The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]

Published: 2026-10-21

Last Updated: 2026-10-21 14:53:38 UTC

by Johannes Ullrich (Version: 1)

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.

Various vendors have released bulletins listing products that must be patched for this vulnerability. For example:

Cisco: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq

OPNSense: https://x.com/opnsense/status/2112985458514756087

PFSense: https://forum.netgate.com/topic/201565/critical-php-security-update

Palo Alto Networks: https://security.paloaltonetworks.com/CVE-2026-109618

Many open source firewall/router products use PHP. Expect updates for them, and as always, do not expose the web admin interface to the internet.

PHP also published a summary around the release: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

The PHP update was released as scheduled: https://www.php.net/index.php#2026-10-20-1

This diary will be continuously updated today. I am starting to write this diary with many details still unclear and with the patch not yet available.

Which versions of PHP are vulnerable?

The easy answer: All of them. At least starting with PHP 5, including the most recent releases.

PHP Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, all released today, are currently the only "safe" versions. Note that Linux distributions may backport the patch for older versions.

Ubuntu just released updated PHP packages for Ubuntu 22.04, 24.04, 26.04, and 26.10. [https://ubuntu.com/security/notices/USN-8948-1].

Which versions will receive patches?

Only PHP 8 is expected to receive a patch. Older versions are no longer supported. The patch is expected to be released at 14:00 UTC today, October 21st. [https://www.php.net/archive/2026.php#2026-10-20-1] Ubuntu will release patches "as soon as possible" and may include backported patches for PHP versions included in supported Ubuntu versions.

The real "race to patch" does not start at 14:00 UTC for most people, but at the time distributions release updated packages. Most PHP sites do not use PHP compiled from php.net directly. It will almost certainly be faster to wait for your distribution to release an update.

Does this vulnerability affect specific configurations or extensions?

The vulnerability is in the PHP core, and all default PHP installations are expected to be vulnerable (see below for mitigations).

What steps can I take to mitigate the vulnerability before applying the patch?

Early guidance suggests that the configuration setting "session.upload_progress.enabled = Off" provides partial mitigation against the vulnerability being exploited. By default, this setting is "On". Restricting the maximum allowed request size in your web server and/or PHP configuration may also help.

Are there WAF rules or other measures to protect a site running PHP?

Yes. I will add more as I verify them. Cloudflare appears to have already deployed some protections. Other vendors have likely done the same.

Have exploits been seen "in the wild"?

Cloudflare is reporting exploits [https://x.com/IntCyberDigest/status/2112845843938054610/photo/1]. PoC exploits and vulnerability details have been released [hxxps://jackalsyn.com/posts/php-up-2026[.]html]

How do the vulnerabilities work?

Wiz Security published a blog post detailing how they discovered the vulnerability using AI tools. [https://www.wiz.io/blog/php2shell-php-rce] ...

Read the full entry: https://isc.sans.edu/diary/Critical+PHP+Vulnerability+CVE2026109618+CVE2026109619+infocon+yellow/33440/

Orphaned VBA Projects Inside DWG Files: YARA Rule

Published: 2026-10-18

Last Updated: 2026-10-18 12:59:30 UTC

by Didier Stevens (Version: 1)

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files"

A VirusTotal retrohunt with this rule gave me only 2 detections ...

Read the full entry: https://isc.sans.edu/diary/Orphaned+VBA+Projects+Inside+DWG+Files+YARA+Rule/33434/

Small Agents, Smaller Blast Radius: Controlling What AI Can Do

Published: 2026-10-16

Last Updated: 2026-10-16 00:46:35 UTC

by Mark Baggett (Version: 2)

I believe the cybersecurity industry may be approaching AI security the wrong way.

AI agents are becoming more powerful every day. Systems like ChatGPT, Claude, and Grok can write and execute code, use command shells, browse the web, call APIs, interact with MCP servers, and access enterprise data. Yet much of the industry is taking these extraordinarily powerful, general-purpose agents and trying to make them safe by building cages around them. We add containers, policy layers, monitoring, guardrails, and humans in the loop.

I think that’s backwards. If the companies building these models struggle to control their behavior, why do we assume we can reliably contain them? And when in human history has requiring a user to click a button before something dangerous happened EVER worked?

