Security Digest: September 8, 2026 - 29 Critical Vulnerabilities

Today’s advisory is dominated by high-risk remote attack paths, including unauthenticated code execution, auth bypasses, file write/read flaws, and exposed management APIs. Several issues already have public exploit disclosure, which means defenders should assume active scanning will begin immediately.

· 16 min read

Executive Summary

Today’s advisory is dominated by high-risk remote attack paths, including unauthenticated code execution, auth bypasses, file write/read flaws, and exposed management APIs. Several issues already have public exploit disclosure, which means defenders should assume active scanning will begin immediately. Prioritize internet-facing systems, VPN and network appliances, SAP components, WordPress plugins, and any service exposed to untrusted users.

Action now: patch or isolate affected systems, disable exposed management interfaces, and verify no unauthorized access, file changes, or new admin accounts have appeared.

Critical Vulnerabilities

  • CVE-2026-44756: EPP processing memory safety flaw
    • Impact: Crafted unauthenticated network requests may trigger undefined behavior, crashes, and potentially broader compromise.
    • Affected Systems: Extended Passport Protocol (EPP) processing library.
    • Immediate Action: Remove Internet exposure, apply vendor fixes, and restart affected services after patching.
    • Mitigation: Block untrusted EPP traffic at the edge and monitor for abnormal terminations.
  • CVE-2026-86510: D-Link DIR-822A L2TP parser out-of-bounds write
    • Impact: Remote attackers can exploit this to crash or potentially take control of the router; exploit is public.
    • Affected Systems: D-Link DIR-822A A_101.
    • Immediate Action: Disconnect from the Internet if unpatched; replace or update immediately.
    • Mitigation: Restrict management access and watch for reboot loops or configuration changes.
  • CVE-2026-71376: Cosminexus Component Container command injection
    • Impact: Remote code execution via OS command injection.
    • Affected Systems: Multiple Cosminexus versions from 09-00 through 11-70-01 (see vendor ranges).
    • Immediate Action: Patch to fixed releases now; treat exposed instances as high risk.
    • Mitigation: Limit access to trusted networks and review for suspicious process execution.
  • CVE-2026-86543: knowns management API exposed without authentication
    • Impact: Attackers can open public tunnels and republish the API externally.
    • Affected Systems: knowns versions before 0.30.0.
    • Immediate Action: Update immediately and disable unauthenticated API exposure.
    • Mitigation: Bind management interfaces to localhost or a private network only.
  • CVE-2026-58240: SAP NetWeaver Message Server registration weakness
    • Impact: Unauthorized components may register and perform actions inside the application environment.
    • Affected Systems: SAP NetWeaver Message Server.
    • Immediate Action: Apply SAP guidance and restrict network reachability now.
    • Mitigation: Segment internal app-server registration traffic and log all registration events.
  • CVE-2026-62645: Reyrolle 7SR5 session ID exposure
    • Impact: Attackers may derive session IDs and bypass authentication.
    • Affected Systems: Reyrolle 7SR5 versions before V2.70.
    • Immediate Action: Upgrade device firmware and isolate management access.
    • Mitigation: Review active sessions and force credential resets where supported.
  • CVE-2026-71377: Cosminexus Component Container command argument injection
    • Impact: Potential command execution through crafted arguments.
    • Affected Systems: Multiple Cosminexus versions from 09-00 through 11-70-01 (see vendor ranges).
    • Immediate Action: Patch immediately and disable unneeded interfaces.
    • Mitigation: Monitor for unusual child processes and shell activity.
  • CVE-2026-86509: D-Link DIR-895L stack buffer overflow
    • Impact: Local-network attackers can trigger overflow and potentially compromise the device; exploit is public.
    • Affected Systems: D-Link DIR-895L A1_102b07.
    • Immediate Action: Update firmware or remove from service until patched.
