VulnHub

CISA has added a new vulnerability, identified as CVE-2026-85706, to its Known Exploited Vulnerabilities Catalog. This vulnerability affects both the GitLab Community Edition and the GitLab Enterprise Edition and allows for path traversal, which can be exploited by attackers to gain unauthorized access to sensitive files. Federal agencies are required to prioritize addressing this high-risk vulnerability under the Binding Operational Directive 26-04, which emphasizes rapid remediation of vulnerabilities that could allow total control over affected systems. Although this directive applies specifically to federal agencies, CISA encourages all organizations to adopt similar risk-based strategies to manage vulnerabilities. Organizations aware of other exploited vulnerabilities not listed in the catalog can submit them for potential inclusion.

Check Point has issued patches for two critical vulnerabilities tracked as CVE-2026-85102 and CVE-2026-85103. These vulnerabilities pose a significant risk as they could be exploited by attackers to execute code remotely, which could allow unauthorized access to affected systems. Organizations using Check Point's VPN solutions need to prioritize applying these patches to safeguard their networks. The potential for remote code execution means that if these vulnerabilities are exploited, attackers could gain control over sensitive data and systems, leading to serious security breaches. It’s crucial for users to stay informed and take action to mitigate the risks associated with these vulnerabilities.

A serious vulnerability, identified as CVE-2026-19490, has been found in NetScaler products that allows attackers to bypass authentication. This flaw has been actively exploited since at least September 3, raising concerns for organizations using affected systems. The vulnerability affects various versions of NetScaler and poses a significant risk as it could allow unauthorized access to sensitive information. Companies using NetScaler should prioritize patching their systems to mitigate potential breaches. The exploitation of this vulnerability highlights the ongoing risks associated with widely used network infrastructure.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities are identified as CVE-2026-67277, which involves missing authentication for critical functions, and CVE-2026-86060, which pertains to improper handling of command delimiters. These weaknesses could allow attackers to gain complete control over affected systems, posing significant risks to federal agencies and other organizations that use these routers. CISA emphasizes the importance of promptly addressing these vulnerabilities, especially for federal agencies under its Binding Operational Directive 26-04, which mandates prioritizing the remediation of high-risk vulnerabilities. Organizations are encouraged to adopt similar practices for their own security management.

A serious vulnerability has been identified in the Orthanc DICOM Server, affecting versions prior to 1.13.0. This flaw allows an authenticated remote attacker to exploit an integer overflow when the server decodes specially crafted PNG or JPEG images, potentially leading to a crash of the Orthanc process and causing a denial-of-service condition. The issue has been assigned CVE-2026-87020 and has a high severity score of 8.1 according to the CVSS metrics. Users of Orthanc DICOM Server worldwide, particularly in healthcare sectors, are at risk and are strongly urged to update to version 1.13.0 to mitigate the threat. No active exploitation of this vulnerability has been reported so far, but organizations should remain vigilant and take appropriate defensive measures.

AVEVA Pipeline Integrity Monitor has several vulnerabilities that could be exploited by attackers to gain unauthorized access to sensitive information or execute arbitrary code. The affected versions include those up to 2025_SP1_P1_build_7.1.9580.8513. If exploited, these vulnerabilities could allow attackers to decrypt sensitive project files, reverse engineer user passwords, and perform unauthorized read operations. AVEVA recommends that users of the affected software apply the 2025 SP1 P2 Security Update and migrate project files to mitigate these risks. This situation is particularly concerning as it affects critical infrastructure sectors and could have significant security implications for organizations worldwide.

ST Engineering iDirect has reported multiple vulnerabilities affecting its iQ-Series terminals, specifically the Evolution, 3315, and 9-Series models running versions 4.5.2.1 or earlier. These weaknesses could allow unauthorized access to sensitive device information and lead to denial-of-service conditions. Attackers could exploit these flaws to impersonate terminals on satellite networks, launch cross-site request forgery attacks, or escalate privileges due to inadequate authentication measures. Users are strongly advised to update their systems to version 4.5.3.0 or newer to mitigate these risks, while also implementing security best practices such as restricting access to management interfaces and monitoring for unusual activity.

NextGen Healthcare's Mirth Connect software has several serious vulnerabilities that could be exploited by attackers to extract sensitive data or disrupt services. Specifically, versions 4.7.1 and earlier are affected by SQL injection and XML external entity (XXE) flaws. These vulnerabilities could allow unauthorized users to execute arbitrary SQL commands, leading to the potential exposure of stored credentials and denial-of-service conditions. NextGen Healthcare has advised users to upgrade to version 4.7.2 or later to mitigate these risks. Given that Mirth Connect is widely used in the healthcare sector, these security issues pose a significant threat to patient data integrity and system availability.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified three serious vulnerabilities affecting products from Cisco, Citrix, and Fortinet. These vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, which means federal agencies are required to patch them by September 12, 2026. One of the vulnerabilities, CVE-2026-20079, has a maximum severity score of 10.0, indicating a critical risk. It's crucial for organizations using these products to prioritize these updates to protect against potential exploitation. Failure to address these vulnerabilities could lead to significant security breaches, putting sensitive data at risk.

Cisco has confirmed that a serious authentication bypass vulnerability, labeled CVE-2026-20079, exists in its Secure Firewall Management Center (FMC) software. This flaw allows attackers to bypass authentication mechanisms, putting systems at risk of unauthorized access. Cisco has noted that this vulnerability is currently being exploited in active attacks, which raises significant concerns for organizations using their firewall management solutions. Users of Cisco's Secure FMC should take immediate action to protect their systems, as the potential for data breaches and unauthorized activities is heightened. The situation emphasizes the need for prompt updates and vigilance in cybersecurity practices.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that these flaws are currently being exploited in the wild. The vulnerabilities include a heap-based buffer overflow in Fortinet products (CVE-2025-25249), an authentication bypass in Citrix NetScaler (CVE-2026-19490), an out-of-bounds write in Google Chromium's V8 engine (CVE-2026-87491), and another authentication bypass affecting Cisco Firewall Management Center (CVE-2026-20079). These vulnerabilities pose significant risks, especially to federal agencies, which are urged to prioritize quick remediation efforts based on a directive from CISA. While the directive primarily affects federal entities, CISA encourages all organizations to adopt similar risk-based practices to address these vulnerabilities effectively. Organizations are also invited to report any exploited vulnerabilities not yet listed in the KEV Catalog for evaluation.

Google has released updates to address 230 security vulnerabilities in Chrome, including a medium-severity bug known as CVE-2026-87491. This vulnerability is an out-of-bounds issue in V8, the JavaScript and WebAssembly engine used by Chrome. Notably, it is currently being exploited in the wild, which raises concerns for users and organizations that rely on this browser. This kind of vulnerability could allow attackers to execute arbitrary code within the browser's sandbox environment, potentially leading to unauthorized access or data breaches. Users and administrators are strongly advised to update their Chrome installations to the latest version to mitigate this risk.

SAP has released urgent security updates to tackle several vulnerabilities, including one that poses a significant risk to its Extended Passport (EPP) Processing system. This vulnerability, identified as CVE-2026-44756, has a maximum severity score of 10.0, indicating it allows unauthenticated remote code execution due to memory corruption issues. If exploited, this flaw could severely compromise the confidentiality, integrity, and availability of the application, making it a critical concern for users. Companies using SAP solutions need to apply the patches immediately to protect their systems from potential attacks. As this vulnerability is serious, swift action is recommended to mitigate risks associated with it.