifically in versions 10.0.0 through 10.0.6. A flaw in the managed cryptographic implementation results in incorrect validation of protected payloads, allowing tampered or forged data to be treated as valid. This affects authentication tokens, cookies, and other protected data structures. The issue primarily impacts applications running on Linux, macOS, or non-Windows systems where managed cryptography is used. Windows systems using default CNG-based encryption are not affected unless explicitly configured to use managed algorithms.

EXPLOITABILITY:
Affected systems include ASP.NET Core applications using Microsoft.AspNetCore.DataProtection versions 10.0.0–10.0.6, particularly in self-contained deployments or where the NuGet package overrides the shared framework. Exploitation involves sending specially crafted payloads to the application to bypass signature validation and gain elevated privileges.

BUSINESS IMPACT:
This vulnerability can lead to full compromise of application trust boundaries. Attackers may gain SYSTEM-level privileges, access sensitive data, modify critical records, and generate valid authentication artifacts that persist beyond remediation. This creates risks of long-term persistence, data breaches, regulatory violations, and reputational damage.

WORKAROUND:
If patching is not immediately possible, avoid using affected Data Protection package versions, ensure applications rely on the shared framework where safe, restrict exposure of vulnerable services, and monitor logs for anomalies such as repeated invalid payload errors. Transitioning to unaffected environments or configurations can reduce risk temporarily.

URGENCY:
The combination of network-based exploitation, no authentication requirement, and high impact to confidentiality and integrity makes this vulnerability extremely dangerous. Even though exploitation is not yet observed, the conditions are ideal for rapid attacker adoption. Immediate patching, combined with validation of runtime binaries and key rotation, is critical to prevent both initial compromise and post-patch persistence.

 

CVE-2026-20929 – Windows HTTP.sys Elevation of Privilege Vulnerability

“This flaw turns a trusted network foothold into a chance to climb higher inside Windows, making a routine compromise far more dangerous.”

CVE-2026-20929 is a high-severity elevation of privilege vulnerability in Microsoft Windows HTTP.sys caused by improper access control. It allows an authorized attacker to elevate privileges over a network, which means an attacker who already has some level of access could use the flaw to gain stronger control over an affected system. While there is no confirmed public exploitation listed here, the issue is still serious because privilege escalation flaws often help attackers deepen an intrusion, expand access, and strengthen persistence after an initial breach.

CVSS Score: 7.5

SEVERITY:
High

THREAT:
An authorized attacker could exploit improper access control in Windows HTTP.sys to elevate privileges over a network. This makes the vulnerability especially concerning in environments where attackers may already have a low-privileged foothold and are looking to move toward administrative control.

EXPLOITS:
There is no confirmed active exploitation noted in the provided data. There is also no clear public zero-day status indicated here. However, because this is a network-based elevation of privilege issue in a core Windows component, security teams should assume exploit interest is likely once patch analysis becomes widespread.

TECHNICAL SUMMARY:
CVE-2026-20929 affects Windows HTTP.sys, the kernel-level HTTP protocol stack used by Windows to process web traffic and support HTTP-based services. The vulnerability is caused by improper access control, meaning HTTP.sys does not correctly enforce restrictions in certain conditions. An attacker with authorized access can abuse this weakness over the network to gain elevated privileges on the target system. Because HTTP.sys operates in a highly privileged part of the operating system, successful exploitation can have a severe impact on confidentiality, integrity, and availability. In practical terms, this flaw can help an attacker move from limited access to a far more powerful position on the host, increasing the chance of deeper compromise and follow-on attacks.

EXPLOITABILITY:
Affected versions include Windows 10 Version 1607 and other supported Windows releases that use the vulnerable HTTP.sys component prior to the relevant security updates. On Windows 10 Version 1607, vulnerable builds are those before 10.0.14393.8783. Exploitation requires the attacker to already be authorized at some level and able to reach the target over the network.

BUSINESS IMPACT:
This vulnerability is dangerous because it can help attackers turn a small breach into a major security incident. A low-level compromise that might otherwise be contained can become a stepping stone to privileged access, broader system control, and stronger persistence. In business terms, that can lead to service disruption, unauthorized access to sensitive data, damage to critical systems, and increased recovery costs. Powerful privilege escalation flaws often become the force multiplier that turns ordinary intrusion activity into a full operational crisis.

WORKAROUND:
The preferred mitigation is to apply Microsoft’s security update. If the patch cannot be deployed immediately, reduce exposure by limiting access to affected systems, restricting unnecessary HTTP-based services, segmenting sensitive hosts, and monitoring closely for suspicious privilege escalation activity tied to HTTP services. No strong substitute for patching is available.

 

Cisco Webex Meetings Critical Remote Vulnerability

“One exposed meeting service can become a full system entry point.”

Cisco has released a critical security update for Webex Meetings addressing CVE-2026-20184. This vulnerability affects the core meeting service and could allow a remote attacker to execute malicious actions without authentication under certain conditions. Given Webex’s widespread use in enterprise environments, the exposure significantly raises the risk profile.

CVE-2026-20184 has a CVSS score of 9.8, which is Critical severity. This level of severity indicates a high likelihood of impact with minimal attack complexity. There is no verified evidence of active exploitation or publicly available proof-of-concept code at this time, but the severity alone makes this a priority patch.

 

Cisco Identity Services Engine Software Critical Authentication and Access Control Vulnerabilities

“When identity breaks, the entire network follows.”

Cisco has released critical security patches for Identity Services Engine (ISE) Software addressing three severe vulnerabilities: CVE-2026-20180, CVE-2026-20186, and CVE-2026-20147. These issues impact core identity, authentication, and access control functions, potentially allowing attackers to bypass protections or execute unauthorized actions within enterprise networks.

CVE-2026-20180 has a CVSS score of 9.9, which is Critical severity. CVE-2026-20186 has a CVSS score of 9.9, which is Critical severity. CVE-2026-20147 has a CVSS score of 9.9, which is Critical severity. The consistently high scores reflect extreme risk, especially given ISE’s role as a centralized security enforcement point. There is no verified evidence of active exploitation or publicly available proof-of-concept code for these vulnerabilities.

The patch strengthens authentication logic and closes gaps in access control enforcement, reducing the risk of unauthorized network access and privilege misuse.

 

Google Chrome Update

“A single browser session can become the entry point for a full-scale attack.”

Two latest Google Chrome patches (one with 118 CVEs and another with 30+ CVEs) address a wide range of vulnerabilities across browser components, including rendering engines, memory handling, and sandbox enforcement. These issues could allow attackers to execute arbitrary code, escape security boundaries, or destabilize the browser using malicious web content. The update includes multiple critical and high-severity flaws that significantly expand the browser’s attack surface.

Critical Severity

• CVE-2026-7908 — 9.6
• CVE-2026-6296 — 9.6

High Severity

• CVE-2026-5281 — 8.8 (Active exploitation)
• CVE-2026-7896 — 8.8
• CVE-2026-7898 — 8.8
• CVE-2026-7899 — 8.8
• CVE-2026-7901 — 8.8
• CVE-2026-7902 — 8.8
• CVE-2026-7903 — 8.8
• CVE-2026-7906 — 8.8
• CVE-2026-7907 — 8.8
• CVE-2026-6299 — 8.8
• CVE-2026-6300 — 8.8
• CVE-2026-6301 — 8.8
• CVE-2026-6302 — 8.8
• CVE-2026-6303 — 8.8
• CVE-2026-6305 — 8.8
• CVE-2026-6306 — 8.8
• CVE-2026-6307 — 8.8
• CVE-2026-6315 — 8.8
• CVE-2026-6316 — 8.8
• CVE-2026-6317 — 8.8
• CVE-2026-6318 — 8.8
• CVE-2026-6359 — 8.8
• CVE-2026-6360 — 8.8
• CVE-2026-6363 — 8.8
• CVE-2026-7900 — 8.3
• CVE-2026-7911 — 8.3
• CVE-2026-6297 — 8.3
• CVE-2026-6304 — 8.3
• CVE-2026-6309 — 8.3
• CVE-2026-6310 — 8.3
• CVE-2026-6311 — 8.3
• CVE-2026-6314 — 8.3
• CVE-2026-6361 — 8.3
• CVE-2026-6308 — 7.5

Medium Severity

• CVE-2026-6364 — 6.5
• CVE-2026-6362 — 6.3
• CVE-2026-6298 — 4.3

Low Severity

• CVE-2026-6312 — 3.1
• CVE-2026-6313 — 3.1

There is no verified proof-of-concept code for most vulnerabilities, but the presence of active exploitation for one issue and multiple critical flaws increases overall risk.

