Search: “cve-2010-0806”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489

Canadian Cyber Centre alerts on Citrix NetScaler ADC/Gateway flaws CVE-2026-19490 (authentication bypass) and CVE-2026-19489 (buffer overflow), urging emergency patching.

The Canadian Centre for Cyber Security issued alert AL26-019 covering two Citrix NetScaler vulnerabilities disclosed in a vendor advisory on August 19, 2026. CVE-2026-19490 (CWE-288) allows a remote unauthenticated attacker to bypass authentication on appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. CVE-2026-19489 (CWE-120) is a classic buffer overflow that may cause memory overflow, unpredictable behavior, or denial-of-service conditions. Affected appliances are vulnerable when configured as a SAML IdP; fixed versions include 14.1-73.32, 13.1-63.21, and 13.1-37.277 for FIPS.

Canadian Centre for Cyber Security·Sep 4, 19:00 UTC · 12d agoAdvisory 3 sourcesCVE-2026-19490CVE-2026-19489

68

Microsoft Patch Tuesday for August 2026 Fixed a Zero

Microsoft's August 2026 Patch Tuesday fixes 398 CVEs, including an actively exploited WinSock zero-day CVE-2026-68820 and wormable DNS RCE CVE-2026-62878.

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, .NET and other products, with 62 rated Critical. The actively exploited CVE-2026-68820 is a use-after-free in the Windows WinSock afd.sys driver that can yield SYSTEM privileges via a race condition. CVE-2026-62878 is a critical, wormable stack buffer overflow in Windows DNS Server allowing unauthenticated, remote code execution without user interaction. Other notable fixes include WDS TFTP RCE CVE-2026-62893, a QUIC flaw affecting roughly 13.5 million sites (CVE-2026-62815), an Exchange authentication bypass EoP demonstrated at Pwn2Own Berlin (CVE-2026-62911), and two TPM 2.0 reference implementation fixes.

Security Affairs·Aug 12, 06:49 UTC · Aug 12, 2026Advisory in the wildCVE-2026-68820CVE-2026-62878CVE-2026-62893+5 CVEs

82

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)

Tenable reports Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including three zero-days, one exploited in the wild (CVE-2026-68820).

Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 important, and one moderate, and three zero-days among them. One zero-day is confirmed as exploited in the wild. The release covers components including .NET, .NET Framework, Active Directory Certificate Services (AD CS), Azure services, and Windows. Tenable's count omits two CVEs assigned by MITRE, CVE-2026-6726 and CVE-2026-6727.

Tenable Blog·Aug 11, 18:04 UTC · Aug 11, 2026Vulnerability in the wildCVE-2026-68820CVE-2026-6726CVE-2026-67271

77

CVE-2026-73749: HPE ArubaOS-CX RCE

HPE patched CVE-2026-73749, a critical unauthenticated remote code execution flaw in ArubaOS-CX network switch software; affected devices need prompt updates.

HPE released patches for CVE-2026-73749, a critical unauthenticated remote code execution vulnerability in HPE Aruba Networking AOS-CX switch operating system. Published details are limited, but the flaw allows unauthenticated attackers to execute code on affected AOS-CX devices. Administrators running ArubaOS-CX should prioritize applying HPE's update.

SOCRadar·Sep 4, 14:36 UTC · 12d agoVulnerabilityCVE-2026-73749

55

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 8d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

85

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

Unauthenticated attackers are actively exploiting GitLab CVE-2026-19478 (CVSS 9.4) to modify or delete public projects days after disclosure.

GitLab CVE-2026-19478, a CVSS 9.4 code injection flaw exploitable via a GraphQL directive without authentication, allows attackers to modify or delete publicly accessible projects, rewrite repository data, forge merge records, and ban maintainers. Affected versions include GitLab CE/EE 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. watchTowr reproduced the flaw within minutes of disclosure and observed in-the-wild exploitation against its honeypot network. Fixes shipped in 19.2.4, 19.1.6, 19.0.8, and 18.11.11; interim mitigations include restricting unauthenticated access to /api/graphql or removing public repository access.

