Security Digest: May 13, 2026 - 62 Critical Vulnerabilities

Today’s security picture is dominated by active-risk flaws in sandboxing, ERP, firewall, ecommerce, and JavaScript supply-chain components. The most urgent issues include vm2 sandbox escapes, ERPNext authorization bypasses, OPNsense root RCE, and multiple CubeCart paths to full server compromise.

2026-05-13 · 11 min read

Security Digest: May 13, 2026 — 62 Critical Vulnerabilities

Executive Summary

Today’s security picture is dominated by active-risk flaws in sandboxing, ERP, firewall, ecommerce, and JavaScript supply-chain components. The most urgent issues include vm2 sandbox escapes, ERPNext authorization bypasses, OPNsense root RCE, and multiple CubeCart paths to full server compromise.

Act now: prioritize internet-facing systems, admin consoles, and any application that runs untrusted code or processes user-controlled templates, manifests, or metadata. Several of today’s issues can lead directly to remote code execution, while others expose secrets, payment integrity, or internal infrastructure.

Critical Vulnerabilities

CVE-2026-44005: vm2 sandbox prototype pollution escape
- Impact: Attackers can break out of the Node.js sandbox and mutate host prototypes, enabling host compromise.
- Affected Systems: vm2 3.9.6 through 3.10.5
- Immediate Action: Upgrade to 3.11.0 immediately; disable untrusted sandbox execution until patched.
- Mitigation: Treat any application embedding vm2 as exposed if it runs attacker-controlled JavaScript.
CVE-2026-45411: vm2 async generator sandbox escape
- Impact: Arbitrary command execution on the host through sandbox escape.
- Affected Systems: vm2 prior to 3.11.3
- Immediate Action: Upgrade to 3.11.3 now.
- Mitigation: Remove trust in any vm2-based isolation until patched and revalidated.
CVE-2026-44007: vm2 nesting bypass
- Impact: Sandbox code can bypass require restrictions and execute OS commands on the host.
- Affected Systems: vm2 prior to 3.11.1
- Immediate Action: Upgrade to 3.11.1 and disable nesting: true for untrusted code.
- Mitigation: Assume any nested NodeVM handling untrusted input is compromised.
CVE-2026-44442: ERPNext authorization bypass
- Impact: Authenticated users can modify data beyond their role.
- Affected Systems: ERPNext prior to 16.9.1
- Immediate Action: Upgrade to 16.9.1 immediately.
- Mitigation: Review privileged accounts and audit recent data changes.
CVE-2026-44377: CubeCart authenticated SSTI to RCE
- Impact: Admin-level attackers can read sensitive files or execute arbitrary PHP commands.
- Affected Systems: CubeCart prior to 6.7.0
- Immediate Action: Upgrade to 6.7.0; restrict admin access now.
- Mitigation: Check email templates, documents, and other template-driven modules for abuse.
CVE-2026-45714: CubeCart authenticated SSTI in multiple modules
- Impact: Arbitrary operating system command execution.
- Affected Systems: CubeCart prior to 6.7.0
- Immediate Action: Patch to 6.7.0 immediately.
- Mitigation: Limit administrative access and review template content for malicious payloads.
CVE-2026-45053: CubeCart REST API file upload to webshell
- Impact: Attackers with API file permissions can upload PHP files and gain RCE.
- Affected Systems: CubeCart prior to 6.7.0
- Immediate Action: Upgrade to 6.7.0 and rotate API keys with files:rw access.
- Mitigation: Inspect the web-accessible images/source/ directory and document root for unexpected PHP files.
CVE-2026-45055: CubeCart host-header password reset takeover
- Impact: Unauthenticated attackers can hijack password reset flows and take over accounts.
- Affected Systems: CubeCart 6.6.x through 6.7.1
- Immediate Action: Upgrade to 6.7.2 now.
- Mitigation: Review recent password reset activity and rotate exposed credentials.
CVE-2026-45708: CubeCart invoice editor to public PHP execution
- Impact: An admin with document permissions can plant PHP that executes when orders are printed.
- Affected Systems: CubeCart prior to 6.7.3
- Immediate Action: Upgrade to 6.7.3 and restrict document-edit permissions.
- Mitigation: Audit invoice templates and the files/print.*.php path.
CVE-2026-44194: OPNsense local user sync RCE
- Impact: Authenticated users with user-management privileges can execute commands as root.
- Affected Systems: OPNsense prior to 26.1.8
- Immediate Action: Upgrade to 26.1.8 immediately.
- Mitigation: Restrict user-management roles and review sync-user activity.
CVE-2026-45158: OPNsense DHCP config command execution
- Impact: Remote code execution as root via DHCP configuration input.
- Affected Systems: OPNsense prior to 26.1.8
- Immediate Action: Upgrade to 26.1.8 now.
- Mitigation: Validate interface and DHCP settings after patching.
CVE-2026-44193: OPNsense XMLRPC config restore RCE
- Impact: Remote code execution through unsanitized XMLRPC input.
- Affected Systems: OPNsense prior to 26.1.7
- Immediate Action: Upgrade to 26.1.7 or later immediately.
- Mitigation: Restrict XMLRPC exposure and review remote management access.
CVE-2026-41225: BIG-IP iControl REST command execution
- Impact: Highly privileged authenticated users can create objects that run arbitrary commands.
- Affected Systems: F5 BIG-IP / BIG-IQ affected versions; EoTS not evaluated
- Immediate Action: Apply the latest F5 security update and restrict Manager/Admin roles.
- Mitigation: Audit automation and API users with elevated privileges.
CVE-2026-44193: OPNsense XMLRPC RCE
- Impact: Remote code execution via configuration restore.
- Affected Systems: OPNsense prior to 26.1.7
- Immediate Action: Patch to 26.1.7+.
- Mitigation: Limit XMLRPC access and review restore workflows.
CVE-2026-44351: previously alerted
CVE-2026-42602: previously alerted
CVE-2026-42561: previously alerted
CVE-2026-42551: previously alerted
CVE-2026-43997: previously alerted
CVE-2026-44006: previously alerted
CVE-2026-43999: previously alerted
CVE-2026-44001: previously alerted
CVE-2026-43998: previously alerted
CVE-2026-44471: previously alerted
CVE-2026-44004: previously alerted
CVE-2026-42583: previously alerted
CVE-2026-42587: previously alerted