 

Adobe Acrobat Reader

“A malicious document is all it takes to turn a trusted tool into an attack vector.”

Adobe has released a security patch for Acrobat Reader addressing CVE-2026-34621 and CVE-2026-34622. These vulnerabilities affect how the application processes crafted files, potentially allowing attackers to execute unauthorized actions or compromise user systems through malicious documents.

CVE-2026-34621 has a CVSS score of 8.6, which is High severity, and has confirmed active exploitation in the wild. CVE-2026-34622 has a CVSS score of 8.6, which is High severity. The presence of active attacks significantly increases the urgency of applying this patch, especially in environments where PDF files are routinely opened from external or untrusted sources.

SAP Business Planning and Consolidation

“A critical gap in enterprise planning systems can expose the entire financial backbone.”

This patch addresses CVE-2026-27681, a critical vulnerability affecting SAP Business Planning and Consolidation and SAP Business Warehouse. The issue allows attackers to execute arbitrary code, putting core financial data, reporting systems, and enterprise decision-making processes at serious risk. Given the role of these platforms in business operations, exploitation could lead to widespread disruption and data compromise.

CVE-2026-27681 has a CVSS score of 9.9, which is Critical severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for this vulnerability.

 

Mozilla Firefox v150

“A cluster of high-severity browser flaws increases the risk of compromise through everyday web activity.”

Mozilla has released a security patch for Firefox addressing 271 vulnerabilities impacting browser security and stability, including several high-severity flaws capable of remote code execution. The most critical vulnerabilities patched in this release are primarily memory corruption and use-after-free bugs.

CVE-2026-6746 and CVE-2026-6747 each have a CVSS score of 7.5, which is High severity. CVE-2026-6751, CVE-2026-6752, and CVE-2026-6753 each carry a CVSS score of 7.3, which is High severity. CVE-2026-6754 has a CVSS score of 7.5, which is High severity, while CVE-2026-6785 carries a CVSS score of 8.1, which is High severity. These vulnerabilities affect how the browser processes web content, creating multiple potential attack paths.

There is no confirmed active exploitation for these issues. However, given the browser’s constant exposure to untrusted web content, these high-severity vulnerabilities present a significant risk. Exploitation could occur through malicious websites, leading to unauthorized actions or system compromise.

 

Fortinet FortiSandbox Patch for Critical Remote Compromise Vulnerabilities

“When your security layer breaks, attackers don’t knock—they walk straight in.”

Fortinet has issued a critical patch for FortiSandbox addressing two severe vulnerabilities that could enable system-level compromise. Both CVE-2026-39813 and CVE-2026-39808 carry a CVSS score of 9.1, which is Critical severity. These flaws present a high risk to organizations relying on FortiSandbox to analyze and contain threats, as successful exploitation could undermine the integrity of the entire security workflow.

The vulnerabilities impact a core defensive system, meaning exploitation could allow attackers to bypass protections or execute malicious actions within a trusted environment. There is no verified evidence of active exploitation or public proof-of-concept code at this time, but the critical severity and exposure risk make immediate patching essential.

 

Juniper Networks JSI LWC Critical Vulnerability

“A single critical flaw in core infrastructure can bring everything behind it into reach.”

Juniper Networks has released a patch for a critical vulnerability in JSI LWC, tracked as CVE-2026-33784. The CVSS score is 9.8, which is Critical severity, indicating an extremely high risk of exploitation and potential for severe system compromise. This vulnerability affects a core networking component, raising the risk of widespread impact across dependent systems and services.

If exploited, this issue could allow attackers to disrupt operations or gain unauthorized access within critical infrastructure environments. There is no verified evidence of active exploitation or public proof-of-concept code at this time, but the severity level makes immediate remediation a priority.

 

IBM Verify Identity Access Container Security Update Fixes High and Critical Vulnerabilities

“Identity systems failed at the gate, exposing the very controls meant to protect access.”

IBM has released a security update for Verify Identity Access Container addressing two serious vulnerabilities: CVE-2026-1342 and CVE-2026-1346. These issues impact identity and access control mechanisms, potentially allowing unauthorized actions within authentication workflows. CVE-2026-1342 has a CVSS score of 8.5, which is High severity. CVE-2026-1346 has a CVSS score of 9.3, which is Critical severity.

While no active exploitation has been verified, the nature of these vulnerabilities in identity infrastructure raises significant risk. If left unpatched, attackers could undermine authentication controls or escalate privileges within protected environments, directly affecting enterprise security posture.

 

Juniper Networks Junos OS – Multiple High-Severity Vulnerabilities

“Multiple cracks in the network core can quickly turn into a full loss of control.”

This patch addresses several high-severity vulnerabilities in Juniper Networks Junos OS that could allow attackers to escalate privileges across affected network devices. These issues impact core routing and switching systems, increasing the risk of unauthorized access and potential disruption of critical network operations.

CVE-2026-33785 has a CVSS score of 8.8, which is High severity. CVE-2026-21916 has a CVSS score of 7.3, which is High severity. CVE-2026-33790 has a CVSS score of 7.5, which is High severity. CVE-2026-33793 has a CVSS score of 7.8, which is High severity. CVE-2026-33797 has a CVSS score of 7.4, which is High severity. Collectively, these vulnerabilities present a broad attack surface across Junos OS deployments, particularly in environments where network infrastructure is exposed or highly interconnected.

No verified exploitation or public proof-of-concept activity has been confirmed for these vulnerabilities.

 

Fortinet FortiClientEMS

“Two critical, actively exploited flaws put endpoint management systems at immediate risk of takeover.”

Fortinet has released a security patch for FortiClientEMS addressing two critical vulnerabilities: CVE-2026-35616 and CVE-2026-21643. CVE-2026-35616 has a CVSS score of 9.1, which is Critical severity. CVE-2026-21643 also has a CVSS score of 9.1, which is Critical severity. Both vulnerabilities impact the integrity and control of endpoint management systems, significantly increasing the risk of widespread compromise.

These vulnerabilities are actively exploited in real-world attacks, making them high-priority threats. Successful exploitation could allow attackers to gain control over managed endpoints, disrupt security operations, or move laterally across enterprise environments. The patch closes these high-risk attack paths and is essential for maintaining control of endpoint infrastructure.

 

Adobe Commerce/Magento

“When your storefront is under attack, every transaction becomes a risk.”

Adobe has released a critical security patch for CVE-2025-54236 affecting Adobe Commerce. This vulnerability impacts core eCommerce functionality and could allow attackers to compromise online stores, manipulate transactions, or access sensitive customer and payment data. The CVSS score is 9.1, which is Critical severity.

Active exploitation has been confirmed, making this an urgent threat for any organization running affected versions. Attackers can leverage this weakness to target revenue streams directly, disrupt operations, and damage customer trust.

 

Cisco Enterprise NFV Infrastructure Software Security Patch

“A near-maximum severity flaw in core network infrastructure software creates a direct path to full system compromise.”

Cisco has released a security patch for Enterprise NFV Infrastructure Software addressing CVE-2026-20093, a critical vulnerability affecting virtualized network environments. The CVSS score is 9.8, which is Critical severity. This rating reflects an extremely high risk, with potential for complete system takeover if exploited.

There is no confirmed active exploitation at this time, but the severity indicates strong potential for attackers to weaponize the issue quickly. Given the role of NFV infrastructure in managing network services, a successful attack could disrupt operations, expose sensitive data, or enable widespread control across virtualized network functions.

 

CrowdStrike LogScale Self-Hosted Security Patch

“A critical vulnerability in logging infrastructure turns security visibility into a potential point of total compromise.”