The Hacker News·Aug 21, 07:04 UTC · 26d agoExploit / PoC in the wildCVE-2026-194781

84

Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.

Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-68820CVE-2026-62832CVE-2026-72971+6 CVEs1

82

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs details a pre-authentication remote code execution flaw, tracked as CVE-2026-8452, in Citrix NetScaler appliances.

watchTowr Labs published technical analysis of a pre-authentication remote code execution vulnerability in Citrix NetScaler, tentatively assigned CVE-2026-8452. The CVE identifier is marked as provisional in the write-up. No confirmation of in-the-wild exploitation is provided in the available text.

watchTowr Labs·Aug 14, 07:08 UTC · Aug 14, 2026Exploit / PoCCVE-2026-8452

62

SAP Patches Critical Extended Passport Processing Vulnerability

SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.

CVE-2026-44756 is a CVSS 10.0 memory corruption flaw in Extended Passport (EPP) deserialization, triggered when a user session opens across web, SAP GUI, and RFC vectors. Exploitation yields command execution as the SAP OS account, database credential and password hash recovery, session reading, and data or binary modification; affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, and BW/4HANA. Three other criticals were patched: CVE-2026-58240 (S4GET, missing authentication affecting all S/4HANA 2025 and earlier releases), CVE-2026-76969 (CAP credential disclosure), and CVE-2026-66768 (NetWeaver access control). Onapsis and SAP report no indicators of in-the-wild exploitation.

SecurityWeek·Sep 8, 14:55 UTC · 8d agoVulnerability 2 sourcesCVE-2026-44756CVE-2026-58240CVE-2026-76969+1 CVEs

80

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.

SonicWall disclosed on September 1, 2026 that CVE-2026-83548, a critical pre-authentication SSRF in the SMA1000 Appliance Work Place interface (CVSS 10.0), and CVE-2026-83549, an authenticated OS command injection in the Appliance Management Console, can be chained for unauthenticated remote code execution. Both vulnerabilities are confirmed exploited in the wild and were added to CISA's Known Exploited Vulnerabilities catalog. Affected SMA1000 models 6210, 7210 and 8200v on versions 12.4.3-03453 and 12.5.0-02835 platform-hotfix or earlier require upgrades to 12.4.3-03526 or 12.5.0-02952 platform-hotfixes.

Rapid7 Blog·Sep 2, 16:58 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

88

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

CVE-2026-19490 is a critical unauthenticated authentication bypass in Citrix NetScaler ADC and Gateway, remotely exploitable without user interaction.

An advisory published August 19, 2026 describes CVE-2026-19490, a critical authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw carries a CVSS v4.0 base score of 9.3 and is remotely exploitable by unauthenticated attackers over the network without user interaction or elevated privileges. NetScaler ADC and Gateway are widely deployed enterprise products positioned at or near the network perimeter, providing load balancing, SSL/TLS offloading, and secure remote access. The text does not state whether exploitation has been observed in the wild.

Rapid7 Blog·Aug 19, 16:46 UTC · 28d agoVulnerabilityCVE-2026-194901

72

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited zero-days: CVE-2026-85880, an ALPC heap buffer overflow, and CVE-2026-81963 in the Windows Update Stack, both CVSS 7.8 local privilege escalations. It also addresses an unauthenticated Exchange RCE (CVE-2026-55007) triggered by Visio attachment content indexing under memory pressure, an RDP use-after-free (CVE-2026-69525, CVSS 9.8), and 20 wormable flaws in DNS, DHCP, SMB, Active Directory, and other components. ZDI attributed the rising volume partly to AI-assisted vulnerability discovery, noting no corresponding spike in active exploits yet.

