Rosetta Daily · Sep 18, 2026
Microsoft published seven Copilot and Azure AI advisories on 17 September — command injection, SSRF, missing authentication for a critical function, improper authorization. The same day NVD carried Feast failing to verify JWT signatures, Chroma failing to check tenant ownership, Coze Studio failing to check workspace ownership, and Angel deserializing without an allowlist. Not one of these is about model behaviour. All of them are authorization checks in the service layer underneath the model.
Actively exploited (KEV)
[Added detail] Cisco Identity Services Engine: the authentication bypass is confirmed as a zero-day exploited in the wild (CVE-2026-76460, CVSS 10.0)
The flaw is in the authentication control on an API endpoint: an unauthenticated remote attacker who sends a crafted request gains access to the device without going through the web management interface at all. Cisco says it has observed exploitation in attacks. The CVE entered the KEV catalogue on 16 September.
Sources: The Hacker News · Bleeping Computer · NVD
Critical vulnerabilities
Cisco ASA / FTD / FMC and Nexus Dashboard: a hardening bundle following an internal audit (CVE-2026-20332, CVSS 9.9, among others)
Cisco released dozens of advisories in one batch, the output of an internal security review of its firewall and management planes. Besides CVE-2026-20332 at the top, three are worth reading on their own: deserialization in the FMC web management plane lets an authenticated user execute commands as root (CVE-2026-20340, 8.8); improper TLS certificate management on the sftunnel link lets an adjacent attacker impersonate the peer device and obtain manager-role access, equivalent to root (CVE-2026-20323, 8.3); and the ISE SXP REST API carries a SQL injection (CVE-2026-20284, 9.1). Several more cover remote denial of service over DTLS, IKEv2 and TLS 1.3.
Sources: NVD
Check Point Security Management and Log Servers: unauthenticated code execution as root
The Security Management Server is the machine that controls firewall policy and administrator access, so what this flaw reaches is control of the whole policy set. Check Point shipped a fix through its LivePatch channel and says it has no indication the flaw has been exploited.
Sources: The Hacker News
Unbound DNSSEC validator: a malicious zone triggers a heap overflow (CVE-2026-81642)
Every Unbound release before 1.26.1 is affected. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Maintainer NLnet Labs shipped 1.26.1 the same day. The CVE is not in the KEV catalogue.
Sources: The Hacker News
BIND 9: fourteen flaws, one of which takes down DoH service with no credentials
ISC released 9.20.29 and 9.21.26. Any BIND server answering DNS-over-HTTPS is affected — a single request carrying an invalid SIG record crashes the named process, and the sender needs no credentials.
Sources: The Hacker News
Docker Sandboxes: a VM on macOS can read and write host files outside the project directory (CVE-2026-77179)
Malicious code inside the sandbox can escape the project directory shared into it and read or change files anywhere on the host, with the rights of the host account running the virtual machine. Docker published its announcement on 15 September and rates it Critical.
Sources: The Hacker News
SafeLine: the management console's session-signing secret can be recomputed offline (CVE-2026-92749, CVSS 9.2)
Versions through 9.4.1 derive the session-signing key from a time-seeded math/rand generator. An unauthenticated remote attacker who can bound the install timestamp reconstructs the key, forges valid administrator session cookies and takes control of the sites it protects. The product is a WAF.
Sources: NVD
UVdesk and AVideo: two applications, each bypassing authentication end to end (CVE-2026-92805, CVSS 9.3; CVE-2026-92578, CVSS 9.2)
UVdesk Community Skeleton through 1.1.8 neither authenticates its installation-wizard endpoints nor checks whether installation has already completed, so an unauthenticated attacker can repoint the database and create super administrator accounts. AVideo through 29.0 accepts the stored password hash itself as a valid credential — anyone holding the users.password value can log in as any user, through two independent code paths.
Chamilo LMS: the CStudio upload flow allows unauthenticated remote code execution (CVE-2026-45140, CRITICAL)
Arbitrary code execution on the server with no authentication at all.
