Cisco patched critical CVE-2026-76471, a flaw in NX-API affecting certain Nexus switches and UCS 6300 fabric interconnects. Exploitation can enable root-level code execution or device reloads; exposure depends on access and platform configuration.
Researchers reported active exploitation of two AhsayCBS flaws, affecting versions through 10.3.4 at disclosure. Chained, unauthenticated attacks can give SYSTEM access; observed activity included web shells and cryptomining.
Attackers reportedly began exploiting CVE-2026-21589 two days after public PoC code appeared. The unauthenticated path-traversal flaw affects self-hosted Atlassian Data Center products; Atlassian Cloud is not affected.
SonicWall issued hotfixes for four SMA1000 vulnerabilities, including an unauthenticated SSRF flaw that can let remote attackers make appliances reach internal functionality. The company reported no evidence of exploitation.
Citrix says attackers are exploiting CVE-2026-88779 in SAML-enabled NetScaler deployments. The flaw can cause authentication-service crashes and outages; affected systems need the October 3 updates.
Dell released CSM 1.18.0 to fix six critical vulnerabilities. Two unauthenticated flaws could enable network-reachable attackers to obtain storage administrator credentials or gain administrative access to connected resources.
Fortinet reported active exploitation of CVE-2026-104286, an unauthenticated FortiMail file-write flaw that may enable code execution. Patches were pending for affected 7.4, 7.6, and 8.0 deployments; Fortinet published indicators and mitigations.
CVE-2026-65660 enables remote code execution on vulnerable on-premises SharePoint servers. Exploitation attempts followed public PoC release; Microsoft updates address the flaw, and researchers demonstrated a separate chain that can remove the authentication requirement
Cisco says attackers are exploiting CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager that can grant administrator-level API access. On-premises users should apply the update; Cisco-managed cloud users have received the fix.
Microsoft reported at least 13 Star Blizzard campaigns affecting more than 100 organizations in 2026. The activity used conversation-based phishing and password-protected archives to deliver RedFlick and, in at least one incident, the CosmicPulse backdoor.
Citrix disclosed eight NetScaler flaws, including two remotely exploitable vulnerabilities used before patches were available. CISA added both to its KEV catalogue; organizations should patch and assess exposed appliances for compromise.
Canada’s cybersecurity centre reported active exploitation of CVE-2026-48842, a pre-authentication SQL injection flaw in Roundcube’s optional virtuser_query plugin. Versions before 1.6.16 or 1.7.1 are affected; updating or disabling the plugin mitigates exposure.
WordPress 7.1.1 fixes 11 vulnerabilities, including two attack paths that can lead to PHP code execution by abusing an administrator’s existing session. Upgrade to 7.1.1 or later and review administrative workflows.
Researchers observed reconnaissance and exploitation attempts targeting unauthenticated WordPress path traversal CVE-2026-87902 shortly after the September 22, 2026, release of version 7.1.2. Affected deployments should be updated and investigated.
F5 reports active exploitation of CVE-2026-94127, a heap-based buffer overflow enabling unauthenticated RCE on specifically configured BIG-IP APM virtual servers. Hotfixes are available; F5 also provides an iRule mitigation.
Helpfeel disclosed that an attacker exploited Gyazo's image upload server on September 11, accessing about 23.62 million user records and 490 million image metadata records. The vulnerable path was fixed the next day.
CVE-2026-44756 is a critical SAP Extended Passport memory-corruption flaw reachable through HTTP(S), SAP GUI, and RFC. SAP released fixes; researchers report exploitation can enable OS command execution on affected hosts.
Researchers observed attempts to exploit WSO2 CVE-2026-5430, an authentication bypass that can grant administrative access. Fixes were released in May 2026; exposed deployments should be patched and reviewed for unauthorized activity.
Cisco patched an actively exploited authentication bypass in ISE and ISE-PIC that allows unauthenticated remote access to a management API and may enable root-level command execution. Upgrade to a fixed release and restrict management access.
Cisco confirmed active exploitation of a critical SQL injection in Secure Email Gateway that can give attackers unauthenticated root access via crafted email. Fixed AsyncOS releases are available; Cisco also provided investigation guidance.
Researchers recorded 807 sessions and about 32,000 events targeting exposed Vite servers in August 2026. The activity attempted to retrieve sensitive files through CVE-2026-39364, fixed in Vite 7.3.2 and 8.0.5.
Check Point disclosed and began patching two CVSS 9.8 flaws in VPN certificate processing affecting Quantum Security Gateway, Security Management Server, and Spark Firewall products. The flaws may allow code execution under specific conditions.
GitLab patched critical unauthenticated path traversal flaw CVE-2026-85706 in self-managed CE and EE; researchers reported internet-wide probing beginning September 11. Exposed files may include credentials and tokens.
CISA added N-able N-central flaw CVE-2026-86218 to its Known Exploited Vulnerabilities catalog. N-able issued a hotfix for affected self-hosted deployments; hosted deployments received vendor-applied remediation.