Security Digest: September 24, 2026 - 18 Critical Vulnerabilities

Today’s alert is urgent: 18 critical vulnerabilities were disclosed across CMS platforms, brokers, WebSocket services, AI/API gateways, and developer tooling. Several issues allow remote code execution, authentication bypass, SSRF, stored cross-user XSS, and full-service denial of service with little or no user interaction.

· 27 min read

Executive Summary

Today’s alert is urgent: 18 critical vulnerabilities were disclosed across CMS platforms, brokers, WebSocket services, AI/API gateways, and developer tooling. Several issues allow remote code execution, authentication bypass, SSRF, stored cross-user XSS, and full-service denial of service with little or no user interaction.

Act now: prioritize internet-facing services first, patch exposed systems immediately, and temporarily disable risky features where upgrades are not yet possible. If you run any of the affected products below, assume they are targetable today.

Critical Vulnerabilities

CVE-2026-57149: Plone Classic portlet code execution

  • Impact: Authenticated users who can edit Classic portlets can trigger arbitrary code execution inside the Plone process.
  • Affected Systems: plone.app.portlets on Plone 6.0, 6.1, and 6.2.
  • Immediate Action: Upgrade immediately to plone.app.portlets 5.0.8, 6.0.4, or 7.0.2 depending on your Plone line.
  • Mitigation: Remove ManageOwnPortlets from untrusted roles and disable the Classic portlet if you cannot patch right away.

CVE-2026-85724: moquette MQTT ACL bypass and broker crash

  • Impact: Untrusted MQTT clients can bypass pattern ACLs, disrupt sessions, and crash the broker; this is not RCE, but it is a serious integrity and availability issue.
  • Affected Systems: io.moquette:moquette-broker.
  • Immediate Action: Treat anonymous or multi-tenant broker deployments as exposed; patch and review ACL rules immediately.
  • Mitigation: Reject +/# in client IDs/usernames, cap subscriptions, and fail closed on auth/config errors.

CVE-2026-77601: OpenC3 plugin install command injection

  • Impact: Authenticated users can execute operating system commands during plugin installation.
  • Affected Systems: openc3 / openc3-cosmos-cmd-tlm-api.
  • Immediate Action: Restrict plugin installation to trusted admins and patch the shell invocation path now.
  • Mitigation: Run pipinstall through an argv array, not a shell; validate pypi_url as an HTTP(S) URL.

CVE-2026-86064: Klever public WebSocket log control

  • Impact: An unauthenticated client can read live logs and globally mute or amplify logging.
  • Affected Systems: github.com/klever-io/klever-go.
  • Immediate Action: Disable or firewall /log until patched; assume exposed nodes can be manipulated remotely.
  • Mitigation: Require authentication before WebSocket upgrade and stop applying client-supplied logger profiles globally.

CVE-2026-76086: Craft form integration SSRF and credential exfiltration

  • Impact: Authenticated users can redirect integration traffic to attacker-controlled hosts and leak API keys or tokens.
  • Affected Systems: verbb/formie on Craft 4 and Craft 5.
  • Immediate Action: Patch to 3.1.31 or 2.2.23 immediately.
  • Mitigation: Restrict CP access and front-end registration until upgraded.

CVE-2026-56675: 9router reverse-proxy API auth bypass

  • Impact: Public traffic proxied through localhost can be misclassified as local, exposing /v1/* APIs without an API key.
  • Affected Systems: 9router v0.4.80.
  • Immediate Action: Remove public exposure or enforce API keys on all /v1 routes now.
  • Mitigation: Do not trust loopback proxy traffic as local; use explicit trusted-proxy settings and real client-IP handling.

CVE-2026-76087: Craft incomplete submission hijack

  • Impact: Unauthenticated attackers can overwrite or hijack other users’ in-progress form submissions.
  • Affected Systems: verbb/formie on Craft 4 and Craft 5.
  • Immediate Action: Upgrade to 3.1.31 or 2.2.23 immediately.
  • Mitigation: There is no reliable configuration-only workaround; reduce exposure by disabling multi-page/save-for-later where feasible.

CVE-2026-76089: Craft sent notification content exposure

  • Impact: Authenticated users can read full sent notification emails, including submitted data and headers, without proper permission.
  • Affected Systems: verbb/formie on Craft 4 and Craft 5.
  • Immediate Action: Upgrade to 3.1.31 or 2.2.23 now.
  • Mitigation: Limit CP access to trusted users only until patched.

CVE-2026-77394: OpenC3 stored cross-user XSS in shared screens

  • Impact: A user with screen-editing rights can execute JavaScript in another operator’s browser and steal session tokens.
  • Affected Systems: OpenC3 COSMOS / @openc3/vue-common.
  • Immediate Action: Restrict screen editing rights and audit shared screens immediately.
  • Mitigation: Remove eval() from button actions and tighten CSP to block inline/eval script.

CVE-2026-86065: Klever unauthenticated /subscribe resource exhaustion

  • Impact: Remote attackers can exhaust memory and goroutines, taking down the node and its consensus participation.
  • Affected Systems: github.com/klever-io/klever-go.
  • Immediate Action: Block or disable /subscribe on exposed nodes until patched.
  • Mitigation: Add WebSocket read limits, cap live connections, and reject untrusted origins.

