Vulnerability Digest October 2026 – Third-Party Updates

This Adobe Commerce update fixes nine vulnerabilities. Three are Critical and six are High. The most serious is CVE-2026-75650, a template engine injection flaw that lets an attacker run arbitrary code without any user interaction. It has a CVSS score of 10.0, Critical severity. Attackers are actively exploiting CVE-2026-75650, so internet-facing stores are under direct threat.

CVE-2026-76200 and CVE-2026-76201 are stored cross-site scripting flaws. Each has a CVSS score of 9.3, Critical severity. They let attackers plant malicious scripts in form fields and take over victim accounts or sessions. The remaining six flaws allow privilege escalation and security feature bypass through incorrect authorization and path traversal. CVE-2026-76202 has a CVSS score of 8.2, High severity. CVE-2026-77108 has a CVSS score of 7.5, High severity. CVE-2026-77109 has a CVSS score of 8.6, High severity. CVE-2026-77110 has a CVSS score of 7.6, High severity. CVE-2026-77111 has a CVSS score of 8.7, High severity. CVE-2026-77774 has a CVSS score of 8.6, High severity. Together, these flaws expose sensitive data, restricted resources and unauthorized read and write access.

Apple's iOS and iPadOS update fixes six vulnerabilities, five Critical and one High. Attackers are actively exploiting CVE-2026-86950, an out-of-bounds write that lets a maliciously crafted file run arbitrary code. Apple reports its use in an extremely sophisticated attack against specific targeted individuals. The fix ships in iOS 26.7.1 and iPadOS 26.7.1, along with macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. CVE-2026-86950 has a CVSS score of 8.8, High severity.

The rest of the update closes memory corruption, permissions, and certificate validation flaws. These fixes also reach macOS, tvOS, visionOS, and watchOS. CVE-2026-65414 has a CVSS score of 9.8, Critical severity: an out-of-bounds write that lets a remote attacker terminate apps or run arbitrary code. CVE-2026-84561 has a CVSS score of 9.8, Critical severity: a double free that lets an app corrupt kernel memory. CVE-2026-84609 has a CVSS score of 9.8, Critical severity: it lets an app modify protected system files. CVE-2026-84625 has a CVSS score of 9.1, Critical severity: it lets an app fingerprint the user. CVE-2026-86881 has a CVSS score of 9.1, Critical severity: it lets an attacker who holds a compromised intermediate certificate authority issue certificates with arbitrary extended key usages.

Check Point's update for Quantum Security Gateway fixes two Critical flaws in VPN certificate handling. Attackers are actively exploiting CVE-2026-85102. In that flaw, the gateway trusts certificates it should reject during VPN negotiation, so an unauthenticated remote attacker can run arbitrary code on the Gateway. CVE-2026-85102 has a CVSS score of 9.8, Critical severity.

CVE-2026-85103 is a heap-based buffer overflow in how the product decodes ASN.1 data in VPN certificates. An unauthenticated remote attacker can use it to run arbitrary code on Quantum Security Management and Quantum Security Gateway systems. CVE-2026-85103 has a CVSS score of 9.8, Critical severity. Both flaws can be reached without credentials on an internet-facing security boundary. Apply this update immediately.

This update for Check Point Quantum Security Management fixes two Critical flaws that unauthenticated attackers can reach. CVE-2026-91843 has a CVSS score of 9.8, Critical severity. A stack overflow in the login process lets a remote attacker run arbitrary code with root privileges. CVE-2026-93616 has a CVSS score of 9.8, Critical severity. A directory traversal and file upload flaw lets an unauthenticated attacker upload and run arbitrary scripts on the Check Point Management Server, which gives them elevated privileges.

Attackers are actively exploiting CVE-2026-93616. The management server controls security policy for the whole Check Point environment, so a compromise exposes the entire network perimeter. Apply this update immediately.

Cisco has released a fix for a critical authentication bypass in Cisco Catalyst SD-WAN Manager. CVE-2026-76504 has a CVSS score of 9.8, Critical severity. The flaw stems from improper handling of URI encoding in HTTP requests, which lets a crafted request slip past an authentication rule meant to restrict access to a specific API endpoint. An unauthenticated, remote attacker can exploit it to reach the API with admin privileges.

Attackers are actively exploiting CVE-2026-76504. Because SD-WAN Manager centrally controls the network fabric, admin-level API access gives an attacker direct control over network configuration across the organization. Patch immediately.

Cisco has released a security update for Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that fixes 14 vulnerabilities, 13 of them Critical. Attackers are actively exploiting CVE-2026-76460, an authentication bypass in an ISE API that lets an unauthenticated, remote attacker gain unauthorized access to the device. CVE-2026-76423 lets an unauthenticated attacker take administrative control through the exposed REST API and read or change ISE configuration and identity data. Several command injection and Java deserialization flaws let an authenticated attacker run arbitrary commands and elevate to root. CVE-2026-20284 enables SQL injection through the SXP REST API, and CVE-2026-20352 lets an unauthenticated attacker crash an ISE node with crafted RADIUS requests. In single-node deployments, a successful attack can take ISE offline and block endpoints that have not yet authenticated from reaching the network.

CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, and CVE-2026-76460 each have a CVSS score of 10.0, Critical severity. CVE-2026-20234 and CVE-2026-20307 each have a CVSS score of 9.9, Critical severity. CVE-2026-20176, CVE-2026-20194, CVE-2026-20211, CVE-2026-20237, CVE-2026-20284, CVE-2026-20305, and CVE-2026-20306 each have a CVSS score of 9.1, Critical severity. CVE-2026-20352 has a CVSS score of 8.6, High severity.

Cisco has released software updates for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager that fix five vulnerabilities. Attackers are actively exploiting CVE-2026-76461, an email parsing flaw in Cisco AsyncOS Software. An unauthenticated, remote attacker can send a crafted email containing malicious SQL statements through an affected device. A successful exploit leads to command execution with root privileges on the underlying operating system. CVE-2026-76461 has a CVSS score of 9.8, Critical severity.

The release also fixes four vulnerabilities found in Cisco's internal security review. CVE-2026-20353 has a CVSS score of 9.8, Critical severity, and involves improper control of a resource through its lifetime. CVE-2026-76440 has a CVSS score of 9.8, Critical severity, and involves path traversal. CVE-2026-76443 has a CVSS score of 9.8, Critical severity, and involves improper neutralization. CVE-2026-76442 has a CVSS score of 7.5, High severity, and involves improper validation of a specified quantity in input, with elevation of privilege impact. Patch every affected email gateway and manager now.

This update fixes five vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, the appliances that sit at the edge of the network and handle remote access. CVE-2026-88771 has a CVSS score of 9.5, Critical severity. It is an improper input validation flaw that lets an unauthenticated attacker execute arbitrary commands. CVE-2026-88772 has a CVSS score of 9.5, Critical severity, and leads to remote code execution or denial of service. CVE-2026-88773 has a CVSS score of 9.3, Critical severity, and is an HTTP request smuggling flaw. CVE-2026-107406 has a CVSS score of 9.5, Critical severity. It is a memory overflow that leads to remote code execution or denial of service on appliances configured as a SAML SP or SAML IdP. CVE-2026-88779 has a CVSS score of 8.7, High severity.

Attackers are actively exploiting CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779. All supported 14.1, 13.1 and FIPS/NDcPP builds are affected. CVE-2026-107406 also affects some recently fixed 14.1 and 13.1 builds when they run as a SAML IdP, so systems that took the earlier fix still need this update. Update every NetScaler ADC and Gateway appliance now.

ConnectWise has fixed a flaw in the ScreenConnect client that lets files be transferred and executed through an active remote session without authorization or Host confirmation. The flaw comes from improper privilege management and a missing authorization check, so an attacker can gain elevated privileges on the endpoint. CVE-2026-84869 has a CVSS score of 9.9, Critical severity. ScreenConnect servers are not affected. The risk sits on the client endpoints.

Attackers are actively exploiting CVE-2026-84869. Every machine running the ScreenConnect client is exposed while it stays unpatched. Treat this update as an immediate priority across all managed endpoints.

Fortinet has released a fix for a path traversal vulnerability in FortiMail. The flaw affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files on the underlying system, which can lead to elevation of privilege. CVE-2026-104286 has a CVSS score of 9.8, Critical severity.

Attackers are actively exploiting CVE-2026-104286. FortiMail sits at the edge of the network and handles all inbound and outbound email, so a compromised gateway exposes sensitive communications and gives attackers a foothold for further compromise. Apply the update immediately.

GitLab has released fixes for eight vulnerabilities in GitLab CE/EE that expose servers to file theft, code execution and leaks of CI/CD secrets. The most serious is CVE-2026-85706, which has a CVSS score of 10.0, Critical severity. A missing authentication check and improper path handling in the repository commits API let an unauthenticated attacker read arbitrary files from the GitLab server. Attackers are actively exploiting CVE-2026-85706. Three more Critical flaws enable server compromise: CVE-2026-87719 has a CVSS score of 9.9, Critical severity, and lets Duo Chat users pull Advanced Search configurations and credentials through a crafted GraphQL subscription. CVE-2026-89078 has a CVSS score of 9.9, Critical severity, and CVE-2026-93577 has a CVSS score of 9.9, Critical severity. Both let authenticated users run arbitrary code on the server through crafted regular expressions in a CI/CD configuration.

The update also closes four High severity flaws. CVE-2026-88765 has a CVSS score of 8.5, High severity, and allows remote code execution through a crafted Git project import. CVE-2026-79708 has a CVSS score of 8.5, High severity, and lets developers run policy test pipelines that expose protected CI/CD variables. CVE-2026-13210 has a CVSS score of 7.7, High severity, and CVE-2026-92470 has a CVSS score of 7.7, High severity. Both expose CI/CD variables outside their intended scope, one through the environment scope matcher and one through Duo AI troubleshooting of debug job traces. Upgrade to GitLab 18.11.12, 19.0.9, 19.1.8, 19.2.7, 19.3.3 or 19.4.1, depending on your release line.

This Android update fixes seven remote flaws in Bluetooth, the IP Multimedia Subsystem, the cellular modem, and core memory handling. None of them needs any user action to exploit. Attackers are actively exploiting CVE-2026-58704, a permission bypass in the cellular modem that lets a nearby attacker gain elevated privileges. CVE-2026-58704 has a CVSS score of 8.8, High severity.

Six more flaws are rated Critical, each with a CVSS score of 9.8. CVE-2026-49921 and CVE-2026-58822 are memory safety flaws that allow remote code execution. CVE-2026-55330 is a Bluetooth use-after-free that also allows remote code execution. CVE-2026-28606 lets an attacker skip Bluetooth pairing and gain privileges without user consent. CVE-2026-55366 bypasses authentication in the IP Multimedia Subsystem, and CVE-2026-56960 is a use-after-free in several components; both allow remote privilege escalation. Treat this update as an immediate priority for every managed Android device.

MikroTik's RouterOS update fixes eight vulnerabilities in SSH, WebFig, the web management service, btest, SMB and BGP. Attackers are actively exploiting CVE-2026-67276, CVE-2026-67277, CVE-2026-67279 and CVE-2026-86060. CVE-2026-67276 (CVSS 9.2, Critical) lets an attacker who knows an authorized RSA modulus forge an SSH signature and open a command channel as that user without the private key. CVE-2026-86060 (CVSS 9.2, Critical) abuses argument handling in the SSH login path to change the policy mask and escalate privileges. CVE-2026-67277 (CVSS 8.8, High) lets an unauthenticated client start btest sessions that leak kernel memory and can restart the kernel. CVE-2026-67279 (CVSS 6.9, Medium) lets an unauthenticated client skip SSH authentication and create or overwrite files that hold configuration and diagnostic data.

CVE-2026-84411 (CVSS 9.8, Critical) is a pre-authentication integer underflow in the web management service that gives a remote attacker root code execution with a single request. Public proof-of-concept code exists for CVE-2026-81281 (CVSS 8.7, High), an unauthenticated WebFig file read that exposes root-owned configuration stores containing credentials. CVE-2026-89028 (CVSS 7.5, High) corrupts heap memory in the SMB daemon and enables remote code execution. CVE-2026-93345 (CVSS 7.5, High) lets an unauthenticated on-path attacker keep BGP down with one malformed UPDATE packet. Versions 6.49.21, 7.23.4 and 7.24.2 fix the exploited flaws, but the BGP fix ships only in the 7.25beta4 development build.

N-able has released fixes for three vulnerabilities in N-central, and attackers are actively exploiting all three: CVE-2026-86206, CVE-2026-86207 and CVE-2026-86218. The most serious, CVE-2026-86218, has a CVSS score of 10.0, Critical severity. It allows remote code execution before authentication and affects N-central versions before 2026.3.1.14. CVE-2026-86207 has a CVSS score of 7.7, High severity. It is an authentication bypass in internal-only APIs in versions before 2026.3 HF 3. CVE-2026-86206 has a CVSS score of 6.9, Medium severity. It is a flaw in the internal API access control filter that allows unauthorized access to internal APIs, and N-central 2026.3 HF3 and 2026.4 fix it.

N-central manages remote endpoints, so an attacker who takes over the console can reach every device it manages. Taken together, these flaws give attackers a direct path from no access to full control. Upgrade all N-central instances to a fixed release immediately.