CrowdStrike has released a security patch for LogScale Self-Hosted addressing CVE-2026-40050, a critical vulnerability affecting log management infrastructure. The CVSS score is 9.8, which is Critical severity. This level of risk indicates a near-certain path to full system compromise if exploited.

There is no confirmed active exploitation at this time. However, because LogScale plays a central role in collecting and analyzing security data, a successful attack could allow attackers to manipulate logs, hide malicious activity, or gain control over the system. The patch is essential to protect the integrity and reliability of security monitoring operations.

 

SimpleHelp Remote Access

“Active attacks are hitting SimpleHelp, turning remote support into a direct entry point.”

This patch addresses two vulnerabilities in SimpleHelp that significantly impact remote access security. CVE-2024-57726 has a CVSS score of 9.9, which is Critical severity, while CVE-2024-57728 carries a CVSS score of 7.2, which is High severity. These issues expose core remote support functionality, potentially allowing attackers to gain unauthorized access or disrupt managed systems.

Both vulnerabilities are actively exploited in the wild, confirming real-world attacks are already occurring. This elevates the urgency from risk to active threat. The patch closes these attack paths and is essential to protect systems relying on SimpleHelp for remote operations.

 

Linux Kernel Privilege Escalation

“Two active kernel exploits mean attackers don’t wait—they move in.”

The latest Linux kernel patches address two high-severity vulnerabilities that enable privilege escalation and system compromise. These flaws affect core kernel operations, allowing attackers to gain root access and potentially take control of affected systems.

CVE-2026-31431 has a CVSS score of 7.8, which is High severity. Active exploitation has been observed in the wild.
CVE-2026-43284 has a CVSS score of 7.8, which is High severity. Active exploitation has been observed in the wild.

The patch eliminates critical escalation paths and reinforces kernel protections. With both vulnerabilities now confirmed as actively exploited, unpatched systems face immediate risk of compromise and unauthorized control.

 

Wireshark

“Packet analysis tools become attack surfaces when parsing goes wrong.”

The Wireshark patch resolves a broad set of vulnerabilities affecting packet dissection and file parsing components. The most serious issue, CVE-2026-5402, carries a CVSS score of 8.8, which is High severity, followed by multiple additional high-severity flaws including CVE-2026-5403 (7.8), CVE-2026-5405 (7.8), and CVE-2026-5656 (7.0). These issues can allow attackers to trigger crashes or potentially execute code through crafted network traffic or malicious capture files, directly impacting analysts and systems processing untrusted data.

CVE-2026-5402 has a CVSS score of 8.8, which is High severity. CVE-2026-5403 has a CVSS score of 7.8, which is High severity. CVE-2026-5405 has a CVSS score of 7.8, which is High severity. CVE-2026-5656 has a CVSS score of 7.0, which is High severity. A large number of medium-severity vulnerabilities, generally scored at 5.5, expand the attack surface and increase reliability of exploitation chains. Proof-of-concept code is confirmed for several vulnerabilities, including CVE-2026-5405 and multiple medium-severity issues, demonstrating practical exploitation risk when handling untrusted traffic captures.

 

cPanel

“One exposed service can hand over the entire hosting environment.”

The cPanel patch addresses CVE-2026-41940, a critical vulnerability that enables remote code execution on affected systems. This flaw directly impacts internet-facing services, allowing attackers to execute arbitrary commands without requiring prior access. Given cPanel’s role in managing hosting environments, successful exploitation can lead to full server compromise, data exposure, and control over hosted websites.

CVE-2026-41940 has a CVSS score of 9.8, which is Critical severity. Active exploitation has been confirmed, indicating that attackers are already leveraging this vulnerability in real-world attacks. This significantly increases risk, particularly for publicly accessible systems running unpatched versions.

 

Palo Alto Cloud NGFW

“When your firewall is vulnerable, your entire network is exposed.”

This patch addresses CVE-2026-0300, a critical vulnerability in Palo Alto Networks Cloud NGFW that allows remote code execution. The flaw impacts a core security control layer, meaning attackers can bypass protections and execute arbitrary commands on affected systems. This puts network traffic, sensitive data, and downstream systems at immediate risk.

CVE-2026-0300 has a CVSS score of 9.3, which is Critical severity. Active exploitation has been confirmed, indicating that attackers are already leveraging this vulnerability in real-world environments. This significantly increases urgency, especially for organizations relying on Cloud NGFW to secure internet-facing infrastructure.

 

Salesforce Marketing Cloud Engagement

“When marketing platforms are exposed, customer data becomes the target.”

The latest Salesforce Marketing Cloud Engagement patch resolves multiple critical vulnerabilities that could allow unauthorized access, data exposure, or system manipulation within marketing automation workflows. These issues impact core services responsible for handling customer data, campaign execution, and integrations, creating significant risk for organizations relying on the platform for large-scale customer engagement.

CVE-2026-22585 has a CVSS score of 9.8, which is Critical severity.
CVE-2026-22586 has a CVSS score of 9.8, which is Critical severity.
CVE-2026-22582 has a CVSS score of 9.8, which is Critical severity.
CVE-2026-22583 has a CVSS score of 9.8, which is Critical severity.
CVE-2026-2298 has a CVSS score of 9.4, which is Critical severity.

The patch closes multiple high-impact attack paths that could expose sensitive customer data and disrupt marketing operations. There is no verified evidence of public exploitation or proof-of-concept code at this time, but the concentration of critical vulnerabilities significantly elevates the urgency to apply updates.

 

Juniper Networks Apstra – Privilege Escalation Vulnerability Patch

“A hidden weakness in network control can quietly hand over the keys.”

This patch addresses a high-severity vulnerability in Juniper Networks Apstra that could allow attackers to escalate privileges within the system. As Apstra is used to automate and manage data center networks, this issue poses a serious risk to infrastructure control and operational integrity if exploited.

CVE-2025-13914 has a CVSS score of 8.7, which is High severity. This indicates a strong potential for impact, particularly in environments where Apstra has broad access to network configuration and orchestration. No verified exploitation or public proof-of-concept activity has been confirmed.

 

Adobe ColdFusion Security Update Fixes Critical Remote Exploitation Risk

“A core web platform exposed a critical path for attackers to take control.”

Adobe has released a security update for ColdFusion to address CVE-2026-27304, a critical vulnerability affecting application server environments. This issue could allow attackers to execute unauthorized actions or gain control over affected systems, putting web applications and backend services at significant risk. The CVSS score is 9.3, which is Critical severity.

There is no verified evidence of active exploitation. However, due to ColdFusion’s role in powering enterprise web applications, this vulnerability presents a high-impact risk if left unpatched. Immediate remediation is essential to prevent potential compromise of application infrastructure.

 

Marimo

“A critical flaw in a developer tool can turn convenience into compromise.”

Marimo addressed CVE-2026-39987, a critical vulnerability that allows remote code execution within its platform. The issue stems from improper handling of user input or execution flows, enabling attackers to run arbitrary code and potentially gain full control of the host system and connected environments.

CVE-2026-39987 has a CVSS score of 9.3, which is Critical severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code. The patch secures execution pathways and strengthens input validation to prevent unauthorized code execution.

 

Microsoft Edge (Chromium-based) and Edge for Android Security Update

“Small browser bugs still open doors—this update quietly shuts them.”

Microsoft has released security updates addressing two vulnerabilities affecting Edge on desktop and Android platforms. CVE-2026-33118 impacts Chromium-based Edge, while CVE-2026-33119 affects Edge for Android. These issues could allow unintended behavior within the browser, increasing exposure risk during routine web activity.

CVE-2026-33118 has a CVSS score of 4.3, which is Medium severity. CVE-2026-33119 has a CVSS score of 5.4, which is Medium severity. Both vulnerabilities are moderate in impact but still relevant due to the browser’s role as a primary attack surface. There is no verified evidence of active exploitation or publicly available proof-of-concept code for either issue.

 

Fortinet FortiAnalyzer Cloud Access Control Vulnerability

“A gap in monitoring security can quickly become a gateway for attackers.”

