Critical Splunk Enterprise Flaw Lets Attackers Run Commands on Search Head Clusters Without a Login
Splunk has fixed CVE-2026-76268, a critical (CVSS 9.8) flaw that lets anyone who can reach the Patroni REST API on a Splunk Enterprise search head cluster member run operating system commands without logging in. It is one of three critical issues in this month's Splunk Enterprise release, alongside more than a dozen authenticated flaws and fixes for MCP Server and the AWS Add-on. Upgrade to 10.4.3, 10.2.7, 10.0.10, or 9.4.15.
read article
SonicWall has patched CVE-2026-102255, a maximum-severity (CVSS 10.0) flaw in SMA1000 remote access gateways that needs no login to exploit, and honeypots recorded attack attempts within three days of the fix. Appliances patched for September's zero-days are still vulnerable. Upgrade to 12.4.3-03670 or 12.5.0-03082 or later.
Cisco has patched five critical (CVSS 9.8) flaws in NX-OS that let an unauthenticated attacker run code as root on Nexus 3000 and 9000 switches, or crash them, with a single crafted packet or HTTP request. Exposure depends on whether NX-API, NGOAM, or MPLS OAM is enabled. No exploitation has been reported yet. Check your features, then upgrade.
ASUS has patched two router flaws, CVE-2026-14157 (CVSS 9.4) and CVE-2026-13313 (CVSS 8.9), that let anyone with access to the router's admin page run commands on the device, one through a poisoned VPN configuration file and one by switching on a leftover debug path to Telnet with root access. No exploitation has been reported yet. Update the firmware, lock down the admin interface, and check for Telnet.
Two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772 (nicknamed "PitScaler"), were exploited for weeks before Citrix disclosed them on September 27, 2026. One affects every NetScaler ADC and Gateway in its default configuration. Attackers have gained root, deployed custom web shells, and tunnelled into internal networks. Patch now, and check for compromise before you do.
CVE-2026-86950 is an out-of-bounds write in Apple's CoreGraphics framework, already used in an "extremely sophisticated" targeted attack before Apple shipped a patch on September 28, 2026. A public proof-of-concept now exists, and CISA has added it to the KEV catalog. Update every affected iPhone, iPad, and Mac now.
CVE-2026-86296 is a maximum-severity stack buffer overflow in the DHCP server of D-Link's DIR-822A router. A public proof-of-concept exists, no patch is available, and D-Link is still deciding whether one is "appropriate" for a model line its own records list as end-of-life. Find these routers and plan to replace them.
Attackers are exploiting CVE-2026-76504, a critical (CVSS 9.8) authentication bypass in Cisco Catalyst SD-WAN Manager, to gain admin access without a password. Every deployment is affected regardless of configuration, there is no workaround, and CISA has given federal agencies until October 3 to patch. It is the fifth exploited Cisco SD-WAN zero-day of 2026. Check for compromise, then upgrade.
Click2Shell is a WordPress Core flaw, fixed in 7.1.1, that lets a single crafted link, opened by a logged-in administrator, silently install a theme from the WordPress.org catalog. Chained with an insecure theme, it reaches PHP code execution on the server. No CVE is assigned yet and there is no confirmed exploitation, but a full public proof-of-concept is available. Update now.
CISA added three actively exploited Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026, with a remediation deadline of September 21. The flaws touch kernel TLS, netfilter bridge rules, and the kernel's cryptographic socket interface, and agencies must also investigate for signs of prior compromise, not just patch.
CVE-2026-91843 is a critical stack-based buffer overflow in the login process of Check Point Security Management and Log Servers, letting an unauthenticated attacker run code as root. No public PoC and no known exploitation as of writing, but it is the fifth critical management-reachable Check Point flaw since July. Patch via LivePatch now.
Cisco disclosed two maximum-severity, actively exploited zero-days within a day of each other in mid-September 2026. CVE-2026-76461 (CVSS 9.8) lets an attacker take root on Secure Email Gateway with a single crafted email. CVE-2026-76460 (CVSS 10.0) lets an attacker bypass authentication entirely on Identity Services Engine. Both are unauthenticated, both are confirmed under active attack, and both belong on your patch list today.
