Rosetta Daily · Sep 10, 2026
CISA added four exploited vulnerabilities in one day, three of them in security appliances themselves. Cisco Secure FMC and Citrix NetScaler share a weakness class — authentication bypass using an alternate path or channel; the Fortinet entry is a 2025 heap overflow that only reached the catalog today.
Actively exploited (KEV)
Cisco Secure Firewall Management Center and Security Cloud Control: authentication bypass to root on the underlying OS (CVE-2026-20079)
An unauthenticated remote attacker can bypass authentication, execute script files on the device, and from there obtain root on the underlying operating system. Cisco has confirmed exploitation, and Talos says it is tracking exploitation of two FMC vulnerabilities. A firewall management platform is where policy originates; taking it means taking the rule set of every device it manages.
Sources: Bleeping Computer · Cisco Talos · CISA
[Added detail] Citrix NetScaler: authentication bypass enters KEV (CVE-2026-19490)
The catalog entry names the affected configurations: an unauthenticated remote attacker can bypass authentication when the appliance is configured as an AAA virtual server or runs as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy). Instances doing plain load balancing are outside that scope.
[Added detail] Chromium V8: out-of-bounds write enters KEV (CVE-2026-87491)
Code execution occurs inside the sandbox, and the trigger is a crafted HTML page. The catalog entry states the reach explicitly: not just Chrome, but Chromium-based browsers including Edge and Opera. The fix shipped with the 230 vulnerabilities Google patched in one release.
Sources: CISA · The Hacker News
Fortinet FortiOS, FortiSwitchManager and FortiSASE: heap overflow via crafted packets (CVE-2025-25249)
The flaw lets an attacker execute unauthorized code or commands. This is a 2025 identifier that only reached the catalog on September 9 on evidence of exploitation. Environments that applied that year's patches are unaffected; environments running long-lived, untouched Fortinet appliances should re-check versions against this entry.
Critical vulnerabilities
cPanel and WHM: one mail-privileged hosting account reaches root
An authenticated account holder can create files of their choosing on the server through EmailTrack, and from there run code as root. cPanel says every supported version is affected. Shared hosting rests on the premise that one compromised account does not reach the others; this removes that premise entirely.
Sources: The Hacker News
Predis: CRLF smuggling in pipelined commands injects arbitrary Redis commands (CVE-2026-84372)
On aggregate connections (cluster or replication), an attacker who can influence any pipelined argument — a value or a key, such as a URL slug used as a cache key — can smuggle additional Redis commands into the connection. No authentication is needed, and the attacker never has to touch Redis directly.
Sources: GitHub Advisory
CakePHP: JSON path parameter is SQL-injectable on the Postgres driver (CVE-2026-77635, plus CVE-2026-77634)
The $jsonPath argument of FunctionsBuilder::jsonValue($field, $jsonPath) is not neutralized under the Postgres driver, so user-controlled data reaching it is an injection point. CVE-2026-77634, fixed in the same release, is header injection: Message::setHeaders() and addHeaders() do not strip CRLF. Fixed in 5.3.7, 5.2.15/5.2.14 and 5.1.10/5.1.9.
Sources: GitHub Advisory · GitHub Advisory
Microsoft Defender: ShieldCrash proof-of-concept published on Patch Tuesday, grants SYSTEM
The researcher describes it as a bypass of the patch for CVE-2026-69414 (ShieldBreak, CVSS 7.8) — that is, the flaw reported last month was not properly fixed. The release landed immediately after the September updates. It is not in the KEV catalog and there are no reports of in-the-wild use. The two outlets give different researcher handles: Bleeping Computer writes Nightmare Eclipse, The Hacker News writes Chaotic Eclipse.
Sources: Bleeping Computer · The Hacker News
xmldom: ten advisories, five of them a previous fix defeated by one line terminator
Five are bypasses. createProcessingInstruction() performs no validation on its target, so a single > breaks out of the <?...?> boundary (CVE-2026-83616). Element names, attribute names, a DocType's publicId and systemId, and creation-time QName validation can all be bypassed with an embedded line terminator — a name whose first line is well-formed slips through, and everything after the break is emitted verbatim (CVE-2026-83617, CVE-2026-83618, CVE-2026-83609, CVE-2026-83608). The other five are complexity defects: quadratic-time attribute deduplication and error-recovery re-scan, quadratic memory in namespace maps, output amplification from a case-mismatched HTML raw-text closing tag, and end-tag ReDoS on the 0.8.x line.
Sources: GHSA-c7q8-3ch8-vqpv · GHSA-jxjr-3g7g-3944 · GHSA-27p8-2357-5qqv · GHSA-93r5-fhx6-vmg9
HTTPX2 and httpcore2: wss://through a SOCKS5 proxy never starts TLS (CVE-2026-84381)
The caller explicitly selects the secure wss scheme, but httpcore2 does not start TLS on the SOCKS5 path, so the WebSocket opening handshake and every subsequent frame crosses the proxy in plaintext. Affects httpcore2 before 2.10.0. The same batch carries a decompression amplification issue (CVE-2026-84382): each network read is fully decompressed before content is yielded, so a small compressed input drives a large allocation even when the application is streaming.
Sources: GitHub Advisory · GitHub Advisory
Composer: a malicious package's Perforce source URL runs commands on install or update (CVE-2026-84361)
This requires the p4 client to be installed and a package repository that allows arbitrary Perforce source URLs — packagist.org does not, so it is unaffected. Composer passed the package's Perforce address straight to p4, and the command ran with it. Environments using private or self-hosted Composer repositories should check against this.
