Rosetta Daily · Sep 15, 2026

Both of today's large disclosures are single-vendor sweeps rather than single bugs. Contec's 31 CVEs cover ten product families and repeat the same four defects — OS command injection behind a login, path traversal over FTP, stored XSS, CSRF — which is the shape of one audit applied across a shared web stack, not ten independent findings.

Actively exploited (KEV)

Cisco Secure Email Gateway: unauthenticated remote attacker reaches root command execution (CVE-2026-76461, CVSS 9.8)

CISA added the flaw to the KEV catalogue on September 14 and classifies it as SQL injection; Cisco describes insufficient validation in the AsyncOS email parsing logic, reachable by an unauthenticated remote attacker. A mail gateway sits at the front of the mail flow and terminates it, so that parser is reachable by anyone who can deliver a message to the appliance.

Sources: The Hacker News · CISA KEV

Critical vulnerabilities

Contec and CONPROSYS: 31 CVEs in one day across ten product families (CVE-2026-82762 through CVE-2026-82796)

The set covers the FX5000/FX4000/FX3000 series, SGA1000, RP-WAH-SR series, EC1000 series, CONPROSYS M2M Gateway and Controller, PAC series, TM series, nano series, HMI System (CHS), CPSL-08P1EN, the CAN 2.0B wireless LAN/USB converter and SolarView Compact. Most of the OS command injections require a login first, but several do not: CPSL-08P1EN is missing authentication on a critical function, so a remote attacker can operate the product without credentials (CVE-2026-82787, CVSS 8.7); the RP-WAH-SR and EC1000 web services contain buffer overflows where one crafted request executes an arbitrary program (CVE-2026-82770, CVE-2026-82772, both 8.7); and the M2M and PAC series return a directory listing to an unauthenticated remote request (CVE-2026-82775, CVE-2026-82778).

Sources: NVD

Joomla Conditional Content Pro before 8.0.0: inline PHP in an article runs as the web-server process (CVE-2026-85192, CVSS 9.4)

The extension passes PHP condition rules written in article syntax to the conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves that syntax, so an account with only Author rights publishes an article and the code runs on the server.

Sources: NVD

ESPHome Device Builder: an environment variable rename silently disables dashboard authentication on upgrade (CVE-2026-59178, CRITICAL)

The dashboard used to read credentials from $USERNAME / $PASSWORD. When those were renamed to $ESPHOME_USERNAME / $ESPHOME_PASSWORD the bare names were dropped with no fallback. An operator who protected the dashboard the way the older getting-started guide documented loses authentication on upgrade, and the configuration itself raises no error.

Sources: GitHub Security Advisories

D-Link DIR-878 120B05: two remotely reachable stack overflows (CVE-2026-90692, CVE-2026-90693, both CVSS 9.4)

One is in SetDynamicDNSIPv6Settings via the IPv6Address/Hostname arguments, the other in SetWan3Settings via Primary/Secondary.

Sources: NVD

D-Link DWR-M920 and DWR-M921: three OS command injections with public exploits (CVE-2026-90699, CVSS 8.6; CVE-2026-90702 and CVE-2026-90703, CVSS 8.5)

The arguments reach a command directly, in the M920's PIN management setup and the M921's disk format and share creation handlers.

Sources: NVD

Apache Doris 3.1.x through 4.1.3: an authenticated user bypasses privilege checks (CVE-2026-72524, CVSS 8.8)

Incorrect authorization lets an authenticated user access or modify data they are not entitled to. Fixed in 4.0.8 and 4.1.4.

Sources: NVD

Logitech Options+ updater service: local privilege escalation to SYSTEM (CVE-2026-12518, CVSS 8.5)

The Windows updater service lets a low-privileged local user execute arbitrary code as SYSTEM.