CVE-2026-85706 is a maximum-severity path traversal flaw in GitLab's repository commits API, carrying a CVSS score of 10.0. Attackers require no authentication, exploitation was observed within a day of disclosure, and CISA has confirmed active exploitation. Patch immediately.
Check Point has patched two critical flaws in its VPN certificate handling, CVE-2026-85102 and CVE-2026-85103, both rated 9.8. Check Point found them internally and says there is no evidence of exploitation, but the Dutch NCSC is warning that exploitation attempts should be expected soon. Patch now, or apply the interim mitigation if you cannot.
CVE-2026-73299 is a maximum-severity (CVSS 10.0) remote code execution flaw in the TypeScript renderer for Microsoft's Prompty prompt format. Any application that renders an untrusted .prompty file with an affected version can be made to run arbitrary code on the host. A patch is available; here's what to check and what to do.
Microsoft's September 2026 Patch Tuesday is the largest security release in the company's history, addressing roughly 973 vulnerabilities, 113 of them Critical, including two zero-days already exploited in the wild. Here's what matters and what to prioritize.
CVE-2025-25249 is a critical heap-based buffer overflow in FortiOS and FortiSwitchManager, patched by Fortinet in January 2026. Eight months later, a financially motivated threat actor is actively exploiting unpatched devices to install PivotC2, a custom-built remote access trojan, across more than 30,000 targeted FortiGate firewalls.
MikroTrick is a chain of MikroTik RouterOS vulnerabilities, CVE-2026-67276 and CVE-2026-86060, that lets an attacker take full administrative control of a router with no authentication at all, provided its SSH service is reachable from the internet. CERT Polska has confirmed active exploitation since at least September 2, 2026. Patch immediately, or lock down SSH now.
HardBreacher is a public proof-of-concept targeting an unconfirmed local privilege escalation flaw in Kaspersky Endpoint Security for Windows. No CVE has been assigned, and Kaspersky says the underlying issue is already resolved through its automatic database update mechanism. Here's what that means, and what your team should still verify.
SonicWall has confirmed active exploitation of two new zero-day vulnerabilities in its SMA 1000 series remote access appliances, CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 (CVSS 7.8). This is the third SMA 1000 zero-day incident in under a year. There is no workaround; patch now.
CVE-2026-69836 is a maximum-severity (CVSS 10.0) remote code execution flaw in Microsoft Entra ID, exploited in the wild before Microsoft disclosed and fully patched it server-side on August 20, 2026. No customer action is required to fix it, but the exploitation window means a log review is worth your time.
CVE-2026-59310 is a critical directory-traversal flaw in VMware vCenter's Syslog server that lets an unauthenticated attacker execute code with system privileges. A suspected China-nexus APT began exploiting it five days after disclosure, compromising 361 systems across 47 countries and, on at least one host, deploying Babuk-derived ransomware on ESXi. No workaround exists; patch now.
Flooding Dropper is a malicious package campaign, not a vulnerability, that has published nearly 850 packages to npm and is still growing. Packages load through 'require()' rather than install-time hooks, then drop a cross-platform RAT and infostealer onto Windows, macOS, and Linux hosts. If any of these packages touched your environment, the fix is not "update to a new version," it is "treat the host as compromised."
ShieldBreak is an unpatched proof-of-concept from researcher Nightmare Eclipse claiming a full bypass of Microsoft's patch for the Defender flaw RoguePlanet (CVE-2026-50656). No CVE has been assigned yet, no patch exists, and independent researchers have confirmed it works on fully updated Windows 11 and Windows Server 2025.
Januscape (CVE-2026-53359) is a 16-year-old use-after-free in the Linux kernel's KVM shadow MMU that lets a guest virtual machine crash or, in the worst case, take over the host it runs on. It is the first guest-to-host KVM escape shown to work on both Intel and AMD hardware, and it was already used as a zero-day in Google's kvmCTF program before disclosure.
