TPRM Insights: N-central, Adobe Commerce & Magento, MikroTik, Fortinet, MSSQL, SharePoint, Exchange Server, MongoDB, Roundcube, Jenkins

Introduction

This week's Focus Friday® is the largest single-week release in the Focus Friday series, covering ten FocusTags spanning remote monitoring and management platforms, e-commerce infrastructure, network devices, enterprise security appliances, database engines, collaboration and messaging servers, webmail, and CI/CD automation. Two tags carry actively exploited CISA KEV listings with confirmed in-the-wild attacks: N-central's new zero-day RCE cluster and Adobe Commerce & Magento's maximum-severity template injection flaw. MikroTik RouterOS brings a six-vulnerability set dubbed MikroTrick by CERT Polska, including a confirmed mass exploitation campaign targeting over 122,500 internet-exposed devices. The remaining seven tags — Fortinet, MSSQL, SharePoint, Exchange Server, MongoDB, Roundcube, and Jenkins — cover September's Patch Tuesday and concurrent vendor security releases.

The most operationally urgent events this week are N-central's CVSS 10.0 pre-authenticated RCE zero-day (CVE-2026-86218) and Adobe Commerce's CVSS 10.0 template injection flaw (CVE-2026-75650), both confirmed as actively exploited and listed in CISA's KEV catalog. N-central's RMM platform manages endpoint access across entire MSP client portfolios — a single compromise grants attackers lateral reach into every downstream organization. MSSQL's 61-CVE Patch Tuesday batch is the largest single-month SQL Server disclosure on record. TPRM professionals face a high-volume week requiring differentiated prioritization across actively exploited zero-days, mass-exploit campaigns, and large-scale vendor patch releases.

Filtered view of vendors with N-central - Sep2026 FocusTag® on the Black Kite platform.

N-central - Sep2026 (CVE-2026-86218, CVE-2026-86206, CVE-2026-86207, CVE-2026-18556, CVE-2026-18577)

What is this vulnerability?

N-able N-central is the flagship Remote Monitoring and Management (RMM) platform used by Managed Service Providers to centrally monitor, patch, and remotely access endpoints across entire customer portfolios. Three new vulnerabilities — CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207 — were disclosed in September 2026 alongside two previously-disclosed August 2026 flaws (CVE-2026-18556, CVE-2026-18577) that prior hotfixes failed to fully remediate. CVE-2026-86218 (CVSS 10.0) is a pre-authenticated Remote Code Execution zero-day confirmed as actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog on September 8, 2026 — any unauthenticated attacker with network access can execute arbitrary code on the N-central server without any credentials. CVE-2026-86206 (CVSS 6.9) and CVE-2026-86207 (CVSS 7.7) are independent authentication bypass vulnerabilities enabling unauthorized full platform access, with Huntress having developed and validated a working proof-of-concept exploiting both.

All three September CVEs are entirely distinct from the August 2026 N-central vulnerabilities and render all prior hotfixes insufficient. Organizations must apply Hotfix 4 (build 2026.3.1.14), which supersedes all previous releases. Hosted N-central (NCOD) instances have been automatically patched; all self-hosted N-central deployments require immediate manual action. The August exploitation timeline demonstrated that threat actors moved from initial N-central compromise to lateral traversal across multiple MSP client organizations within minutes — the September cluster worsens this threat by removing even the low-privilege authentication barrier of the August flaws.

Why should TPRM professionals care?

N-central's strategic position as an MSP RMM platform makes a single server compromise disproportionately consequential: an attacker who achieves RCE on the N-central server can immediately leverage the platform's built-in Take Control, scripting, and job execution capabilities to push malware, establish persistence, and open remote sessions across every endpoint managed by every MSP client — simultaneously and at scale. For organizations that use MSPs running N-central, this vulnerability is effectively a supply chain risk: your vendor's RMM compromise becomes your breach. The CISA KEV listing with confirmed active exploitation means this is not a theoretical risk. TPRM teams must verify that MSP vendors have applied Hotfix 4 specifically — not just any N-central patch — and that NCOD migration or immediate self-hosted patching has been completed.

What questions should TPRM professionals ask vendors?

Have you upgraded all instances of N-able N-central to version 2026.3 Hotfix 4 (build 2026.3.1.14) to mitigate the risk of CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207?
Have you audited all user accounts for email addresses with .invalid appended or other unexpected string manipulations, as part of the remediation process for CVE-2026-86206 and CVE-2026-86207?
Have you reviewed envoy_proxy_HTTPS.log and syslog ncentraldms for successful requests to internal API routes using URL-encoded values, as part of the detection process for CVE-2026-86206 and CVE-2026-86207?
Have you restricted all external access to the N-central console and applied network-level restrictions to mitigate the risk of the pre-authenticated RCE zero-day vulnerability (CVE-2026-86218)?

Remediation recommendations

Apply N-central Hotfix 4 (build 2026.3.1.14) to all self-hosted N-central deployments immediately; this release supersedes all prior hotfixes and is the only complete remediation for all five CVEs in this cluster.
Treat any N-central server that was not patched to Hotfix 4 before CVE-2026-86218's public disclosure as potentially compromised; conduct an IoC review and consider full server rebuild from a clean backup.
Restrict N-central management interface access to trusted internal IP ranges and VPN tunnels; remove all direct public internet exposure of the platform.
Review all endpoint and network activity across MSP-managed client environments for anomalous Take Control sessions, unauthorized script execution, or lateral movement originating from the N-central server.

Black Kite's N-central - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

Adobe Commerce & Magento (CVE-2026-75650, CVE-2026-7565)

What is this vulnerability?

Adobe Commerce and Magento Open Source are widely deployed e-commerce platforms used by retailers and enterprises globally to power online storefronts. CVE-2026-75650 is a critical template injection vulnerability (CWE-1336, CVSS 10.0) in which an unauthenticated remote attacker can inject template syntax that the server-side engine evaluates, executing arbitrary code in the context of the current user. Exploitation requires no credentials and no user interaction, and the CVSS scope is changed — meaning a compromise can reach components beyond the vulnerable component. Adobe confirmed this vulnerability is being actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on September 8, 2026, with a remediation deadline of September 11, 2026 for federal agencies.

Two aspects of this disclosure significantly elevate its urgency above a typical critical Adobe Commerce advisory. First, every version is affected — including the most recent release. Adobe's bulletin lists all supported branches through the August 2026 release as vulnerable, meaning a store that applied the August security patches remains fully exposed. Second, the remediation is delivered as a hotfix rather than a version upgrade: the fix is a composer hotfix (VULN-39341) that does not change the reported version string, making the patched state externally unobservable. Every identified Adobe Commerce or Magento host must be treated as presumed vulnerable until the merchant confirms hotfix application.

Why should TPRM professionals care?

