Rosetta Daily · Sep 23, 2026
Three of the four entries CISA added to the exploited catalogue today are security appliances themselves — Check Point's Security Management Server, Arista's VeloCloud Orchestrator, F5 BIG-IP APM. All three sit in the layer that manages other devices, so one box is every policy and session it holds.
Actively exploited (KEV)
F5 BIG-IP APM: a heap overflow exploited as a zero-day (CVE-2026-94127)
F5 shipped updates for a flaw already being used in remote code execution attacks. CISA added it to the exploited catalogue the same day.
Sources: Bleeping Computer · CISA
Check Point Security Management Server: directory traversal plus upload, scripts run without logging in (CVE-2026-93616, CVSS 9.8)
Check Point says the attacks happened on July 23 against a handful of targets, and released emergency hotfixes on September 22. This is the server that pushes firewall policy. CVE-2026-85102, improper certificate validation, entered the catalogue alongside it.
Sources: The Hacker News · Bleeping Computer · NVD
Arista VeloCloud Orchestrator: unauthenticated access to privileged internal functions (CVE-2026-93952, CVSS 9.5)
Only on-premises orchestrators that authenticate their Edge devices with certificates are affected; hosted deployments are not. Arista confirmed exploitation on September 22.
Sources: The Hacker News · NVD
[Added detail] Zyxel GS1900 switches (CVE-2026-7273, CVSS 8.8): the operator is a Chinese-speaking actor
The attacker behind the catalogue entry now has a shape: a Chinese-speaking actor chaining the Zyxel GS1900 flaw with WordPress vulnerabilities, taking government data from 996 devices and more than 18,500 records in backend databases. CISA has given federal agencies until Thursday to patch.
Sources: Bleeping Computer · Bleeping Computer · The Hacker News
Critical vulnerabilities
Bifrost AI gateway: one HTTP request runs commands with no credentials (CVE-2026-90898, CVSS 9.8)
Bifrost is an open-source gateway that routes requests to more than 20 LLM providers. In HTTP transport before 2.1.0, with management authentication left off, an unauthenticated attacker runs arbitrary commands on the gateway host — the host that holds every downstream provider's API credentials.
Sources: The Hacker News
D-Link DIR-822A: maximum severity, public proof of concept, no patch (CVE-2026-86296)
D-Link's own notice says the model is legacy and end of support, no fix is coming, and owners should retire the device.
Sources: Bleeping Computer
Linux kernel ARM64 KVM: guests read and write host kernel memory (CVE-2026-89775)
On ARM64 hosts with nested virtualization enabled, a freed piece of host memory stays exposed to the guest. The researcher who found it says it can be used to escape the guest and run code on the host.
Sources: The Hacker News
SharePoint Server: a flaw Microsoft filed as spoofing is authenticated remote code execution (CVE-2026-65660)
Microsoft rated it CVSS 6.5 as a spoofing issue. Full technical details from Viettel Cyber Security researcher Dinh Ho Anh Khoa show it reaches authenticated RCE. SharePoint Server 2016, 2019 and Subscription Edition are affected and patches are out. The practical cost of the low rating is where it landed in everyone's patch queue.
Sources: The Hacker News
ManageEngine ADSelfService Plus: remote code execution in the GINA client (CVE-2026-74849, CVSS 9.8; CVE-2026-75791, CVSS 8.6)
Builds before 7001 are affected. The GINA client is the component that runs on the Windows logon screen for domain self-service password reset. The second entry is an authentication bypass in the REST API.
Erlang/OTP: a TLS 1.3 client completes the handshake without validating the server certificate (CVE-2026-89422, CVSS 9.3)
A pre_shared_key extension in a ServerHello that the client never offered causes the client to finish the handshake with certificate validation skipped, so any peer that answers the connection can impersonate the intended server. The same batch carries an algorithmic complexity flaw in the asn1 OBJECT IDENTIFIER decoder, letting an unauthenticated remote attacker cause denial of service with a crafted OID during the handshake (CVE-2026-65634, CVSS 8.2).
OpenStack Octavia: control characters pass URL validation and land in the HAProxy config (CVE-2026-94571, CVE-2026-94572, both CVSS 9.4)
Before 18.0.1 the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields, nor in the listener and pool tls_ciphers field. The RFC 3986 validator percent-encodes control characters before checking them, so newlines pass the structural test, while Octavia stores and writes the raw unencoded value into the HAProxy configuration generated on the amphora.
WordPress core: an unauthenticated visitor makes a site load a PHP file from outside its theme folders
Fixed on September 22 in 7.1.2, with fixes for every branch the project still supports, back to 4.7. On some server configurations it goes further and runs the attacker's code. This is a separate issue from Comment2Shell, fixed in 7.1.1 on September 17.