CVE-2026-20230 is an unauthenticated SSRF vulnerability in Cisco Unified Communications Manager's WebDialer service that attackers are now chaining into arbitrary file writes and root-level webshells. Active exploitation was confirmed in June 2026, and the flaw has since been added to CISA's Known Exploited Vulnerabilities catalog. Patch now, or disable WebDialer if you cannot.
CVE-2026-20245 is a root-level command injection flaw in Cisco Catalyst SD-WAN Manager, Controller, and Validator. Mandiant has confirmed it was exploited as a zero-day for months before Cisco disclosed it, as part of an attack chain that also leveraged two earlier, maximum-severity SD-WAN authentication bypass flaws. Patch now; no workaround exists.
DirtyClone (CVE-2026-43503) is the fourth Linux kernel privilege escalation in a family that began with Copy Fail in April. It lets any local user gain root by manipulating cloned network packets, with no trace left on disk or in the logs. A patch has existed since May 24; a public proof of concept arrived June 25.
CVE-2026-55200 is a critical integer overflow in libssh2 that allows a remote attacker to corrupt heap memory and execute arbitrary code, with no authentication required. A public proof-of-concept is available and CISA has updated its assessment to reflect PoC-stage exploitation. A patch exists as a committed fix but no official release has been tagged yet; check your distribution's package repository for backported updates now.
PixelSmash (CVE-2026-8461) is a heap out-of-bounds write in FFmpeg's MagicYUV decoder. A 50 KB video file is enough to crash any application that links FFmpeg, and researchers demonstrated full remote code execution against Jellyfin and Nextcloud. Patch to the latest FFmpeg now.
AryStinger is a newly discovered botnet that has quietly compromised more than 4,300 end-of-life routers by exploiting decade-old vulnerabilities. With no patches available for these devices, the only reliable fix is replacement. If you have legacy networking equipment still connected to the internet, this campaign is a direct illustration of the risk it poses.
F5 issued an out-of-band advisory on June 17, 2026 for two critical NGINX vulnerabilities, CVE-2026-42530 and CVE-2026-42055. Neither has been confirmed exploited in the wild yet, but NGINX Rift went from advisory to active exploitation in days last month. Patch now, or apply the interim mitigations immediately.
FortiBleed is a large-scale, financially motivated campaign that has targeted more than 430,000 FortiGate firewalls since February 2026, using a custom sniffer to harvest over 110 million credentials. CISA has issued a hardening advisory; here's what happened and what to do about it.
usbliter8 is a hardware flaw in the USB controller built into Apple's A12 and A13 chips. Because the bug lives in silicon, not software, it cannot be patched, and a public proof-of-concept exploit is already available. Here is what it means, who is affected, and what you can actually do about it.
CVE-2026-48907 is a maximum-severity, unauthenticated remote code execution flaw in the JCE (Joomla Content Editor) extension, one of the most widely installed editors in the Joomla ecosystem. Active exploitation is confirmed, CISA has added it to its KEV catalog, and even the official Joomla project sites were taken offline by it. Patch to the most current JCE now.
Three critical FortiSandbox vulnerabilities (CVE-2026-39808, CVE-2026-39813, CVE-2026-25089) are under active exploitation. All three allow unauthenticated attackers to run commands or bypass authentication, and FortiSandbox is the system other Fortinet products trust to decide what's safe. Patch now.
CVE-2026-5027 is a high-severity path traversal flaw in the Langflow AI development platform that allows unauthenticated attackers to write files anywhere on an exposed server, with remote code execution already confirmed in the wild. Upgrade to version 1.10.0 immediately.
RoguePlanet (CVE-2026-50656) is an unpatched race condition in Microsoft Defender that grants SYSTEM-level access on fully patched Windows 10 and 11 machines. Released by researcher Nightmare Eclipse hours after June 2026 Patch Tuesday, it is the seventh zero-day in an ongoing feud with Microsoft. No patch is available yet; here's what to do in the meantime.
