Security Digest: September 7, 2026 - 13 Critical Vulnerabilities

Today’s alert is high-risk for both exposed internet services and internal business systems. The most urgent issue is a CRITICAL Advantech command-injection flaw with public exploit code, alongside multiple high-severity SQL injection, authorization bypass, and unrestricted upload vulnerabilities that can quickly lead to full compromise.

· 11 min read

Executive Summary

Today’s alert is high-risk for both exposed internet services and internal business systems. The most urgent issue is a CRITICAL Advantech command-injection flaw with public exploit code, alongside multiple high-severity SQL injection, authorization bypass, and unrestricted upload vulnerabilities that can quickly lead to full compromise. Teams should patch the Advantech devices immediately, then prioritize any internet-facing school, voting, tourism, and hospital-order systems listed below.

Action now: identify affected assets, apply vendor fixes or approved patches, restrict access to exposed admin endpoints, and monitor for suspicious requests and new accounts.

Critical Vulnerabilities

CVE-2026-79698: Advantech WISE-6610 Node-RED command injection

  • Impact: Remote attackers can inject commands and potentially take control of the device.
  • Affected Systems: Advantech WISE-6610-NB/EB/TB/JB/CB, WISE-6610-EL variants, and WISE-6610P variants running 1.2.1_20251110.
  • Immediate Action: Patch now to 1.2.4_20260821; if you cannot patch immediately, remove internet exposure and restrict management access.
  • Mitigation: Upgrade to the fixed release and review Node-RED library usage for abnormal command execution.

CVE-2026-86313: Samsung Walrus out-of-bounds write

  • Impact: Memory corruption may enable code execution or service crash.
  • Affected Systems: Samsung Opensource Walrus build af80e665ea49d9003695a66502f841ed1d8397e7.
  • Immediate Action: Identify any products embedding this build and apply the vendor fix as soon as it is available.
  • Mitigation: Update the affected component; isolate exposed services until patched.

CVE-2026-86268: itsourcecode School Management System SQL injection

  • Impact: Attackers can query or alter the database remotely.
  • Affected Systems: School Management System 1.0, User_Login.php.
  • Immediate Action: Take the login endpoint off the public internet if possible and patch the application immediately.
  • Mitigation: Apply vendor fixes, rotate database credentials, and review for unauthorized logins.

CVE-2026-86272: U+Smart Enjoyment WebSite unrestricted upload

  • Impact: Attackers can upload malicious files and potentially execute code or deface content.
  • Affected Systems: Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000, /Report/Upload/UploadFormImg.ashx.
  • Immediate Action: Disable or restrict upload functionality until patched.
  • Mitigation: Apply the vendor fix and enforce file-type, size, and path validation.

CVE-2026-86273: projeto-siga SSRF in HTML-to-PDF endpoint

  • Impact: Remote attackers can force the server to make internal requests.
  • Affected Systems: projeto-siga up to 11.1.1, DownloadExterno.getUrl.
  • Immediate Action: Block access to the HTML-to-PDF endpoint from untrusted networks.
  • Mitigation: Apply patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 and add SSRF filtering.

CVE-2026-86276: Syllabus-Aligned LMS hard-coded credentials

  • Impact: Exposed credentials can let attackers authenticate and move laterally.
  • Affected Systems: SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0, db.php.
  • Immediate Action: Rotate all embedded secrets and database passwords immediately.
  • Mitigation: Remove hard-coded credentials from code and redeploy with secret management.

CVE-2026-86277: Syllabus-Aligned LMS authorization bypass

  • Impact: Unauthorized users may delete exams or alter protected records.
  • Affected Systems: SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0, delete_exam.php.
  • Immediate Action: Restrict access to exam administration endpoints now.
  • Mitigation: Apply the vendor fix and verify server-side authorization checks.

CVE-2026-86282: Tourism Management System SQL injection

  • Impact: Remote attackers can steal or modify database data.
  • Affected Systems: jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132, CommonController.java.
  • Immediate Action: Apply patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 immediately.
  • Mitigation: Validate all table and column parameters; monitor for injection probes.

CVE-2026-86290: Online Voting System SQL injection

  • Impact: Attackers can manipulate voting data and backend records.
  • Affected Systems: SourceCodester Online Voting System 1.0, /voting/ajax.php?action=save_category.
  • Immediate Action: Remove public access to the voting admin interface until patched.
  • Mitigation: Patch immediately and review database integrity.

CVE-2026-86261: hosp_order authorization bypass

  • Impact: Attackers may access or alter orders without proper authorization.
  • Affected Systems: sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, OrderController.java.
  • Immediate Action: Restrict order-management endpoints and review access logs.
  • Mitigation: Apply the fix from the project once available; enforce server-side permission checks.

CVE-2026-86292: Simple Traffic Offense System missing authentication

  • Impact: Remote attackers can create users without authenticating.
  • Affected Systems: SourceCodester Simple Traffic Offense System 1.0, saveuser.php.
  • Immediate Action: Disable user creation endpoints until patched.
  • Mitigation: Apply the vendor fix and audit newly created accounts.

CVE-2026-86262: hosp_order authorization bypass in order update

  • Impact: Unauthorized users may update order status or disease information.
  • Affected Systems: sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, OrderController.java.
  • Immediate Action: Lock down order update APIs and review recent changes.
  • Mitigation: Apply the available project fix and verify authorization on every request.

CVE-2026-86263: hosp_order order cancellation authorization bypass

  • Impact: Attackers can cancel orders remotely without permission.
  • Affected Systems: sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, orderRecordsService.cancelOrder.
  • Immediate Action: Restrict cancellation functions and inspect cancellation activity.
  • Mitigation: Apply the project fix when released and enforce strict access control.

Previously Alerted

What to Do Now

  1. Patch the Advantech issue first and remove any public exposure to WISE-6610 management interfaces.
  2. Inventory all affected applications and identify any internet-facing installs of the school, voting, tourism, and hospital-order systems.
  3. Apply vendor fixes or approved patches immediately; where no patch is available, disable the vulnerable endpoint or isolate the host.
  4. Rotate credentials for systems exposed to hard-coded secrets, login flaws, or possible database access.
  5. Check logs for abuse including command injection, SQL injection, unusual uploads, SSRF-style requests, and unauthorized admin actions.

Verification: confirm patched versions, validate that vulnerable endpoints are no longer reachable, and test that access controls block unauthorized users. Review recent account creation, exam deletion, order changes, and file uploads for signs of compromise.

Monitoring: alert on spikes in 4xx/5xx responses, new admin sessions, outbound requests to internal IPs, unexpected shell commands, and database errors tied to login or upload endpoints.

Related Resources

  • Internal blog posts: add links to your organization’s patch-status dashboard and incident-response playbook for web application exploitation.
  • Official vendor advisories: Advantech security update for WISE-6610; Samsung Walrus component advisory; and project/vendor notices for the affected open-source applications listed above.

Keep reading