Even if you build the perfect cage, the model you tested in your cage will eventually change. Providers retire models, and moving to a replacement means revisiting your assumptions and testing. Your application code may be unchanged, but the component deciding what to do next is different.

In my opinion, we should use these agents, which are very good at coding, to build smaller, single-purpose agents. If an agent only needs to read logs from one directory, why give it functions that can read, write, or execute things anywhere on the system?

This isn’t a new idea. It’s the principle of least privilege and separation of duties. But somehow, when we build agents, we seem willing to hand over broad access and ask the model to use good judgment.

This is the guiding philosophy behind SANS SEC573: AI-Powered Security Automation, where we learn to vibe code these focused agents into existence. Use the powerful coding agent to build a better agent. Give the resulting agent only the access it needs to do its job.

An October 15 article from Check Point provides a good case in point ...

Read the full entry: https://isc.sans.edu/diary/Small+Agents+Smaller+Blast+Radius+Controlling+What+AI+Can+Do/33430/

On Wednesday, October 21, PHP released updates to address two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2).

In an Emergency Livestream, Moses Frost and Rich Greene of SANS Institute walk through what is confirmed, what to patch first, and what to do if you are on a PHP version that is past end of life and will not get a fix.

Watch the replay:

https://www.linkedin.com/events/7518495968229748736/

https://www.youtube.com/watch?v=OrfwyFVkzqY

See additional information the Internet Storm Center diary entry above.

Panchan's Mining Island [Guest Diary] (2026.10.14)

https://isc.sans.edu/diary/Panchans+Mining+Island+Guest+Diary/33426/

October 2026 Microsoft Patch Tuesday (2026.10.13)

https://isc.sans.edu/diary/October+2026+Microsoft+Patch+Tuesday/33422/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-104935 - Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Product: Ivanti Connect Secure

CVSS Score: 8.6

** KEV since 2026-10-13 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104935

ISC Podcast: https://isc.sans.edu/podcastdetail/10140

NVD References: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability

Product: Windows Shell

CVSS Score: 8.8

** KEV since 2026-10-13 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96951

ISC Podcast: https://isc.sans.edu/podcastdetail/10136

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

CVE-2026-0322 - Palo Alto Networks PAN-OS Code Injection Vulnerability

Product: Palo Alto Networks PAN-OS

CVSS Score: 0

** KEV since 2026-10-14 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0322

ISC Podcast: https://isc.sans.edu/podcastdetail/10140

CVE-2026-76519 - Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Product: Cisco Secure Email Gateway

CVSS Score: 0

** KEV since 2026-10-14 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76519

ISC Podcast: https://isc.sans.edu/podcastdetail/10140

CVE-2026-96652 - Plex Media Server before version 1.43.3.10861 is vulnerable to SSRF via '/player/timeline', allowing an attacker to force the server to POST to a specified URL using any X-Plex-Token value.

Product: Plex Media Server

CVSS Score: 0

** KEV since 2026-10-20 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96652

ISC Podcast: https://isc.sans.edu/podcastdetail/10142

CVE-2026-96654 - Plex Media Server before 1.43.3.10861 is vulnerable to URL manipulation, enabling attackers to exploit other plugins' functions with custom parameters.

Product: Plex Media Server

CVSS Score: 0

** KEV since 2026-10-20 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96654

ISC Podcast: https://isc.sans.edu/podcastdetail/10142

CVE-2026-96655 - Plex Media Server is vulnerable to an authenticated user being able to request arbitrary internal or external addresses through the '/video/:/transcode/universal' path parameter.

Product: Plex Media Server

CVSS Score: 0

** KEV since 2026-10-20 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96655

ISC Podcast: https://isc.sans.edu/podcastdetail/10142

CVE-2026-96656 - Plex Media Server before 1.43.3.10861 has a vulnerability that allows an admin user to write files that can be executed on load.