CVE-2026-33829 is a patched NTLM credential leakage flaw in the Windows Snipping Tool's URI handler that can expose a user's NTLMv2 hash to an attacker with a single link click. A related primitive in Windows Search remains unpatched. Both are mitigated by blocking outbound SMB.
HTTP/2 Bomb (CVE-2026-49975) is a remote denial-of-service exploit that can crash major web servers - including NGINX, Apache, IIS, Envoy, and Cloudflare Pingora - in under a minute using a single home internet connection. Patches are available for NGINX and Apache. IIS and Envoy users should disable HTTP/2 or place a hard-limiting proxy in front while awaiting vendor fixes.
CVE-2026-41089 is a critical stack-based buffer overflow in Windows Netlogon with a CVSS score of 9.8. No authentication is required to exploit it, active exploitation of domain controllers has been confirmed in the wild, and there is no mitigation short of patching. Apply the May 2026 Patch Tuesday update now.
CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect that allows unauthenticated attackers to establish unauthorized VPN connections by forging authentication override cookies. Active exploitation was confirmed from May 17, with a second wave on May 21. CISA added it to KEV on May 29. Patch immediately, or disable authentication override cookies.
DirtyDecrypt (CVE-2026-31635) is a page-cache write primitive in the Linux kernel's rxgk subsystem affecting distros with CONFIG_RXGK enabled. Published alongside ssh-keysign-pwn (CVE-2026-46333), the pair add to a remarkable month for Linux kernel privilege escalation disclosures.
NGINX Rift (CVE-2026-42945) is an 18-year-old heap buffer overflow in the NGINX rewrite module with a CVSS score of 9.2. A public PoC is available and active exploitation was confirmed within three days of disclosure. Patch now, or reconfigure affected rewrite directives immediately.
A public proof-of-concept for BitUnlocker, a downgrade attack rooted in CVE-2025-48804, can defeat BitLocker on fully patched Windows 11 machines in under five minutes — because the patch alone was never enough.
Three Linux kernel local privilege escalation vulnerabilities in three weeks! Fragnesia (CVE-2026-46300) is a separate bug from Dirty Frag, but it shares the same mitigation, so if you already applied it then you are already covered until patches arrive.
A working proof-of-concept for a BitLocker bypass, called YellowKey, affecting Windows 11 and Windows Server 2022/2025 was published publicly this week with no patch available.
A second major Linux privilege escalation vulnerability was disclosed this week, days after Copy Fail, with a working public exploit already circulating. Here's what Dirty Frag means for your organization, in plain terms.
A critical memory corruption flaw in Apache HTTP Server's HTTP/2 implementation allows remote attackers to crash or fully compromise any server running version 2.4.66.
A newly disclosed Linux vulnerability lets any local user become root in under a second — no hacking experience required. Here's what that means for your organization, in plain terms.
Introducing the updated CrowdSOC blog — where we share threat intelligence insights, security operations best practices, and platform updates for the organizations we protect.
Ransomware groups have refined their targeting strategy. Smaller organizations with thinner security coverage and higher urgency to restore operations are increasingly in scope. Here is what the data shows and what you can do about it.
The updated Cybersecurity Framework brings new governance functions and an expanded scope. We break down the practical implications for county and municipal IT teams who need to do more with less.
Comprehensive security feels overwhelming when you're short on budget and staff. The data is clear that focused foundational controls provide outsized protection. Start here.
The decisions made in the first few hours of an incident have an outsized impact on outcome. A practical, step-by-step guide for non-security teams facing a possible breach.
Understanding the business model behind modern ransomware groups helps organizations understand how they think about targeting — and how to make themselves a less attractive target.
Free tools, federal programs, and prioritization strategies for county and local government IT teams working to improve security posture without meaningful budget increases.
Insurance questionnaires are becoming de facto security frameworks for small businesses. Understanding what's really being asked — and what a policy will and won't cover — matters.