Security Affairs·Sep 9, 07:03 UTC · 7d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+3 CVEs2

88

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.

CSO Online·Sep 9, 03:27 UTC · 8d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-69730+2 CVEs1

84

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-586 reports a memory corruption RCE (CVE-2026-19886, CVSS 7.8) in OriginLab Origin Viewer OGM file parsing, needing user interaction.

The Zero Day Initiative published advisory ZDI-26-586 describing a memory corruption vulnerability in OriginLab Origin Viewer's OGM file parsing. Exploitation allows remote code execution when a user opens a malicious file or visits a crafted page. ZDI rated the issue CVSS 7.8 and assigned CVE-2026-19886.

ZDI Published Advisories·Aug 24, 05:00 UTC · 24d agoAdvisoryCVE-2026-19886

15

Another Artifactory CVE under attack by AI agents or humans

Attackers are actively exploiting CVE-2026-82329, a critical JFrog Artifactory authentication bypass, minting admin tokens on exposed servers days after patch release.

CVE-2026-82329 is a CVSS 9.8 unauthenticated authentication bypass in JFrog Artifactory, disclosed Friday, that allows attackers to create new administrative credentials. watchTowr's honeypots recorded exploitation from a small number of IPs within days, including enumeration of users, groups, credential sets, and federated access topologies. Researchers urge urgent patching, credential rotation, and treating exposed instances as potentially compromised to prevent build-pipeline tampering and downstream supply-chain impact.

The Register · Security·Sep 1, 21:07 UTC · 15d agoExploit / PoC in the wild 2 sourcesCVE-2026-82329

88

OpenVPN security advisory (AV26-889)

Canada's Cyber Centre advisory AV26-889 flags CVE-2026-84732 in OpenVPN 2.6.22 and earlier and 2.7.6 and earlier, urging administrators to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-889 noting that OpenVPN versions up to and including 2.6.22 and 2.7.6 are affected by CVE-2026-84732. The flaw involves unbounded TLS timeouts and acknowledgements for non-outstanding packets in the reliability layer. Administrators are encouraged to review the linked OpenVPN guidance and apply updates as they become available. No exploitation is reported.

Canadian Centre for Cyber Security·Sep 8, 15:19 UTC · 8d agoAdvisoryCVE-2026-84732

15

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

A maximum-severity (CVSS 10.0) unauthenticated RCE flaw in SAP Commerce Cloud, CVE-2026-58231, is under active exploitation days after patching.

CVE-2026-58231, rated 10.0 on CVSS, stems from insufficient authorization checks and input validation in SAP Commerce Cloud, enabling unauthenticated arbitrary code execution. Defused Cyber's honeypots detected exploitation attempts three days after the patch, and KEVIntel independently confirmed two attempts on August 14 from a US IP address. Onapsis urges customers to patch and rebuild, with an IP Filter Set offered as a temporary workaround. No actor attribution yet, though prior SAP NetWeaver flaw CVE-2025-31324 was exploited by China-nexus and criminal groups.

The Hacker News·Aug 17, 17:57 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2026-58231CVE-2025-31324

80

USN-8740-1: .NET vulnerabilities

Ubuntu issued USN-8740-1 fixing two .NET watch flaws, CVE-2026-58649 and CVE-2026-69806, enabling information exposure and privilege escalation.

Ubuntu Security Notice USN-8740-1 addresses two vulnerabilities in .NET watch components. CVE-2026-58649 involves missing cross-origin WebSocket validation in BrowserRefreshServer that could expose sensitive information. CVE-2026-69806 involves improper information exposure through AspireServerService arguments, potentially allowing privilege elevation and arbitrary code execution.

Ubuntu Security Notices·updated Sep 16, 20:12 UTC · 9h ago·first Sep 10, 06:57 UTC · 6d agoAdvisory 15 sourcesCVE-2026-58649CVE-2026-69806

16

ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

ConnectWise patched critical ScreenConnect flaw CVE-2026-84869 (CVSS 9.9) exploited since August 20 in worm-like attacks; CISA added it to KEV.