This SonicWall SMA1000 update fixes three vulnerabilities in the appliance's Work Place and Appliance Management Console interfaces. CVE-2026-102255 has a CVSS score of 10.0, Critical severity. It is a pre-authentication server-side request forgery flaw that lets a remote, unauthenticated attacker abuse an unintended access path to make the appliance send requests for them, reach internal functions, and perform unauthorized operations. Attackers are actively exploiting CVE-2026-102255.

CVE-2026-102256 has a CVSS score of 7.8, High severity. It is an OS command injection flaw that lets an authenticated administrator run arbitrary OS commands, which leads to remote code execution. CVE-2026-102257 has a CVSS score of 7.2, High severity. It is a Zip Slip flaw in the Appliance Management Console: a crafted archive can write files outside the intended directory, which leads to code execution. Together, these flaws give attackers a path from unauthenticated access to full control of the remote access gateway.

This WordPress update fixes a local file inclusion flaw in page-template resolution. CVE-2026-87902 has a CVSS score of 8.1, High severity. An unauthenticated attacker can make the get_page_template() function include a readable local .php file of their choice from outside the active theme directories. When certain server and active-theme conditions are met, the flaw can lead to remote code execution.

Attackers are actively exploiting CVE-2026-87902. No login is required, so any public-facing WordPress site is exposed. Apply this update right away to close the attack path before attackers reach your sites.

This Adobe Campaign Classic update fixes 17 Critical vulnerabilities, and none of them needs user interaction to exploit. Code injection, OS command injection, and improper input validation flaws let attackers run arbitrary code on the server. SQL injection flaws let attackers run arbitrary SQL commands or bypass security controls to read and alter data. Incorrect authorization and server-side request forgery flaws give attackers elevated access to internal resources. Most of these flaws have a changed scope, so a successful attack can reach systems beyond Campaign Classic. Several need only a low-privileged account.

CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-82004, CVE-2026-84412, and CVE-2026-89275 each have a CVSS score of 10.0, Critical severity. CVE-2026-82008, CVE-2026-82010, CVE-2026-82013, CVE-2026-83660, and CVE-2026-89276 each have a CVSS score of 9.9, Critical severity. CVE-2026-82443 has a CVSS score of 9.6, Critical severity. CVE-2026-75728, CVE-2026-82009, and CVE-2026-82011 each have a CVSS score of 9.1, Critical severity.

Adobe's ColdFusion 2025 update fixes four vulnerabilities, two Critical and two High. CVE-2026-48273 has a CVSS score of 9.9, Critical severity. It is an eval injection flaw that lets a low-privileged attacker run arbitrary code with no user interaction. CVE-2026-75746 has a CVSS score of 9.1, Critical severity. It is a SQL injection flaw that an attacker with high privileges can use to run arbitrary code.

CVE-2026-76190 has a CVSS score of 8.6, High severity. It is a second eval injection flaw that leads to remote code execution. CVE-2026-75998 has a CVSS score of 7.5, High severity. It is an improper access control flaw that lets an attacker read sensitive files and directories outside the intended scope, which raises their privileges. None of these flaws require user interaction, and three of them can affect resources beyond the vulnerable component. Patch ColdFusion 2025 servers the same day.

Apache Airflow 3.3.2 fixes two access-control flaws that weaken authorization and session handling in the platform. CVE-2026-86473 has a CVSS score of 9.1, Critical severity. The Core API logout endpoint revokes a session token only when the token arrives as the _token cookie. API clients that send a bearer token in the Authorization header get a normal logout response, but the token is not revoked. Anyone who already holds a copy of that token keeps the victim's access for the rest of its lifetime, which is 24 hours by default.

CVE-2026-75157 has a CVSS score of 7.5, High severity. The asset queued-events DELETE endpoints check for READ permission on a Dag when they should check for EDIT. Any authenticated user who can read a Dag can delete its queued asset events and quietly stop asset-triggered scheduling. Standard RBAC setups are exposed with no special configuration needed. Upgrade to apache-airflow 3.3.2 or later to close both issues.

Apache HTTP Server 2.4.69 fixes 14 vulnerabilities that affect versions 2.4.0 through 2.4.68. Three are Critical: CVE-2026-56154, a use-after-free in mod_rewrite lookahead, has a CVSS score of 9.8, Critical severity; CVE-2026-57941, a use-after-free in mod_http2, has a CVSS score of 9.8, Critical severity; and CVE-2026-59797, an improper privilege management flaw in mod_ssl, has a CVSS score of 9.8, Critical severity. Most of the flaws in this release are classified as remote code execution or elevation of privilege risks.

The remaining 11 are High severity. CVE-2026-93546 (mod_dav_fs integer overflow) has a CVSS score of 8.8, High severity. CVE-2026-73636 (mod_auth_digest credential replay) has a CVSS score of 8.1, High severity. CVE-2026-73637 (mod_auth_digest use-after-free) has a CVSS score of 7.3, High severity. CVE-2026-46729 (mod_heartmonitor), CVE-2026-48005 (mod_auth_digest), CVE-2026-56153 (mod_charset_lite), CVE-2026-56449 (mod_proxy_html), CVE-2026-59685 (Windows 8.3 path handling), CVE-2026-63045 (mod_proxy_ftp), CVE-2026-63292 (mod_vhost_alias) and CVE-2026-63686 (mod_xml2enc) each have a CVSS score of 7.5, High severity. Together they cover memory corruption, authentication bypass, proxy abuse, and denial of service across core modules.

Apache Tomcat versions 11.0.26, 10.1.60, and 9.0.122 fix five authentication and request-handling flaws, and three of them are rated Critical. CVE-2026-76183 has a CVSS score of 9.8, Critical severity, and lets attackers bypass security constraints on any WebSocket endpoint. CVE-2026-86248 has a CVSS score of 9.8, Critical severity, and stops CLIENT_CERT authentication from failing as it should in some cases when soft fail is disabled. CVE-2026-86350 has a CVSS score of 9.1, Critical severity: an HTTP/2 request smuggling regression can mix up request headers between requests.

Two High severity flaws complete the update. CVE-2026-77762 has a CVSS score of 8.1, High severity: a race condition lets an attacker inject trailer fields into another user's HTTP/2 request. CVE-2026-75973 has a CVSS score of 7.3, High severity: when several web applications share the SimpleAuthConfigProvider for Jakarta Authentication, all of them can end up using the realm of the first application to authenticate a request. The affected releases cover the 11.0, 10.1, and 9.0 branches. End-of-life 8.5 releases, and for the WebSocket flaw 7.0 releases, are also affected and will not receive a fix, so organizations should move those servers to a supported branch.

Apple's latest macOS update fixes two Critical kernel memory flaws. CVE-2026-43790 has a CVSS score of 9.1, Critical severity. A remote attacker can use it to crash the system or corrupt kernel memory, and Apple resolved it with improved memory handling in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. CVE-2026-84520 has a CVSS score of 9.8, Critical severity. This buffer overflow lets a local attacker crash the system or corrupt kernel memory, and Apple fixed it with improved size validation in macOS Golden Gate 27.

Kernel memory corruption hits the core of the operating system, which puts system stability and the integrity of every workload on affected Macs at risk. Deploy these updates across all macOS endpoints today.

This Arista EOS update fixes seven vulnerabilities in the switch operating system's management and network services. Two flaws carry perfect 10.0 scores: an unauthenticated attacker can run arbitrary code and take full administrative control of a switch through P4Runtime or the gRPC Network Packet Sampling Interface (gNPSI). Other flaws let authenticated users run commands as root, raise their privileges, or let a network attacker feed malicious DHCP settings to clients.

CVE-2026-73453 has a CVSS score of 10.0, Critical severity. CVE-2026-73456 has a CVSS score of 10.0, Critical severity. CVE-2026-73437 has a CVSS score of 9.6, Critical severity, and lets unvalidated DHCP replies redirect or disrupt client traffic. CVE-2026-73447 has a CVSS score of 9.1, Critical severity, and allows root command execution through the gNSI Certz and Bootz services. CVE-2026-73464 has a CVSS score of 8.8, High severity, and enables root code execution through gNMI. CVE-2026-73454 has a CVSS score of 8.1, High severity, and lets crafted gNSI Credentialz requests grant accounts elevated privileges. CVE-2026-73461 has a CVSS score of 8.0, High severity, and causes gRPC OpenConfig requests to be authorized at the wrong privilege level.

Arista Networks' VeloCloud Edge update fixes two serious flaws in the device that links branch sites to the corporate network. CVE-2026-86106 has a CVSS score of 9.6, Critical severity. On Edge units with high availability (HA) enabled, an attacker with network access to the private HA interconnect can trigger sensitive peer functions without authentication and run commands with elevated privileges. CVE-2026-86108 has a CVSS score of 8.0, High severity. Weak input validation in management and configuration workflows lets an authorized request or configuration value run as an operating-system command, which gives the attacker elevated command execution on the device.

Both flaws can give an attacker elevated control of a device that sits on the network perimeter and carries branch traffic. Organizations running VeloCloud Edge should apply this update the same day, starting with HA-enabled deployments.

Artifex Software has released Ghostscript 10.08.0 to fix a heap-based buffer overflow in the JPEG 2000 output adapter. CVE-2026-39919 has a CVSS score of 9.8, Critical severity. An attacker can supply a crafted PDF with a JPEG 2000 image whose components declare mismatched subsampling factors. Ghostscript then sizes a row buffer for packed output but writes a full byte per column, which overflows the buffer and corrupts internal allocator metadata. The result is remote code execution.

Ghostscript often runs out of sight inside print servers, document converters, and preview services that handle untrusted files automatically. Any system that renders PDFs from outside sources is exposed until it runs 10.08.0 or later.

Atlassian has patched an arbitrary file access flaw in Bamboo Data Center. CVE-2026-21589 has a CVSS score of 9.3, Critical severity. An unauthenticated remote attacker can read specific files in the web application root directory. The attacker must already know each file's exact name and path, because the flaw does not allow directory listing. Where sensitive files sit in that directory, the exposure is severe. Proof-of-concept code for this vulnerability exists.

The same flaw affects Bitbucket, Confluence, Crowd, Jira Software and Jira Service Management Data Center, plus Crucible and Fisheye. Bamboo Data Center 7.0.1 and later is affected, and fix versions 10.2.24 and 12.1.12 close the gap. Apply the fixed release to every affected Atlassian Data Center product now.

Amazon has released Amazon SSM Agent version 3.3.4851.0 to fix a critical server-side request forgery flaw in the agent's port forwarding to remote hosts. CVE-2026-89049 has a CVSS score of 9.9, Critical severity. The agent does not properly validate equivalent address representations. An authenticated remote user can write a denied link-local address in an alternate form, slip past the remote destination denylist, and reach link-local endpoints.

The business impact is direct. A successful attack can expose the temporary IAM role credentials of a managed instance. The attacker can then act with that role's permissions from outside the instance and reach any cloud resource the role can access. The flaw affects all platforms running versions earlier than 3.3.4851.0. Upgrade every managed instance to version 3.3.4851.0 or later.

Cisco has released software hardening updates for the Cisco Application Policy Infrastructure Controller (APIC). The updates fix three Critical vulnerabilities that Cisco's engineering team found during an internal security review. CVE-2026-76498 has a CVSS score of 9.8, Critical severity. It is an improper access control flaw that allows elevation of privilege. CVE-2026-76499 has a CVSS score of 9.8, Critical severity. It is an improper neutralization flaw. CVE-2026-76500 has a CVSS score of 9.8, Critical severity. It involves improper control of a resource through its lifetime.

APIC is the central policy and management point for the Cisco data center fabric. A compromised controller gives an attacker control over network policy for every workload it manages. Apply the hardening releases on a same-day schedule.

Cisco has shipped a software hardening release for Cisco Nexus Dashboard that fixes four vulnerabilities found in an internal security review. Three are Critical and one is High. CVE-2026-20322 has a CVSS score of 9.9, Critical severity, and is an improper access control flaw that allows elevation of privilege. CVE-2026-20325 has a CVSS score of 9.9, Critical severity, and is a command injection flaw that allows remote code execution. CVE-2026-20326 has a CVSS score of 9.8, Critical severity, and is a missing authentication flaw on a critical function that allows elevation of privilege. CVE-2026-76409 has a CVSS score of 8.8, High severity, and is a path traversal flaw that allows elevation of privilege.

Nexus Dashboard is the central management plane for Cisco data center networks. An attacker who takes it over through command execution or privilege escalation controls the network fabric it manages. Apply this update the same day.

Cisco has released a security update for Cisco NX-OS Software that fixes eight vulnerabilities. Seven are Critical and one is High. Five of them let an unauthenticated, remote attacker run arbitrary code with root privileges or cause a denial of service (DoS). An attacker only needs to send crafted traffic to an affected device. Affected features include NX-API, MPLS OAM on Cisco Nexus 3000 and 9000 Series Switches, VXLAN OAM (NGOAM), and SRv6 OAM. CVE-2026-76471 (NX-API) has a CVSS score of 9.8, Critical severity. CVE-2026-76465 (MPLS OAM) has a CVSS score of 9.8, Critical severity. CVE-2026-76485 and CVE-2026-76486 (VXLAN NGOAM) each have a CVSS score of 9.8, Critical severity. CVE-2026-76501 (SRv6 NGOAM) has a CVSS score of 9.8, Critical severity.