    • Mitigation: Restrict LAN access, especially guest or unmanaged segments.
  • CVE-2026-76969: @sap/cds-mtxs credential and tenant data exposure
    • Impact: Unauthenticated attackers may steal credentials and alter or delete tenant data.
    • Affected Systems: Multitenant CAP applications using @sap/cds-mtxs with extensibility enabled.
    • Immediate Action: Apply vendor updates and review tenant permissions immediately.
    • Mitigation: Rotate exposed secrets and audit tenant changes.
  • CVE-2026-86542: knowns path traversal file write
    • Impact: Attackers can write files outside the imports directory and overwrite arbitrary writable files.
    • Affected Systems: knowns versions before 0.30.0.
    • Immediate Action: Patch now and restrict upload/import endpoints.
    • Mitigation: Watch for unexpected file creation or configuration tampering.
  • CVE-2026-50093: Siemens Siveillance Control file upload leading to root
    • Impact: Arbitrary file upload may lead to root access and full host compromise.
    • Affected Systems: Siveillance Control Pro and Siveillance Control versions listed below vendor-fixed builds.
    • Immediate Action: Update to fixed versions immediately and isolate the OIS web module.
    • Mitigation: Inspect for webshells, new services, and privilege escalation.
  • CVE-2026-66768: SAP GUI for Java trust policy bypass
    • Impact: Low-privileged attackers can trigger arbitrary command execution on victim machines.
    • Affected Systems: SAP GUI for Java.
    • Immediate Action: Patch clients and limit trusted backend connections now.
    • Mitigation: Restrict backend trust relationships and review endpoint protections.
  • CVE-2026-76958: SAP Integration Suite XML external entity issue
    • Impact: Sensitive file contents may be exposed; resource exhaustion is also possible.
    • Affected Systems: SAP Integration Suite internal components.
    • Immediate Action: Apply SAP fixes and block untrusted XML input.
    • Mitigation: Disable external entity resolution where possible.
  • CVE-2026-86544: knowns authorization bypass
    • Impact: Read-restricted users can modify permission settings and escalate privileges.
    • Affected Systems: knowns versions before 0.30.0.
    • Immediate Action: Patch immediately and review permission changes.
    • Mitigation: Audit for unexpected role or policy edits.
  • CVE-2026-81790: Csomagpontok és szállítási címkék WooCommerce-hez missing authorization
    • Impact: Incorrect access control may allow unauthorized actions by authenticated users.
    • Affected Systems: Plugin versions before 4.2.8.
    • Immediate Action: Update the plugin now and review admin permissions.
    • Mitigation: Remove unused plugins and test access controls.
  • CVE-2026-48888: WooCommerce resource exhaustion DoS
    • Impact: Attackers can trigger HTTP denial of service.
    • Affected Systems: WooCommerce versions before 11.1.0.
    • Immediate Action: Update immediately and rate-limit exposed endpoints.
    • Mitigation: Add WAF rules and monitor request spikes.
  • CVE-2026-62649: Reyrolle 7SR5 request flood crash
    • Impact: High request volume can crash and reboot the device.
    • Affected Systems: Reyrolle 7SR5 versions before V2.70.
    • Immediate Action: Patch and isolate management access.
    • Mitigation: Apply network rate limits and watch for reboot events.
  • CVE-2026-86538: knowns path traversal read flaw
    • Impact: Unauthenticated attackers can read arbitrary files, including credentials and configs.
    • Affected Systems: knowns through 0.30.0.
    • Immediate Action: Update and block access to the preview endpoint.
    • Mitigation: Search logs for traversal patterns and unusual file reads.
  • CVE-2026-62647: Reyrolle 7SR5 predictable security values
    • Impact: Predictable session-related values may enable impersonation and unauthorized access.
    • Affected Systems: Reyrolle 7SR5 versions before V2.70.
    • Immediate Action: Upgrade firmware and rotate credentials.
    • Mitigation: Review authentication logs for repeated or unusual tokens.
  • CVE-2026-71375: Cosminexus XML external entity flaw
    • Impact: XXE can expose local files and internal data.
    • Affected Systems: Multiple Cosminexus versions from 09-00 through 11-70-01 (see vendor ranges).