Sources: GitHub Security Advisories
AI security
Microsoft: seven Copilot and Azure AI advisories in one day
M365 Copilot's Business Chat carries a command injection leading to information disclosure (CVE-2026-78501), and Microsoft Copilot carries the same class of injection (CVE-2026-55946). M365 Copilot has two more: a command injection elevation of privilege (CVE-2026-85885) and an incorrect permission assignment leading to information disclosure (CVE-2026-85887). Azure AI Foundry has two, both exploitable by an unauthenticated attacker for privilege escalation: missing authentication for a critical function (CVE-2026-85889) and SSRF (CVE-2026-85917). Azure Machine Learning carries incorrect authorization leading to information disclosure (CVE-2026-68791).
Feast: JWT signatures are not verified before identity is established (CVE-2026-92787, CVSS 9.3)
Versions through 0.66.0 accept an unverified token. Presenting one with a hardcoded claim value bypasses all role-based access control, yields a trusted internal identity, and grants unchecked read and write access to every entity, feature view, data source and permission policy on the server. Feast is a feature store, sitting upstream of both training and inference data.
Sources: NVD
Angel and nanobot: one deserialization, one SSRF (CVE-2026-92785, CVE-2026-92576, both CVSS 9.2)
Angel through 3.3.0 deserializes the setAlgoMetrics payload with Kryo, without class registration or allowlist validation; an unauthenticated network attacker sending crafted serialized objects to the master RPC endpoint can instantiate arbitrary classes or exhaust coordinator memory. In nanobot before 0.3.0, _validate_url() in WebFetchTool fails to block internal ranges, so instructing the bot to fetch cloud metadata endpoints, localhost services and RFC 1918 addresses extracts IAM credentials.
Chroma and Coze Studio: neither checks who the tenant or workspace belongs to (CVE-2026-92782, CVSS 8.6; CVE-2026-92788, CVSS 8.7)
Chroma through 1.5.9 does not validate the tenant and database segments when resolving collections, so an authenticated attacker who knows a collection identifier can read, modify and update another tenant's collections by issuing requests under their own tenant path. Coze Studio through 0.5.1 does not validate that table names in workflow SQL customization nodes belong to the caller's workspace; table identifiers are predictable, so an attacker can read, insert and delete against other workspaces' memory databases.
ComfyUI and LightGBM: loading someone else's workflow or model file is enough to go out of bounds (CVE-2026-92816, CVE-2026-92786, both CVSS 8.5)
ComfyUI before 0.30.0 does not sanitize folder_name in dataset save nodes; a crafted workflow writes attacker-controlled content to arbitrary paths outside the output directory, reaching code execution through modified startup files or package initializers. LightGBM through 4.7.0 does not validate child and split array values when parsing text models, so a malicious model file triggers an out-of-bounds write at an attacker-chosen offset in the leaf_depth_ buffer during SHAP feature-contribution computation.
Supply chain
Brevo: one stolen Cloudflare API key put ClickFix scripts on customer sites
Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its own websites and into JavaScript files embedded on customer sites, to distribute malware. The blast radius therefore extends past Brevo's own domains.
Sources: Bleeping Computer
Incidents
Gyazo: 23.62 million user records and 490 million image metadata records
Helpfeel's image-sharing service Gyazo disclosed that the exposed user records include email addresses and password hashes. A further 490 million image metadata records were exposed, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links.
Sources: The Hacker News
Vendor advisories
[Added detail] Windows domain login failures: Microsoft publishes a workaround
After the September security updates, domain trust relationships broke on some enterprise systems and valid domain credentials stopped working. Microsoft shared a temporary fix on 16 September.
Sources: Bleeping Computer
Windows 11 24H2 Home and Pro stop receiving updates next month
Microsoft reminded customers that devices running the 24H2 Home and Pro editions reach end of support in October.
Sources: Bleeping Computer