The same update includes a software hardening release that fixes flaws found in Cisco's internal security review. CVE-2026-76455 is an improper access control flaw with a CVSS score of 9.8, Critical severity. CVE-2026-76459 is an out-of-bounds write flaw with a CVSS score of 9.8, Critical severity. CVE-2026-76457 is an out-of-bounds read flaw with a CVSS score of 8.6, High severity. A successful attack can crash processes, reload switches, and take down core data center traffic.

Cisco has released a hardening update for Cisco Secure Email and Web Manager that fixes multiple vulnerabilities found in an internal security review. They are tracked as CVE-2026-76441, which has a CVSS score of 9.8, Critical severity. The flaws come from improper access control (CWE-284) and allow elevation of privilege. An attacker could gain rights they should not have on the platform that manages an organization's email and web security.

This system sits at the center of email and web protection policy, so a compromise affects more than one device. Apply the update on the same day to close the access-control gaps before attackers can use them.

Cisco has issued a software hardening release for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software that fixes four Critical vulnerabilities found during an internal security review. The release also covers Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software. CVE-2026-20329 has a CVSS score of 9.9, Critical severity, and involves improper handling of exceptional conditions. CVE-2026-20330 has a CVSS score of 9.9, Critical severity, and involves improper neutralization. CVE-2026-20331 has a CVSS score of 9.6, Critical severity, and involves failed protection mechanisms. CVE-2026-20332 has a CVSS score of 9.9, Critical severity, and involves improper access control that enables elevation of privilege.

These flaws sit in the perimeter devices that guard the entire network, so a compromise there opens the door to everything behind them. Apply this update on a same-day basis to close all four Critical gaps.

Cisco has released an update for Secure Firewall Management Center (FMC) that fixes seven vulnerabilities. Four are Critical and three are High. Most of them give an attacker root access to the system that manages the organization's firewalls. CVE-2026-20324 has a CVSS score of 9.9, Critical severity, and lets an authenticated attacker write a malicious file through the sftunnel inter-device protocol that then runs as root. CVE-2026-20242 has a CVSS score of 9.8, Critical severity. It is an insecure deserialization flaw in the External Database Access feature that lets an unauthenticated remote attacker run commands as root from a host on the external database access list. CVE-2026-20341 has a CVSS score of 9.1, Critical severity, and lets an attacker who holds admin credentials on a managed FTD device gain root on the FMC and its high-availability peer through crafted sftunnel RPCs. CVE-2026-76420 has a CVSS score of 9.0, Critical severity. A misconfigured AJP connector lets an unauthenticated attacker impersonate a peer device, run commands as root, and take full control of the FMC REST APIs.

The three High-severity flaws widen the risk. CVE-2026-20340 has a CVSS score of 8.8, High severity, and lets any user with the read-only Security Analyst role run code as root through a crafted HTTP payload. CVE-2026-20323 has a CVSS score of 8.3, High severity, and lets an adjacent attacker with a crafted TLS certificate impersonate an sftunnel peer with root-equivalent access. CVE-2026-20343 has a CVSS score of 7.5, High severity. An API with no authentication lets remote attackers download sensitive files and fill the disk until the device stops responding. Because FMC controls policy for every managed firewall, compromising it puts the entire network perimeter at risk.

Claris FileMaker Server 26.0.3 fixes two Critical vulnerabilities that expose server memory and bypass access controls. CVE-2026-86930 has a CVSS score of 9.1, Critical severity. It is an out-of-bounds read in FileMaker Server for Linux: an attacker who uploads a crafted image to a container field can disclose process memory while FileMaker WebDirect generates thumbnails. CVE-2026-86934 has a CVSS score of 9.1, Critical severity. It is an authorization bypass in the Web Publishing Engine: requests carrying an extended privilege header skip the disabled Custom Web Publishing with XML setting and reach the XML Web Publishing interface.

Together, these flaws let attackers read sensitive memory and reach interfaces that administrators deliberately turned off. Upgrade every FileMaker Server deployment to version 26.0.3.

Commvault has released a maintenance update for Commvault Cloud that closes an authentication bypass in the Command Center API. The flaw affects privilege management, so an attacker can get past authentication controls that protect administrative functions. CVE-2026-77089 has a CVSS score of 9.3, Critical severity.

Commvault Cloud manages backup and recovery data, so a compromised Command Center puts the organization's last line of defense at risk. Customers running the software should upgrade Command Center to the resolved maintenance release.

This curl update fixes five vulnerabilities in libcurl that affect memory safety, connection reuse, and TLS trust enforcement. CVE-2026-19931 has a CVSS score of 9.8, Critical severity: libcurl can wrongly reuse a Negotiate-authenticated connection, so one user's request can travel over another user's authenticated session. CVE-2026-18924 has a CVSS score of 9.1, Critical severity: a use-after-free in HTTP/2 Server Push cleanup on shared connections can enable remote code execution and privilege escalation. CVE-2026-80229 has a CVSS score of 7.5, High severity: pooled TLS connections in OpenSSL 3 provider configurations keep a dangling pointer after the easy handle is destroyed, causing a heap use-after-free that can lead to code execution.

CVE-2026-80230 has a CVSS score of 7.5, High severity: libcurl skips public key pinning when peer verification is disabled, letting unauthenticated connections succeed. CVE-2026-82208 has a CVSS score of 7.5, High severity: with the wolfSSL backend, a cached trust store can silently replace a callback-selected one and accept certificates that should be rejected. Proof-of-concept code exists for CVE-2026-18924, CVE-2026-19931, CVE-2026-80230, and CVE-2026-82208. Apply this update promptly to every system and application that bundles libcurl.

This update fixes three Critical vulnerabilities in Delinea Secret Server (On-Prem), the system many organizations use to store their most privileged credentials. CVE-2026-15640 has a CVSS score of 9.5, Critical severity. Under certain conditions, a valid SAML identity provider response can be used to impersonate another Secret Server user, which lets an attacker gain that user's privileges. CVE-2026-15639 has a CVSS score of 9.3, Critical severity. It is a cross-site scripting flaw: a crafted link runs attacker-supplied JavaScript in the browser of any legitimate user who opens it.

CVE-2026-15638 has a CVSS score of 9.1, Critical severity. An unauthenticated attacker with access to Secret Server can use a padding oracle to decrypt or encrypt data with one of the server's cryptographic keys, although the key itself is not exposed. Together, these flaws threaten the confidentiality of stored secrets and the integrity of user identities. Apply this patch the same day.

Dell System Update 2.3.0.0 fixes five vulnerabilities that affect all earlier versions. The most serious is CVE-2026-86360, a path traversal flaw with a CVSS score of 9.6, Critical severity. An unauthenticated remote attacker can use it to reach the filesystem, and Dell states it can be leveraged to execute arbitrary code with root privileges, which can fully compromise the application and the underlying operating system. Dell recommends upgrading at the earliest opportunity.

The update also fixes four High severity flaws. CVE-2026-63697 has a CVSS score of 7.6, High severity, and is an improper certificate validation flaw that a highly privileged remote attacker can use to execute code remotely. CVE-2026-71168 has a CVSS score of 7.3, High severity, and is a path traversal flaw that a low-privileged local attacker can use to execute code remotely. CVE-2026-86361 has a CVSS score of 8.2, High severity, and comes from incorrect permission assignment on a critical resource. CVE-2026-86362 has a CVSS score of 8.2, High severity, and comes from improper access control. A low-privileged local attacker can use either of these last two flaws to elevate privileges. All five flaws lead to elevation of privilege, so a fleet-wide upgrade to 2.3.0.0 should be a same-day priority.

Dell has fixed six vulnerabilities in ThinOS 10. Four are Critical and two are High. Most of these flaws require no authentication. Some can be reached remotely and others from an adjacent network, and they can lead to remote code execution, OS command execution, unauthorized access, or a bypass of security protections. CVE-2026-81467 has a CVSS score of 9.8, Critical severity, and allows unauthenticated OS command injection. CVE-2026-81048 has a CVSS score of 9.6, Critical severity, and allows an attacker on the adjacent network to run code remotely through command injection. CVE-2026-81046 has a CVSS score of 9.4, Critical severity, and is a protection mechanism failure that leads to arbitrary code execution. CVE-2026-81468 has a CVSS score of 9.1, Critical severity, and allows OS command injection by a high-privileged attacker.

The two High-severity flaws undermine trust and access controls. CVE-2026-81455 has a CVSS score of 8.6, High severity, and is a missing authentication check on a critical function. CVE-2026-82157 has a CVSS score of 8.3, High severity, and is an improper certificate validation flaw that allows an attacker to bypass protections and gain unauthorized access. Release 2605_10.2616 fixes the four Critical flaws. SecurityAddon_2605.10.2766_T10 fixes the two High flaws. Deploy both updates to fully protect ThinOS 10 endpoints.

This update closes a critical authentication bypass in the Erlang/OTP ssl application. CVE-2026-89422 has a CVSS score of 9.3, Critical severity. A malicious peer that answers a TLS 1.3 client connection can impersonate the intended server. It does this by sending a pre-shared key extension the client never offered. The client then completes the handshake without validating the server's certificate. This skips certificate path validation, hostname verification, CRL checking and OCSP stapling, so the connection succeeds against a peer with no certificate, no private key and no prior session.

The default client configuration is affected. Clients restricted to TLS 1.2 are not affected. The flaw affects OTP 22.2 and later. The fixed releases are OTP 27.3.4.18, OTP 28.5.0.7 and OTP 29.1.1, which correspond to ssl 11.2.12.13, 11.6.0.6 and 11.7.7. Any Erlang or Elixir service that makes outbound TLS connections is exposed to interception and data theft until it is patched.

This FlexNet Publisher update closes a critical authentication bypass in the lmadmin license server. CVE-2026-19572 has a CVSS score of 9.3, Critical severity. The flaw sits in a SOAP handler that contains a hardcoded authentication bypass. An unauthenticated attacker can use it to get a privileged administrator session without valid credentials.

Administrator control of lmadmin gives an attacker command of license management, so they can disrupt access to licensed software across the organization. The update removes the bypass and restores proper authentication on the SOAP interface. Patch every exposed lmadmin instance on a same-day timeline.

Fluent Bit version 5.0.8 fixes a critical stack-based buffer overflow in the out_forward plugin's Secure Forward handshake. CVE-2026-61674 has a CVSS score of 9.2, Critical severity. The flaw affects versions 0.11.0 through 5.0.7. The plugin copies a server-controlled reason field into a fixed 32-byte stack buffer without checking its type or length. An attacker who controls or impersonates a Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data.

The impact ranges from a crash to remote code execution as the Fluent Bit process user, and the flaw also allows elevation of privilege. Builds with stack canaries reliably terminate, but builds without them, or builds that leak memory, are exposed to code execution. When the opt-in supervisor mode is used, repeated crash probes can defeat a hardened build. Proof-of-concept code exists for this vulnerability. Upgrade all Fluent Bit deployments to version 5.0.8.

FreeRDP 3.31.0 fixes four vulnerabilities that affect both FreeRDP servers and clients. CVE-2026-91949 has a CVSS score of 9.3, Critical severity. It is a protocol negotiation bypass that lets unauthenticated attackers open RDSTLS connections even when server policy disables them. That gets around the server's pre-authentication transport restrictions. CVE-2026-91964 has a CVSS score of 8.8, High severity. It is a heap-based buffer overflow in the client: a malicious RDP server can send an oversized LoadBalanceInfo field in a Server Redirection message, which crashes the client and can lead to code execution.

CVE-2026-91948 has a CVSS score of 7.5, High severity. It is an out-of-bounds write in server-side static virtual channel handling that lets authenticated clients corrupt heap memory and possibly execute code. CVE-2026-91947 has a CVSS score of 7.5, High severity. It is a use-after-free race in the server's DRDYNVC parser that authenticated clients can trigger for elevation of privilege. Upgrade all FreeRDP deployments to version 3.31.0.

This Gitea update fixes eleven flaws in authentication, authorization, CI pipelines, and service stability. The most serious problems let attackers skip passkey checks, sign in over SSH as another user, extend OAuth2 access past its intended lifetime, and run fork-controlled workflow code on a project's own runners without approval. Others let users keep write access after a team is demoted, delete published releases, change repository visibility, push to internal services or local server paths, hide malicious content behind a harmless-looking diff, and crash the instance for all users.

CVE-2026-73278 and CVE-2026-94205 each have a CVSS score of 9.8, Critical severity. CVE-2026-101023, CVE-2026-103059, and CVE-2026-95106 each have a CVSS score of 9.1, Critical severity. CVE-2026-103504, CVE-2026-105267, and CVE-2026-89430 each have a CVSS score of 8.1, High severity. CVE-2026-96399 has a CVSS score of 7.5, High severity. CVE-2026-79960 and CVE-2026-86684 each have a CVSS score of 7.1, High severity.

GitHub has fixed a server-side request forgery flaw in the notebook viewer of GitHub Enterprise Server. CVE-2026-77987 has a CVSS score of 9.3, Critical severity. The viewer checked the scheme and host of a user-supplied URL but not the port. This let attackers send requests to internal services on other ports of the same appliance. Response timing then exposed instance secrets one character at a time. An attacker could use a stolen secret to run code remotely on the appliance.

Attackers need only network access when private mode is off. With private mode on, any signed-in user can exploit the flaw. Versions 3.17 through 3.22 are affected. The fix ships in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.

