Vulnerabilities

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.

CVE-2026-87528 is a type confusion flaw (CWE-843) in Rust-based code in Google Chrome on Windows. A remote attacker can trigger it by persuading a user to open a crafted HTML page, causing incorrect type handling in memory. Successful exploitation potentially allows execution of arbitrary code outside the browser sandbox, meaning an attacker's code would run beyond Chrome's renderer-level containment. Users running Google Chrome on Windows prior to 153.0.8010.36 are affected; no other products or platforms are named in the advisory. No in-the-wild exploitation is currently known: the flaw is not in CISA's KEV, EPSS assigns a 0.2% 30-day exploitation probability, and while the CVSS base score is 9.6 (critical), the Chromium project itself rates the issue Medium; one public reference (Chromium issue 539569491) exists.

Do: Update Google Chrome on Windows to 153.0.8010.36 or later, verifying the installed version at chrome://settings/help or chrome://version. No workaround that prevents the type confusion is documented, so prioritize patching, especially for users who browse untrusted web content; note the vendor severity is Medium but the flaw can yield code execution outside the sandbox. Technical details may emerge at Chromium issue 539569491, worth monitoring for indicators or exploit development.

CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.

Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).

Do: Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected.

CVE-2026-20079 is an authentication bypass (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, caused by an improper system process created at boot time. An unauthenticated, remote attacker can exploit it by sending crafted HTTP requests to the FMC web interface, which allows the execution of script files and commands on the device. A successful exploit grants the attacker root access to the underlying operating system, giving full control of the management platform (CVSS 3.1: 10.0, network-exploitable, no privileges or user interaction required, scope changed). The flaw affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management deployments. Cisco has confirmed the vulnerability is being exploited in active attacks, it carries a 35.9% EPSS score (98th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.

Do: Upgrade FMC (and SCC Firewall Management tenants) to the fixed release specified in Cisco's advisory, prioritizing internet-exposed or externally reachable management interfaces; CISA KEV action applies to federal agencies under BOD 26-04. Until patching, restrict FMC web interface access to trusted management networks and VPNs and check devices for signs of exploitation such as unexpected script execution, unfamiliar processes, or root-level changes. Triage per CISA's Forensics Triage Requirements if compromise is suspected.

CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.

Do: Upgrade FortiOS, FortiSwitchManager, and FortiSASE in accordance with Fortinet's advisory (specific fixed versions are not listed in the available data), prioritizing internet-exposed FortiGate firewalls per CISA KEV and BOD 26-04 timelines. Hunt for signs of compromise, including custom Node.js malware and the PivotC2 RAT, on FortiGate devices, and review exposure and access logs for admin/SSL-VPN interfaces. If patching is not possible, apply vendor-recommended mitigations or, per BOD 26-04, discontinue use of the exposed product.