E-commerce platforms are a standing target for card-skimming groups, and a pre-authenticated code execution flaw in the template engine provides the access needed to inject a payment skimmer directly into the storefront, steal or delete customer and order data, create administrative backdoor users, and establish persistent server access. The CISA KEV listing with a September 11, 2026 federal remediation deadline — the same date as today's Focus Friday — signals maximum urgency. The invisible nature of the hotfix (no version string change) means standard version-based scanning will report affected hosts as clean. TPRM teams must explicitly verify hotfix application through vendor confirmation rather than relying on automated version checks.

What questions should TPRM professionals ask vendors?

Have you applied the hotfix for CVE-2026-75650 to all Adobe Commerce and Magento Open Source installations, including end-of-life and Extended Support versions?
Can you confirm that, after applying the hotfix, you have rotated all relevant secrets and credentials, including encryption keys, admin user passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH/deploy keys, and API keys used by shipping, tax, and other third-party integrations?
Have you restricted administrative and API exposure by limiting access to the admin panel and any GraphQL or REST endpoints not required by the storefront to trusted network ranges, and by placing the store behind a WAF with virtual patching for template injection patterns?
Have you reviewed checkout pages for injected client-side code, compared rendered checkout content against a known-good baseline, and audited third-party script inclusions to identify potential card-skimming activity related to exploitation of CVE-2026-75650?

Remediation recommendations

Apply the Adobe APSB26-146 composer hotfix (VULN-39341) immediately to all Adobe Commerce and Magento deployments; every version through the August 2026 release is affected and must be treated as vulnerable until hotfix application is confirmed.
Verify hotfix deployment through internal validation rather than version string checks, as the fix does not change the reported version number.
Review all administrator accounts, checkout page JavaScript, and server-side template configurations for indicators of compromise consistent with CVE-2026-75650 exploitation.
Implement or validate WAF rules blocking template injection syntax against Commerce and Magento endpoints as an interim layer of defense pending confirmed hotfix deployment.

Black Kite's Adobe Commerce & Magento FocusTag® details critical insights on the event for TPRM professionals.

MikroTrick (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277, CVE-2026-67279, CVE-2026-67278, CVE-2026-67281)

What is this vulnerability?

MikroTik RouterOS is widely deployed as a core router, firewall, and network gateway across enterprise, ISP, and government environments. Six vulnerabilities — collectively named MikroTrick by CERT Polska — were disclosed on September 5, 2026 with active exploitation confirmed against internet-exposed devices. The critical two-vulnerability chain consists of CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass via incomplete RSA key validation that allows any attacker who knows a valid username and the public RSA modulus — both obtainable through reconnaissance — to forge a valid SSH session without the private key by supplying a crafted key with exponent one; and CVE-2026-86060 (CVSS 9.2), an SSH privilege escalation via argument injection in username parsing logic that escalates the forged session to full administrative access. Chained, these two flaws enable complete unauthenticated takeover of any RouterOS device with SSH exposed to the internet.

The remaining four vulnerabilities extend the attack surface independently: CVE-2026-67277 enables unauthenticated kernel memory disclosure and denial of service via the bandwidth-test service; CVE-2026-67281 enables unauthenticated WebFig file disclosure via an uninitialized pointer; CVE-2026-67279 enables unauthenticated arbitrary file write via SSH workflow bypass; and CVE-2026-67278 enables X.509 TLS certificate forgery via improper signature validation. CERT Polska confirmed exploitation originating from IP 82.192.72.4 since at least September 2, 2026, with creation of a highly privileged 'ops' user account as the primary post-exploitation indicator. The ShadowServer Foundation identified 122,500 MikroTik devices with exposed SSH interfaces as of September 5. Fixed releases are available in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All six vulnerabilities were discovered using AI-assisted research by Sławomir Rozbicki of CERT Polska.

Why should TPRM professionals care?

MikroTik RouterOS devices serve as core network infrastructure components — compromising one gives attackers full visibility into all network traffic, the ability to redirect or intercept communications, and a persistent foothold for lateral movement into connected network segments. The unauthenticated SSH chain (CVE-2026-67276 + CVE-2026-86060) requires only knowledge of a valid username and public RSA modulus, both trivially obtainable. With 122,500 exposed SSH interfaces and confirmed automated scanning already underway, every internet-exposed MikroTik device running a vulnerable RouterOS version should be treated as potentially targeted. For TPRM teams, vendors running MikroTik as their perimeter or core routing infrastructure represent elevated network-level exposure risk.

What questions should TPRM professionals ask vendors?

Have you updated all instances of MikroTik RouterOS to versions 7.24.2, 7.23.4, or 6.49.21 to mitigate the risk of the MikroTrick vulnerabilities (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277, CVE-2026-67281, CVE-2026-67279, CVE-2026-67278)?
Can you confirm if you have implemented the recommended actions such as factory reset and rebuild, checking the "Flagged" compromise marker, investigating for active compromise using published IoCs, and immediate RouterOS upgrade?
Have you taken measures to restrict or disable exposed services like SSH, WWW/WWW-SSL, and the bandwidth-test service to trusted management IP ranges exclusively, especially if immediate patching was not feasible?
Can you confirm if you have taken steps to avoid initiating TLS connections or using the built-in SSH clients (/system ssh and /system ssh-exec) on unpatched devices, particularly over untrusted networks or towards untrusted hosts?

Remediation recommendations

Update all MikroTik RouterOS devices to version 7.24.2, 7.23.4, 6.49.21, or 7.25beta3 immediately; every device with SSH exposed to the internet and a vulnerable RouterOS version should be assumed targeted given confirmed mass exploitation.
Disable or restrict SSH access on all MikroTik devices to trusted internal IP ranges only; SSH should not be directly accessible from the public internet on any RouterOS device regardless of patch status.
Review all RouterOS device user account lists for unauthorized entries, particularly any 'ops' user account or newly created high-privilege accounts consistent with MikroTrick post-exploitation tradecraft.
Treat any device confirmed as compromised as requiring full rebuild from a clean configuration; audit all network traffic that traversed the device during the compromise window for potential interception or modification.

Black Kite's MikroTrick FocusTag® details critical insights on the event for TPRM professionals.

Fortinet - Sep2026 [Suspected] (CVE-2026-84393, CVE-2026-84391, CVE-2026-22575)

What is this vulnerability?

Fortinet published its September 2026 PSIRT advisories on September 8, 2026, disclosing ten vulnerabilities across its portfolio. Three fall within this tag's scope: CVE-2026-84393 affecting FortiOS and FortiProxy, CVE-2026-84391 affecting FortiAnalyzer, and CVE-2026-22575 affecting FortiManager and FortiManager Cloud. The most operationally significant, CVE-2026-84393 (CVSS 8.1), is an improper certificate validation flaw in the Agentless ZTNA portal that allows a remote unauthenticated attacker positioned on the network path to intercept traffic between the portal and its backend destination. The attack requires a man-in-the-middle position (explaining the High attack complexity), but once positioned, the missing certificate validation means a forged certificate passes undetected — exposing session details, application content, and any sensitive data traversing the ZTNA channel.