Fortinet has released a security update for FortiAnalyzer Cloud addressing CVE-2026-22828. This vulnerability affects access control mechanisms within the platform, which is widely used for centralized logging, analytics, and security monitoring. If exploited, it could allow unauthorized actions within the environment, potentially weakening visibility and control over network security events.

CVE-2026-22828 has a CVSS score of 7.3, which is High severity. This indicates a serious risk, especially in environments relying on FortiAnalyzer for threat detection and response. There is no verified evidence of active exploitation or publicly available proof-of-concept code associated with this issue.

 

nginx-ui Critical Remote Code Execution Vulnerability 

“One exposed admin interface is all it takes to hand over the keys.”

A critical vulnerability in nginx-ui, tracked as CVE-2026-33032, has been addressed with a security patch. The CVSS score is 9.8, which is Critical severity, signaling maximum risk. This issue could allow attackers to execute arbitrary code, potentially taking full control of affected systems through the management interface.

The presence of a verified proof-of-concept increases the urgency, as it lowers the barrier for exploitation and accelerates attacker adoption. Systems running nginx-ui in exposed or improperly secured environments are especially at risk, making rapid patching essential to prevent compromise.

 

Ivanti Endpoint Manager

“When mobile endpoints are exposed, attackers gain a direct line into the enterprise.”

The latest Ivanti Endpoint Manager Mobile patch addresses a high-severity vulnerability that could allow attackers to compromise managed mobile devices and potentially pivot into enterprise systems. The issue affects how the platform handles certain requests, creating a pathway for unauthorized access or manipulation of device management functions.

CVE-2026-6973 has a CVSS score of 7.2, which is High severity.

Active exploitation has been observed in the wild, increasing the urgency of this patch. Organizations using Endpoint Manager Mobile are at heightened risk, as attackers may already be targeting exposed systems to gain control over mobile endpoints and associated enterprise data.

 

Juniper Networks CTP OS High Severity Vulnerability 

“A high-severity gap in network software can quietly turn into a major disruption.”

Juniper Networks has released a patch for a vulnerability in CTP OS, identified as CVE-2026-33771. The CVSS score is 7.4, which is High severity, indicating a significant security risk that could impact system integrity and availability if exploited. This issue affects a core networking platform, increasing the potential for operational disruption in enterprise environments.

While not critical, the vulnerability still poses a meaningful threat, particularly in environments where network reliability is essential. There is no verified evidence of active exploitation or public proof-of-concept code at this time, but the risk level justifies timely patching to prevent potential misuse.

 

FreeBSD Kernel Memory Handling 

“Even trusted operating systems can be turned against themselves when critical bugs surface.”

This FreeBSD patch addresses two high-severity vulnerabilities impacting core system security. CVE-2026-4747 presents a significant risk with the potential for system compromise through exploitable conditions, while CVE-2026-42511 further weakens system integrity and stability. Together, these issues increase the likelihood of unauthorized access or disruption across affected environments.

CVE-2026-4747 has a CVSS score of 8.8, which is High severity. CVE-2026-42511 has a CVSS score of 8.1, which is High severity. Proof-of-concept code is available for CVE-2026-4747, confirming that exploitation is feasible. There is no verified evidence of exploitation or public proof-of-concept code for CVE-2026-42511.

 

OpenClaw Critical Remote Execution 

“Two critical bugs open the door wide enough for complete system takeover.”

OpenClaw released a critical security update addressing two severe vulnerabilities that expose systems to potential remote compromise. These issues impact core application components and could allow attackers to execute arbitrary code with minimal resistance. CVE-2026-32922 has a CVSS score of 9.9, which is Critical severity. CVE-2026-33579 has a CVSS score of 9.9, which is Critical severity. Both vulnerabilities represent near-maximum risk, with the potential to fully compromise affected systems.

No verified real-world exploitation or proof-of-concept code has been confirmed for either vulnerability at this time. Despite this, the severity alone makes these flaws highly dangerous, especially in exposed or production environments. The patch enforces stricter input validation and closes the pathways that could lead to unauthorized code execution.

 

Kubernetes ingress-nginx Controller 

“A single weak entry point in your cluster can expose everything behind it.”

Kubernetes addressed a high-severity vulnerability in the ingress-nginx controller that could allow attackers to manipulate traffic handling and potentially execute unauthorized actions within the cluster. The issue impacts how incoming requests are processed, creating an opportunity for abuse in exposed environments. CVE-2026-4342 has a CVSS score of 8.8, which is High severity. This level of risk is significant for organizations relying on ingress-nginx as a primary gateway to services.

No verified real-world exploitation or proof-of-concept code has been confirmed. However, given the role of ingress in controlling external access, the vulnerability presents a serious attack surface. The patch strengthens request validation and closes the pathway that could allow malicious traffic to influence cluster behavior.

 

OpenSSL 

“A small weakness in encryption handling can bring secure systems to a halt.”

OpenSSL released a security update to fix a vulnerability that could allow attackers to trigger a denial-of-service condition through crafted inputs. The issue affects how the library processes certain cryptographic operations, potentially causing services that rely on OpenSSL to become unresponsive. CVE-2026-31790 has a CVSS score of 7.5, which is High severity. This makes it a serious concern for any system depending on OpenSSL for secure communications.

No verified real-world exploitation or proof-of-concept code has been confirmed. Despite that, the widespread use of OpenSSL amplifies the potential impact, as disruption at the cryptographic layer can cascade across applications and services. The patch improves input handling and stabilizes processing to prevent service interruption.

 

Flatpak

“If the sandbox breaks, the system behind it is no longer safe.”

Flatpak released a critical security update to address a vulnerability that could allow sandbox escape, enabling attackers to break out of application isolation and interact with the host system. This undermines one of Flatpak’s core security guarantees, potentially exposing sensitive data and system resources. CVE-2026-34078 has a CVSS score of 9.3, which is Critical severity. The impact is severe, especially in environments relying on sandboxing for application security.

No verified real-world exploitation or proof-of-concept code has been confirmed. However, the nature of the vulnerability makes it highly dangerous, as it directly affects the boundary between untrusted applications and the host system. The patch strengthens sandbox enforcement and closes the escape path.

 

Discord Client 

“Even everyday apps can become entry points if input isn’t handled right.”

Discord addressed a high-severity vulnerability in its client that could allow attackers to exploit improper input handling and potentially execute unintended actions on a user’s system. The issue affects how the client processes certain data, creating a risk when interacting with untrusted content. CVE-2026-0776 has a CVSS score of 7.3, which is High severity. This makes it a notable concern given the platform’s widespread use and constant exposure to external inputs.

No verified real-world exploitation or proof-of-concept code has been confirmed. Still, the nature of the vulnerability increases risk in environments where users frequently interact with unknown links or content. The patch improves input validation and strengthens safeguards within the client to prevent misuse.

 

TP-Link AX53 v1.0 Router 

“A vulnerable router turns your entire network into an easy target.”

TP-Link released a security patch for the AX53 v1.0 router to address a high-severity vulnerability that could allow attackers to interfere with device operations or gain unauthorized access. The issue affects core router functionality, making it especially dangerous as it sits at the center of network traffic. CVE-2026-30818 has a CVSS score of 8.5, which is High severity. This level of risk puts both home and small business networks at potential exposure.

No verified real-world exploitation or proof-of-concept code has been confirmed. Even so, routers are high-value targets, and any weakness at this layer can expose all connected devices. The patch strengthens access controls and corrects the underlying issue to reduce the attack surface.

 

GitLab 

“When your development platform slows to a halt, productivity and security both take a hit.”

GitLab released a security update to address a vulnerability that could allow attackers to trigger a denial-of-service condition, disrupting normal operations. The issue affects how GitLab processes certain requests, potentially causing system slowdown or unavailability. CVE-2025-12664 has a CVSS score of 7.5, which is High severity. This makes it a significant risk for organizations relying on GitLab for continuous integration and collaboration.

No verified real-world exploitation or proof-of-concept code has been confirmed. However, service disruption in development pipelines can lead to operational delays and impact software delivery timelines. The patch improves request handling and system stability to prevent abuse.

