42
57
42
60
42
42
42
57
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.
CVE-2026-82430 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. When launching Docker or OCI workers, the setuid-root worker-launcher transfers ownership of the entire worker directory to the untrusted topology user before reading and acting on the supervisor-written command file in that directory. An untrusted tenant can tamper with the command file to achieve local privilege escalation to root. Fixed in version 3.1.0.
38
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.
Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.
85
42
42
42
60
60
42
42
57
60
47
47
57
57
57
57
47
42
57
57
57
57
57
57
57
42
42
57
42
42