The other two present materially lower risk. CVE-2026-84391 (CVSS 6.5) produces only a denial-of-service condition against the FortiAnalyzer SNMP daemon under authenticated access, with no confidentiality or integrity impact. CVE-2026-22575 (CVSS 4.9) requires existing high-privilege administrative access and results in a bypass of the FortiManager workflow approval process — a segregation-of-duties control failure rather than an external attack path. Fortinet reports no evidence of exploitation in the wild for any of the three CVEs, and none appear in CISA's KEV catalog. This tag is scoped at product level rather than version level, as Fortinet appliance banners do not reliably expose build numbers — confidence is set to MEDIUM accordingly.

Why should TPRM professionals care?

FortiOS and FortiProxy are enterprise security appliances frequently deployed at network perimeters, and the Agentless ZTNA portal is by design internet-facing — making CVE-2026-84393's external attack surface meaningful despite the MITM prerequisite. FortiAnalyzer and FortiManager are centralized management and log-analysis platforms that, if identified on internet-facing scans, represent a configuration finding worth raising independently of these CVEs. While none of the three vulnerabilities carry the active-exploitation urgency of this week's N-central or MikroTick tags, Fortinet products are historically high-value targets for threat actors, and prompt application of September 2026 patches is recommended for all deployed products.

What questions should TPRM professionals ask vendors?

Have you updated all instances of FortiOS and FortiProxy to version 7.6.7 or later to mitigate the risk of CVE-2026-84393, which involves an improper validation of certificate with host mismatch vulnerability?
Can you confirm if you have patched all instances of FortiAnalyzer affected by the use of uninitialized variable vulnerability (CVE-2026-84391) as per Fortinet advisory FG-IR-26-172?
Have you applied the recommended fixes for the improper access control vulnerability (CVE-2026-22575) in FortiManager and FortiManager Cloud, as outlined in Fortinet advisory FG-IR-26-171?
Can you confirm if you have enforced backend certificate validation in the ZTNA portal after upgrading, as recommended in the advisory, to prevent potential man-in-the-middle attacks?

Remediation recommendations

Apply the September 8, 2026 Fortinet PSIRT security updates for FortiOS, FortiProxy, FortiAnalyzer, and FortiManager; patch prioritization should focus on CVE-2026-84393 given its unauthenticated external attack surface.
Implement additional certificate validation controls on ZTNA portal deployments and restrict ZTNA backend paths to trusted certificate authorities to mitigate MITM interception risk from CVE-2026-84393.
Ensure FortiAnalyzer and FortiManager management interfaces are not exposed directly to the internet; their identification on external scans represents a misconfiguration independent of these CVEs.

Black Kite's Fortinet - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

MSSQL - Sep2026

What is this vulnerability?

Sixty-one vulnerabilities were disclosed by Microsoft as part of the September 8, 2026 Patch Tuesday release for Microsoft SQL Server, spanning SQL Server 2017, 2019, 2022, and 2025 across both GDR and CU servicing branches. CVSSv3 scores range from 4.9 to 9.8, covering heap-based buffer overflows enabling RCE and privilege escalation, an untrusted pointer dereference and stack-based overflow that break out of the SQL Server security scope, deserialization of untrusted data reachable without authentication, SQL injection enabling privilege escalation, improper access control, weak authentication paths, use-after-free flaws, and a large cluster of memory read vulnerabilities leaking SQL Server process memory. This is the largest single-month SQL Server disclosure batch on record.

Three vulnerabilities require no authentication and define the outer perimeter of this batch. CVE-2026-47297 (CVSS 8.1) is a deserialization of untrusted data flaw reachable by an unauthenticated remote attacker, gated only by high attack complexity. CVE-2026-67376 (CVSS 7.5) is an integer overflow enabling unauthenticated denial of service. CVE-2026-65669 (CVSS 9.6, the highest-scoring flaw in the batch) is an injection flaw with changed scope and full confidentiality, integrity, and availability impact. Three flaws — CVE-2026-67378 (untrusted pointer dereference), CVE-2026-67379 (stack-based buffer overflow), and CVE-2026-67636 (out-of-bounds read with RCE potential) — all carry scope change vectors, meaning successful exploitation can reach the underlying OS. Microsoft rates CVE-2026-67378, CVE-2026-67636, CVE-2026-67631, and CVE-2026-67643 as Critical. No active exploitation has been confirmed and no CISA KEV listings apply to this batch; the only remediation path is applying the September 2026 GDR or CU security update for the deployed SQL Server branch.

Why should TPRM professionals care?

The significance of this batch lies less in any single flaw than in the density of independent routes to the same outcome. Thirty of the 61 vulnerabilities share an identical risk profile: network-reachable, low attack complexity, low-privilege authentication, no user interaction required — each independently capable of privilege escalation or code execution. An attacker with any authenticated SQL Server session has a menu of interchangeable escalation paths rather than a single narrow one, collapsing the value of individual CVE prioritization. For TPRM professionals, this means branch-level patch verification — confirming the September 2026 GDR or CU update is applied for the specific SQL Server version — is the only defensible assessment approach.

What questions should TPRM professionals ask vendors?

Have you updated all instances of Microsoft SQL Server to the versions that address the vulnerabilities mentioned, specifically CVE-2026-47297, CVE-2026-67376, CVE-2026-67378, CVE-2026-67636, CVE-2026-67631, and CVE-2026-67643?
Can you confirm if you have implemented the recommended actions to mitigate the risk of these vulnerabilities, such as hunting for IoCs, deploying the September 8, 2026 updates, shrinking the authenticated surface, and patching unauthenticated paths first?
Have you tested the known regressions in staging first, specifically the issues with connection validation and SQL 2022 CU26 and 2025 CU8 GDR throwing an access violation when sys.dm_exec_requests is queried during recovery?
Can you confirm if you have assessed third-/Nth-party exposure, specifically vendors hosting your data, and have you confirmed their patch status and prioritized vendors with internet-reachable instances or unpatchable SQL Server 2016?

Remediation recommendations

Apply the September 2026 GDR or CU security update for every deployed SQL Server branch (2017, 2019, 2022, and 2025) without delay; no mitigations or workarounds exist for any of the 61 vulnerabilities.
Restrict SQL Server network access using firewalls and network access controls to prevent unauthenticated exploitation of CVE-2026-47297, CVE-2026-67376, and CVE-2026-65669 from untrusted network paths.
Enforce principle of least privilege across all SQL Server user accounts to limit the escalation impact of the large cluster of low-privilege authenticated escalation paths.