 

Contemporary Controls BASControl20 

“A single exposed weakness can open the door to full system compromise.”

This patch addresses a critical vulnerability in Contemporary Controls BASControl20 devices that could allow an attacker to gain unauthorized control over the system. The issue poses a severe risk to building automation environments, where these controllers are often deployed to manage HVAC and other infrastructure systems.

CVE-2025-13926 has a CVSS score of 9.8, which is Critical severity. This level of severity indicates that the vulnerability can be exploited remotely with little to no user interaction, potentially leading to full system compromise. No verified exploitation or proof-of-concept activity has been confirmed at this time.

 

Canonical LXD

“Break the container once, and the host is no longer yours.”

This patch addresses multiple critical vulnerabilities in Canonical’s LXD that undermine container isolation and expose the host system to compromise. These issues affect how LXD enforces boundaries between containers and the underlying host, creating a path for attackers to escalate privileges and potentially take full control of the environment.

CVE-2026-34177 has a CVSS score of 9.1, which is Critical severity. CVE-2026-34178 has a CVSS score of 9.1, which is Critical severity. CVE-2026-34179 has a CVSS score of 9.1, which is Critical severity. All three vulnerabilities present a serious risk to systems running LXD in production, especially in multi-tenant or cloud environments.

Public proof-of-concept code is available for these vulnerabilities, increasing the likelihood of exploitation and making rapid patching essential to maintain system integrity.

 

R Project

“When code meant for analysis becomes a path to execution, everything is at risk.”

This patch addresses a high-severity vulnerability in the R programming language that could allow attackers to execute arbitrary code within affected environments. The issue impacts how R processes certain inputs, creating a pathway for malicious code execution in systems that rely on R for statistical computing and data analysis.

CVE-2019-25695 has a CVSS score of 8.4, which is High severity. This level of risk indicates significant impact, particularly in environments where R is integrated into automated workflows or exposed to untrusted input sources.

Public proof-of-concept code is available, increasing the likelihood of exploitation and making this vulnerability a practical threat in real-world scenarios.

 

Hitachi JP1/IT Desktop Management 2

“When endpoint control is compromised, the entire enterprise follows.”

This patch addresses a high-severity vulnerability in Hitachi JP1/IT Desktop Management 2 – Manager that could allow attackers to escalate privileges within managed environments. Given the product’s role in centralized desktop and endpoint management, exploitation could lead to widespread control over enterprise systems and sensitive operations.

CVE-2025-65115 has a CVSS score of 8.8, which is High severity. This indicates a significant risk to organizations relying on this platform for device administration and policy enforcement. No verified exploitation or public proof-of-concept activity has been confirmed.

 

Elastic Logstash

“When your data pipeline is exposed, attackers can turn ingestion into intrusion.”

This patch addresses a high-severity vulnerability in Elastic Logstash that could allow attackers to exploit weaknesses in data processing pipelines. As Logstash is widely used to ingest and transform data across systems, this issue introduces risk to environments where untrusted or external data sources are handled.

CVE-2026-33466 has a CVSS score of 8.1, which is High severity. This level of risk signals a strong potential for impact, particularly in centralized logging and data aggregation infrastructures where Logstash operates with elevated trust and access.

No verified exploitation or public proof-of-concept activity has been confirmed for this vulnerability.

 

Red Hat Enterprise Linux 10

“A trusted operating system weakness can quietly elevate an attacker’s reach.”

This patch addresses a high-severity vulnerability in Red Hat Enterprise Linux 10 that could allow attackers to escalate privileges on affected systems. As a core enterprise operating system, any privilege escalation issue introduces risk to system integrity, access controls, and sensitive workloads running on the platform.

CVE-2025-14821 has a CVSS score of 7.8, which is High severity. This indicates a strong potential for impact, especially in environments where local or limited access can be leveraged to gain elevated permissions.

No verified exploitation or public proof-of-concept activity has been confirmed for this vulnerability.

 

OpenClaw 

“Two critical bugs open the door wide enough for complete system takeover.”

OpenClaw released a critical security update addressing two severe vulnerabilities that expose systems to potential remote compromise. These issues impact core application components and could allow attackers to execute arbitrary code with minimal resistance. CVE-2026-32922 has a CVSS score of 9.9, which is Critical severity. CVE-2026-33579 has a CVSS score of 9.9, which is Critical severity. Both vulnerabilities represent near-maximum risk, with the potential to fully compromise affected systems.

No verified real-world exploitation or proof-of-concept code has been confirmed for either vulnerability at this time. Despite this, the severity alone makes these flaws highly dangerous, especially in exposed or production environments. The patch enforces stricter input validation and closes the pathways that could lead to unauthorized code execution.

 

ShowDoc 

“One exposed endpoint can hand over your entire system.”

This patch addresses a critical remote code execution vulnerability in ShowDoc tracked as CVE-2025-0520. The issue allows attackers to execute arbitrary code on affected systems, creating a direct path to full system compromise. The CVSS score is 9.4, which is Critical severity. This level of severity reflects the ease of exploitation and the high impact on confidentiality, integrity, and availability.

Proof-of-concept code is publicly available, increasing the likelihood of exploitation in real-world environments. Organizations using ShowDoc should treat this as an urgent security risk due to the potential for rapid weaponization and automated attacks.

 

Composer 

“Two silent weaknesses can quietly open the door to serious damage.”

This patch addresses two high-severity vulnerabilities in Composer, tracked as CVE-2026-40261 and CVE-2026-40176. These issues expose systems to potential compromise through improper handling of dependencies and package operations. CVE-2026-40261 has a CVSS score of 8.8, which is High severity. CVE-2026-40176 has a CVSS score of 7.8, which is also High severity. Both vulnerabilities pose significant risk to application integrity and development pipelines if left unpatched.

No verified exploitation or proof-of-concept code is currently confirmed for these issues. However, the nature of Composer as a dependency manager increases the potential blast radius, as compromised components can propagate risk across multiple projects and environments.

 

Kyverno 

“A single gap in policy enforcement can open the door to total cluster compromise.”

Kyverno has released a critical security patch addressing CVE-2026-22039, a severe vulnerability impacting its policy enforcement mechanisms. This issue could allow attackers to bypass admission controls, undermining Kubernetes security policies and exposing clusters to unauthorized workloads or configuration changes. The CVSS score is 10.0, which is Critical severity.

Proof-of-concept code is publicly available, confirming that exploitation is feasible. This significantly raises the risk for organizations relying on Kyverno for policy governance, as attackers can weaponize this weakness to evade controls and deploy malicious resources.

 

Apache Tomcat

“Weaknesses in core web infrastructure quietly open the door to serious application compromise.”

Apache has released security updates for Tomcat addressing CVE-2026-34486 and CVE-2026-29146, both affecting core request handling and application processing behavior. These vulnerabilities could allow attackers to interfere with how web applications process input, potentially leading to unauthorized access or service disruption in exposed environments.

CVE-2026-34486 has a CVSS score of 7.5, which is High severity. CVE-2026-29146 has a CVSS score of 7.5, which is High severity. While no verified exploitation or public proof-of-concept code has been confirmed, both issues pose meaningful risk to production systems running unpatched versions of Tomcat.

 

Splunk Enterprise 

“When visibility tools are compromised, the blind spots spread across the entire operation.”

Splunk has released a security patch for CVE-2026-20204 affecting Splunk Enterprise. This vulnerability impacts core platform behavior and could allow attackers to interfere with how data is processed or accessed within the system. Given Splunk’s role in monitoring and analytics, this creates risk around data integrity and operational visibility. The CVSS score is 7.1, which is High severity.

There is no verified evidence of real-world exploitation or publicly available proof-of-concept code. Despite this, the vulnerability poses a significant risk to environments relying on Splunk for security monitoring and log management.

 

Splunk MCP Server

“When control systems are exposed, attackers gain a direct path into the heart of operations.”

Splunk has released a security patch for CVE-2026-20205 affecting the Splunk MCP Server. This vulnerability impacts core server functionality and could allow unauthorized interaction with managed processes, increasing the risk of system manipulation or service disruption. The CVSS score is 7.2, which is High severity.