ConnectWise released urgent patches for CVE-2026-84869 (CVSS 9.9), a missing authorization and improper privilege management flaw in ScreenConnect allowing file transfer and execution through active remote sessions without host confirmation. Huntress reported in-the-wild exploitation since August 20, with attackers using rogue ScreenConnect clients to push four VBScript files for persistence and worm-like propagation to other ScreenConnect clients. The flaw is fixed in ScreenConnect 26.6.5, with disabling the TransferFiles permission as a temporary mitigation. CISA added the CVE to its KEV catalog, requiring federal agencies to patch within three days under BOD 26-04.

SecurityWeek·updated Sep 16, 15:31 UTC · 14h ago·first Sep 14, 08:25 UTC · 2d agoExploit / PoC in the wild 4 sourcesCVE-2026-848691

90

September 2026 Patch Tuesday forecast: All we need is more time

September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.

This Patch Tuesday forecast column notes August 2026 Patch Tuesday was the second largest ever with 398 resolved CVEs, yet only one was confirmed actively exploited. SharePoint flaws CVE-2026-55040 and CVE-2026-63520 are being chained for authentication bypass and remote code execution in active attacks against unpatched servers. Microsoft Defender's ShieldBreak elevation of privilege flaw (CVE-2026-69414) is publicly disclosed with PoC code and a fix is expected, while Chrome CVE-2026-85046 was reported exploited in the wild. Several products, including Windows 11 24H2 Home/Pro and Exchange Server 2016/2019 ESU, reach end of support in October 2026.

Help Net Security·Sep 9, 09:05 UTC · 7d agoAdvisory in the wildCVE-2026-55040CVE-2026-63520CVE-2026-62911+5 CVEs1

45

CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)

CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.

CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. CVE-2026-83548 is a critical (CVSS 10.0) pre-authentication SSRF in the SMA1000 Appliance Work Place interface; CVE-2026-83549 is a high (CVSS 7.8) post-authentication OS command injection leading to RCE in the Appliance Management Console. SMA1000 models 6210, 7210, and 8200v running 12.4.3-03453 or 12.5.0-02835 platform-hotfix and older are affected; fixes ship in 12.4.3-03526 and 12.5.0-02952. Qualys customers can detect vulnerable assets via QID 388624.

Qualys ThreatPROTECT·Sep 3, 13:09 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

82

Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code

Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.

Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.

Cyber Security News·Sep 9, 10:10 UTC · 7d agoVulnerabilityCVE-2026-69485

58

Check Point Patches Critical VPN Vulnerabilities

Check Point patches two critical unauthenticated RCE flaws (CVE-2026-85102, CVE-2026-85103) in VPN gateways and firewalls; no exploitation observed.

Check Point released patches for CVE-2026-85102 and CVE-2026-85103, two critical vulnerabilities (CVSS 9.8) enabling unauthenticated remote code execution in products using VPN functionality. CVE-2026-85102 involves improper validation of certificate data during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow. Updates cover versions R82.10, R82, and R81.20; manually defining VPN rules is offered as a mitigation, though it does not apply to locally managed Spark Firewall instances. Check Point discovered both flaws internally and reports no evidence of exploitation in the wild.

SecurityWeek·updated 05:23 UTC · 32m ago·first Sep 11, 11:10 UTC · 5d agoVulnerability 10 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-16232+1 CVEs1

60

Back-to-back N-able bugs send admins on a patching spree

CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.

N-able disclosed CVE-2026-86218 on September 6, a pre-authentication remote code execution flaw with CVSS 10.0 in its N-central RMM platform, and both N-able and Huntress report it is being exploited in the wild. It follows Huntress's disclosure of an exploit chain combining CVE-2026-86206 and CVE-2026-86207 that bypasses access controls to create unauthorized administrative accounts, investigated after a September 4 compromise of a fully patched customer environment. N-able has applied mitigations to all hosted N-central instances; on-premises customers must upgrade to Hotfix 4 (build 2026.3.1.14) immediately.