Note: The remaining critical items span ERPNext, BIG-IP/BIG-IQ, Next.js, protobufjs/protobufjs-cli, Nautobot, LangSmith/LangChain, systeminformation, uniget, Grav, Anchor, and several older but still high-risk Joomla/Huawei/Lenovo issues. Patch versions are listed in vendor advisories and should be applied without delay.

Previously Alerted

What to Do Now

Patch internet-facing systems first — especially ecommerce, firewall, ERP, and Node.js services that process templates, manifests, or sandboxed code.
Disable or isolate untrusted execution paths — sandboxing, admin template editors, API file upload endpoints, and workflow engines.
Rotate credentials where admin consoles, password reset flows, API keys, or config secrets may have been exposed.
Audit for abuse — look for new webshells, unexpected PHP files, suspicious template edits, and unusual outbound requests.
Verify versions against vendor release notes and confirm patched builds are actually deployed.

Verification steps: inventory all systems using vm2, CubeCart, ERPNext, OPNsense, Next.js, Nautobot, LangSmith/LangChain, protobufjs, systeminformation, and uniget. Confirm the fixed versions are installed, then re-check exposed admin endpoints and file-write locations.

Monitoring recommendations: watch for new admin users, template changes, unexpected outbound DNS/HTTP traffic, PHP files in web roots, and shell activity from web processes. On firewalls and edge systems, review logs for configuration changes and suspicious API calls.

Related Resources

Internal blog post: May 13, 2026 Exploitation Watchlist (publishing soon).
Official vendor advisories: vm2, ERPNext, CubeCart, OPNsense, F5 BIG-IP/BIG-IQ, Next.js, Nautobot, LangSmith, protobufjs, and Grav security notices.

Security Digest: May 13, 2026 - 62 Critical Vulnerabilities