Black Kite's MSSQL - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

SharePoint - Sep2026 (16 CVEs)

What is this vulnerability?

Sixteen vulnerabilities affecting Microsoft SharePoint Server Subscription Edition were disclosed as part of the September 8, 2026 Patch Tuesday release. CVSSv3 scores range from 3.5 to 8.8, spanning five RCE vulnerabilities via improper access control, two RCE vulnerabilities via missing authorization enforcement, one RCE via a time-of-check time-of-use race condition, privilege escalation via excessive privilege execution, SQL injection-based privilege escalation, two SQL injection and SSRF-based information disclosure vulnerabilities, one additional SSRF, and four cross-site scripting spoofing flaws. The high concentration of six independent RCE pathways — all requiring only low-privileged authenticated access — distinguishes this release as a significant month for SharePoint exposure.

CVE-2026-69464 and CVE-2026-69716 (both CVSS 8.8, EPSS 0.92%) carry the highest exploitation probability signals: CVE-2026-69464 exploits excessive privilege execution to escalate from a low-privileged session to administrative access, while CVE-2026-69716 leverages SQL injection for the same escalation — two independently exploitable paths. CVE-2026-69268, CVE-2026-69273, and CVE-2026-69282 (all CVSS 8.8) represent a recurring improper access control weakness allowing low-privileged users to reach and invoke code execution functionality beyond their permitted scope; CVE-2026-69282 is additionally assessed as automatable by SSVC. CVE-2026-69465 and CVE-2026-69724 (CVSS 8.8, EPSS 0.82% and 0.78% respectively) provide two further RCE paths via absent function-level authorization. All sixteen vulnerabilities are remediated through the September 8, 2026 security update KB5002908 (build 16.0.20326.20136) for SharePoint Server Subscription Edition.

Why should TPRM professionals care?

SharePoint Server Subscription Edition is a widely deployed enterprise collaboration and document management platform that holds sensitive business documents, project data, and intranet content. Six independent RCE pathways exploitable from standard low-privileged accounts — the baseline access level for most employees, external collaborators, and service accounts — means that any authenticated SharePoint user in a vendor's environment could potentially escalate to code execution if the September 2026 update has not been applied. For TPRM teams, internet-accessible SharePoint deployments at unpatched levels present direct external risk.

What questions should TPRM professionals ask vendors?

Have you updated all instances of Microsoft SharePoint Server Subscription Edition to the patched build 16.0.20326.20136 or later to mitigate the risk of the sixteen high-severity vulnerabilities including CVE-2026-69268, CVE-2026-69273, CVE-2026-69282, CVE-2026-69465, CVE-2026-69724, and CVE-2026-69804?
Can you confirm if you have implemented or updated Web Application Firewall (WAF) rules to detect SSRF request patterns targeting internal network ranges originating from SharePoint and XSS injection payloads in HTTP request parameters as a defense-in-depth measure pending or supplementing patch deployment?
Have you reviewed and enforced role-based access control (RBAC) across all SharePoint site collections and restricted Site Collection Administrator, Farm Administrator, and elevated workflow permissions to the minimum set of verified, human-owned accounts to limit the exploitable population for all eight CVSS 8.8 vulnerabilities in this cluster?
Are you actively monitoring SharePoint ULS logs and Unified Audit Logs for anomalous SQL special characters in query parameters (CVE-2026-69636, CVE-2026-69716), unexpected server-side HTTP requests to internal network ranges (CVE-2026-69683), unusual access control errors followed by successful privileged operations from low-privileged accounts (CVE-2026-69268, CVE-2026-69273, CVE-2026-69282), and script injection patterns in web request logs (XSS cluster)?

Remediation recommendations

Apply KB5002908 (build 16.0.20326.20136) to all SharePoint Server Subscription Edition deployments immediately; this is the only remediation for all 16 vulnerabilities in this batch.
Prioritize internet-accessible SharePoint deployments for immediate patching given the multiple low-privilege authenticated RCE pathways and the high EPSS scores for CVE-2026-69464, CVE-2026-69716, CVE-2026-69465, and CVE-2026-69724.
Review and enforce principle of least privilege across all SharePoint user and service accounts to limit escalation impact from the low-privilege RCE paths.

Black Kite's SharePoint - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

Exchange Server - Sep2026 (CVE-2026-69356, CVE-2026-69641, and 7 additional CVEs)

What is this vulnerability?

Nine vulnerabilities affecting Microsoft Exchange Server were disclosed as part of the September 8, 2026 Patch Tuesday release, affecting Exchange Server 2016 CU23, 2019 CU14, 2019 CU15, and Exchange Server Subscription Edition RTM. CVSSv3 scores range from 5.9 to 9.3, spanning a critical unauthenticated XSS enabling spoofing, a critical missing authorization flaw with changed scope enabling privilege escalation, two unauthorized RCE-class flaws (one unauthenticated double free, one via external file path control), two additional privilege escalation and RCE paths via missing authorization, an SSRF enabling information disclosure, an authorization bypass enabling tampering, a broken cryptographic algorithm enabling unauthenticated information disclosure, and an unauthenticated uncontrolled recursion enabling denial of service.

CVE-2026-69356 (CVSS 9.3, EPSS 0.70%) is the highest-scoring vulnerability and uniquely dangerous: an unauthenticated XSS with changed scope against Exchange OWA, which is routinely internet-accessible. A remote attacker requires only that a target user interact with a crafted URL or web interface element. CVE-2026-69641 (CVSS 9.1, EPSS 0.85%) carries the highest exploitation probability in the cluster and is a missing authorization flaw with changed scope allowing high-privileged attackers to escape the authentication boundary. CVE-2026-69355 (CVSS 8.8, EPSS 0.84%) provides a network-accessible RCE path via external file path control exploitable by any low-privileged authenticated user. CVE-2026-55007 (CVSS 8.1, EPSS 0.73%) introduces a zero-authentication double-free memory corruption path to full RCE, though high attack complexity limits opportunistic exploitation. All nine vulnerabilities are remediated through the September 8, 2026 Exchange Server security updates.

Why should TPRM professionals care?

Exchange Server is the most critical enterprise messaging infrastructure component, holding the full organizational email archive, calendar data, contacts, and authentication credentials. The unauthenticated XSS (CVE-2026-69356) against OWA — Exchange's internet-facing webmail interface — requires no credentials and no server access; it only requires a user to interact with a crafted link. This is a significant phishing amplifier for business email compromise. The combination of four unauthenticated attack vectors across nine CVEs means that internet-exposed Exchange deployments have an external attack surface requiring immediate attention. TPRM teams should prioritize Exchange patch verification for vendors running self-hosted Exchange, as Exchange Online (Microsoft 365) is not affected.

What questions should TPRM professionals ask vendors?