Sources: GitHub Advisory
Okta: five advisories, clustered at both ends of the identity path
A privileged Access Gateway script does not neutralize shell metacharacters in SNMP configuration values, so an authenticated local user with management-interface access executes OS commands as root (CVE-2026-78630). The Hyperdrive Agent writes the decoded SAML bearer assertion into a local log file at the default log level on every successful MFA completion, making a live credential readable by any local user who can read the log (CVE-2026-78631). The same plugin, when the organization's policy requires no MFA for a user, returns a bare boolean with no signed assertion — an unverifiable authentication verdict handed to the relying application (CVE-2026-78629). Also fixed: a missing option terminator in the Privileged Access scaleft:// handler (CVE-2026-78635) and junction-following in the Okta Verify uninstaller (CVE-2026-78622).
Adobe Acrobat Reader: roughly 25 CVEs in one release, one of which needs no user interaction (CVE-2026-81996, CVSS 8.8)
Nearly all of them require the victim to open a malicious file, and cluster into use-after-free, out-of-bounds read/write and integer overflow. The exception is CVE-2026-81996: incorrect authorization letting a low-privileged attacker escalate, explicitly marked as requiring no user interaction, with scope changed.
Sources: NVD
@yeger/turbo-graph and ESPHome Device Builder: services that should hear only the local machine bound to every interface
The embedded Next.js server in @yeger/turbo-graph listens on 0.0.0.0:29312 by default, and its /api/run endpoint executes Turborepo tasks with no authentication (CVE-2026-59160). ESPHome's Home Assistant add-on gets there differently: the dashboard's ingress site legitimately skips authentication because the supervisor authenticates upstream, but it bound 0.0.0.0, and the add-on runs in host network mode for mDNS — so any device on the LAN can open it (CVE-2026-59177).
Sources: GitHub Advisory · GitHub Advisory
functype-mcp-server: an MCP tool interpolates a version string into a package specifier and installs it (CVE-2026-59176)
set_functype_version accepts an unconstrained version string, interpolates it into functype@<version>, and installs it with pnpm add followed by a dynamic import. Package alias syntax lets an attacker name any package, and installation is execution.
Sources: GitHub Advisory
Windows ML CLI: bound to localhost, but CORS set to wildcard (CVE-2026-84452)
serve/cli_api.py in winml-cli exposes every CLI command over HTTP with no authentication. It binds localhost by default, but sets allow_origins to a wildcard — so any web page the user visits can drive it from the browser.
Sources: GitHub Advisory
.NET and Visual Studio: three advisories in Microsoft.DiaSymReader.Native
Two remote code execution issues (CVE-2026-69522, CVE-2026-71328) and one elevation of privilege (CVE-2026-69439), all in the same native component. The remedy is updating the SDK and its dependencies, not patching Visual Studio alone.
Sources: GitHub Advisory · GitHub Advisory · GitHub Advisory
Alby Hub: an internet-exposed self-hosted Lightning wallet can be taken over and drained
The flaw affects versions from v1.7.0. Alby stresses it only applies where the owner made the Hub reachable from the internet — but remote reachability is precisely why self-hosted wallets of this kind get put on the internet.
Sources: The Hacker News
AI security
DeepSeek Harness: a sandboxed agent turned off its own sandbox with one command
The tool exists to run a coding agent's commands inside an OS sandbox so that an agent handling untrusted files cannot write outside its workspace. The agent could remove that limit by calling the tool's own web endpoint — the constraint and the switch that releases it were held in the same hand.
Sources: The Hacker News
AI service tokens in infostealer logs are replayable, and MFA does not enter into it
Stealers like Lumma Stealer and Vidar already harvest credentials, session tokens and API keys. Applied to AI services, the captured tokens can simply be replayed — multi-factor authentication plays no part in token reuse. The reporting names model providers including Google and Anthropic.
Sources: The Hacker News
Other
[Added detail] Plex: over 36,000 internet-facing servers remain unpatched
Last week's notice — upgrade immediately, no statement of what was fixed — now has a number attached: more than 36,000 exposed Plex Media servers are still vulnerable. Withholding what was fixed does not slow exploitation; it only removes the administrator's basis for prioritizing.
Sources: Bleeping Computer
The Lean theorem prover: a defect that lets a "checked" proof pass
Trail of Bits reported a bug affecting every stable version of Lean up to 4.33.1, patched in v4.34.0-rc1. The credibility of the 13-million-line Lean formalization of Fermat's Last Theorem rests on the correctness of the proof checker itself — when the checker has a hole, the weight of "machine-verified" has to be re-weighed.
Sources: Trail of Bits
[Added detail] Trezor: this time the email provider was breached, and users are receiving phishing
This is Trezor's second notice within the week caused by a third party — here its email provider, whose access the attackers are using to deliver phishing to customers. A hardware wallet vendor's customer list is a high-value target in itself, and once it leaks it stays useful indefinitely.
Sources: Bleeping Computer
Skullcandy Dime 3 earbuds: any nearby unpaired device can pair with them
CERT/CC warns that the earbuds accept Bluetooth pairing requests from nearby unpaired devices with no user interaction required. The microphone and audio channel are open to any attacker in physical proximity.
Sources: Bleeping Computer