Sources: NVD

ZITADEL: the token exchange endpoint does not verify who the token belongs to (CVE-2026-56668, HIGH)

The OAuth2 Token Exchange flow is missing a check: it does not validate that the incoming access token belongs to or is authorized for the client initiating the exchange, and it does not require the newly requested scopes to stay inside the original token's. An attacker holding a token for one low-privilege application can exchange it for an elevated token at a different application, which defeats the client-permission and project-role separation an administrator configured.

Sources: GitHub Security Advisories

AI security

HexStrike AI and PentestAgent: offensive AI frameworks expose their command-execution endpoints to the network (CVE-2026-90617 through CVE-2026-90620, CVE-2026-90690, CVE-2026-90691)

HexStrike AI's hexstrike_server.py carries four issues, all with public exploits: the execute endpoint passes code/script to a system command, the tools endpoint interpolates target/username/password/payload arguments into subprocess.Popen, the files endpoint allows path traversal on filename, and the command endpoint has no authentication at all. PentestAgent's two are the same shape — run_task in its MCP HTTP server and LocalRuntime.execute_command both take injected commands remotely. Running attack tools is what these frameworks are for, so the boundary that matters is not execution itself but who is allowed to invoke it.

Sources: NVD

Oraios AI Serena before 1.0.0: the MCP server binds 0.0.0.0 in HTTP mode (CVE-2026-38924, CVSS 2.9)

The supplier acknowledged 0.0.0.0 as a "potential security hazard", but the documentation at the time of the report recommended running Serena in a sandboxed environment rather than binding 127.0.0.1.

Sources: NVD

Vendor advisories

[Added detail] Microsoft Edge absorbs 206 Chromium CVEs in a single batch (CVE-2026-87429 through CVE-2026-87658)

Between 00:51 and 00:55 UTC on September 15, MSRC published 206 Chromium-ingest advisories at once: 29 of them use-after-free, seven in V8. The September 12 batch held seven and September 11 held fifteen — this one is a different order of magnitude.

Sources: MSRC

[Added detail] Microsoft ships out-of-band updates for the RDS failures its September patches caused

The same out-of-band release also addresses Hyper-V problems and USB audio device failures on some Windows versions (KB5124008, KB5124012).

Sources: Bleeping Computer · Bleeping Computer

Windows Secure Kernel Mode elevation of privilege (CVE-2026-85921)

A double free lets an authorized attacker elevate privileges locally.

Sources: MSRC

Security research

DDRop: dropping memory writes breaks Intel TDX and AMD SEV-SNP confidential computing

An attacker inserts a small circuit that silently drops writes to the server's memory, so the processor keeps reading stale encrypted data as if it were current. It requires an attacker who already controls the server's software and can briefly access the machine physically — which is the threat model confidential computing exists to defeat.

Sources: The Hacker News

Telegram Desktop: exported HTML chat logs carry executable JavaScript

Researchers at ExPatch published on September 12 that a bot's message can plant hidden JavaScript in a chat. Inside Telegram the message looks ordinary, with a link button; the script runs only when someone opens the exported HTML file in a browser, and it can then copy every message in that file out.

Sources: The Hacker News

Other

Revolut discloses a breach in which the data was requested by an attacker impersonating a government agency

Revolut says it shared data belonging to an undisclosed number of customers with a threat actor posing as a government agency. Financial information and passports are among the exposed data.

Sources: Bleeping Computer

Japan's Digital Agency: a VPN flaw exposed around 246,000 personnel record rows

The agency describes roughly 246,000 record rows containing personal information of government employees.

Sources: Bleeping Computer

WordPress runs an automated security review on every plugin update

New plugins were already reviewed on entry to the directory, but updates shipped continuously after that. The new check analyses each release before it is distributed through the WordPress.org update API.

Sources: The Hacker News

Homebrew 7.0.0 adds a built-in vulnerability scanner

The release brings a built-in scanner, stronger security controls, and the full release of the native BrewUI graphical interface.

Sources: Bleeping Computer