Have you applied the Microsoft-issued security updates released on September 8, 2026 for all affected Exchange Server versions, specifically KB5121608 for Subscription Edition RTM, KB5121609 for Exchange 2019 CU15, KB5121610 for Exchange 2019 CU14, and KB5121611 for Exchange 2016 CU23?
Can you confirm if you have implemented network-level access controls to restrict direct Exchange connectivity to only trusted client ranges, specifically to mitigate the risk of CVE-2026-55007, CVE-2026-69378, and CVE-2026-69382 which require no authentication?
Have you audited all Exchange administrator and organization management role members and enforced multi-factor authentication for all privileged Exchange accounts to mitigate the risk of CVE-2026-69641?
Are you monitoring for unusual Exchange IIS request patterns that may indicate XSS injection attempts (CVE-2026-69356), unexpected file path references in Exchange logs (CVE-2026-69355), unusual server-side HTTP requests to internal network ranges (CVE-2026-69361), service availability disruptions or recursive processing errors (CVE-2026-69378), and unexpected privilege escalations within Exchange role assignments (CVE-2026-69641, CVE-2026-69380)?

Remediation recommendations

Apply the September 8, 2026 Exchange Server security updates to all on-premises Exchange deployments immediately; Exchange Online (Microsoft 365) is not affected and requires no action.
Prioritize OWA-facing deployments for immediate patching given the unauthenticated XSS (CVE-2026-69356) against the internet-accessible webmail interface.
Review Exchange audit logs for any anomalous session activity, unexpected privilege escalation, or crafted URL patterns against OWA since September 8, 2026.

Black Kite's Exchange Server - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

MongoDB - Sep2026

What is this vulnerability?

Twenty-one vulnerabilities — CVE-2026-82052 through CVE-2026-82076 — were disclosed in MongoDB Server on September 8, 2026. CVSSv4 scores range from 6.0 to 9.2, spanning an unauthenticated authorization bypass caused by configuration validation failing at server startup, two unauthenticated denial-of-service conditions reachable on sharded cluster routers and replica set members, an LDAP authorization flaw producing incorrect role assignment and privilege escalation, an out-of-bounds write during collection creation with code execution potential, cleartext credential exposure through the diagnostic reporting interface, two aggregation framework authorization bypasses granting unauthorized read access to collection data, and a series of memory-safety and assertion failures producing process termination — several of which corrupt metadata and persist across restarts.

CVE-2026-82067 (CVSSv4 9.2) is the only Critical-rated flaw and uniquely dangerous: improper handling of case sensitivity in configuration validation can cause the authorization subsystem to remain in its default disabled state during server startup, meaning a deployment intending to enforce access control silently runs without it. An unauthenticated user with network access to a deployment in this state can perform arbitrary administrative operations — full compromise of data confidentiality, integrity, and availability. CVE-2026-82075 and CVE-2026-82064 (both CVSSv4 8.7) are fully unauthenticated: the former allows CPU exhaustion on the sharded cluster router, the latter triggers process termination on replica set members. These vulnerabilities affect MongoDB Server branches 7.0, 8.0, and 8.3, and are remediated in MongoDB Server versions 7.0.41, 8.0.30, and 8.3.9. Approximately 51,135 internet-exposed MongoDB instances running affected versions were identified via Shodan.

Why should TPRM professionals care?

MongoDB is one of the most widely deployed NoSQL database management systems, used across enterprise, cloud-native, and data-intensive application environments globally. CVE-2026-82067's silent authorization bypass is particularly insidious: an affected deployment reports no obvious indication that authorization is disabled, and the case-variant configuration condition may not be caught by standard configuration review. For TPRM teams, the combination of 51,135 exposed internet-facing MongoDB instances and three fully unauthenticated vulnerabilities means that vendors running unpatched MongoDB Server at external-facing positions represent direct data exposure risk. Patch verification should confirm specific version numbers (7.0.41, 8.0.30, or 8.3.9) for the deployed branch.

What questions should TPRM professionals ask vendors?

Have you upgraded all instances of MongoDB Server to the patched release corresponding to the deployed branch—7.0.41, 8.0.30, or 8.3.9—to mitigate the risk of the multiple vulnerabilities including CVE-2026-82067, CVE-2026-82075, and CVE-2026-82064?
Can you confirm if you have audited every mongod and mongos configuration file for the exact casing of security.authorization and any equivalent command-line flags to address the case-sensitivity mishandling in configuration validation (CVE-2026-82067)?
Have you restricted access to the diagnostic reporting interface to limit clusterMonitor and equivalent diagnostic-data privileges, reducing the population able to exploit CVE-2026-82070 for credential disclosure?
Can you confirm if you have audited aggregation query logs for invocations of internal expressions and for read access to collections outside a user's authorized scope to address the aggregation framework authorization bypasses (CVE-2026-82074 and CVE-2026-82073)?

Remediation recommendations

Upgrade MongoDB Server to version 7.0.41, 8.0.30, or 8.3.9 immediately depending on the deployed branch; these are the vendor's complete fixes for all 21 vulnerabilities in this cluster.
Verify authorization enforcement on all MongoDB deployments by reviewing startup logs and configuration for case sensitivity conditions that may have silently disabled authorization (CVE-2026-82067).
Restrict MongoDB network exposure to internal network access only; deployments directly exposed to the internet represent an unauthenticated attack surface given CVE-2026-82067, CVE-2026-82075, and CVE-2026-82064.

Black Kite's MongoDB - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

Roundcube - Sep2026

What is this vulnerability?

Roundcube released security updates 1.6.19 and 1.7.4 on September 6, 2026, addressing 12 vulnerabilities across the 1.6 LTS and 1.7 release branches. Roundcube Webmail is widely deployed open-source webmail software used across enterprise, hosting, education, and government environments, frequently bundled by hosting providers and control panels such as cPanel, Plesk, and Nextcloud. The Roundcube project did not assign CVE IDs to any of the 12 fixes in this release — meaning vulnerability scanners and software composition analysis tools relying on NVD feeds will not flag these issues and affected deployments may be reported as clean.

The most severe issue is a zero-click stored Cross-Site Scripting vulnerability in Roundcube's TNEF attachment handling, where a MIME tag injected into the attachment URL executes without any user click. An attacker needs only the ability to deliver an email to a user of an affected deployment — no Roundcube credentials, administrative privileges, or direct server access required. Successful exploitation may execute attacker-controlled JavaScript within the Roundcube application origin, exposing email content, contacts, session-accessible account data, and anti-CSRF tokens. The release also fixes a second XSS in the HTML editor, a Server-Side Request Forgery bypass in the CSS proxy via hexadecimal IPv6-mapped IPv4 addresses (enabling pivot to internal resources), three email header injection flaws enabling mail spoofing, a cross-user access flaw in the SQL address book, two CSS injection issues, and three remote-content blocker bypasses.