GLPI versions 11.0.8 and 10.0.26 fix five privilege escalation flaws in the IT asset management platform, one Critical and four High. CVE-2026-48482 has a CVSS score of 9.4, Critical severity. A form administrator can import a crafted form that writes a malicious script to an executable server location and then runs it remotely. CVE-2026-47679 has a CVSS score of 8.5, High severity. Any logged-in user can abuse the profile-picture update to delete a file of their choice from the server.

CVE-2026-49470 has a CVSS score of 7.7, High severity. It allows unlimited one-time password attempts, so an attacker who already holds a user's password can brute-force the second factor and take over the account. CVE-2026-53625 has a CVSS score of 7.5, High severity. A technician can change another user's authentication method through the API, which can lead to takeover of a super-administrator account. CVE-2026-53626 has a CVSS score of 7.1, High severity. It lets users read documents linked to items they are not allowed to access. Upgrade to GLPI 11.0.8, or to 10.0.26 on the 10.x branch, to close all five flaws.

HPE has patched six Critical vulnerabilities in AOS-Switch (AOS-S). The most serious flaws let an unauthenticated attacker bypass authentication on the management interface or run arbitrary code on the switch. CVE-2026-76742 has a CVSS score of 9.8, Critical severity, and CVE-2026-76743 has a CVSS score of 9.8, Critical severity. Both allow an attacker to bypass authentication and gain unauthorized access. CVE-2026-76744 has a CVSS score of 9.8, Critical severity. It is a buffer overflow that lets an unauthenticated remote attacker execute arbitrary code.

CVE-2026-76745 has a CVSS score of 9.6, Critical severity. It is a memory corruption flaw that lets an unauthenticated adjacent attacker execute arbitrary code. CVE-2026-76746 has a CVSS score of 9.3, Critical severity, and CVE-2026-76747 has a CVSS score of 9.1, Critical severity. These two buffer overflows expose sensitive memory and can cause a denial of service on the device. Switches sit at the core of the network, so a compromised device gives attackers a strong position for further attacks and can take down connectivity. Patch AOS-S switches today and restrict access to their management interfaces.

This HPE update fixes ten Critical vulnerabilities in ClearPass Policy Manager (CPPM), the platform that controls network access across the enterprise. The flaws include deserialization of untrusted data, authentication bypass, format string memory corruption, SQL injection, missing integrity checks in the OnGuard and client agents, and path traversal. Most can be exploited remotely without authentication. A successful attacker could run arbitrary code, gain administrative access, issue arbitrary database commands, or read and modify files on the underlying operating system. The agent flaws also allow code execution on managed endpoints with elevated privileges.

CVE-2026-76750, CVE-2026-76751, CVE-2026-76752, CVE-2026-76753 and CVE-2026-76754 each have a CVSS score of 9.8, Critical severity. CVE-2026-79794 has a CVSS score of 9.1, Critical severity. CVE-2026-79796 has a CVSS score of 9.8, Critical severity. CVE-2026-79798 has a CVSS score of 9.9, Critical severity. CVE-2026-79801 and CVE-2026-79805 each have a CVSS score of 9.8, Critical severity.

This HPE update fixes six Critical vulnerabilities in EdgeConnect SD-WAN Gateways and the EdgeConnect SD-WAN Orchestrator. Each one can lead to full compromise of the system. CVE-2026-76673 has a CVSS score of 9.8, Critical severity. It lets an unauthenticated remote attacker bypass authentication in the Orchestrator API and take administrative control. CVE-2026-76674 has a CVSS score of 9.8, Critical severity. It is a buffer overflow in the gateway's underlying operating system that lets an unauthenticated remote attacker run arbitrary commands.

CVE-2026-76669 and CVE-2026-76670 each have a CVSS score of 9.9, Critical severity. Both let a low-privileged authenticated user escalate to administrator through the Orchestrator API. CVE-2026-76672 has a CVSS score of 9.9, Critical severity. It lets a read-only user pull third-party API tokens and credentials from the cache synchronization endpoint, which opens a path to external security platforms. CVE-2026-76675 has a CVSS score of 9.1, Critical severity. It is a command injection flaw in the gateway CLI that gives a highly privileged attacker control of the operating system. SD-WAN devices sit at the edge of the network and control traffic between sites, so patch them right away.

Hewlett Packard Enterprise has released a firmware update for HPE Integrated Lights-Out (iLO) 7 that fixes a remote user validation failure. CVE-2026-79820 has a CVSS score of 9.0, Critical severity. Because iLO provides out-of-band management of the server below the operating system, a failure to validate remote users weakens the control layer that administrators rely on to manage, recover, and secure their hardware. Organizations running iLO 7 should apply the updated firmware on a same-day basis to close this gap in their server management infrastructure.

Hewlett Packard Enterprise has patched an authentication bypass vulnerability in HPE Intelligent Management Center (iMC) versions prior to v7.3 E0713. CVE-2026-79842 has a CVSS score of 9.1, Critical severity. iMC centrally manages network infrastructure, so an attacker who bypasses its authentication can gain a commanding position over the managed environment. Update iMC to v7.3 E0713 or later to close this gap.

This IBM DataPower Gateway update fixes a critical cross-site scripting flaw in the Web UI of versions 10.6.0.0 through 10.6.0.10. CVE-2026-14990 has a CVSS score of 9.3, Critical severity. An unauthenticated attacker can embed arbitrary JavaScript in the Web UI, change how the interface behaves, and expose credentials inside a trusted administrative session.

DataPower sits at the edge of enterprise API and integration traffic, so stolen administrator credentials put the whole gateway at risk. Apply the update to every 10.6.0 deployment now.

This IBM DataPower Gateway update fixes 22 vulnerabilities across versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Six are Critical. CVE-2026-14269, CVE-2026-14502, CVE-2026-14991, CVE-2026-14992, CVE-2026-15762, and CVE-2026-16340 each have a CVSS score of 9.8, Critical severity. These flaws let an unauthenticated remote attacker run arbitrary code through heap overflows and out-of-bounds writes, including one in the RFC2047 encoded-word parser. One of them lets an attacker gain administrative access because LDAP authentication accepts empty passwords.

The remaining 16 are High severity. CVE-2026-16159 and CVE-2026-16163 have a CVSS score of 8.6, High severity. CVE-2026-14496 and CVE-2026-15824 have a CVSS score of 8.2, High severity. CVE-2026-14888 and CVE-2026-15784 have a CVSS score of 8.1, High severity. CVE-2026-15781 has a CVSS score of 8.0, High severity. CVE-2026-15819, CVE-2026-16161, CVE-2026-16164, CVE-2026-16165, CVE-2026-16167, CVE-2026-16170, CVE-2026-16178, and CVE-2026-16179 each have a CVSS score of 7.5, High severity. CVE-2026-16181 has a CVSS score of 7.4, High severity. These flaws enable remote code execution, information disclosure, authorization bypass, memory corruption, and denial of service against the gateway. Patch DataPower Gateway the same day.

IBM has released fixes for 60 vulnerabilities in IBM Guardium Data Protection 12.0, 12.1 and 12.2. All 60 are rated Critical or High. Remote attackers can use these flaws to run code without logging in, read and change data through SQL injection, and skip authentication on the management interface and internal servlets. Local users can gain root access to Collector and Central Manager appliances. Many of the flaws need no credentials, so any Guardium system that can be reached over the network is at serious risk.

Critical: CVE-2026-80442, CVE-2026-84064, CVE-2026-84075 and CVE-2026-84078 each have a CVSS score of 9.9, Critical severity. CVE-2026-75875, CVE-2026-80381, CVE-2026-80441, CVE-2026-81657, CVE-2026-82340, CVE-2026-82967, CVE-2026-84082, CVE-2026-84249 and CVE-2026-84272 each have a CVSS score of 9.8, Critical severity. CVE-2026-82832 has a CVSS score of 9.6, Critical severity. CVE-2026-84244 has a CVSS score of 9.3, Critical severity. CVE-2026-84073 and CVE-2026-84436 each have a CVSS score of 9.1, Critical severity. CVE-2026-84031 has a CVSS score of 9.0, Critical severity.

High: CVE-2026-82885, CVE-2026-82887, CVE-2026-84034 and CVE-2026-85542 each have a CVSS score of 8.8, High severity. CVE-2026-84250 has a CVSS score of 8.4, High severity. CVE-2026-82334, CVE-2026-82335, CVE-2026-82344, CVE-2026-82892, CVE-2026-82895, CVE-2026-82900, CVE-2026-84035, CVE-2026-84057, CVE-2026-84058, CVE-2026-84081, CVE-2026-84085, CVE-2026-84198, CVE-2026-84241, CVE-2026-84246, CVE-2026-84247 and CVE-2026-84842 each have a CVSS score of 8.1, High severity. CVE-2026-82893, CVE-2026-84083, CVE-2026-84089, CVE-2026-84245 and CVE-2026-84271 each have a CVSS score of 7.8, High severity. CVE-2026-82896 and CVE-2026-84076 each have a CVSS score of 7.6, High severity. CVE-2026-84230, CVE-2026-84275, CVE-2026-84440, CVE-2026-84875, CVE-2026-84882 and CVE-2026-85029 each have a CVSS score of 7.5, High severity. CVE-2026-84036 has a CVSS score of 7.4, High severity. CVE-2026-81669, CVE-2026-81937, CVE-2026-84071, CVE-2026-84086, CVE-2026-84278, CVE-2026-84422 and CVE-2026-84862 each have a CVSS score of 7.2, High severity.

This IBM MQ update fixes twelve vulnerabilities across queue managers, the MQ Console, and the Java and JMS client libraries. The most serious, CVE-2026-12351, has a CVSS score of 9.8, Critical severity. It lets a remote attacker run arbitrary code through unsafe JNDI lookup processing when the IVT application is deployed. CVE-2026-10575, CVE-2026-11375, CVE-2026-11378, CVE-2026-11725, and CVE-2026-13293 each have a CVSS score of 8.8, High severity. They cover heap and stack buffer overflows, integer overflows in distribution list and MQINQ processing, and unsafe deserialization that lets authenticated attackers execute code or crash the service.

CVE-2026-11729 has a CVSS score of 8.5, High severity, and enables JNDI injection against client applications. CVE-2026-10027 and CVE-2026-11728 each have a CVSS score of 8.1, High severity. They cover a buffer overflow in compressed channel data and a client-side heap overflow triggered by a malicious queue manager or a man-in-the-middle attacker. CVE-2026-10751 has a CVSS score of 7.5, High severity, and fixes a deserialization filter bypass in the Java and JMS clients. CVE-2026-10030 has a CVSS score of 7.1, High severity, and stops non-administrative Console users from creating and starting queue managers. CVE-2026-12150 has a CVSS score of 7.0, High severity, and fixes improper handling of deeply nested TLS certificate data. Affected releases span the 9.1, 9.2, 9.3, and 9.4 LTS and CD streams and 10.0.0.0.

IBM's update fixes seven vulnerabilities in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3. The two most severe flaws let a remote attacker with no credentials run arbitrary code through deserialization of untrusted data: CVE-2026-78401 and CVE-2026-78406 each have a CVSS score of 9.8, Critical severity. Three improper authentication flaws let attackers bypass security restrictions or authentication: CVE-2026-16823 and CVE-2026-19491 each have a CVSS score of 9.1, Critical severity, and CVE-2026-19494 has a CVSS score of 8.1, High severity.

The update also fixes a protection mechanism failure that lets an authenticated attacker run arbitrary code. CVE-2026-16916 has a CVSS score of 9.1, Critical severity. It also fixes a path traversal flaw that allows arbitrary file writes. CVE-2026-19493 has a CVSS score of 7.5, High severity. This platform controls identity and access for the whole organization, so a compromise reaches every application it protects. Apply this update the same day.

Ivanti Neurons for ITSM 2026.2 fixes eight vulnerabilities that let remote attackers run arbitrary code on the server. Every flaw affects versions before 2026.2. CVE-2026-12744 and CVE-2026-12745 are unsafe deserialization flaws that an unauthenticated attacker can exploit. Each has a CVSS score of 9.8, Critical severity. CVE-2026-12650 is a deserialization flaw that needs an authenticated attacker. It has a CVSS score of 9.9, Critical severity. CVE-2026-12648 and CVE-2026-12651 are the same type of flaw. Each has a CVSS score of 8.8, High severity.

CVE-2026-12645, CVE-2026-12646, and CVE-2026-12647 are missing authorization flaws that let an authenticated attacker escalate privileges and run code on the server. Each has a CVSS score of 9.9, Critical severity. The service desk platform holds sensitive asset, user, and workflow data, so a compromise reaches deep into the organization. Upgrade to Ivanti Neurons for ITSM 2026.2 the same day.

JetBrains YouTrack updates fix ten authorization and authentication flaws that let attackers take over accounts, gain higher privileges, and change or reach data they should never touch. The most serious is CVE-2026-86478, which has a CVSS score of 9.8, Critical severity. A flaw in YouTrack Helpdesk let an unauthenticated attacker take over an account by claiming an email address. CVE-2026-100277 has a CVSS score of 8.9, High severity, and allowed account takeover by replaying a notification signature. CVE-2026-100273 has a CVSS score of 8.2, High severity, and let an attacker bypass authorization in the scripts debugger to run arbitrary code.