There is no verified evidence of real-world exploitation or publicly available proof-of-concept code. Even so, the vulnerability presents a meaningful threat to environments relying on MCP Server for operational control and coordination.

 

etcd 

“When the data backbone is exposed, every connected system is at risk.”

The etcd project has released a security patch for CVE-2026-33413, a high-severity vulnerability affecting its core data storage and coordination functions. As a critical component in distributed systems and Kubernetes environments, etcd plays a central role in maintaining cluster state. This issue could allow attackers to interfere with data handling or access sensitive cluster information, increasing the risk of system-wide impact. The CVSS score is 8.8, which is High severity.

There is no verified evidence of real-world exploitation or publicly available proof-of-concept code. Despite this, the importance of etcd within infrastructure makes this vulnerability a serious concern that warrants prompt attention.

 

HPE Private 5G Core

“When telecom core systems are exposed, the entire network becomes a target.”

Hewlett Packard Enterprise has released a security patch for CVE-2026-23818 affecting its Private 5G Core platform. This high-severity vulnerability impacts critical network control functions and could allow attackers to interfere with core operations or access sensitive network data. Given the role of 5G core infrastructure, exploitation could disrupt communications or compromise service integrity. The CVSS score is 8.8, which is High severity.

Proof-of-concept code is publicly available, confirming that the vulnerability is actionable and increasing the likelihood of targeted attacks. Organizations running HPE Private 5G Core should treat this as a significant risk to network stability and security.

 

Ghost CMS 

“A weakness in your publishing platform can turn your content engine into an attack surface.”

TryGhost has released a critical security patch for CVE-2026-26980 affecting the Ghost CMS platform. This vulnerability impacts core application behavior and could allow attackers to compromise content management operations, potentially leading to unauthorized access, data exposure, or site manipulation. The CVSS score is 9.4, which is Critical severity.

There is no verified evidence of real-world exploitation or publicly available proof-of-concept code. Despite this, the severity of the issue makes it a high-risk concern for organizations running Ghost in production environments.

 

mailcow-dockerized

“Two exposed paths in mailcow turn routine email infrastructure into a high-risk entry point.”

This patch addresses two vulnerabilities in mailcow-dockerized that significantly impact system security. CVE-2026-40872 carries a CVSS score of 9.3, which is Critical severity, while CVE-2026-40871 has a CVSS score of 7.2, which is High severity. Together, these issues create serious exposure across core mail services, potentially allowing attackers to disrupt operations or gain unauthorized access.

Proof-of-concept code is available for both vulnerabilities, confirming that exploitation is practical. The critical issue poses immediate risk to exposed environments, while the high-severity flaw further expands the attack surface. This update closes both vectors and strengthens the overall resilience of the mail platform.

 

AWS Firecracker

“A weakness in virtualization layers can quietly break isolation and expose everything above it.”

AWS has released a security patch for CVE-2026-5747 affecting Firecracker, its lightweight virtualization technology used to run microVMs. This vulnerability impacts isolation controls between virtualized workloads and could allow attackers to interfere with or escape intended boundaries, posing a risk to multi-tenant environments. The CVSS score is 7.5, which is High severity.

There is no verified evidence of real-world exploitation or publicly available proof-of-concept code. However, due to Firecracker’s role in cloud infrastructure and serverless environments, this issue represents a meaningful risk to workload security and tenant isolation.

 

Grafana Pyroscope

“A single exposed weakness can open the door to full system compromise.”

Grafana addressed a critical vulnerability in Pyroscope that could allow severe system impact if exploited. This issue affects core functionality and exposes systems to high-risk compromise scenarios if left unpatched. CVE-2025-41118 has a CVSS score of 9.1, which is Critical severity.

The patch closes this gap by strengthening how the application handles unsafe conditions within its processing logic. There is no verified evidence of active exploitation or public proof-of-concept code at this time, but the severity alone makes this a high-priority update for any environment running Pyroscope.

 

Cloud Foundry UUA

“A high-impact identity weakness can quietly put entire platforms at risk.”

Cloud Foundry addressed a high-severity vulnerability in UUA that could significantly impact authentication and identity management processes. This issue affects a critical layer of the platform, increasing the risk of unauthorized access or misuse if left unresolved. CVE-2026-22734 has a CVSS score of 8.6, which is High severity.

The patch strengthens protections around how identity data and access controls are handled within the system. There is no verified evidence of active exploitation or public proof-of-concept code, but the exposure level and role of this component make this a priority fix for any Cloud Foundry deployment.

 

Dell PowerProtect Data Domain BoostFS

“A storage layer weakness can quietly become a gateway to deeper system access.”

Dell resolved a high-severity vulnerability in PowerProtect Data Domain BoostFS that could expose systems to unauthorized access or disruption within data protection workflows. The issue affects how the BoostFS component handles critical operations, creating risk in environments relying on secure backup and recovery processes. CVE-2025-36568 has a CVSS score of 7.8, which is High severity.

The patch reinforces safeguards within the file system interaction layer to prevent misuse or unintended access paths. There is no verified evidence of active exploitation or public proof-of-concept code, but the role of this component in enterprise data protection makes timely remediation important.

 

Barracuda RMM 

“A remote management gap can quickly turn into full control of managed systems.”

Barracuda addressed a high-severity vulnerability in its RMM platform that could expose managed environments to unauthorized access or control. The issue impacts how the remote monitoring and management system handles critical operations, increasing the risk of compromise across connected endpoints. CVE-2026-22676 has a CVSS score of 7.8, which is High severity.

The patch strengthens protections within the management layer to prevent misuse of remote capabilities. There is no verified evidence of active exploitation or public proof-of-concept code, but given the centralized control RMM platforms hold, this issue presents significant operational risk if not addressed.

 

SGLang 

“One exposed endpoint can hand over complete control in seconds.”

SGLang patched a critical remote code execution vulnerability affecting its core framework. The issue allows unauthenticated attackers to execute arbitrary code on impacted systems through crafted requests, putting entire environments at immediate risk of compromise.

CVE-2026-5760 has a CVSS score of 9.8, which is Critical severity. The vulnerability carries maximum impact across confidentiality, integrity, and availability with no required privileges. Public proof-of-concept code has been verified, increasing the likelihood of rapid weaponization.

This patch closes the exposed execution path and enforces stricter input handling to prevent unauthorized command execution.

 

TrueConf Client 

“An actively exploited client-side bug turns a trusted communication tool into an entry point for attackers.”

TrueConf has released a security patch for TrueConf Client addressing CVE-2026-3502, a high-severity vulnerability impacting the application’s security controls. The CVSS score is 7.8, which is High severity. This level of risk indicates a strong likelihood of compromise, particularly in environments relying on secure communications.

The vulnerability is actively exploited in real-world attacks, raising immediate concern for organizations using the client. Attackers can leverage this issue to gain unauthorized access or execute malicious actions through the application, making timely patching critical to reduce exposure.

 

Cisco Smart Software Manager On-Prem 

“A critical weakness in software licensing infrastructure opens the door to full system control.”

Cisco has released a security patch for Smart Software Manager On-Prem addressing CVE-2026-20160, a critical vulnerability affecting license management systems. The CVSS score is 9.8, which is Critical severity. This level of severity indicates a near-certain path to complete system compromise if exploited.

There is no confirmed active exploitation at this time, but the risk remains extremely high due to the system’s central role in managing software entitlements across enterprise environments. A successful attack could allow unauthorized access, manipulation of licensing controls, or broader system compromise.

 

CrewAI

“Multiple critical vulnerabilities expose AI-driven workflows to takeover, with one already demonstrated in the wild.”

CrewAI has released a security patch addressing multiple high-impact vulnerabilities affecting its platform. The update includes four CVEs, with three rated Critical and one High severity. CVE-2026-2275 has a CVSS score of 9.6, which is Critical severity, and has a publicly available proof-of-concept. CVE-2026-2286 and CVE-2026-2287 each carry a CVSS score of 9.8, which is Critical severity. CVE-2026-2285 has a CVSS score of 7.5, which is High severity.

