42
47
57
57
57
57
60
57
47
60
57
57
57
47
60
60
42
cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands
CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.
CVE-2026-65638 affects ConfigServer Security & Firewall (CSF) versions 14.00 through 16.29 and allows unauthenticated remote attackers to execute arbitrary commands through the MESSENGER service, running under the unprivileged CSF service account rather than root. Exploitation requires the non-default MESSENGER service to be enabled and a reCAPTCHA secret configured, reducing exposure for standard deployments. CSF 16.30 and later fix the flaw; administrators who cannot update immediately can set MESSENGER = 0 in /etc/csf/csf.conf as a temporary mitigation.
55
Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root
Palo Alto Networks fixed CVE-2026-0310, a CVSS 9.2 unauthenticated PAN-OS buffer overflow enabling root code execution on PA-Series firewalls.
Palo Alto Networks published an advisory on September 9, 2026 for CVE-2026-0310, a CWE-787 out-of-bounds write in PAN-OS XML processing with a CVSS v4.0 base score of 9.2, affecting the management and dataplane interfaces. Unauthenticated attackers could execute arbitrary code as root on PA-Series hardware firewalls, while VM-Series faces denial-of-service impact and Prisma Access and Cloud NGFW have reduced, authenticated exposure. Affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before fixed maintenance releases such as 12.2.3, 12.1.4-h10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround is available. Palo Alto is not aware of malicious exploitation but classifies remediation urgency as highest.
78
42
42
42
42
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog.
CISA adds three actively exploited flaws—Cisco ASA/FTD DoS, Windows Winsock SYSTEM-level UAF, and Metabase SQL injection—to its Known Exploited Vulnerabilities catalog.
CISA added CVE-2026-20349 (CVSS 8.6, heap inspection flaw crashing Cisco ASA/FTD via crafted HTTP requests to the Remote Access SSL VPN service), CVE-2026-68820 (CVSS 7.0, use-after-free in the Windows afd.sys Winsock driver allowing SYSTEM-privilege code execution, actively exploited per Microsoft) and CVE-2026-72898 (CVSS 10.0, unauthenticated SQL injection in Metabase) to the KEV catalog. Metabase disclosed its cloud service was attacked with the 0-day, giving the intruder a path to administrator rights and stored credentials for connected databases; cloud instances were patched while self-hosted deployments need urgent updates. Under BOD 22-01, federal civilian agencies must patch by August 14, 2026, except CVE-2026-68820, due August 25.
76
57
42
57
60
42
57
42
57
42
57
60
57
Nearly 12,000 Juniper Firewalls Found Vulnerable to Recently Disclosed RCE Vulnerability
60
42
Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)
Cisco patches CVE-2026-20349, a high-severity unauthenticated DoS in ASA and FTD VPN services now added to CISA's KEV.
CVE-2026-20349 affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software, where specially crafted unauthenticated HTTP requests can cause appliances to reload, creating a denial of service. Cisco confirmed active exploitation observed in August 2026 and released hot fixes for ASA versions 9.16 through 9.24 and FTD versions 7.0 through 10.0. The flaw was added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 14, 2026 for US civilian federal agencies. No workarounds or indicators of compromise are available.
76
ZDI-26-533: Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability
ZDI discloses CVE-2026-20316, a 9.8-rated unauthenticated authentication bypass in Cisco Secure Firewall Management Center login.cgi.
ZDI-26-533 describes an authentication bypass vulnerability in Cisco Secure Firewall Management Center's login.cgi that allows remote attackers to bypass authentication without any credentials. ZDI assigned a CVSS score of 9.8, and the flaw is tracked as CVE-2026-20316. As a central management plane for firewall infrastructure, compromise could enable broad policy changes.
60