CSO Online·Sep 7, 11:53 UTC · 9d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

88

CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing

Apache MyFaces fixes critical CVE-2026-76646, a remote denial-of-service flaw triggered by crafted request parameters across versions 2.2.0-4.1.3.

Apache MyFaces disclosed CVE-2026-76646, a critical denial-of-service vulnerability in which remote attackers can cause excessive resource consumption by supplying specially crafted request parameters. Affected versions span 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3 and 2.3-next-*. The disclosure notes older versions may also be impacted.

oss-security·Sep 16, 15:35 UTC · 14h agoVulnerability 2 sourcesCVE-2026-76646

45

CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.

CVE-2026-78336 is a moderate-severity insertion-of-sensitive-information-into-sent-data flaw in Apache Syncope's syncope-ext-oidcc4ui-logic module. The OIDCC4UI provider list discloses client secrets to any authenticated user. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:52 UTC · 2d agoVulnerabilityCVE-2026-783361

22

Hackers Target Langflow in CVE-2026

Threat actors are actively exploiting CVE-2026-0768, an unauthenticated Python RCE in Langflow, hunting OpenAI, AWS, and SSH credentials.

Attackers began exploiting CVE-2026-0768 (CVSS 9.8), an unauthenticated remote code execution flaw in the code validator of the Langflow AI low-code platform, affecting all versions up to 1.4.2. VulnCheck observed 50+ Canary detections on the first day of exploitation, with attackers checking Langflow, OpenAI, and AWS keys in environment variables, reading the secret key, and looking for SSH access and shell history; most traffic originates from Russia and targeted UK-based canaries. The flaw was reported via ZDI by Trend Research in July 2025 and disclosed in January 2026; six other Langflow CVEs were added to VulnCheck's KEV list this year.

Security Affairs·Sep 2, 07:58 UTC · 14d agoExploit / PoC in the wildCVE-2026-07682

72

N-able security advisory (AV26-885)

N-able says CVE-2026-86218 in N-central is exploited in the wild; MSPs must apply hotfix 2026.3.1.14 (2026.3 HF4).

Canadian Centre for Cyber Security advisory AV26-885 covers CVE-2026-86218 in N-able N-central, which the vendor confirms is being exploited in the wild. Versions prior to 2026.3.1.14 are affected, and the fix ships as N-central 2026.3 Hotfix 4. The Cyber Centre urges users and administrators to apply the update promptly.

Canadian Centre for Cyber Security·Sep 8, 14:06 UTC · 8d agoAdvisory in the wildCVE-2026-86218

66

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP patched CVE-2026-44756 (CVSS 10.0), an unauthenticated kernel memory corruption allowing OS command execution, plus three other critical flaws.

SAP's September security updates include CVE-2026-44756 (OVERPASS, CVSS 10.0), a missing boundary validation during deserialization of Extended Passport (EPP) data in the SAP kernel, enabling unauthenticated attackers to run arbitrary OS commands with SAP administrative privileges. Also patched: CVE-2026-58240 (S4GET, CVSS 9.8), a missing authentication check in SAP NetWeaver Message Server yielding RCE as <sid>adm; CVE-2026-76969 (9.4), credential disclosure in SAP Cloud Application Programming Model multi-tenant apps; and CVE-2026-66768 (9.0), improper access control in SAP NetWeaver SAP GUI for Java. Onapsis, which discovered the flaws, says none have been exploited to date and recommends prioritizing internet-facing SAP systems.

The Hacker News·Sep 9, 06:25 UTC · 7d agoVulnerabilityCVE-2026-44756CVE-2026-58240CVE-2026-76969+1 CVEs

68