Security Digest: February 27, 2026 - 3 Critical Vulnerabilities

Three high-severity vulnerabilities demand immediate attention: privilege escalation in Statamic CMS, unauthorized data access in Umbraco Engage, and unverified account creation in phpMyFAQ.

· 3 min read

Today's Critical Security Threats

Three high-severity vulnerabilities demand immediate attention: privilege escalation in Statamic CMS, unauthorized data access in Umbraco Engage, and unverified account creation in phpMyFAQ.

Critical Vulnerabilities

CVE-2026-27939: Statamic CMS Privilege Escalation

  • Impact: Authenticated users can elevate privileges, accessing sensitive operations.
  • Affected Systems: composer statamic/cms, versions prior to 6.4.0.
  • Immediate Action: Upgrade to version 6.4.0 immediately.
  • Mitigation: Ensure all systems are updated and monitor user access logs for unusual activity.

CVE-2026-27449: Umbraco Engage Unauthorized Data Access

  • Impact: Attackers can query API endpoints without authentication, accessing sensitive data.
  • Affected Systems: nuget Umbraco.Engage.Forms, versions before 16.2.1 and 17.1.1.
  • Immediate Action: Update to versions 16.2.1 or 17.1.1 immediately.
  • Mitigation: Review API access logs and restrict network access to the affected endpoints.

CVE-2026-27836: phpMyFAQ Unverified Account Creation

  • Impact: Unauthenticated users can create accounts, potentially leading to database exhaustion.
  • Affected Systems: composer thorsten/phpmyfaq with default WebAuthn controllers.
  • Immediate Action: Implement temporary access controls or disable the WebAuthn prepare endpoint.
  • Mitigation: Apply rate limiting and enable CSRF protections immediately.

Previously Alerted

What to Do Now

  1. Upgrade all affected software versions as specified.
  2. Verify patch application by checking version numbers and functionality.
  3. Monitor access logs for unusual activity and potential exploitation attempts.

Related Resources

Keep reading