Why should TPRM professionals care?

Roundcube's broad deployment across hosting environments means a single rendering flaw exposes large pools of mailboxes across many downstream tenants. The zero-click TNEF XSS removes the interaction requirement that normally limits webmail XSS exploitation — email delivery is the only prerequisite. The three email header injection flaws allow spoofing that undermines email authentication controls and supports business email compromise campaigns. The SSRF bypass enables conversion of an externally exposed webmail interface into a pivot into protected internal network resources. Critically, the absence of CVE IDs means standard automated scanning will miss these vulnerabilities entirely — version-based detection is required, which is precisely what this FocusTag provides.

What questions should TPRM professionals ask vendors?

Have you updated all instances of Roundcube Webmail to versions 1.6.19 or 1.7.4 to mitigate the risk of the zero-click stored XSS vulnerability, SSRF bypass, and email spoofing flaws?
Can you confirm if you have implemented a restrictive Content Security Policy, enabled MFA where supported, and applied secure session cookie settings to further secure your Roundcube Webmail instances?
Have you applied egress filtering to prevent the Roundcube server from reaching internal networks, cloud metadata endpoints, and management interfaces, thereby mitigating the risk of the SSRF bypass vulnerability?
Have you migrated all Roundcube 1.5.x and earlier installations to a supported branch, and upgraded Roundcube 1.6.x to 1.6.19 and 1.7.x to 1.7.4, as recommended by the vendor?

Remediation recommendations

Update Roundcube Webmail to version 1.6.19 or 1.7.4 across all deployments immediately, including bundled instances in cPanel, Plesk, and Nextcloud; note that these 12 vulnerabilities carry no CVE IDs and will not appear in standard NVD-based scanner output.
Audit all Roundcube deployment instances across hosting environments, including control panel-bundled versions, as these may not be covered by standard patch workflows and may remain at vulnerable version levels.
Subscribe to Roundcube security advisories via GitHub Releases or the official Roundcube security mailing list to ensure future no-CVE security releases are captured in your patch management process.

Black Kite's Roundcube - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

Jenkins - Sep2026 (CVE-2026-84645, CVE-2026-84647, CVE-2026-84649, CVE-2026-84652, CVE-2026-53435, CVE-2026-70426)

What is this vulnerability?

Four high-severity vulnerabilities — CVE-2026-84645, CVE-2026-84647, CVE-2026-84649, and CVE-2026-84652 — were disclosed in Jenkins core as part of the September 2026 Jenkins Security Advisory. CVSSv3 scores range from 7.3 to 8.8. CVE-2026-84645 (CVSS 8.8) is the primary risk driver: a crafted config.xml submission can nest PersistenceRoot-marked objects as field values that subsequently handle HTTP requests through the Stapler framework, ultimately reaching an improperly protected Script Console and enabling authenticated RCE on the Jenkins controller. CVE-2026-84647 (CVSS 8.8) provides an independent privilege escalation path where any user with Overall/Read permission — the lowest meaningful Jenkins permission — can submit crafted form data to instantiate arbitrary configuration-related types.

CVE-2026-84649 (CVSS 8.8) is notable for its same-site attack surface: the CSRF token is embedded as a plaintext string in dynamically generated JavaScript resources loadable from sibling subdomains, enabling any co-hosted web service or compromised subdomain to extract valid session credentials and perform authorized Jenkins actions on behalf of any user. CVE-2026-84652 (CVSS 7.3) completes the picture with a session fixation path exploitable from the same-site position established by CVE-2026-84649, enabling full account takeover for any user whose 'remember me' session is in scope. This is the third deserialization-class RCE vulnerability disclosed in Jenkins within this reporting cycle, following CVE-2026-53435 and CVE-2026-70426. No active exploitation or public proof-of-concept has been confirmed at the time of disclosure. All four are remediated in Jenkins 2.580 and LTS 2.568.3.

Why should TPRM professionals care?

Jenkins is the world's most widely deployed CI/CD automation server — a compromised Jenkins controller has access to source code repositories, build artifact signing keys, deployment credentials, environment secrets, and the ability to inject malicious code into build pipelines that feed directly into production environments. The combination of CVE-2026-84645 (RCE from authenticated session) and CVE-2026-84647 (escalation from read-only access) creates a credible chain from minimal access to full controller compromise. Jenkins is a recurring high-value target because its role in software supply chains makes it an ideal pivot point for supply chain attacks affecting downstream customers and end users.

What questions should TPRM professionals ask vendors?

Have you upgraded all instances of Jenkins to version 2.580 (weekly) or Jenkins LTS 2.568.3 to fully remediate the vulnerabilities CVE-2026-84645, CVE-2026-84647, CVE-2026-84649, and CVE-2026-84652?
Have you implemented measures to restrict config.xml submission permissions, specifically Item/Configure, Agent/Configure, View/Configure, and Overall/Administer, to mitigate the risk of CVE-2026-84645?
Have you audited your same-site domain exposure for CVE-2026-84649 and CVE-2026-84652, and isolated Jenkins to its own dedicated domain where operationally feasible?
Have you disabled the Resource Root URL or migrated it to a separate domain as a mitigation measure for CVE-2026-84649?

Remediation recommendations

Upgrade Jenkins to version 2.580 or LTS 2.568.3 immediately; no workarounds exist for the four CVEs in this advisory.
Restrict Jenkins controller access to internal networks and authenticated VPN connections; Jenkins should not be directly accessible from the public internet.
Enforce principle of least privilege in Jenkins role assignments and audit all accounts holding Overall/Read or higher permissions, given CVE-2026-84647's escalation path from the lowest meaningful permission level.
Isolate Jenkins from co-hosted web services at the DNS and domain level to eliminate the same-site CSRF token exposure vector in CVE-2026-84649.

Black Kite's Jenkins - Sep2026 FocusTag® details critical insights on the event for TPRM professionals.

How TPRM Professionals Can Leverage Black Kite for These Vulnerabilities

This week's ten FocusTags® span the full spectrum of enterprise technology — from RMM platforms and network infrastructure to e-commerce, database engines, collaboration servers, webmail, and CI/CD automation. Black Kite's platform automatically identifies vendors in your third-party portfolio running any of these affected technologies at vulnerable versions, surfacing FocusTag® alerts directly on vendor scorecards without requiring manual research or vendor self-disclosure.

For the highest-urgency events this week — N-central's CVSS 10.0 RCE zero-day, Adobe Commerce's maximum-severity template injection, and MikroTrick's actively exploited router takeover chain — Black Kite's platform provides immediate portfolio-wide visibility into which MSP vendors, e-commerce providers, and network infrastructure suppliers require urgent engagement. TPRM professionals can filter their entire vendor portfolio by FocusTag® to generate a prioritized outreach list and begin structured vendor engagement using the pre-built questions provided in each tag.