Product: Plex Media Server

CVSS Score: 0

** KEV since 2026-10-20 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96656

ISC Podcast: https://isc.sans.edu/podcastdetail/10142

CVE-2026-21589 - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Product: Atlassian Multiple Products

CVSS Score: 0

** KEV since 2026-10-15 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21589

CVE-2026-105133 - Ahsay AhsayCBS Improper Authentication Vulnerability

Product: Ahsay Cloud Backup Suite

CVSS Score: 0

** KEV since 2026-10-14 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105133

CVE-2026-105134 - Ahsay AhsayCBS Command Injection Vulnerability

Product: AhsayCBS

CVSS Score: 0

** KEV since 2026-10-14 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105134

CVE-2026-106931 - SiteGuard Server Edition is susceptible to OS command injection, enabling attackers to run arbitrary commands with elevated system privileges.

Product: SiteGuard Server Edition

CVSS Score: 0

** KEV since 2026-10-20 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106931

CVE-2026-102764 - BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

Product: BeyondTrust Remote Support

CVSS Score: 0

** KEV since 2026-10-16 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102764

CVE-2026-110936 - Siemens Software Center (All versions) is vulnerable to arbitrary code execution due to loading DLLs from an uncontrolled search path.

Product: Siemens Software Center

CVSS Score: 0

** KEV since 2026-10-20 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110936

CVE-2026-53362 - Linux Kernel Unspecified Vulnerability

Product: Linux Kernel

CVSS Score: 0

** KEV since 2026-08-27 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53362

CVE-2026-97229 - GitLab had a vulnerability that could have allowed an unauthenticated user to execute arbitrary code via a specially crafted regular expression in a CI/CD configuration.

Product: GitLab

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229

ISC Podcast: https://isc.sans.edu/podcastdetail/10134

NVD References: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

CVE-2026-106173 - Fortinet FortiSIEM 7.5.0 is vulnerable to path traversal, allowing attackers to execute unauthorized code through crafted packets.

Product: Fortinet FortiSIEM

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106173

ISC Podcast: https://isc.sans.edu/podcastdetail/10144

NVD References: https://fortiguard.fortinet.com/psirt/FG-IR-26-180

CVE-2026-94603 - Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Product: Red Hat Podman

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94603

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94603

NVD References: https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g

CVE-2026-100202 - Windows Message Queuing Queue Manager Remote Code Execution Vulnerability

Product: Microsoft Windows 10 1607

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100202

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100202

CVE-2026-100219, CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerabilities

Product: Microsoft QUIC

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100219

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105016

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105016

CVE-2026-85806, CVE-2026-100222 - Network Policy Server (NPS) Remote Code Execution Vulnerabilities

Product: Microsoft Network Policy Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85806

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100222

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85806

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222

CVE-2026-83770, CVE-2026-97814, CVE-2026-102210 - Windows Text Shaping Remote Code Execution Vulnerabilities

Product: Microsoft Windows Text Shaping

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83770

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97814

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102210

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83770

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97814

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102210

CVE-2026-85818, CVE-2026-105008 - Windows Schannel Spoofing Vulnerabilities

Product: Windows Schannel

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85818

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105008

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85818

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105008

CVE-2026-105010 - Microsoft Windows Search Component Elevation of Privilege Vulnerability

Product: Microsoft Windows Search Component

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105010

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105010

CVE-2026-69634, CVE-2026-69705, CVE-2026-69883 - Windows iSCSI Remote Code Execution Vulnerabilities

Product: Microsoft Windows iSCSI

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69634

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69705

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69883

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69634

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69705

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69883

CVE-2026-69639 - Windows libarchive Remote Code Execution Vulnerability

Product: Microsoft Windows Libarchive

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69639

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69639

CVE-2026-69886 - Windows Imaging Component Remote Code Execution Vulnerability

Product: Microsoft Windows Imaging Component

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69886

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69886

CVE-2026-70024 - Windows Internet Information Services Remote Code Execution Vulnerability

Product: Microsoft Windows Internet Information Services

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70024

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70024

CVE-2026-70096 - Windows Rich Text Edit Control Remote Code Execution Vulnerability

Product: Microsoft Windows Rich Text Edit Control

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70096

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70096

CVE-2026-70147, CVE-2026-70153 - Microsoft PostScript Printer Driver Remote Code Execution Vulnerabilities

Product: Microsoft PostScript Printer Driver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70147

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70153

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70147

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70153

CVE-2026-70157 - Windows System Information Console Remote Code Execution Vulnerability