These vulnerabilities could allow attackers to compromise AI workflows, manipulate outputs, or gain unauthorized control of system operations. While only one issue currently has confirmed proof-of-concept code, the severity across the set indicates strong potential for rapid weaponization. This patch is essential to secure AI-driven environments and prevent misuse.

 

Vim 

“A critical vulnerability in a trusted text editor turns simple file edits into a high-risk operation.”

Vim has released a security patch addressing two significant vulnerabilities impacting its core functionality. CVE-2026-34714 has a CVSS score of 9.2, which is Critical severity, while CVE-2026-34982 carries a CVSS score of 8.2, which is High severity. These issues could allow attackers to exploit routine file interactions, potentially leading to system compromise.

There is no confirmed active exploitation for either vulnerability. However, given Vim’s widespread use across development and administrative environments, these high-impact issues present a serious risk. Exploitation could occur through malicious files or manipulated inputs, making this patch important for maintaining system integrity.

 

n8n 

“Two critical vulnerabilities in automation workflows create a direct path to full system compromise.”

n8n has released a security patch addressing two critical vulnerabilities impacting its workflow automation platform. CVE-2026-33660 has a CVSS score of 9.4, which is Critical severity. CVE-2026-33696 also has a CVSS score of 9.4, which is Critical severity. These issues pose a severe risk to environments relying on automated processes and integrations.

There is no confirmed active exploitation at this time. However, the critical severity indicates a high likelihood of attackers leveraging these vulnerabilities to gain unauthorized access, execute malicious workflows, or take control of connected systems. The patch is essential to secure automation pipelines and prevent large-scale compromise.

 

Broadcom Data Loss Prevention 

“A high-severity gap in data protection software weakens the very system meant to stop data leaks.”

Broadcom has released a security patch for Data Loss Prevention addressing CVE-2026-3991, a high-severity vulnerability impacting core data protection mechanisms. The CVSS score is 7.8, which is High severity. This level of risk indicates a strong potential for attackers to bypass controls or interfere with data protection processes.

There is no confirmed active exploitation at this time. However, because the vulnerability affects a system designed to safeguard sensitive data, any weakness significantly increases the risk of data exposure or policy evasion. The patch strengthens the integrity of DLP enforcement and reduces the chance of unauthorized data movement.

 

nginx-ui

“A critical flaw with proven exploit code puts web management interfaces one step away from full compromise.”

A security patch has been released for nginx-ui addressing CVE-2026-33026, a critical vulnerability affecting the web-based management interface. The CVSS score is 9.4, which is Critical severity. This level of risk indicates a high likelihood of full system compromise if exploited.

A public proof-of-concept is available, confirming that exploitation is feasible and lowering the barrier for attackers. This vulnerability could allow unauthorized access, manipulation of configurations, or complete takeover of systems managed through nginx-ui. The patch closes this high-risk exposure and is essential for securing administrative interfaces.

 

Foxit PDF Editor

“High-severity flaws in a common PDF tool turn everyday documents into potential attack vectors.”

Foxit has released a security patch for Foxit PDF Editor addressing two high-severity vulnerabilities: CVE-2026-3775 and CVE-2026-3779. CVE-2026-3775 has a CVSS score of 7.8, which is High severity. CVE-2026-3779 also has a CVSS score of 7.8, which is High severity. These vulnerabilities affect how the application processes PDF content, creating risk during normal document handling.

There is no confirmed active exploitation for these issues. However, given the widespread use of PDF files and the ease of delivering malicious documents, these vulnerabilities present a meaningful risk. Exploitation could lead to unauthorized actions or system compromise when opening specially crafted files.

 

Tenable Nessus

“A high-severity issue in a core vulnerability scanner weakens the very tool trusted to find risk.”

Tenable has released a security patch addressing CVE-2026-33694 in Nessus and Nessus Agent. The vulnerability carries a CVSS score of 7.4, which is High severity. This issue affects a widely deployed vulnerability scanning platform used across enterprise environments.

There is no confirmed active exploitation at this time. However, weaknesses in security scanning tools can undermine trust in detection and expose systems to indirect risk. If exploited, attackers could interfere with scanning operations or leverage the tool as a foothold within the environment.

 

PackageKit 

“A trusted system service became a fast track to full system control.”

PackageKit patched a high-severity vulnerability that allowed local attackers to escalate privileges through improper authorization handling. The flaw could be exploited to gain elevated system access, effectively bypassing standard permission controls and exposing the host to full compromise. CVE-2026-41651 has a CVSS score of 8.8, which is High severity.

Proof-of-concept code is publicly available, increasing the likelihood of exploitation in real environments. Systems that rely on PackageKit for software management are especially exposed, as the vulnerability sits in a core service often running with elevated privileges.

 

InternLM lmdeploy

“A high-impact weakness in lmdeploy opens the door to real attack code.”

This patch addresses CVE-2026-33626 in InternLM’s lmdeploy. The issue exposes the system to a significant security risk that could be leveraged to compromise operations or data integrity. The CVSS score is 7.5, which is High severity. This level of severity indicates a strong potential for damage if left unpatched, especially in production environments.

Proof-of-concept code is publicly available, confirming that exploitation is practical and not just theoretical. This increases the urgency for remediation, as attackers can replicate the issue with minimal effort. The patch closes the gap and reduces exposure to active misuse.

 

NGINX

“A high-severity gap in NGINX exposes critical web infrastructure to avoidable risk.”

This patch addresses CVE-2026-27654 in F5’s NGINX Open Source. The vulnerability introduces a high-impact weakness in a widely deployed web server component, potentially affecting availability or security of hosted applications. The CVSS score is 8.2, which is High severity, signaling a serious threat to exposed systems.

There is no verified evidence of real-world exploitation or proof-of-concept code at this time. However, the severity level alone warrants prompt attention, especially given NGINX’s role in front-end infrastructure. Applying the patch reduces the risk of service disruption or compromise.

 

Spinnaker

“A critical flaw in Spinnaker creates a worst-case security scenario with maximum impact.”

This patch addresses CVE-2026-32613 in Spinnaker. The vulnerability represents a severe weakness in a continuous delivery platform that sits at the center of deployment pipelines. The CVSS score is 10.0, which is Critical severity. This is the highest possible rating, indicating complete compromise potential across affected systems.

There is no verified evidence of real-world exploitation or proof-of-concept code at this time. Despite that, the severity alone demands immediate action, as exploitation could lead to full control over deployment processes and downstream environments. The patch closes this critical gap and restores control integrity.

 

Iperius Backup

“A long-standing weakness in backup software exposes critical data paths to real attack code.”

This patch addresses CVE-2018-25261 in Iperius Backup. The vulnerability affects backup operations, a core function responsible for safeguarding critical data. If exploited, it could allow attackers to interfere with backup integrity or gain unauthorized access to sensitive information. The CVSS score is 8.4, which is High severity, indicating a serious risk to business continuity and data protection.

Proof-of-concept code is available, confirming the vulnerability can be actively exploited. This raises the urgency, especially for environments relying on backups for recovery and resilience. The patch mitigates the issue and restores trust in backup operations.

 

Hugging Face LeRobot

“A critical flaw in LeRobot turns AI workflows into a high-risk execution path.”

This patch addresses CVE-2026-25874 in Hugging Face LeRobot. The vulnerability introduces a severe security gap within an AI and robotics framework, potentially allowing attackers to manipulate execution flows or compromise connected systems. The CVSS score is 9.3, which is Critical severity, indicating a high likelihood of major impact if exploited.

Proof-of-concept code is available, confirming that exploitation is feasible and accessible. This raises immediate concern for environments using LeRobot in automated or integrated pipelines. The patch eliminates this exposure and strengthens the security of AI-driven operations.

 

GitHub Enterprise

“A high-severity gap in enterprise code management demands swift closure before it turns into real risk.”

GitHub Enterprise Server addresses CVE-2026-3854, a high-severity vulnerability that could impact the integrity and security of enterprise development environments. The CVSS score is 8.7, which is High severity. This level of risk signals meaningful exposure, particularly for organizations relying on GitHub Enterprise Server to manage sensitive code, workflows, and collaboration pipelines.