    • Immediate Action: Patch now and disable external entity processing.
    • Mitigation: Filter XML inputs and inspect for outbound entity fetches.
  • CVE-2026-62646: Reyrolle 7SR5 low-entropy session IDs
    • Impact: Attackers may brute-force or predict valid session identifiers.
    • Affected Systems: Reyrolle 7SR5 versions before V2.70.
    • Immediate Action: Upgrade and invalidate existing sessions.
    • Mitigation: Enforce MFA where possible and monitor auth anomalies.
  • CVE-2026-86539: knowns SSRF in embedding model test endpoint
    • Impact: Attackers can probe internal hosts and metadata services.
    • Affected Systems: knowns through 0.33.0.
    • Immediate Action: Patch and restrict outbound network access.
    • Mitigation: Block access to cloud metadata endpoints from the app network.
  • CVE-2026-81798: Easy Appointments DOM XSS
    • Impact: Attackers can run script in users’ browsers.
    • Affected Systems: Easy Appointments through 4.0.2.1.
    • Immediate Action: Update the plugin and review exposed appointment pages.
    • Mitigation: Clear cached pages and verify input/output encoding.
  • CVE-2026-84817: JetFormBuilder unauthenticated XSS
    • Impact: Remote attackers can inject script without authentication.
    • Affected Systems: JetFormBuilder 3.6.5.1 and earlier.
    • Immediate Action: Patch immediately and inspect public forms.
    • Mitigation: Add WAF filtering and validate all form fields.
  • CVE-2026-9331: EDD Product Catalog Feed unauthorized option deletion
    • Impact: Authenticated users can delete option values and potentially cause site-wide denial of service.
    • Affected Systems: EDD Product Catalog Feed up to 1.0.2.
    • Immediate Action: Update plugin and review subscriber-level access.
    • Mitigation: Audit options changes and remove unnecessary privileges.
  • CVE-2026-84818: Open User Map unauthenticated XSS
    • Impact: Script injection can target visitors without login.
    • Affected Systems: Open User Map 1.4.50 and earlier.
    • Immediate Action: Patch now and sanitize map content.
    • Mitigation: Purge caches and verify all public inputs.
  • CVE-2026-81781: Unbounce Landing Pages missing authorization
    • Impact: Incorrect access controls may allow unauthorized actions.
    • Affected Systems: Unbounce Landing Pages through 1.1.4.
    • Immediate Action: Update and review connected accounts and permissions.
    • Mitigation: Recheck role boundaries and API access.
  • CVE-2026-84820: Unlimited Elements for Elementor unauthenticated XSS
    • Impact: Remote attackers can inject script into WordPress sites.
    • Affected Systems: Unlimited Elements For Elementor 2.0.17 and earlier.
    • Immediate Action: Patch immediately and inspect public widgets/templates.
    • Mitigation: Use a WAF and review all front-end inputs.

Previously Alerted

What to Do Now

  1. Patch or isolate every exposed system listed above, starting with internet-facing appliances, SAP services, and WordPress plugins.
  2. Disable or restrict management interfaces to trusted networks only; if no patch is available, take the service offline.
  3. Rotate credentials and session secrets for any affected platform where authentication bypass, file exposure, or command execution is possible.
  4. Check for compromise by reviewing logs for unusual requests, new admin accounts, file writes, webshells, unexpected reboots, and outbound connections.
  5. Verify versions against vendor advisories and confirm fixes were applied, not just downloaded.

Verification steps: confirm patched build numbers, scan exposed ports, and validate that vulnerable endpoints are no longer reachable. For appliances and SAP systems, review change logs and restart status after remediation.

Monitoring recommendations: alert on authentication anomalies, file integrity changes, repeated 4xx/5xx spikes, outbound calls to unknown hosts, and any process spawning shells or command interpreters.

Related Resources

  • Internal blog posts on emergency patch triage, SAP exposure hardening, and WordPress plugin risk reduction (to be published).
  • Official vendor advisories from D-Link, SAP, Siemens, Hitachi, and WordPress plugin maintainers.

Keep reading