For the seven Patch Tuesday and concurrent advisory tags — Fortinet, MSSQL, SharePoint, Exchange Server, MongoDB, Roundcube, and Jenkins — Black Kite enables differentiated prioritization: vendors with internet-exposed instances of critical severity tags are ranked above those with only internal deployments, and risk scores update automatically as patch status changes. The Bridge connector enables automated questionnaire dispatch to affected vendors at scale, turning ten simultaneous FocusTag® activations into structured, manageable vendor engagement workflows rather than ten separate manual assessment projects.

Strengthening TPRM Outcomes with Black Kite’s FocusTags®

This week's ten-tag release demonstrates the breadth of threat intelligence Black Kite's FocusTags® translate into actionable TPRM intelligence — from the highest-severity actively exploited zero-days to the quieter but significant Patch Tuesday batches affecting widely deployed enterprise infrastructure.

Maximum-Severity Zero-Day Detection: Two CVSS 10.0 vulnerabilities in widely deployed enterprise platforms — N-central's pre-authenticated RCE (CVE-2026-86218) and Adobe Commerce's template injection (CVE-2026-75650) — are both confirmed as actively exploited and CISA KEV listed. FocusTags® surface these immediately across your vendor portfolio, enabling same-day vendor engagement before exploitation reaches your third-party ecosystem.
Mass Exploitation Campaign Coverage: MikroTrick's six-vulnerability set was actively being exploited against 122,500 exposed RouterOS devices within days of disclosure. FocusTags® identify which vendors in your portfolio operate MikroTik network infrastructure, enabling targeted engagement before confirmed exploitation reaches their environments.
No-CVE Vulnerability Coverage: Roundcube's 12-fix security release carries no CVE identifiers, making it invisible to NVD-based vulnerability scanners. FocusTags® use version-based detection to close this gap, ensuring vendors running affected Roundcube deployments are surfaced in your portfolio even when standard scanning would report them as clean.
Patch Tuesday Scale Management: MSSQL's 61-CVE batch, SharePoint's 16-CVE batch, and Exchange Server's 9-CVE batch together represent 86 individual vulnerabilities in a single week. FocusTags® consolidate this into three structured vendor engagement workflows with pre-built questions and remediation guidance, enabling TPRM teams to manage large-scale Patch Tuesday releases without building custom assessments from scratch.
Differentiated Urgency Across a Mixed Week: This week spans CVSS 10.0 actively exploited zero-days, confirmed mass exploitation campaigns, and large Patch Tuesday batches with no confirmed exploitation. FocusTags® provide differentiated prioritization signals — routing N-central and Adobe Commerce to immediate escalation while scheduling MSSQL, SharePoint, and Exchange as urgent but non-emergency patch verification tasks.
Automated Vendor Scoring Across 10 Tags: FocusTags® automatically update vendor risk scores across the Black Kite platform for all third parties detected with internet-accessible instances of any of the ten affected products at vulnerable versions — providing immediate, portfolio-wide risk signal updates for N-central, Adobe Commerce, MikroTik, Fortinet, SQL Server, SharePoint, Exchange, MongoDB, Roundcube, and Jenkins without manual assessment effort.
Supply Chain and MSP Risk Identification: N-central's RMM platform breach propagates instantly across all MSP-managed client environments, and Jenkins controller compromises can inject malicious code into build pipelines affecting downstream software consumers. FocusTags® surface these supply chain multiplier risks explicitly, ensuring TPRM teams understand that vendor exposure to these specific technologies represents risk beyond the vendor themselves.

About Focus Friday

Every week, we delve into the realms of critical vulnerabilities and their implications from a Third-Party Risk Management (TPRM) perspective. This series is dedicated to shedding light on pressing cybersecurity threats, offering in-depth analyses, and providing actionable insights.