The patch focuses on closing this security gap to prevent potential misuse or unauthorized impact within enterprise deployments. There is no verified evidence of active exploitation or public proof-of-concept tied to this issue at this time, but the severity alone warrants prompt attention.

 

Microsoft Windows 10 Version 1607

“Even a moderate flaw becomes urgent when attackers are already using it.”

Microsoft addresses CVE-2026-32202 in Windows 10 Version 1607, a vulnerability with a CVSS score of 4.3, which is Medium severity. While the numerical severity is moderate, the risk is elevated due to confirmed active exploitation. This means attackers are already leveraging the issue in real-world scenarios, increasing the urgency for remediation.

The patch is designed to eliminate the weakness and reduce exposure in affected systems. Organizations running this legacy Windows version face increased risk if updates are delayed, especially given the confirmed exploitation activity tied to this vulnerability.

 

CODESYS Control RTE and Runtime Toolkit

“Industrial control systems fail hard when trust boundaries break.”
This CODESYS patch addresses multiple vulnerabilities across Control RTE (SL) and the Runtime Toolkit, directly impacting industrial automation environments. CVE-2025-41660 and CVE-2025-41659 are high-severity issues that can compromise system integrity and disrupt operational control, posing risk to both availability and safety in ICS deployments. CVE-2025-41658 introduces a medium-severity weakness that contributes to the overall exposure of the runtime environment.

CVE-2025-41660 has a CVSS score of 8.8, which is High severity. CVE-2025-41659 has a CVSS score of 8.3, which is High severity. CVE-2025-41658 has a CVSS score of 5.5, which is Medium severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for these vulnerabilities.

 

OpenEMR

“Critical gaps in healthcare software can expose entire patient systems in seconds.”

The OpenEMR patch addresses three vulnerabilities that impact system integrity and data security across deployments. The most severe, CVE-2026-24908, allows attackers to fully compromise the system, posing immediate risk to sensitive medical data and application control. CVE-2026-23627 introduces a high-severity issue that can further weaken system protections, while CVE-2026-24487 presents a moderate risk that still contributes to the overall attack surface.

CVE-2026-24908 has a CVSS score of 10.0, which is Critical severity. CVE-2026-23627 has a CVSS score of 7.4, which is High severity. CVE-2026-24487 has a CVSS score of 5.7, which is Medium severity. Proof-of-concept code is available for all three vulnerabilities, confirming that exploitation is practical and increasing the urgency for remediation in production environments handling healthcare data. A total of 38 CVEs have been assigned to OpenEMR.

 

MOVEit Automation

“A single weakness in file transfer systems can expose entire data pipelines.”

The MOVEit Automation patch addresses two serious vulnerabilities impacting secure file transfer operations. CVE-2026-4670 is a critical issue that could allow attackers to gain unauthorized access or execute actions at the highest privilege levels, threatening the integrity and confidentiality of transferred data. CVE-2026-5174 introduces a high-severity weakness that further weakens system defenses and increases exposure risk in enterprise environments handling sensitive file exchanges.

CVE-2026-4670 has a CVSS score of 9.8, which is Critical severity. CVE-2026-5174 has a CVSS score of 7.7, which is High severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for these vulnerabilities at this time.

 

Jenkins Plugin

“Trusted plugins can become the weakest link in your CI/CD pipeline.”

This Jenkins patch addresses multiple vulnerabilities across widely used plugins, including GitHub, Credentials Binding, and HTML Publisher. CVE-2026-42523 is a critical issue in the GitHub Plugin that can severely impact pipeline security and potentially allow unauthorized access or manipulation of build processes. CVE-2026-42524 affects the HTML Publisher Plugin with high severity, while CVE-2026-42520 impacts the Credentials Binding Plugin, introducing additional risk around sensitive credential handling.

CVE-2026-42523 has a CVSS score of 9.0, which is Critical severity. CVE-2026-42524 has a CVSS score of 8.0, which is High severity. CVE-2026-42520 has a CVSS score of 7.5, which is High severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for these vulnerabilities at this time.

 

MetInfo CMS

“One vulnerable CMS endpoint can expose the entire website to takeover.”

The MetInfo CMS patch addresses CVE-2026-29014, a critical vulnerability that allows remote code execution on affected systems. This flaw enables attackers to execute arbitrary commands without authentication, putting full control of the web application and underlying server at risk. The issue directly impacts website integrity, data security, and service availability.

CVE-2026-29014 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available, confirming that exploitation is practical and increasing the urgency for immediate patching, especially for internet-facing deployments.

 

E-cology

“One exposed enterprise app can hand attackers full control in seconds.”

The E-cology patch addresses CVE-2026-22679, a critical vulnerability that enables remote code execution on affected systems. This flaw allows attackers to execute arbitrary commands without authentication, directly compromising enterprise environments that rely on the platform for business operations and data management.

CVE-2026-22679 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available, confirming that exploitation is practical and increasing the urgency for immediate remediation, especially for internet-facing deployments.

 

E-office

“A single vulnerable office system can expose the entire organization.”

The E-office patch addresses CVE-2022-50993, a critical vulnerability that allows remote code execution on affected systems. This issue enables attackers to execute arbitrary commands without authentication, putting enterprise data, user accounts, and system control at immediate risk.

CVE-2022-50993 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available, confirming that exploitation is feasible and increasing the urgency for immediate patching, especially for externally accessible systems.

 

Apache HTTP Server

“A web server weakness can quietly expose everything behind it.”

This patch addresses CVE-2026-23918, a high-severity vulnerability in Apache HTTP Server that impacts core web service functionality. The issue can allow attackers to compromise server integrity, potentially leading to unauthorized access, service disruption, or manipulation of hosted content. Given the widespread use of Apache in public-facing environments, the exposure risk is significant.

CVE-2026-23918 has a CVSS score of 8.8, which is High severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for this vulnerability.

 

WhatsApp

“Even everyday messaging apps can quietly expose sensitive conversations.”

This patch addresses two vulnerabilities affecting WhatsApp for Android and WhatsApp Desktop for Windows. CVE-2026-23863 presents a medium-severity risk with potential impact on user data and application behavior in desktop environments. CVE-2026-23866, while lower in severity, still contributes to overall exposure on mobile devices and may affect how content is handled within the app.

CVE-2026-23863 has a CVSS score of 6.5, which is Medium severity. CVE-2026-23866 has a CVSS score of 4.3, which is Medium severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for these vulnerabilities.

 

Android

“A mobile OS flaw can turn every device into an entry point.”

This Android patch addresses CVE-2026-0073, a high-severity vulnerability affecting core operating system components. The issue can allow attackers to compromise device integrity, potentially leading to unauthorized access, data exposure, or privilege escalation. Given Android’s widespread use across personal and enterprise devices, the risk extends to a large attack surface.

CVE-2026-0073 has a CVSS score of 8.8, which is High severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code for this vulnerability.

 

vm/sandbox for Node.js

“A broken sandbox turns trusted code isolation into full system exposure.”

The latest vm2 patch addresses multiple critical sandbox escape vulnerabilities that allow attackers to break out of the JavaScript sandbox and execute arbitrary code on the host system. The affected vulnerabilities include CVE-2026-24118, CVE-2026-24120, CVE-2023-37466, CVE-2026-24781, CVE-2026-26332, and CVE-2026-26956. These issues impact applications using vm2 to run untrusted code inside Node.js environments.

CVE-2026-24118 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available.
CVE-2026-24120 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available.
CVE-2023-37466 has a CVSS score of 9.8, which is Critical severity.
CVE-2026-24781 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available.
CVE-2026-26332 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available.
CVE-2026-26956 has a CVSS score of 9.8, which is Critical severity. Public proof-of-concept code is available.

The patch strengthens sandbox isolation controls and closes multiple paths that attackers could use to access host-level functionality. Systems relying on vm2 for tenant isolation, plugin execution, or automation workloads face elevated risk if these updates are not applied.