The remaining flaws widen access and privileges. CVE-2026-86482 has a CVSS score of 8.8, High severity, and CVE-2026-103490 has a CVSS score of 7.2, High severity; both allow privilege escalation, through role assignments and user group links. CVE-2026-86479 has a CVSS score of 8.0, High severity, and exposes restricted REST API resources. CVE-2026-103488 has a CVSS score of 7.1, High severity, and lets users join project teams to read restricted issues. CVE-2026-86494 and CVE-2026-86498 each have a CVSS score of 7.7, High severity, and allow unauthorized changes to links on issues and linked entities. CVE-2026-100262 has a CVSS score of 7.6, High severity, and lets read-only users overwrite project notification templates. Upgrade YouTrack to 2026.2.19422 or later to close all ten flaws.

This Kiteworks Core update fixes 15 vulnerabilities. Versions before 9.5.0 are affected. Two flaws are Critical. CVE-2026-102115 has a CVSS score of 9.8, Critical severity: a password reset flaw lets an unauthenticated attacker take over any account with a locally stored password, including administrator accounts. CVE-2026-102147 has a CVSS score of 9.3, Critical severity: a stored cross-site scripting flaw lets an unauthenticated attacker run script in an administrator's session and seize full administrative control.

The other 13 flaws are rated High. They allow command injection, unsafe deserialization, arbitrary file writes, and privilege escalation to root or full system administrator. CVE-2026-102120 has a CVSS score of 8.8, High severity. CVE-2026-102101 has a CVSS score of 8.1, High severity. CVE-2026-102112, CVE-2026-102113, and CVE-2026-102118 each have a CVSS score of 7.8, High severity. CVE-2026-102123 has a CVSS score of 7.4, High severity. CVE-2026-102093, CVE-2026-102096, CVE-2026-102099, CVE-2026-102114, CVE-2026-102129, CVE-2026-102132, and CVE-2026-102142 each have a CVSS score of 7.2, High severity. Taken together, these flaws let an attacker move from an outside foothold to root control of the appliance.

This LiteSpeed Web Server update fixes a critical flaw in how the server checks internal redirect URLs. Versions before 6.3.7 build 1 handle redirect URL validation incorrectly in a specific corner case. The weakness comes from improper encoding handling, which lets crafted requests get past the server's redirect checks. CVE-2026-93903 has a CVSS score of 9.4, Critical severity.

LiteSpeed Web Server sits directly in front of public websites and applications, so a flaw in its request handling is directly exposed to attackers. Update to version 6.3.7 build 1 or later on every LiteSpeed host, starting with internet-facing servers.

MantisBT version 2.28.4 fixes a critical authentication bypass in the SOAP API of the open source bug tracker. CVE-2026-47156 has a CVSS score of 9.3, Critical severity. The flaw sits in the mci_check_login() function: any user who holds a valid cookie string can sign in as any other user, including the administrator, using only that user's username. The attacker never needs the target's password.

Default installations are exposed with no prior access, because self-registration is on by default. An attacker can create an account, take their own cookie string from the browser, and impersonate the administrator through the SOAP API. The REST API and the Web UI are not affected. No workarounds exist, so upgrading to 2.28.4 is the only fix.

Mozilla has fixed 33 Critical vulnerabilities in Firefox, and the same fixes reach Firefox ESR and Thunderbird. Most of these flaws are sandbox escapes in core components such as DOM, Graphics, WebRender, WebRTC, XPCOM, XUL, Widget: Win32, and Process Sandboxing. The rest are mitigation bypasses, memory boundary errors, a site isolation issue, and a spoofing flaw. A successful sandbox escape lets malicious web content break out of the browser's isolation layer and reach the host system. The fixes ship in Firefox 156, Firefox 157, and Firefox 157.0.1; Firefox ESR 115.41, 115.42, 140.16, 140.17, 153.3, and 153.4; and Thunderbird 156, 157, 140.16, 140.17, 153.3, and 153.4.

CVE-2026-106016, CVE-2026-92036, CVE-2026-92037, CVE-2026-92061, and CVE-2026-92066 have a CVSS score of 9.8, Critical severity. CVE-2026-100758, CVE-2026-100760, CVE-2026-100762, CVE-2026-100770, CVE-2026-100775, CVE-2026-100778, CVE-2026-100781, CVE-2026-100786, CVE-2026-100787, CVE-2026-100800, CVE-2026-100819, CVE-2026-100828, CVE-2026-100829, CVE-2026-92018, CVE-2026-92032, CVE-2026-92035, CVE-2026-92045, and CVE-2026-92071 have a CVSS score of 9.6, Critical severity. CVE-2026-92059 has a CVSS score of 9.3, Critical severity. CVE-2026-92034, CVE-2026-92038, CVE-2026-92041, CVE-2026-92050, CVE-2026-92051, CVE-2026-92057, CVE-2026-92075, and CVE-2026-92079 have a CVSS score of 9.1, Critical severity. CVE-2026-92048 has a CVSS score of 9.0, Critical severity.

Mozilla has fixed nine Critical vulnerabilities in Thunderbird across graphics, WebAssembly, internationalization, preferences, DevTools, the DOM, the Gtk widget layer, mail header parsing, and the IMAP response parser. Four of these flaws allow sandbox escape, and two sit directly in the mail-handling path: a crafted mail header can trigger memory safety violations, and a malicious or compromised IMAP server can crash Thunderbird before authentication.

CVE-2026-100788, CVE-2026-100810, and CVE-2026-92238 each have a CVSS score of 9.8, Critical severity. CVE-2026-100794, CVE-2026-100804, CVE-2026-100811, and CVE-2026-100818 each have a CVSS score of 9.6, Critical severity. CVE-2026-100763 and CVE-2026-92240 each have a CVSS score of 9.1, Critical severity. The fixes ship in Thunderbird 157, 153.4, and 140.17, with the mail header and IMAP fixes first delivered in Thunderbird 156, 153.3, and 140.16.

This update patches three heap buffer overflows in NLnet Labs Unbound through version 1.26.0. All three can lead to remote code execution. CVE-2026-81642 has a CVSS score of 9.1, Critical severity. An attacker who controls a malicious zone can send a crafted DNSKEY that overflows the DNSSEC validator's digest buffer, causing denial of service or remote code execution. CVE-2026-82717 has a CVSS score of 8.4, High severity. Crafted CNAME synthesis combined with a compression pointer progressively corrupts heap memory, crashes the resolver, and on certain systems and builds allows remote code execution. CVE-2026-81634 has a CVSS score of 7.5, High severity. A maximum-length query name paired with a large TCP response overflows the heap during RRSet canonicalisation.

Each of these flaws is triggered by attacker-controlled DNS responses, and canonicalisation runs before DNSSEC validation, so DNSSEC does not block the attack. Any Unbound resolver that queries untrusted name servers is exposed and should be updated right away.

This Suricata update fixes seven vulnerabilities in the network intrusion detection and prevention engine, including three Critical flaws. CVE-2026-94083 has a CVSS score of 9.4, Critical severity, and CVE-2026-94084 has a CVSS score of 9.4, Critical severity. Both affect HTTP/2 handling: a DoH2 type confusion that triggers an invalid free, and a use-after-free during HTTP response header inspection. CVE-2026-45764 has a CVSS score of 9.1, Critical severity, and is an HTTP/2 type confusion that crashes the engine. CVE-2026-57228 has a CVSS score of 8.2, High severity, and is an out-of-bounds read in the SMTP MIME decoder. CVE-2026-45747 has a CVSS score of 7.5, High severity, and is a NULL dereference in the Lua TLS certificate helper. Proof-of-concept code exists for this flaw. CVE-2026-45770 has a CVSS score of 7.5, High severity, and lets an overloaded Lua rule corrupt detection state and escape the Lua sandbox. CVE-2026-57223 has a CVSS score of 7.0, High severity, and is an unquoted Windows service path that lets a local attacker run code as LocalSystem.

Crafted network traffic can knock Suricata offline and leave the network unmonitored. Several flaws also corrupt memory or escalate privileges. Versions 8.0.7 and 7.0.17 fix these issues. Upgrade 8.x deployments to 8.0.7 and 7.x deployments to 7.0.17.

OPNsense has patched a path traversal flaw in the NTP configuration module of its FreeBSD-based firewall and routing platform. CVE-2026-53581 has a CVSS score of 9.0, Critical severity. An attacker with access to the NTP configuration can manipulate the GPS or PPS serial port parameter to escape the intended directory and write attacker-controlled data to any file on the system as root. This creates a direct path to elevation of privilege on the device that guards the network edge.

Proof-of-concept code exists for this vulnerability. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core fix the issue. Upgrade all OPNsense firewalls to the patched release now.

This Oracle Access Manager update fixes ten Critical vulnerabilities in the platform that controls single sign-on and access to enterprise applications. Every flaw in this batch is rated Critical. A weakness in the access layer puts every application behind it at risk, so this update needs same-day attention.

CVE-2026-71133 has a CVSS score of 10.0, Critical severity. CVE-2026-71163 and CVE-2026-73945 each have a CVSS score of 9.9, Critical severity. CVE-2026-73940, CVE-2026-73947, and CVE-2026-73950 each have a CVSS score of 9.8, Critical severity. CVE-2026-73962 has a CVSS score of 9.6, Critical severity. CVE-2026-73944, CVE-2026-73946, and CVE-2026-83001 each have a CVSS score of 9.1, Critical severity.

Oracle has released a security update for Oracle Applications Framework that fixes CVE-2026-83327. CVE-2026-83327 has a CVSS score of 9.8, Critical severity. This framework underpins Oracle's business applications, so a flaw rated this high puts core enterprise workflows and the data behind them at serious risk.

Treat this update as a same-day priority. Apply it to every Oracle Applications Framework deployment to close a critical exposure before attackers can use it.

Oracle has released a security update for Oracle BI Publisher that fixes two Critical vulnerabilities. CVE-2026-83268 has a CVSS score of 9.1, Critical severity. CVE-2026-83269 has a CVSS score of 9.8, Critical severity. Both flaws affect the same product, so one update closes them together.

Oracle BI Publisher generates and distributes business reports, which often hold sensitive financial and operational data. Two Critical-rated flaws in this platform put that data at serious risk. Organizations running Oracle BI Publisher should apply this update the same day.

Oracle has released a security update for Oracle Business Intelligence Enterprise Edition that fixes two Critical vulnerabilities. CVE-2026-83282 has a CVSS score of 9.9, Critical severity. CVE-2026-83283 has a CVSS score of 9.8, Critical severity.

Both flaws sit in a platform that centralizes reporting, analytics, and sensitive business data. Scores this close to the top of the scale put these systems at serious risk. Apply the update the same day to close both flaws before attackers can use them.

This Oracle Hyperion Financial Management update fixes 13 vulnerabilities, and every one of them is rated Critical. CVE-2026-87230 has a CVSS score of 10.0, Critical severity. CVE-2026-87172 has a CVSS score of 9.9, Critical severity. CVE-2026-87184 and CVE-2026-87188 each have a CVSS score of 9.8, Critical severity. CVE-2026-87186 has a CVSS score of 9.6, Critical severity. CVE-2026-87170, CVE-2026-87173, CVE-2026-87175, CVE-2026-87176, CVE-2026-87189, CVE-2026-87214, CVE-2026-87217, and CVE-2026-87223 each have a CVSS score of 9.1, Critical severity.

Hyperion Financial Management handles consolidation and financial close, so a compromise reaches directly into an organization's most sensitive financial data and reporting. With a maximum score of 10.0 and the entire batch rated Critical, this update needs same-day deployment across all Hyperion Financial Management environments.

This Oracle Identity Manager update fixes two critical vulnerabilities. CVE-2026-70913 has a CVSS score of 9.8, Critical severity. CVE-2026-83042 has a CVSS score of 9.8, Critical severity.

Oracle Identity Manager controls user provisioning and access across the enterprise, so a weakness here puts every connected system at risk. Both flaws carry the highest severity rating, and this update needs same-day deployment to close them.

This Oracle WebLogic Server update fixes five Critical severity vulnerabilities. Every CVE in this batch scores 9.8 or higher, and one has the maximum possible score. WebLogic Server often hosts business-critical applications and middleware, so these flaws put core enterprise services at direct risk.

The update covers CVE-2026-70748, CVE-2026-70756 and CVE-2026-70757, each with a CVSS score of 9.8, Critical severity. CVE-2026-83021 has a CVSS score of 10.0, Critical severity. CVE-2026-83038 has a CVSS score of 9.9, Critical severity. Deploy this patch to all WebLogic Server instances the same day, starting with internet-facing servers.

Oracle has released an update for Siebel CRM Deployment that fixes four Critical vulnerabilities. CVE-2026-83196 has a CVSS score of 9.1, Critical severity. CVE-2026-83201 has a CVSS score of 9.1, Critical severity. CVE-2026-83202 has a CVSS score of 9.1, Critical severity. CVE-2026-83229 has a CVSS score of 9.1, Critical severity.

Siebel CRM holds sensitive customer, sales, and service data, so four Critical flaws in one component create serious business risk. Apply this update on the same day to close all four flaws before attackers can use them.

Oracle's update for Siebel CRM End User fixes a Critical vulnerability. CVE-2026-83154 has a CVSS score of 9.1, Critical severity.

Siebel CRM holds customer records, sales pipelines, and service history, so a flaw rated this high puts core business data and customer trust at risk. Apply this update the same day across every Siebel CRM End User deployment.