Product: Microsoft Windows System Information Console

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70157

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70157

CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Product: Microsoft ASP.NET Core

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70188

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70188

CVE-2026-88092 - ASP.NET Core Tampering Vulnerability

Product: Microsoft Visual_Studio_2026

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88092

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092

CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749 - Microsoft Office Outlook Remote Code Execution Vulnerabilities

Product: Microsoft Office

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70242

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70291

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88156

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97016

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97749

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70242

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70291

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88156

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97016

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749

CVE-2026-70279 - Microsoft Exchange Server Spoofing Vulnerability

Product: Microsoft Exchange Server

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70279

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70279

CVE-2026-70571 - Microsoft Exchange Server Remote Code Execution Vulnerability

Product: Microsoft Exchange Server

CVSS Score: 8.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70571

ISC Podcast: https://isc.sans.edu/podcastdetail/10136

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571

CVE-2026-70300 - Microsoft Office Word Remote Code Execution Vulnerability

Product: Microsoft Office

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70300

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70300

CVE-2026-83517, CVE-2026-85814, CVE-2026-96096 - Microsoft Windows Media Foundation Remote Code Execution Vulnerabilities

Product: Microsoft Windows Media Foundation

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83517

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85814

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96096

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83517

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85814

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96096

CVE-2026-83519, CVE-2026-83693, CVE-2026-83748, CVE-2026-97815 - Windows Error Reporting Remote Code Execution Vulnerabilities

Product: Microsoft Windows Error Reporting

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83519

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83693

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83748

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97815

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83519

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83693

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83748

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97815

CVE-2026-83578 - Microsoft PowerShell Remote Code Execution Vulnerability

Product: Microsoft Windows PowerShell

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83578

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83578

CVE-2026-83780 - Windows CCFFilter Driver Remote Code Execution Vulnerability

Product: Microsoft Windows CCFFilter Driver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83780

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83780

CVE-2026-83782 - Windows Shell Remote Code Execution Vulnerability

Product: Microsoft Windows Shell

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83782

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83782

CVE-2026-83862 - Windows Network Load Balancing Remote Code Execution Vulnerability

Product: Microsoft Windows Network Load Balancing

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83862

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862

CVE-2026-83869, CVE-2026-96113 - Windows Domain Name Service Remote Code Execution Vulnerabilities

Product: Microsoft Windows Domain Name Service

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83869

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96113

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83869

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96113

CVE-2026-83910 - RPC Runtime Library Remote Code Execution Vulnerability

Product: Microsoft RPC Runtime

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83910

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83910

CVE-2026-83935 - Microsoft XML Remote Code Execution Vulnerability

Product: Microsoft XML

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83935

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83935

CVE-2026-84015 - Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84015

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84015

CVE-2026-85792, CVE-2026-85809 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerabilities

Product: Microsoft Windows Routing and Remote Access Service

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85792

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85809

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85792

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85809

CVE-2026-85928 - Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

Product: Microsoft Windows Volume Manager Extension Driver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85928

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85928

CVE-2026-88102 - Microsoft Failover Cluster Remote Code Execution Vulnerability

Product: Microsoft Failover Cluster

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88102

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88102

CVE-2026-96864 - Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability

Product: Microsoft Failover Cluster Virtual Driver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96864

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96864

CVE-2026-88178 - Microsoft Office PowerPoint Remote Code Execution Vulnerability

Product: Microsoft Office_2024 -

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88178

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88178

CVE-2026-96219 - Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96219

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96219

CVE-2026-96320, CVE-2026-96934 - Windows DHCP Server Remote Code Execution Vulnerabilities

Product: Microsoft Windows DHCP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96320

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96934

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96320

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96934

CVE-2026-96909 - Windows BitLocker Remote Code Execution Vulnerability

Product: Microsoft Windows_Server_2025

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96909

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96909

CVE-2026-96924 - Windows OLE Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96924

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96924

CVE-2026-97805 - Windows Partition Management Driver Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97805

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97805

CVE-2026-97816 - Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Product: OpenSSH for Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97816