Sources: The Hacker News
Perl's Net::IDN::Punycode: four memory-safety and decoding-correctness flaws
In the XS backend, encode_punycode sizes the output buffer from the input length and then emits code-point digits without checking room on every write, giving a heap overflow (CVE-2016-15059, CVSS 9.8). decode_punycode computes the insertion pointer before growing the buffer, giving a use-after-free (CVE-2026-74766, CVSS 8.4). The buffer is released only on the success path, so each rejected label leaks it (CVE-2026-87078, CVSS 9.1). The pure-Perl decoder uses defined to detect end of input, but substr on an exhausted string returns the empty string, so a truncated label decodes to a name containing a character that was never encoded (CVE-2026-87080, CVSS 9.1). This library sits in the domain-name handling path, where the input comes off the network.
Vendor advisories
CISA published nine ICS advisories in one day: eight Siemens, two lwIP
The two Siemens entries with the shortest path to impact: Industrial Edge Management has an authentication bypass that lets an unauthenticated remote attacker take over an account by resetting credentials without completing email verification (CVE-2026-18963), and the Open Interface Services web module in Siveillance Control allows arbitrary file upload leading to root-level access on the OIS server (CVE-2026-50093). The lwIP pair: an out-of-bounds write in the MQTT client application gives full code execution on the device (CVE-2026-87121, CVSS 9.8), and a double free in the API can corrupt memory (CVE-2026-91018, CVSS 8.8). lwIP is a very common embedded TCP/IP stack, so its reach is counted in downstream products rather than installations.
Sources: CISA ICS · CISA ICS · CISA ICS
Web security research
BigDiskBuster: fill the disk and Microsoft Defender cannot install signature updates
A zero-day proof of concept published on GitHub on September 19, with no CVE, no patch and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits have been used in real attacks. The technique opens no new door; it leaves the defence stopped on old signatures before the attack starts.
Sources: The Hacker News · Bleeping Computer
A rogue external MFA provider steals passwords during legitimate logins
Researchers built an attack in which someone with privileged access registers an external MFA provider they control. From then on, every ordinary login hands that provider the user's password. It happens inside the second-factor exchange, so nothing looks wrong from the user's side.
Sources: Bleeping Computer
AI security
MaxKB: assistants with tools expose shell execution and never ask for approval (CVE-2026-77521, CVSS 10)
Before 2.10.5-lts, any assistant carrying a tool, MCP tool, skill or sub-application uses SandboxShellBackend, which does not exclude the execute shell tool and omits execute from interrupt_on, so the human approval step does not exist. Untrusted chat or ingested content therefore reaches a shell. The same versions let authenticated workspace members inject control characters into the AWS Bedrock access_key_id and secret_access_key fields, appending a new AWS profile when they are written to /root/.aws/credentials (CVE-2026-79916, CVSS 9.1).
mcp-atlassian: the HTTP transport's token verifier accepts any non-empty token (CVE-2026-77244)
AtlassianOpaqueTokenVerifier performs no real verification. In the single-user deployment pattern, where the operator puts Jira or Confluence credentials in server-side environment variables, anyone who can reach the MCP endpoint can use those server-side credentials against Atlassian.
Sources: GitHub Advisory
vLLM: KV transfer parameters go essentially unvalidated in disaggregated deployments, five denial-of-service entries (all CVSS 8.7)
Through 0.29.0, the NIXL connector's handling of kv_transfer_params in prefill/decode disaggregated deployments can be crashed from outside: an incomplete dictionary raises an uncaught KeyError in EngineCore scheduling (CVE-2026-94622), a multi-prompt request trips a block-count assertion (CVE-2026-94623), arbitrary remote host and port values retain ZeroMQ sockets (CVE-2026-94624), and an unvalidated tp_size exhausts memory until the kernel OOM-kills the decode worker (CVE-2026-94626). The Mooncake connector adds GPU memory exhaustion from concurrent child requests sharing one transfer ID (CVE-2026-94627). All are reachable from the OpenAI-compatible completion endpoints.
Other
ShinyHunters claims an FBI breach through an Oracle PeopleSoft zero-day
The extortion group says it reached internal FBI services and holds data on current and former employees as well as people who applied for jobs at the agency. The statement was posted on its dark web site. The FBI has not confirmed it, and Oracle has published no advisory for the claimed PeopleSoft zero-day.
Sources: The Hacker News · Bleeping Computer
Sweden fines Miljödata SEK 1.8 million over the August 2025 breach
The Swedish data protection authority IMY found the IT systems provider's security measures inadequate. The breach affected 2.2 million people; the fine is roughly $183,000.
Sources: Bleeping Computer