47
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.
50
42
Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch
Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.
Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.
68
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
NASA/JPL's AIT-GUI web console (CVSS 9.4) lacked authentication and CSRF protection, letting anyone send unauthenticated commands to spacecraft instruments; fixed in 2.5.2.
Cycode researchers found that AIT-GUI, the browser console of NASA/JPL's open-source AMMOS Instrument Toolkit, ran an HTTP server with no authentication, no session checks, and no CSRF protection on state-changing endpoints, allowing arbitrary commands to spacecraft instruments. The issue combines four weaknesses: binding to 0.0.0.0 regardless of configured host, missing authentication, missing CSRF defense, and path traversal in the /seq and /script/run endpoints. Tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, it is fixed in AIT-GUI 2.5.2. The findings came from AI-assisted code analysis confirmed with working proofs-of-concept, including a headless-browser CSRF demonstration.
46
Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root
Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.
Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.
72
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.
62
42
42
Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root
Two critical ArangoDB flaws (CVSS 9.8 and 9.9) enable unauthenticated API access and root code execution; fixes shipped in version 3.12.11
Remedio researchers found two ArangoDB flaws: GHSA-rrgq-978q-36mq (CVSS 9.8), an authentication bypass caused by the server inconsistently interpreting URL-encoded '/_api' paths, and GHSA-rvhw-4hpw-9vrx (CVSS 9.9), which lets users with database write access run JavaScript tasks with root privileges via the isSystem flag. Chained, they allow administrative database access without credentials, theft of the root password hash, and root code execution, exposing files such as /etc/shadow, TLS keys and cluster signing material on the official container image. ArangoDB shipped fixes in version 3.12.11 on August 31, 2026, with advisories published September 6; CVE identifiers were still pending. Users on 3.12.10.1 or earlier should upgrade, restrict exposure and rotate potentially exposed credentials.
60
CVE-2026-34908: UniFi OS Auth Bypass Vulnerability
Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.
CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.
55
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.
Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.
85
Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
CVE-2026-60004 is a CWE-94 code injection flaw in Gitea's POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, disclosed July 28, 2026 with a CVSS v3.1 score of 9.8 and credited to researcher Shai Rod (NightRang3r). An add/add collision with the three-way merge fallback (--3, Git 2.32+) writes attacker-controlled content into the temporary bare clone's hooks directory, where it executes as a live Git hook running commands as the Gitea OS user. Exploitation requires repository write access, but Gitea's default open registration allows anonymous users to obtain it, exposing app.ini secrets, database credentials, OAuth tokens, and mounted repositories; a public PoC requires no outbound callback. All releases from 1.17 through 1.27.0 are affected; the fix shipped in Gitea 1.27.1 on July 27, 2026, and Gitea Cloud instances were upgraded automatically.
55
42
42
60
47
47
42
47
Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access
WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.
WSO2 disclosed CVE-2026-5430, a critical authentication bypass (CVSS 10.0; 9.8 for single-tenant deployments) in advisory WSO2-2026-5328. The flaw stems from insecure JWT processing: tokens signed with unsupported algorithms bypass authentication checks, potentially granting unauthenticated attackers administrative access. Affected products include WSO2 API Control Plane 4.5.0-4.6.0, API Manager 4.1.0-4.6.0, Traffic Manager 4.5.0-4.6.0, and Universal Gateway 4.5.0-4.6.0. Fixes are available via update levels such as API Manager 4.6.0 update 21 or by migrating to unaffected releases.
65
We got admin access to Baseten's production GitHub in 25 minutes
Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.
Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.
58
AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions
Critical SSRF flaw in AWS SSM Agent (CVE-2026-89049) lets authenticated users bypass link-local denylists and reach EC2 Instance Metadata Service for IAM credentials.