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97816

CVE-2026-15176 - NGINX ngx_http_core_module vulnerability

Product: NGINX Plus and NGINX Open Source

CVSS Score: 8.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15176

ISC Podcast: https://isc.sans.edu/podcastdetail/10142

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-15176

CVE-2026-77524 - KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Product: KEDA

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77524

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77524

CVE-2026-78663 - Double flow control refund on HTTP/2 server streams in net/http

Product: GgRPC

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78663

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78663

CVE-2026-102238 - Visual Studio Code Remote Code Execution Vulnerability

Product: Microsoft Visual Studio Code

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102238

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102238

CVE-2026-108398 - .NET Framework Security Feature Bypass Vulnerability

Product: Microsoft .NET Framework

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108398

ISC Podcast: https://isc.sans.edu/podcastdetail/10136

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398

CVE-2026-96252 - Active Directory Federation Services (AD FS) Spoofing Vulnerability

Product: Microsoft Windows 10 1607

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96252

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96252

Multiple Vulnerabilities in Chromium

Product: Microsoft Edge

CVSS Scores: 9.1 - 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102322 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106195 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106197 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106211 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106227 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106234 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106237 (information leak)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106239 (integer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106241 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106281 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106329 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106358 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106375 (incomplete cleanup)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106382 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106401 (out of bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106417 (integer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110136 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110142 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110144 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110149 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110152 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110159 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110161 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110165 (use after free)

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102322

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106195

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106197

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106211

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106227

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106234

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106237

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106239

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106241

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106281

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106329

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106358

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106375

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106382

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106401

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106417

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110136

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110142

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110144

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110149

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110152

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110159

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110161

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110165

CVE-2026-88131 - Microsoft Dataverse Remote Code Execution Vulnerability

Product: Microsoft Dataverse

CVSS Score: 9.8

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88131

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88131

CVE-2026-69435 - Azure SRE Agent Elevation of Privilege Vulnerability

Product: Microsoft Azure SRE Agent

CVSS Score: 9.6

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69435

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69435

CVE-2026-96207 - Microsoft Partner Center Elevation of Privilege Vulnerability

Product: Microsoft Partner Center

CVSS Score: 10.0

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96207

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96207

CVE-2026-105445 - Docker Hub allows authenticated attackers to reassign personal access tokens to other users, compromising registry access and potentially modifying or deleting images.

Product: Docker Hub

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105445

ISC Podcast: https://isc.sans.edu/podcastdetail/10138

NVD References: https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

CVE-2026-96119 - IBM i versions 7.3, 7.4, 7.5, and 7.6 are vulnerable to remote code execution and sensitive data disclosure through improper sanitization in the HTTP Server Administration web application.

Product: IBM i

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96119

NVD References: https://www.ibm.com/support/pages/node/7292159

CVE-2026-74040, CVE-2026-74041, CVE-2026-74043 - Multiple vulnerabilities in Wazuh versions prior to 4.14.8.

Product: Wazuh

CVSS Scores: 9.0 - 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74040 (arbitrary file overwrite)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74041 (case-sensitivity mismatch)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74043 (path traversal)

NVD References:

- https://github.com/wazuh/wazuh/security/advisories/GHSA-88p6-7cm8-xwj8

- https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6

- https://github.com/wazuh/wazuh/security/advisories/GHSA-cw26-jj8q-x7w5

CVE-2026-102989 - TanStack Router allows an unauthenticated attacker to inject non-public fields into server-function requests, leading to potential data exposure and HTML injection vulnerabilities.

Product: TanStack Router

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102989

NVD References: https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8

CVE-2026-106042 - Ivanti Xtraction before version 2026.4 is vulnerable to an External Control of File Name or Path flaw, enabling a remote authenticated attacker to redirect requests to an attacker-controlled endpoint and steal EPMM connector credentials.

Product: Ivanti Xtraction

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106042

NVD References: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs

CVE-2026-109412 - An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

Product: Ivanti Neurons Patch for Intune

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109412

NVD References: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026

CVE-2026-77459 - Argo CD creates PostDelete resource hooks without applying destination and resource authorization checks, allowing a user to delete forbidden resources; fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Product: Argo CD

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77459

NVD References: https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp

CVE-2026-44415 - Path traversal vulnerability in Siemens Industrial Edge Devices and Industrial Edge Device Kit

Product: Siemens Industrial Edge Devices and Industrial Edge Device Kit

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44415

NVD References:

- https://cert-portal.siemens.com/productcert/html/ssa-377139.html

- https://cert-portal.siemens.com/productcert/html/ssa-832641.html

CVE-2026-63350, CVE-2026-63353, CVE-2026-63354 - Multiple vulnerabilities in Siemens SIMATIC S7 PLCs Web Server.