Perforce P4 Search 2026.4.2 closes four flaws that expose P4 (Helix Core) environments to full takeover. CVE-2026-100103 has a CVSS score of 10.0, Critical severity: container images reset the service authentication token to a publicly documented default, giving an unauthenticated attacker the highest application privilege. CVE-2026-100102 has a CVSS score of 9.5, Critical severity: container images enable an unauthenticated Java debug interface that lets an attacker run arbitrary code as the P4 Search service account. CVE-2026-103510 has a CVSS score of 9.5, Critical severity: P4 Search does not fail securely when its service authentication token is blank, granting an unauthenticated attacker top privilege. CVE-2026-103507 has a CVSS score of 7.5, High severity: the logging configuration interface does not restrict file paths, letting an attacker with the service token write arbitrary files on the host and reach code execution.

Each flaw leads toward compromise of the connected P4 Server, which holds an organization's source code and intellectual property. Three of the four need only network access and no credentials. Upgrade P4 Search to version 2026.4.2.

This pgAdmin 4 update closes two serious flaws in the PostgreSQL management tool. CVE-2026-86863 has a CVSS score of 9.8, Critical severity. When webserver authentication is enabled, pgAdmin accepted a user identity from a client-supplied HTTP header. Any client that could reach pgAdmin could log in as any user, including an existing Administrator, with no password. The fix trusts a header identity only when the operator opts in and the request comes from a trusted proxy. A shared secret can also be required.

CVE-2026-86864 has a CVSS score of 8.8, High severity. Any authenticated user with the default backup permission could abuse the Backup tool's database field. That field let them write or overwrite files anywhere the pgAdmin process can write, including pgAdmin's own configuration database. The same field could also redirect the backup to an attacker's server, which sent the stored database password along with it. Both flaws allow privilege escalation, and both are fixed in pgAdmin 4 version 9.18.

This CPython update fixes two serious flaws in the ssl and tarfile modules. CVE-2026-19445 has a CVSS score of 9.2, Critical severity. It is a use-after-free flaw in TLS servers whose sni_callback assigns a different context to SSLSocket.context while nothing else keeps the original SSLContext alive. A remote, unauthenticated TLS client can crash the server or force it to call through a freed pointer. This mostly affects servers that create an SSLContext for each connection or replace one while connections are open. It can lead to remote code execution and privilege escalation. TLS clients are not affected.

CVE-2026-82049 has a CVSS score of 8.4, High severity. In CPython 3.13 and earlier, the tarfile data and tar extraction filters can be bypassed by crafted archives that contain a hard link to a symbolic link. A malicious archive can change the permissions or modification time of a file outside the destination directory, or expose that file's contents inside the extracted tree. This can lead to privilege escalation. Until the patch is applied, servers should keep a reference to every SSLContext that sets sni_callback for as long as the server runs.

This RabbitMQ update closes two Critical authentication flaws in rabbitmq-server that let attackers bypass identity checks and gain elevated access to the message broker. CVE-2026-67231 has a CVSS score of 9.1, Critical severity. A flaw in the trust-store plugin matches whitelisted certificates by issuer name and serial number alone, so an attacker who knows those non-secret values can connect with a forged self-signed certificate and bypass TLS client authentication. CVE-2026-67404 has a CVSS score of 9.2, Critical severity. When the OAuth2 plugin has no CA bundle available, the broker silently disables certificate verification, letting a man-in-the-middle attacker forge signing keys and have the broker accept arbitrary tokens.

Both flaws are fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Deployments using the trust-store plugin or OAuth2 authentication, including minimal containers without an OS CA bundle, should upgrade now to restore trusted authentication across their messaging infrastructure.

This update fixes four Critical flaws in the automation controller and container groups of Red Hat Ansible Automation Platform 2.4 for RHEL 8. CVE-2026-75884 has a CVSS score of 9.1, Critical severity. CVE-2026-84474 has a CVSS score of 9.9, Critical severity. CVE-2026-84502 has a CVSS score of 9.9, Critical severity. CVE-2026-84719 has a CVSS score of 9.9, Critical severity.

The fixes close several ways to break out of assigned privileges. An incomplete blocklist on pod spec overrides lets an administrator reach OpenShift namespace secrets. An exposed provisioning-callback secret, combined with a trusted X-Forwarded-For header, lets a low-privileged or unauthenticated attacker launch jobs against managed hosts. An unvalidated project SCM URL allows arbitrary command execution on the control-plane task pod. A gap in workflow copy checks lets a user run jobs on instance groups they are not authorized to use, including the control plane. Together, these flaws put credentials, managed hosts, and tenant isolation at direct risk.

This Red Hat Enterprise Linux 10 update fixes 27 vulnerabilities in identity services, virtualization, package handling, and document processing. The most serious is CVE-2026-76578, with a CVSS score of 9.8, Critical severity. It lets a remote, unauthenticated attacker add themselves to the FreeIPA administrators group and take control of directory and identity operations. Other identity and certificate flaws make the risk worse: CVE-2026-79678 and CVE-2026-80110 each have a CVSS score of 8.1, High severity, and CVE-2026-76561 has a CVSS score of 7.2, High severity. Together, they allow server data to be read, certificate authority permissions to be bypassed, and commands to run inside the certificate service.

The virtualization fixes close guest-to-host escape paths in QEMU and libslirp. CVE-2026-93834 has a CVSS score of 8.8, High severity, CVE-2026-81627 has a CVSS score of 8.2, High severity, and CVE-2026-95508 has a CVSS score of 7.4, High severity. Public proof-of-concept code exists for CVE-2026-93834, CVE-2026-81627, CVE-2026-86320, and CVE-2026-96889. The libsoup flaws CVE-2026-102557, CVE-2026-102558, CVE-2026-102559, and CVE-2026-102560 each have a CVSS score of 8.6, High severity, and CVE-2026-102555 has a CVSS score of 8.2, High severity. In rpm, CVE-2026-95519 and CVE-2026-95521 each have a CVSS score of 7.8, High severity, and CVE-2026-103242 and CVE-2026-95520 each have a CVSS score of 7.1, High severity. These flaws let a crafted package or manifest run code.

The update also hardens Flatpak and its sandboxing tools against writes to host files as root. CVE-2026-96275 and CVE-2026-87766 each have a CVSS score of 8.8, High severity, CVE-2026-86320 has a CVSS score of 7.8, High severity, and CVE-2026-97023 and CVE-2026-97024 each have a CVSS score of 7.1, High severity. Crafted documents and images can run code through Ghostscript, GIMP, and librsvg: CVE-2026-101258, CVE-2026-106062, and CVE-2026-96889 each have a CVSS score of 7.8, High severity. The sudo flaw CVE-2026-96512 and the crun flaw CVE-2026-84042 each have a CVSS score of 7.8, High severity, and the Cyrus SASL flaw CVE-2026-107161 has a CVSS score of 7.5, High severity.

This Red Hat OpenShift Container Platform 4.12 update fixes two flaws in the OpenShift console. Attackers can reach both without authentication. CVE-2026-75885 has a CVSS score of 9.3, Critical severity. It lets a remote attacker send crafted devfile payloads to the console's devfile endpoints. The console pod then sends requests to internal services and returns parts of their responses to the attacker, a server-side request forgery. The same endpoints also let repeated large requests grow memory without limit, which can take the console down.

CVE-2026-75887 has a CVSS score of 7.5, High severity. It is a path traversal flaw in the console's locale resource endpoint. Attackers can read sensitive JSON files from the pod filesystem, including plugin manifests and configuration files, and reach registered dynamic-plugin backends. This flaw is also classified as an elevation of privilege. Together, these flaws give an unauthenticated outsider a view into internal services and cluster configuration. Apply this update the same day.

This update closes seven Critical and High severity flaws in Red Hat Satellite 6.16 for RHEL 8 and its Foreman components. CVE-2026-96658 has a CVSS score of 9.9, Critical severity: a low-privileged authenticated attacker can bypass the templating engine's safemode sandbox and run arbitrary commands on the Satellite server. CVE-2026-96659 has a CVSS score of 9.1, Critical severity: a user with only Viewer permissions can pull sensitive data such as host root passwords through template preview endpoints, and can execute commands when Safemode is disabled.

The remaining fixes target command injection and access control failures. CVE-2026-12405 has a CVSS score of 8.8, High severity, and lets users who can run job templates inject shell commands through the effective_user parameter on managed hosts. CVE-2026-12540 and CVE-2026-12541 each have a CVSS score of 8.2, High severity, and allow command injection through foreman-rake log retrieval and database dump/import tasks. CVE-2026-12544 has a CVSS score of 7.7, High severity, and enables template injection and insecure deserialization that can lead to full infrastructure compromise. CVE-2026-12423 has a CVSS score of 7.5, High severity, and lets an unauthenticated requester retrieve kickstart templates for hosts mid-provisioning without supplying a token.

This IdentityIQ update fixes a critical flaw that affects all versions of the product. CVE-2026-12342 has a CVSS score of 9.6, Critical severity. The server does not properly validate content submitted to its web service API. As a result, an unauthenticated attacker can run code remotely on the IdentityIQ server.

IdentityIQ controls user identities and access across the enterprise, so a compromised server puts the whole access-governance layer at risk. Apply this update the same day to close the exposure.

Samsung's SMR Sep-2026 Release 1 fixes three Critical vulnerabilities in Samsung Mobile Devices. Two are heap-based buffer overflows in the libimagecodec.quram.so image library. CVE-2026-21095 sits in the DNG decoder and has a CVSS score of 9.2, Critical severity. CVE-2026-21096 sits in the JPEG decoder and has a CVSS score of 9.2, Critical severity. Both let remote attackers execute arbitrary code by delivering a crafted image to the device.

The third flaw, CVE-2026-21102, is a use-after-free in DualDAR with a CVSS score of 9.3, Critical severity. It lets local privileged attackers execute arbitrary code with root privileges, giving them full control of the device and the corporate data it holds. Devices that are not on SMR Sep-2026 Release 1 remain exposed to all three flaws.

SAP has released a fix for a memory safety vulnerability in its Extended Passport Protocol (EPP) processing library. CVE-2026-44756 has a CVSS score of 10.0, Critical severity. The flaw is a classic buffer overflow (CWE-120). An unauthenticated attacker can send a crafted network request with a malformed EPP header to trigger undefined behavior and crash the application.

The vulnerability enables remote code execution and carries a high impact on confidentiality, integrity, and availability. No authentication is required, so any exposed SAP system processing EPP traffic is at risk. Apply this update the same day.

This update fixes a critical authentication flaw in SAP NetWeaver Message Server. CVE-2026-58240 has a CVSS score of 9.8, Critical severity. The Message Server does not properly check that internal application server components are genuine when they register. An unauthenticated attacker with network access to the service can register an unauthorized component and then perform unauthorized actions inside the application environment.

A successful attack has a high impact on the confidentiality, integrity, and availability of the affected system. SAP NetWeaver often runs core business processes, so a compromised Message Server puts critical operations and sensitive data at direct risk. Patch affected systems without delay.

Schneider Electric has fixed a critical authentication flaw in the Modicon M580 programmable logic controller. CVE-2026-3869 has a CVSS score of 9.2, Critical severity. The controller implements its authentication algorithm incorrectly (CWE-303), so an attacker can get past the checks that are supposed to protect it.

The flaw is exploitable when an application project with a lower application level is running on the PLC. Exploitation can cause full loss of confidentiality, integrity and availability on the controller. That exposes the physical processes it runs to tampering and shutdown. Industrial operators should treat this as a same-day priority.

ServiceNow has released a security update for the ServiceNow AI Platform that fixes two Critical vulnerabilities, both reachable by unauthenticated users. CVE-2026-13016 has a CVSS score of 9.3, Critical severity. It is a SQL injection flaw that lets an attacker run arbitrary SQL statements against the instance's underlying database and read or modify instance data. CVE-2026-86860 has a CVSS score of 9.3, Critical severity. It is a missing authorization flaw that lets an attacker extract instance data they should not reach, resulting in privilege escalation.

ServiceNow has already deployed the fix to hosted instances. Partners and self-hosted customers must apply the update or upgrade to a patched release now to close both flaws.

SolarWinds has released fixes for two unauthenticated remote code execution vulnerabilities in Observability Self-Hosted. CVE-2026-28324 has a CVSS score of 9.8, Critical severity. It comes from insufficient integrity checks and affects installations running in a non-default, non-secure configuration. CVE-2026-28325 has a CVSS score of 8.8, High severity. It comes from deserialization of untrusted data when the application uses a specific communication mode.

Both flaws let an attacker who is not logged in run code on the monitoring server. These servers have wide visibility and privileged access across the environment, so a compromise exposes much more than one host. Apply the update to all self-hosted instances and review their configuration and communication mode settings.

Splunk has released Splunk Enterprise updates that fix two privilege escalation flaws. The more serious one is CVE-2026-76268, with a CVSS score of 9.8, Critical severity. The Patroni REST API on a search head cluster member does not require authentication for critical configuration operations. Any unauthenticated user with network access to it can run attacker-controlled operating-system commands. This flaw affects versions below 10.4.3 and 10.2.7. Versions 10.0.x and 9.4.x are not affected.

CVE-2026-76266 has a CVSS score of 7.7, High severity. It affects Splunk Enterprise on Linux in versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A local user who can run commands as the Splunk service account can tamper with the installation. The next package upgrade then runs that user's commands with root privileges, because the upgrade script trusts the existing installation content. Upgrading to a fixed release closes both flaws.