CVE-2026-89049 (Critical, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) affects Amazon SSM Agent versions earlier than 3.3.4851.0, with the fix shipping in 3.3.4851.0. The remote-host port-forwarding feature's denylist for link-local addresses can be bypassed because equivalent address representations are not validated, enabling SSRF to restricted endpoints such as the EC2 Instance Metadata Service at 169.254.169.254. An attacker with authenticated AWS access and ssm:StartSession permission could retrieve instance profile IAM credentials and pivot to S3, Secrets Manager, Lambda, or other cloud resources depending on role permissions.
58
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.
Check Point disclosed and began patching two critical (CVSS 9.8) vulnerabilities in VPN certificate handling on September 9: CVE-2026-85102, a certificate trust validation failure in VPN negotiation on Security Gateways, and CVE-2026-85103, a heap-based buffer overflow in ASN.1 decoding affecting Quantum Security Gateways and Security Management Server. Affected branches include R81.20, R82, and R82.10 Jumbo Hotfix levels; fixes ship via Live Patch or the latest Jumbo Hotfix. The company found both internally and reports no evidence of exploitation; the Canadian Centre for Cyber Security also published an advisory listing Spark firewalls.
62
Microsoft Patch Tuesday, September 2026 Security Update Review
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
74
New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server
cPanel disclosed critical SQL injection CVE-2026-67401 in EmailTrack, letting authenticated users with mail privileges gain root code execution; patched builds available.
cPanel disclosed CVE-2026-67401 on September 8, 2026, a critical SQL injection in the EmailTrack feature that monitors email delivery and routing. An authenticated attacker holding a valid cPanel account with mail-related privileges can create arbitrary files and achieve code execution as root, enabling full compromise of hosting servers and exposure of co-tenant customers. All supported cPanel/WHM versions before specific patched builds (11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and 11.138.1.9 WP2) are affected; upgrading is the primary mitigation. No exploitation was reported at disclosure.
50
September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows
Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.
84
September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)
Microsoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including 113 critical and two Windows privilege-escalation flaws already exploited in the wild.
Microsoft patched 973 vulnerabilities this month, its largest Patch Tuesday ever and far above the previous record of 664 set in July 2026, with 113 rated critical. Two Important elevation-of-privilege flaws (CVSS 7.8) are confirmed exploited in the wild: CVE-2026-81963 in the Windows Update Stack (improper link resolution, affects Windows 11 and Server 2025) and CVE-2026-85880 in Windows ALPC (heap-based buffer overflow allowing sandbox escape to SYSTEM, affects Windows 10 and Server 2012-2022). Critical unauthenticated RCEs (CVSS 9.8) were also fixed in Skype for Business Server (CVE-2026-66302), Windows Message Queuing (CVE-2026-69579), and Windows RRAS (CVE-2026-69590). SANS urges prioritizing the two exploited EoP fixes, then patching exposed MSMQ, RRAS, and Skype for Business deployments.
78
WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
Researchers demonstrated a zero-click WeChat worm that hijacked accounts via incoming calls; Tencent blocked the exploit server-side after July disclosure, no real attacks reported.
Security firm Calif built a worm that seized WeChat accounts via incoming calls without any target interaction, demonstrating it spreading across three test phones (Android to iPhone to Android). Once exploited, the attacker gains full control of the WeChat account, including messages, calls, payments, and mini programs, though not the phone itself. Tencent mitigated the flaw server-side, confirmed blocked on 28 August, shipping WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August. No CVE has been assigned, Tencent published no advisory, and no attacks in the wild have been reported; WeChat/Weixin counts 1.439 billion monthly active users.
68
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
N-able shipped Hotfix 4 for a CVSS 10.0 unauthenticated RCE (CVE-2026-86218) in N-central RMM, with conflicting statements on exploitation.
N-able released 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a static code injection weakness (CWE-96) scored 10.0 on CVSS 4.0 that enables pre-authentication remote code execution on on-premises N-central RMM servers. Hosted NCOD instances are already patched; N-able's incident notice says the flaw was observed exploited in the wild while its release notes say exploitation is unconfirmed. Huntress, which has tracked N-central attacks since August, advises IP allowlisting, VPN-only access, or taking internet-reachable servers offline until patching. It is the fourth hotfix in five weeks, following fixes for CVE-2026-86206 and CVE-2026-86207, which CISA added to its Known Exploited Vulnerabilities catalog.