N-central - Sep2026: CVE-2026-86218, CVE-2026-86206, CVE-2026-86207, CVE-2026-18556, CVE-2026-18577, Pre-Authenticated CVSS 10.0 Remote Code Execution Zero-Day and Dual Authentication Bypass Vulnerabilities in N-able N-central RMM Platform (CISA KEV, Actively Exploited, Hotfix 4 Required).
Adobe Commerce & Magento: CVE-2026-75650, CVE-2026-7565, Unauthenticated Template Injection Remote Code Execution in Adobe Commerce and Magento Open Source Affecting All Versions (CISA KEV, Actively Exploited, Composer Hotfix Required).
MikroTrick: CVE-2026-67276, CVE-2026-86060, CVE-2026-67277, CVE-2026-67281, CVE-2026-67279, CVE-2026-67278, Six-Vulnerability Set Enabling Unauthenticated RouterOS Takeover via SSH Auth Bypass and Privilege Escalation Chain in MikroTik RouterOS (Active Exploitation Confirmed).
Fortinet - Sep2026 [Suspected]: CVE-2026-84393, CVE-2026-84391, CVE-2026-22575, Improper Certificate Validation in Agentless ZTNA Portal and Authenticated Denial of Service and Workflow Bypass in FortiOS, FortiProxy, FortiAnalyzer, and FortiManager.
MSSQL - Sep2026: CVE-2026-47297, CVE-2026-65669, CVE-2026-67378, CVE-2026-67379, CVE-2026-67636, and 56 additional CVEs, Largest Single-Month SQL Server Disclosure Batch with Unauthenticated RCE and Scope-Breaking Critical Vulnerabilities.
SharePoint - Sep2026: CVE-2026-69464, CVE-2026-69716, CVE-2026-69268, and 13 additional CVEs, Six Independent Remote Code Execution Pathways via Low-Privilege Authentication in Microsoft SharePoint Server Subscription Edition.
Exchange Server - Sep2026: CVE-2026-69356, CVE-2026-69641, CVE-2026-69355, CVE-2026-55007, and 5 additional CVEs, Unauthenticated XSS Spoofing and Multiple RCE Vulnerabilities in Microsoft Exchange Server.
MongoDB - Sep2026: CVE-2026-82067, CVE-2026-82075, CVE-2026-82064, and 18 additional CVEs, Silent Authorization Bypass and Unauthenticated Denial of Service Vulnerabilities in MongoDB Server 7.0, 8.0, and 8.3.
Roundcube - Sep2026: No CVE (12 fixes), Zero-Click Stored XSS in TNEF Attachment Handling, SSRF Bypass in CSS Proxy, Email Header Injection, and Cross-User Address Book Access in Roundcube Webmail.
Jenkins - Sep2026: CVE-2026-84645, CVE-2026-84647, CVE-2026-84649, CVE-2026-84652, CVE-2026-53435, CVE-2026-70426, Authenticated Remote Code Execution via Deserialization Chain and Multiple Privilege Escalation Paths in Jenkins CI/CD Controller.
PaperCut MF/NG - Aug2026: CVE-2026-81578, CVE-2026-82078, Unauthenticated Authentication Bypass via Apache Tapestry Dual-Page Request Format Enabling Unsafe Class Loading Remote Code Execution in PaperCut MF and NG (Emergency Patch Release 2 Required).
SonicWall SMA1000 - Aug2026: CVE-2026-83548, CVE-2026-83549, Pre-Authentication SSRF and OS Command Injection Zero-Day Chain Enabling Unauthenticated Remote Code Execution on SonicWall SMA1000 Secure Access Gateways (CISA KEV, Actively Exploited).
Sangoma Switchvox: CVE-2026-9586, Unauthenticated SQL Injection via /pa Endpoint Enabling PostgreSQL Superuser OS Command Execution in Sangoma Switchvox SMB Edition (CISA KEV, Mass-Exploit Campaign Active).
MongoDB BI Connector: CVE-2026-75159, CVE-2026-75573, Kerberos-Triggered Denial of Service and TLS Private-Key Password Disclosure in MongoDB Connector for BI (mongosqld).
TrueConf - Aug2026: CVE-2026-72529, CVE-2026-72530, Unauthenticated Pre-Authentication Remote Code Execution via Chained Missing Authentication and Sandbox Escape Vulnerabilities in TrueConf Server, Actively Exploited by Head Mare APT (CISA KEV).
OpenSSL - Aug2026: CVE-2026-18798, CVE-2026-63072, CVE-2026-63076, and 6 additional CVEs, Denial-of-Service and AEAD Authentication Tag Bypass Vulnerabilities in QUIC, CMS, CMP, DTLS, RPK, and AEAD Components of OpenSSL.
Apache Tomcat - Aug2026 (Latest): CVE-2026-65182, CVE-2026-68525, CVE-2026-68569, CVE-2026-65637, and 7 additional CVEs, Multiple Authentication and Authorization Bypass Vulnerabilities in Apache Tomcat Affecting 187,461 Exposed Internet-Facing Services.
PostgreSQL - Aug2026: CVE-2026-14669, Heap-Based Buffer Overflow in to_char(timestamptz) Enabling Authenticated Remote Code Execution as OS User in PostgreSQL (Public PoC Available).
WordPress Elementor - Aug2026: CVE-2026-32475, Unauthenticated Arbitrary File Upload to Remote Code Execution via Loop Desynchronization in Elementor Pro WordPress Plugin (Mass-Exploit Campaigns Active).
Citrix NetScaler - Aug2026: CVE-2026-8452, Pre-Authentication Memory Overflow in SAML Signature Canonicalization enabling Remote Code Execution as Root in NetScaler ADC and NetScaler Gateway.
VMware vCenter - Aug2026: CVE-2026-59309, CVE-2026-59310, Authentication Bypass in VMware Directory Service and Directory Traversal RCE in vCenter Syslog Server enabling Unauthenticated Full vCenter Takeover.
Zimbra - Aug2026: CVE-2026-73570, Unauthenticated SNMP Command Injection enabling Arbitrary OS Command Execution as zimbra User in Zimbra Collaboration Suite.
Oracle WebLogic - Aug2026: CVE-2026-60702, and 7 additional CVEs (CVSS up to 9.9), Multiple Unauthenticated Remote Code Execution and Takeover Vulnerabilities via T3 and IIOP in Oracle WebLogic Server.
Roundcube - Aug2026: No CVE, Remote Code Execution via markasjunk Plugin cmd_learn Driver and Server-Side Request Forgery Bypass Vulnerabilities in Roundcube Webmail.
Water Sector Campaign: CVE-2017-16740, Active Cyber Campaign Targeting Internet-Facing Rockwell MicroLogix PLCs Causing Operational Disruptions at U.S. Water and Wastewater Utilities.
Metabase: CVE-2026-72898, Unauthenticated SQL Injection via /api/session/reset_password enabling Full Administrator Takeover in Metabase Business Intelligence Platform.
Cisco ASA & FTD - Aug2026: CVE-2026-20349, Unauthenticated Denial of Service via Crafted HTTP Request to Remote Access SSL VPN Service in Cisco Secure Firewall ASA and FTD.
Cisco IMC - Aug2026: CVE-2026-20200, CVE-2026-20288, Argument Injection via SSH Public Key Retrieval Feature enabling Low-Privilege to Root Escalation in Cisco Integrated Management Controller.
Cisco IOS XE - Aug2026: CVE-2026-20272, CVE-2026-20267, and 5 additional CVEs, Multiple Critical and High-Severity Vulnerabilities including Command Injection and Authentication Bypass in Cisco IOS XE Software.
Adobe ColdFusion - Aug2026: CVE-2026-48362, and 14 additional CVEs (CVSS up to 10.0), Multiple Critical Remote Code Execution and Deserialization Vulnerabilities in Adobe ColdFusion.
SharePoint - Aug2026: CVE-2026-63520, CVE-2026-66808, and 13 additional CVEs, Multiple Deserialization and Unauthenticated Remote Code Execution Vulnerabilities in Microsoft SharePoint Server.
Exchange Server - Aug2026: CVE-2026-62912, CVE-2026-65813, and 5 additional CVEs, Multiple Remote Code Execution and Privilege Escalation Vulnerabilities in Microsoft Exchange Server.
ClamAV - Aug2026: CVE-2026-20337, CVE-2026-20338, and 5 additional CVEs, Multiple ZIP Parser and File Processing Denial of Service Vulnerabilities in ClamAV Antivirus Engine.
pgAdmin - Aug2026: CVE-2026-17566, CVE-2026-17349, CVE-2026-17351, CVE-2025-13780, CVE-2026-12045, Remote Code Execution via Unsafe Deserialization and Multiple Critical Vulnerabilities in pgAdmin 4.
Django - Aug2026: CVE-2026-15307, CVE-2026-15920, CVE-2026-15337, CVE-2026-15830, Remote Code Execution and Multiple High-Severity Vulnerabilities in Django Web Framework.
Jenkins - Aug2026: CVE-2026-70426, JEP-200 Deserialization Filter Bypass enabling Remote Code Execution in Jenkins Automation Server.
TeamCity - Jul2026: CVE-2026-63077, Unauthenticated Authentication Bypass via Agent Polling Protocol leading to Remote Code Execution in JetBrains TeamCity On-Premises.
Cisco FMC - Jul2026: CVE-2026-20316, CVE-2026-20079, Static Credential Authentication Bypass and Critical Authentication Bypass (CVSS 10.0) leading to Root Execution in Cisco Secure Firewall Management Center.
SolarWinds WHD - Aug2026: CVE-2026-28323, CVE-2026-28299, SAML Authentication Bypass and Denial of Service Vulnerability in SolarWinds Web Help Desk.