SUSE has released fixes for four vulnerabilities in Rancher and Rancher Fleet that put cluster management and tenant isolation at risk. CVE-2026-88804 has a CVSS score of 9.6, Critical severity. It lets unauthenticated remote attackers change public UI settings and plant stored cross-site scripting in the Rancher UI. It affects Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18. CVE-2026-88805 has a CVSS score of 8.1, High severity. Rancher 2.15 before 2.15.2 does not clear credentials correctly on logout, so attackers can keep access after a user signs out.

Two Fleet flaws break multi-tenant boundaries. CVE-2026-88808 has a CVSS score of 8.8, High severity. The Fleet agent writes to downstream clusters with its own cluster-admin credentials instead of the deployment's pinned ServiceAccount, which lets tenants overwrite configuration they should not touch. It is fixed in Fleet 0.16.2, 0.15.7, and 0.14.11. CVE-2026-93538 has a CVSS score of 7.1, High severity. A cluster registered by an agent can carry reserved labels that match targeting rules meant for another tenant's cluster, which sends that tenant's deployments to the wrong place. It is fixed in Fleet 0.16.1, 0.15.6, 0.14.10, 0.13.15, and 0.12.19. Three of the four flaws allow privilege escalation, and every Rancher deployment should move to the fixed release for its branch.

Synology has released DiskStation Manager (DSM) updates that fix five vulnerabilities, two of them Critical. These flaws let attackers read or write arbitrary files on the NAS and cause denial-of-service, which puts stored data and file-service availability at risk. CVE-2026-13639 is an insufficient entropy flaw in the login logic, with a CVSS score of 9.8, Critical severity. CVE-2026-13684 is an output encoding flaw in SCGI, with a CVSS score of 9.8, Critical severity. Unauthenticated remote attackers can exploit both.

Three High-severity flaws complete the update. CVE-2026-13673 is an incorrect permission assignment in the LDAP API, with a CVSS score of 8.8, High severity. CVE-2026-6205 is a file path control flaw in the Upload API, with a CVSS score of 8.1, High severity. Authenticated remote users can exploit both. CVE-2026-40539 is an improper certificate validation flaw in the Email API that is open to man-in-the-middle attackers, with a CVSS score of 7.1, High severity. The fixes ship in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075.

This traefik update fixes three authentication and authorization flaws in the reverse proxy. CVE-2026-88007 has a CVSS score of 9.1, Critical severity: with HTTP/3 enabled, an unrelated client can reuse a backend connection already authenticated through NTLM or Negotiate for a victim, then read the victim's data and act as that victim without the victim's credentials. CVE-2026-88008 has a CVSS score of 7.0, High severity: a client-supplied h2c upgrade request opens a raw tunnel to the backend, which skips routers, BasicAuth, ForwardAuth, IP allowlists, rate limits, logging, metrics, and tracing for every HTTP/2 request that follows.

CVE-2026-88877 has a CVSS score of 9.8, Critical severity: in the Kubernetes ingress-nginx provider, a crafted Host header with a non-numeric or empty port sends requests straight to protected backends with every annotation-derived middleware removed, including authentication and source-IP allowlisting. Versions 2.11.57, 3.7.12, and 3.7.13 fix these flaws, depending on the affected branch. Teams running traefik in front of authenticated services should upgrade now.

Veeam's update for Backup and Replication fixes two serious flaws in the system organizations depend on to recover from ransomware and outages. CVE-2025-64393 has a CVSS score of 9.4, Critical severity. It lets a user with only the Backup Viewer role run arbitrary code as SYSTEM on the backup server, which turns a low-privilege, view-only account into full control of the backup infrastructure.

CVE-2026-58069 has a CVSS score of 8.3, High severity. It lets an authenticated Cloud Connect tenant read arbitrary files on the service provider host, which exposes provider data and other tenants' data to any customer account. Together, these flaws threaten backup integrity, and service providers running Cloud Connect face the most exposure.

VMware has released Workstation and Fusion 26H1u1 to fix two flaws that let an attacker inside a virtual machine run code on the host. Both flaws affect Workstation and Fusion 25H2 and 26H1. CVE-2026-59346 has a CVSS score of 9.3, Critical severity. It is an integer overflow in the VMXNET3 virtual network adapter. CVE-2026-59347 has a CVSS score of 8.1, High severity. It is a stack-based buffer overflow in HGFS that runs attacker code as the VM's VMX process on the host.

Both flaws require local administrative privileges inside a guest VM. Once attackers have that access, they can escape the VM and compromise the host. That breaks the isolation that development, testing, and security teams count on. Update all Workstation and Fusion installations to 26H1u1.

This WatchGuard Fireware OS update fixes 12 vulnerabilities across the firewall's VPN, authentication, management and packet-processing services. CVE-2026-86131 has a CVSS score of 9.2, Critical severity. It lets an attacker who controls a remote VPN server run arbitrary commands as root on a connecting Firebox through the BOVPN Over TLS client configuration. CVE-2026-81433 has a CVSS score of 8.7, High severity, and lets an unauthenticated attacker on an adjacent network execute code with a crafted DHCP packet. CVE-2026-18145 has a CVSS score of 8.6, High severity, and exposes the spamBlocker service to code execution by an authenticated administrator.

CVE-2026-86134 has a CVSS score of 8.7, High severity. CVE-2026-86128, CVE-2026-86132 and CVE-2026-86133 each have a CVSS score of 8.2, High severity. Together, these four flaws let remote attackers crash the login interface, NetFlow packet processing and the IKEv2 daemon. CVE-2026-13224 has a CVSS score of 8.2, High severity, and allows arbitrary file reads through the WebUI management agent. CVE-2026-13046 has a CVSS score of 7.5, High severity, and enables code execution in the SAML session service. CVE-2026-86101 has a CVSS score of 7.2, High severity, and grants unauthorized Mobile VPN with SSL access. CVE-2026-86136 and CVE-2026-90441 each have a CVSS score of 7.1, High severity, and let low-privileged accounts crash the wgagent daemon and read files.

Webmin, the web-based system administration tool for Unix-like servers, has a critical cross-site scripting flaw. CVE-2026-49243 has a CVSS score of 9.6, Critical severity. A Webmin user who clicks a malicious link pointing to their own server triggers the flaw, and the attacker can then run commands of their choosing on that server. Webmin manages core server functions, so one successful attack can hand an attacker administrative control of the system.

Webmin version 2.650 fixes this vulnerability. All earlier versions are affected. Upgrade every Webmin instance to version 2.650 or later.

WebPros has fixed two critical command injection flaws in ConfigServer Security & Firewall (CSF) in version 16.30. CVE-2026-65638 has a CVSS score of 9.2, Critical severity. Because CSF does not properly escape a request URL, an unauthenticated remote attacker can run any command as the CSF service account. CVE-2026-65639 has a CVSS score of 9.5, Critical severity. Its advanced-rule parser does not properly check rule data from feeds, so an attacker who controls a configured allow or deny feed can run commands as root.

Both flaws allow remote code execution on the system that is supposed to protect the server. They affect the original ConfigServer releases and any WebPros fork builds that still contain the vulnerable code. Other forks or independently maintained CSF builds may also be affected and need their own review. Upgrade to version 16.30 now.

This cPanel update fixes six vulnerabilities. Five are Critical and one is High, and several give an attacker full root control of the hosting server. CVE-2026-67401 has a CVSS score of 9.9, Critical severity. It lets a mail-enabled account run code as root through SQL injection in the EmailTrack component. CVE-2026-93698 has a CVSS score of 9.9, Critical severity. Weak input validation in the Multilang adminbin lets attackers run arbitrary commands. CVE-2026-87899 has a CVSS score of 9.4, Critical severity. It lets remote authenticated users run arbitrary code with root privileges.

CVE-2026-93029 and CVE-2026-93697 each have a CVSS score of 9.0, Critical severity. Both are stored cross-site scripting flaws that allow arbitrary code execution, one in the WHM Manage SSL Hosts interface and one in the WHM Mass Modify Accounts interface. CVE-2026-68490 has a CVSS score of 8.2, High severity. Incorrect permissions let local users read CalDAV and CardDAV data that belongs to other accounts. On a shared hosting server, one compromised account can expose every customer on it, so administrators should deploy this update the same day.

This Plesk update fixes three flaws that each give an attacker root-level control of the hosting server. CVE-2026-68487 has a CVSS score of 9.9, Critical severity. It is a path traversal flaw in the Backup Manager that lets an authenticated customer write any file as root. CVE-2026-68488 has a CVSS score of 9.9, Critical severity. It is a race condition that follows insecure symlinks, letting a local user take ownership of any file or directory and escalate to root.

CVE-2026-68492 has a CVSS score of 8.7, High severity. It is an untrusted search path flaw that lets remote authenticated users run arbitrary code as root through the Plesk RESTful API extension. It affects Plesk 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1, with RESTful API extension 2.4.2 before 2.4.7. On a shared hosting server, one compromised customer account can become full server takeover, which puts every hosted site and its data at risk. Apply the Plesk update on the same day.

WebPros has fixed an argument injection flaw in WP Toolkit for cPanel. CVE-2026-87900 has a CVSS score of 9.4, Critical severity. It affects version 6.11.2-10794 and earlier. A remote authenticated user can use it to read arbitrary files and execute arbitrary code across customer accounts.

The danger is in how far it reaches. On shared hosting, a single low-privilege account can cross into other customers' accounts and their WordPress sites. That puts data, site integrity, and tenant isolation at risk. Update WP Toolkit for cPanel to a fixed version the same day.

This Zammad update closes ten flaws in the open source helpdesk platform. Attackers can use them to take over accounts, run commands on the server, delete files, and forge trusted email. The worst flaw is CVE-2026-84458, which has a CVSS score of 9.1, Critical severity. When automatic account linking is on, an attacker who controls any identity at a configured single sign-on provider can log in as any user, administrators included, without that user's password. CVE-2026-84462 has a CVSS score of 8.6, High severity, and lets an administrator who can edit AI Agents run arbitrary commands on the Zammad server. CVE-2026-56733 has a CVSS score of 8.7, High severity, and lets an attacker create new administrator accounts despite token restrictions. CVE-2026-61525 has a CVSS score of 8.8, High severity, and lets a low-privilege user delete arbitrary files and directories through session path traversal. CVE-2026-56725 has a CVSS score of 8.7, High severity, and lets an unauthenticated attacker stall request workers and take a production instance offline.

The remaining flaws break access controls and trust signals. CVE-2026-56723, CVE-2026-56724, and CVE-2026-84464 each have a CVSS score of 7.1, High severity, and let users reach internal attachments, knowledge base items, and ticket, customer, and organization records outside their access scope. CVE-2026-56727 and CVE-2026-84465 each have a CVSS score of 7.1, High severity, and let attackers present tampered or forged PGP and S/MIME email as validly signed. The fixes ship in Zammad versions 7.0.2, 7.0.3, 7.1.0, 7.1.1, and 7.1.2.

This Zimbra Collaboration Suite (ZCS) update fixes four Critical vulnerabilities that let unauthenticated attackers take over user mailboxes or run commands on the server. CVE-2026-93641 has a CVSS score of 9.3, Critical severity, and CVE-2026-93642 has a CVSS score of 9.3, Critical severity. In both, an attacker forges a share notification that triggers stored cross-site scripting when a signed-in Zimbra Classic or Zimbra Modern user clicks Accept Share. CVE-2026-93647 has a CVSS score of 9.3, Critical severity. Here, an attacker places active markup in the From address of a calendar COUNTER message, and the script runs when a Zimbra Classic user selects the message. In each case, the attacker gains access to mailbox data and can act as the victim.

CVE-2026-93643 has a CVSS score of 9.8, Critical severity, and is the most serious flaw in this batch. When OnlyOffice/Document Editing is available, an unauthenticated remote attacker who can reach an existing public Briefcase document can abuse unsigned save fields to write files through path traversal and execute commands as the zimbra user. This turns a shared document into a foothold on the mail server itself.

Zohocorp has released build 7001 of ManageEngine ADSelfService Plus to fix two serious vulnerabilities in its self-service password management platform. CVE-2026-74849 has a CVSS score of 9.8, Critical severity. It is an OS command injection flaw in the GINA client that lets attackers execute code remotely. CVE-2026-75791 has a CVSS score of 8.6, High severity. It is an authentication bypass in the REST API caused by missing authentication on a critical function, and it allows elevation of privilege.

ADSelfService Plus connects directly to Active Directory, which makes it a high-value target. A successful attack can expose user credentials, account controls, and the wider domain. Every version before build 7001 is affected, so organizations should upgrade the same day.

This patch for ZohoCorp ManageEngine Applications Manager fixes two vulnerabilities in versions 182200 and below. CVE-2026-86708 has a CVSS score of 10.0, Critical severity. The Applications Manager installer exposes a Google Cloud service-account private key. An unauthenticated attacker can use that key to impersonate the service account and access or modify the cloud resources tied to it.

CVE-2026-86681 has a CVSS score of 7.6, High severity. A permissions validation flaw lets low-privileged users run administrator-configured MBean actions on monitors outside their assigned scope, which gives them elevated control. Together, these flaws expose both the monitoring platform and the cloud resources it connects to. Apply this update now.