76
Cisco searched for IOS XR bugs and found so many it rolled them into an update release
Cisco patched three critical flaws, including CVE-2026-20212 unauthenticated remote root code execution in Nexus 9000 switches; no exploitation observed yet.
Cisco disclosed three critical-rated flaws found during a comprehensive internal security review. CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, affect the IOS XR carrier-grade operating system and are fixed in newly released versions. CVE-2026-20212 lets unauthenticated remote attackers execute code with root privileges on some Nexus 9000 Series Switches by reaching TCP ports 43210 and 43211 in the default Layer 3 VRF; no software fix exists yet, only infrastructure ACL mitigations. Cisco says it has not observed attacks against these flaws.
65
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.
Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.
78
Cisco Fixed Critical RCE in Nexus 9000 Series Switches
Cisco patched CVE-2026-20212 (CVSS 9.8) in Silicon One-based Nexus 9000 switches, allowing unauthenticated remote root code execution via TCP ports 43210/43211.
Cisco patched CVE-2026-20212 (CVSS 9.8), a flaw in the Silicon One integration for Nexus 9000 Series switches that lets unauthenticated remote attackers execute code with root privileges. TCP ports 43210 and 43211 are exposed through the default Layer 3 VRF, and exploitation can also crash the S1HAL process, forcing device reloads. Cisco TAC discovered the flaw during a support case; PSIRT is not aware of public disclosure or malicious exploitation. Workarounds include infrastructure ACLs or blocking the exposed ports, alongside a Live Protect shield pending fixed NX-OS upgrades.
64
Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability
Cisco patches unauthenticated RCE in Nexus 9000 Silicon One switches exposed via TCP ports 43210 and 43211 in the default L3 VRF.
Cisco disclosed and patched a vulnerability in the Silicon One integration for Nexus 9000 Series switches that allows an unauthenticated remote attacker to execute code with root privileges. The flaw stems from TCP ports 43210 and 43211 being accessible in the default Layer 3 VRF. Exploitation can also crash the S1HAL process and force an affected device to reload. Cisco has released software updates, and workarounds are available to mitigate exposure.
62
Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
Unisoc modem firmware flaw CWE-1189 allows VoLTE video call RCE chain to gain full Android kernel access on T606/T612/T7250 chipsets; no patch yet.
SSD Secure Disclosure published the second stage of an exploit chain, first disclosed in March 2026, that achieves full Android kernel access on Unisoc modem firmware via a VoLTE video call. The privilege-escalation flaw, classified as CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip), exploits shared physical memory between modem and application processor with no hardware boundary, letting modem code map the entire 32-bit address space and modify Android kernel pages via ARM Memory Protection Unit registers. Confirmed affected chipsets include Unisoc T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5), sold across more than 140 countries. No CVE has been assigned, the August 2026 Android Security Bulletin does not address it, and Unisoc has not responded to researchers; exploitation requires an attacker-controlled private 4G network and a victim answering the call.
75
Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery
Microsoft patches 419 vulnerabilities in record-breaking Patch Tuesday; Windows Winsock zero-day CVE-2026-68820 is actively exploited by Lazarus Group.
Microsoft's August Patch Tuesday fixes 419 vulnerabilities (62 critical, 357 important), among the largest monthly counts on record, following 206 fixes in June and 622 in July as AI-assisted discovery drives unprecedented volume. Three flaws are zero-days; Windows Winsock bug CVE-2026-68820 is exploited in the wild by Lazarus Group in job-themed attacks using PDFs with a trojanised reader. CVE-2026-62832, publicly disclosed by researcher Nightmare Eclipse via the LegacyHive PoC, is also patched. Microsoft now lists bugs by product family instead of itemized CVEs, which defenders warn complicates triage.
80
47
42
42
42