42
47
47
42
42
42
42
42
47
42
47
42
Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch
Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.
Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.
68
47
42
42
42
47
42
42
42
42
42
42
42
GitLab’s critical flaw is already drawing internet-wide probes
GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.
GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.
78
42
42
42
42
42
42
42
42
42
47
42
47
47
42