Product: Siemens SIMATIC S7 PLCs Web Server

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63350 (eval injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63353 (cross-site scripting)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63354 (cross-site scripting)

NVD References: https://cert-portal.siemens.com/productcert/html/ssa-591731.html

CVE-2026-92892 - Potential arbitrary code execution, under specific configurations.

Product: JFrog

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92892

NVD References: https://docs.jfrog.com/releases/docs/jfrog-security-advisories

CVE-2026-91013, CVE-2026-92464, CVE-2026-92909, CVE-2026-100133, CVE-2026-103849 - Multiple vulnerabilities in Adobe Commerce.

Product: Adobe Commerce

CVSS Scores: 9.1 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91013 (stored XSS)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92464 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92909 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100133 (stored XSS)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103849 (arbitrary code execution)

NVD References: https://www.adobe.com/trust/security/products/commerce/apsb26-153.html

CVE-2026-110130 - Dockhand before version 1.0.45 has an authentication bypass vulnerability allowing unauthenticated remote attackers to reset passwords and take over user accounts.

Product: Dockhand

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110130

NVD References: https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w

CVE-2026-87689 - The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet, allowing unauthorized access to stored credentials.

Product: Rapid7 Metasploit Framework

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87689

CVE-2026-89107 - SAP S/4HANA is vulnerable to arbitrary code execution due to insufficient input validation, allowing attackers to compromise the system and impact confidentiality, integrity, and availability.

Product: SAP S/4HANA

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89107

CVE-2026-89108 - SAP Manufacturing Integration and Intelligence has a vulnerability that could allow an attacker with administrator privileges to gain control over the system, compromising confidentiality, integrity, and availability.

Product: SAP Manufacturing Integration and Intelligence

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89108

CVE-2026-89110 - SAP NetWeaver Visual Composer lacks authorization checks, allowing low-privileged attackers to compromise remote systems, posing a threat to confidentiality, integrity, and availability.

Product: SAP NetWeaver Visual Composer

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89110

CVE-2026-89111 - The SAP Cloud SDK for Python is vulnerable to an OAuth2 SSRF flaw that could lead to the theft of client credentials by manipulating the tenant_subdomain parameter.

Product: SAP Cloud SDK for Python

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89111

CVE-2026-109705, CVE-2026-109707, CVE-2026-109708, CVE-2026-109740, CVE-2026-109745, CVE-2026-109750, CVE-2026-109755 - Multiple vulnerabilities in Mozilla Firefox and Thunderbird.

Product: Mozilla Firefox and Thunderbird

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109705

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109707

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109708

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109740

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109745

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109750

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109755

NVD References:

- https://www.mozilla.org/security/advisories/mfsa2026-106/

- https://www.mozilla.org/security/advisories/mfsa2026-108/

- https://www.mozilla.org/security/advisories/mfsa2026-109/

- https://www.mozilla.org/security/advisories/mfsa2026-110/

CVE-2026-104192 - Dragonfly is vulnerable to double-free via crafted serialized stream to RESTORE, leading to denial of service and potential attacker-controlled code execution.

Product: Dragonfly

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104192

NVD References: https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh

CVE-2026-107460 - Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating's Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component can be bypassed through DNS rebinding.

Product: Apache Fesod

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107460

NVD References: https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83

CVE-2026-79608 - Xen's workaround for XSA-433 was updated to integrate with other MSR manipulations, leading to an inverted conditional causing the workaround to not be applied when required.

Product: Xen

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79608

CVE-2026-69227 - Portal for ArcGIS has a vulnerability that allows unauthenticated access to certain Portal Administrator API endpoints, potentially granting attackers access to administrative functions without authentication.

Product: Esri Portal for ArcGIS

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69227

NVD References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/september-2026-arcgis-security-bulletin