This ManageEngine OpManager update fixes six vulnerabilities. One is Critical and five are High. The most severe, CVE-2026-19599, has a CVSS score of 9.9, Critical severity. It is a remote code execution flaw in the Notification Profile module of OpManager MSP. Two more flaws also lead to code execution. CVE-2026-76978 has a CVSS score of 8.8, High severity, and is a command injection flaw in the Diagnose Settings feature. CVE-2026-12370 has a CVSS score of 7.6, High severity, and is a server-side template injection flaw in Configlet processing.

The other three flaws give attackers more access than they should have. CVE-2026-75825 has a CVSS score of 8.8, High severity. It is an authentication bypass when the Application Manager Plugin is enabled. CVE-2026-84787 has a CVSS score of 8.1, High severity. It lets an authenticated low-privilege user gain Administrator rights through Report Profile import. CVE-2026-15358 has a CVSS score of 7.5, High severity, and is an unauthorized path traversal flaw. Some of these flaws also affect NetFlow Analyzer, Network Configuration Manager and Firewall Analyzer. Because OpManager has broad access to the network, an attacker who takes control of it gains a strong position to attack everything it manages.

This n8n update fixes eight flaws in the workflow automation platform: two Critical and six High. CVE-2026-103248 has a CVSS score of 9.0, Critical severity. It is a filter injection flaw in the Supabase node that lets attackers read, update, or delete entire tables in a single request. CVE-2026-103255 has a CVSS score of 9.0, Critical severity. It is a path traversal flaw in the Supabase node that uses the administrative serviceRole key to bypass Row Level Security. CVE-2026-86076 has a CVSS score of 8.7, High severity, and CVE-2026-83083's companion flaw CVE-2026-86083 has a CVSS score of 7.7, High severity. Both are code injection flaws in the expression engine that enable remote code execution on the backend.

The remaining High severity flaws expose credentials and access controls. CVE-2026-103257 has a CVSS score of 7.7, High severity, and lets crafted resource IDs reach workflows, executions, and credential secrets. CVE-2026-103259 has a CVSS score of 7.6, High severity, and leaks collaborators' session tokens through Dynamic Credentials endpoints. CVE-2026-103251 has a CVSS score of 7.1, High severity, and lets attackers with Redis write access install arbitrary npm packages across queue-mode clusters. CVE-2026-103256 has a CVSS score of 7.1, High severity, and sends Wekan and Baserow passwords to attacker-chosen hosts. Fixed releases are 1.123.80, 2.39.6, and 2.40.1.

This WHMCS update fixes a critical deserialization flaw that lets remote attackers execute arbitrary code on the server. CVE-2026-67399 has a CVSS score of 9.3, Critical severity. WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 are affected, and the fixed releases close the gap.

WHMCS runs billing, client management, and provisioning for hosting providers, so a compromise exposes customer records, payment workflows, and connected server infrastructure. Upgrade to 9.0.8 or 8.13.7 without delay.

This Windows 11 version 23H2 update fixes 22 High severity vulnerabilities. Most of them allow remote code execution, elevation of privilege, or both. Use-after-free memory flaws make up the largest group, and the rest include heap and stack overflows, a double free, an out-of-bounds read, null pointer dereferences, link-following and file-path control flaws, and a missing authentication check. Attackers are actively exploiting CVE-2026-81963, an elevation of privilege flaw that lets an attacker gain higher-level control of the system.

CVE-2026-69740 and CVE-2026-72940 have a CVSS score of 8.8, High severity. CVE-2026-72936 has a CVSS score of 8.1, High severity. CVE-2026-69322 has a CVSS score of 8.0, High severity. CVE-2026-69392, CVE-2026-69447, CVE-2026-69528, CVE-2026-70569, CVE-2026-81963, and CVE-2026-83990 have a CVSS score of 7.8, High severity. CVE-2026-69587, CVE-2026-69599, and CVE-2026-72949 have a CVSS score of 7.5, High severity. CVE-2026-69536, CVE-2026-69597, and CVE-2026-69775 have a CVSS score of 7.1, High severity. CVE-2026-68825, CVE-2026-69300, CVE-2026-69379, CVE-2026-69383, CVE-2026-69606, and CVE-2026-69814 have a CVSS score of 7.0, High severity.

This update closes 62 vulnerabilities in Microsoft 365 Apps for Enterprise, one Critical and 61 High. In 61 of them, an attacker can run code remotely, and 11 can raise an attacker's privileges. Most are memory-corruption flaws: heap and stack buffer overflows, use-after-free, double free, and integer overflow. A single crafted file can give an attacker control of the user's machine. Because Office runs on almost every corporate endpoint, this batch has a large attack surface.

CVE-2026-78509 has a CVSS score of 9.8, Critical severity. CVE-2026-69285, CVE-2026-69442, CVE-2026-69529, CVE-2026-69556, CVE-2026-69614, CVE-2026-69629, CVE-2026-69632, CVE-2026-69671, CVE-2026-69678, CVE-2026-69686, CVE-2026-69722, CVE-2026-69742, CVE-2026-69759, CVE-2026-69764, CVE-2026-69767, CVE-2026-69778, CVE-2026-69797, CVE-2026-70125, CVE-2026-72972, CVE-2026-72973, CVE-2026-77901, CVE-2026-78504, CVE-2026-78505, CVE-2026-78507, CVE-2026-78511, CVE-2026-78512, CVE-2026-78514, CVE-2026-78517, CVE-2026-78518, CVE-2026-78521, CVE-2026-78524, CVE-2026-78525, CVE-2026-78526, CVE-2026-80080, CVE-2026-80081, CVE-2026-80085, CVE-2026-81385, CVE-2026-81952, and CVE-2026-81955 each have a CVSS score of 8.8, High severity. CVE-2026-78510 has a CVSS score of 8.4, High severity. CVE-2026-62804, CVE-2026-81386, CVE-2026-81388, CVE-2026-81396, CVE-2026-81397, CVE-2026-81398, CVE-2026-81947, CVE-2026-81948, CVE-2026-81949, CVE-2026-81950, CVE-2026-81951, CVE-2026-81953, CVE-2026-81954, CVE-2026-81956, CVE-2026-81957, CVE-2026-81959, and CVE-2026-81960 each have a CVSS score of 7.8, High severity. CVE-2026-100208 and CVE-2026-77898 each have a CVSS score of 7.5, High severity. CVE-2026-69477 has a CVSS score of 7.3, High severity. CVE-2026-81389 has a CVSS score of 7.0, High severity.

This update fixes five vulnerabilities in Microsoft Exchange Server 2016 Cumulative Update 23. Two are Critical: CVE-2026-69356 has a CVSS score of 9.3, Critical severity, and is a cross-site scripting flaw. CVE-2026-69641 has a CVSS score of 9.1, Critical severity, and is a missing authorization flaw that enables elevation of privilege. The other three are High severity, and all three enable elevation of privilege. CVE-2026-69355 has a CVSS score of 8.8, High severity, and comes from external control of a file name or path. CVE-2026-69380 has a CVSS score of 8.1, High severity, and comes from missing authorization. CVE-2026-96940 has a CVSS score of 8.8, High severity, and comes from weak authentication.

Four of the five flaws let an attacker raise their privileges on the mail server, and the Critical cross-site scripting flaw puts user sessions at risk. Exchange holds an organization's email, calendars, and identity data, so a breach here exposes the core of business communication. Apply this update to every Exchange Server 2016 CU23 system on a same-day schedule.

This update for Microsoft SQL Server 2017 (CU 31) fixes 21 vulnerabilities. Sixteen of them enable remote code execution, and seven enable elevation of privilege. Two flaws enable both. Most stem from heap-based buffer overflows. The rest come from integer overflows, use-after-free errors, link-following flaws and improper access control. An attacker who exploits these flaws can run code on the database server or gain higher privileges, which puts business-critical data and connected applications at risk.

CVE-2026-67631 has a CVSS score of 9.8, Critical severity. CVE-2026-66818, CVE-2026-67368, CVE-2026-67380, CVE-2026-67381, CVE-2026-67384, CVE-2026-67385, CVE-2026-67388, CVE-2026-67639, CVE-2026-68775, CVE-2026-68786, CVE-2026-73028, CVE-2026-77481, CVE-2026-77482, CVE-2026-77483, CVE-2026-77486, CVE-2026-77487 and CVE-2026-78442 each have a CVSS score of 8.8, High severity. CVE-2026-68787 has a CVSS score of 7.8, High severity. CVE-2026-67376 has a CVSS score of 7.5, High severity. CVE-2026-77485 has a CVSS score of 7.0, High severity.

This Microsoft SQL Server 2019 (CU 32) update fixes five vulnerabilities, including two Critical and three High severity flaws. Four of them allow remote code execution. The flaws include unsafe deserialization of untrusted data, an untrusted pointer dereference, a stack-based buffer overflow, and an out-of-bounds read. Together they expose the database engine that business-critical applications depend on.

CVE-2026-67378 has a CVSS score of 9.0, Critical severity. CVE-2026-67636 has a CVSS score of 9.0, Critical severity, and enables remote code execution through an out-of-bounds read. CVE-2026-77484 has a CVSS score of 8.8, High severity, and CVE-2026-47297 has a CVSS score of 8.1, High severity; both enable remote code execution through unsafe deserialization. CVE-2026-67379 has a CVSS score of 8.5, High severity, and enables remote code execution through a stack-based buffer overflow. Apply this update to every SQL Server 2019 instance on a same-day timeline.

This update fixes two remote code execution vulnerabilities in Microsoft SQL Server 2022 (CU 26). Both flaws are heap-based buffer overflows that let an attacker run code on the database server. CVE-2026-67643 has a CVSS score of 9.8, Critical severity. CVE-2026-78456 has a CVSS score of 8.8, High severity.

SQL Server often holds an organization's most sensitive data and connects to core business applications. A successful attack can expose or change that data, disrupt operations, and give the attacker a foothold to move further into the network. Patch every affected SQL Server 2022 instance today.

Microsoft has released a security update for SQL Server Management Studio 22 that fixes CVE-2026-65669. CVE-2026-65669 has a CVSS score of 9.6, Critical severity. SQL Server Management Studio is the main tool administrators use to manage SQL Server databases. A Critical flaw here puts business data and database operations at risk. Organizations should deploy this update the same day on every workstation and server running SQL Server Management Studio 22.

Microsoft's Visual Studio Code update fixes two vulnerabilities, one Critical and one High. CVE-2026-81376 has a CVSS score of 9.6, Critical severity. It is a protection mechanism failure that lets attackers get around security controls built into the editor. CVE-2026-78461 has a CVSS score of 7.4, High severity. It is a path traversal flaw that allows elevation of privilege on the affected system.

Developer workstations hold source code, signing keys and cloud credentials, so these flaws put high-value assets at risk. Deploy the update to all Visual Studio Code installations on a same-day schedule.

This update fixes 50 vulnerabilities in Windows 10 Version 1809. One is Critical and 49 are High severity. Most are memory-corruption flaws: use-after-free conditions and heap- and stack-based buffer overflows. 47 of them allow remote code execution, and many also open a path to elevation of privilege. Three missing-authorization flaws allow privilege escalation without code execution. Together they give an attacker several ways to take over an unpatched system.

CVE-2026-73010 has a CVSS score of 9.8, Critical severity. CVE-2026-69386 has a CVSS score of 8.8, High severity. CVE-2026-72962 and CVE-2026-81354 each have a CVSS score of 8.2, High severity. CVE-2026-69530 and CVE-2026-78450 each have a CVSS score of 8.1, High severity. CVE-2026-69503, CVE-2026-69625, CVE-2026-69689, CVE-2026-69762, and CVE-2026-69875 each have a CVSS score of 8.0, High severity. CVE-2026-56172, CVE-2026-69377, CVE-2026-69436, CVE-2026-69459, CVE-2026-69513, CVE-2026-69790, CVE-2026-69801, CVE-2026-69822, and CVE-2026-83942 each have a CVSS score of 7.8, High severity. CVE-2026-69397, CVE-2026-69429, CVE-2026-69443, CVE-2026-69881, CVE-2026-69890, and CVE-2026-73017 each have a CVSS score of 7.5, High severity. CVE-2026-69460, CVE-2026-69553, CVE-2026-69602, and CVE-2026-69757 each have a CVSS score of 7.1, High severity. CVE-2026-69279, CVE-2026-69281, CVE-2026-69388, CVE-2026-69398, CVE-2026-69498, CVE-2026-69516, CVE-2026-69517, CVE-2026-69540, CVE-2026-69549, CVE-2026-69574, CVE-2026-69682, CVE-2026-69708, CVE-2026-69791, CVE-2026-69866, CVE-2026-69889, CVE-2026-70577, CVE-2026-72952, CVE-2026-73003, CVE-2026-73022, and CVE-2026-80093 each have a CVSS score of 7.0, High severity.

This Windows Server 2012 update fixes four use-after-free vulnerabilities (CWE-416). Each one enables remote code execution and elevation of privilege, so an attacker can run code on the server and take over the system. CVE-2026-69595 has a CVSS score of 9.8, Critical severity. CVE-2026-78445 has a CVSS score of 9.8, Critical severity. CVE-2026-69712 has a CVSS score of 8.8, High severity. CVE-2026-70585 has a CVSS score of 7.0, High severity.

Two Critical and two High severity flaws in the same server platform make this a same-day priority. Each server that stays unpatched is an easy way for an attacker to move deeper into the network.