CVE-2026-61685: ReactPress SQL injection via query parameter names

  • Impact: Unauthenticated attackers can perform blind SQL injection and potentially exfiltrate database contents.
  • Affected Systems: @fecommunity/reactpress endpoints including /api/article, /api/comment, /api/file, /api/page, and /api/Knowledge.
  • Immediate Action: Upgrade to 3.7.0 or later immediately.
  • Mitigation: Whitelist allowed filter columns before building SQL.

CVE-2026-56669: Elysia form-data CPU exhaustion

  • Impact: Multipart form submissions can trigger quadratic CPU usage and denial of service.
  • Affected Systems: elysia 1.4.28.
  • Immediate Action: Upgrade to 1.4.29 now on any internet-facing service.
  • Mitigation: Enforce request size limits and monitor multipart endpoints for abuse.

CVE-2026-77422: JLine3 grep catastrophic backtracking

  • Impact: A crafted regex can hang the shell thread and tie up remote shell services.
  • Affected Systems: org.jline:jline-builtins.
  • Immediate Action: Patch embedded shells and restrict user-accessible grep commands.
  • Mitigation: Replace backtracking regex use with safer matching and linear-time engines.

CVE-2026-59990: Jawn parser heap exhaustion

  • Impact: Deeply nested JSON can exhaust heap and crash services.
  • Affected Systems: org.typelevel:jawn-parser for Scala 2.12, 2.13, and 3.
  • Immediate Action: Upgrade to 1.6.1 or later immediately.
  • Mitigation: Apply input size and nesting-depth limits at the edge.

CVE-2026-61814: Jawn AsyncParser quadratic CPU use

  • Impact: Chunked JSON input can drive excessive CPU usage and service slowdown.
  • Affected Systems: org.typelevel:jawn-parser for Scala 2.12, 2.13, and 3.
  • Immediate Action: Upgrade to 1.7.0 immediately if you use AsyncParser.
  • Mitigation: Buffer into larger chunks or switch to synchronous parsing where possible.

CVE-2026-69443: Microsoft Azure Attestation out-of-bounds read

  • Impact: An unauthorized network attacker can disclose information through an out-of-bounds read.
  • Affected Systems: Windows 10 1809, Windows Server 2019, 2022, and 2025.
  • Immediate Action: Apply Microsoft security updates immediately across all affected hosts.
  • Mitigation: Prioritize internet-facing and attestation-dependent systems first.

CVE-2026-61695: Wire Swift negative-length protobuf crash

  • Impact: A 10-byte crafted protobuf payload can crash Swift apps with an unrecoverable trap.
  • Affected Systems: Wire Swift runtime through 6.4.0 and 7.0.0-alpha03.
  • Immediate Action: Upgrade to 6.4.1 or 7.0.0-alpha04 immediately.
  • Mitigation: Do not decode untrusted protobuf bytes on vulnerable builds.

CVE-2026-56676: 9router DNS rebinding SSRF via image prefetch

  • Impact: Attackers can trick server-side image fetching into reaching internal-only services.
  • Affected Systems: 9router v0.4.80 vision-capable image fetch flows.
  • Immediate Action: Disable remote image prefetching or patch immediately.
  • Mitigation: Pin resolved IPs, block private ranges at connect time, and re-validate redirects.

Previously Alerted

What to Do Now

  1. Patch exposed systems first. Start with internet-facing CMS, API gateways, MQTT brokers, WebSocket services, and any system that processes untrusted JSON, form-data, or protobuf.
  2. Disable risky features until upgraded. Turn off shared screen editing, remote plugin installs, anonymous MQTT access, public WebSocket log endpoints, and remote image prefetching where possible.
  3. Lock down authentication and permissions. Remove broad roles, restrict CP/admin access, and verify that unauthenticated routes are not exposed by reverse proxies.
  4. Apply vendor fixes immediately. Use the exact patched versions above; do not wait for routine maintenance windows on exposed services.
  5. Assume active probing. These flaws are practical and easy to automate.

Verification steps:

  • Inventory all instances of the affected products and compare installed versions to the patched releases.
  • Check reverse-proxy and WebSocket routes for anonymous access, permissive origin rules, and missing read limits.
  • Review logs for unusual plugin installs, form resubmissions, oversized JSON/form-data requests, and repeated connection attempts.
  • Validate that critical admin endpoints require authentication and object-level authorization.

Monitoring recommendations: alert on spikes in 401/403s, sudden log-level changes, repeated WebSocket upgrades, large request bodies, and outbound calls to unexpected hosts.

Related Resources

  • Internal blog posts: A follow-up hardening note on WebSocket exposure, proxy trust boundaries, and safe parser limits is planned.
  • Official vendor advisories: Plone, Craft/Verbb Formie, OpenC3, Klever, 9router, ReactPress, Elysia, JLine, Jawn, Microsoft, and Wire advisories referenced above.

Keep reading