Security Digest: October 13, 2026 - 73 Critical Vulnerabilities

Today’s threat landscape is severe: 73 critical and high-severity vulnerabilities are now public, including multiple CVSS 10.0 flaws with working exploits, exposed credentials, command injection, and remote code execution risks across SAP, Wavlink, IBM, GitLab, Frappe ERPNext, and industrial control products. Act now: prioritize internet-facing systems, disable or isolate exposed admin services, patch vendor-fixed versions immediately, and assume compromise where public exploits are already circulating.

· 10 min read

Executive Summary

Today’s threat landscape is severe: 73 critical and high-severity vulnerabilities are now public, including multiple CVSS 10.0 flaws with working exploits, exposed credentials, command injection, and remote code execution risks across SAP, Wavlink, IBM, GitLab, Frappe ERPNext, and industrial control products.

Act now: prioritize internet-facing systems, disable or isolate exposed admin services, patch vendor-fixed versions immediately, and assume compromise where public exploits are already circulating.

Critical Vulnerabilities

  • CVE-2026-89111: SAP Cloud SDK for Python OAuth2 SSRF
    • Impact: Attackers can redirect token requests and steal client credentials in multi-tenant BTP apps.
    • Affected Systems: SAP Cloud SDK for Python in multi-tenant BTP deployments.
    • Immediate Action: Review any code that accepts tenant_subdomain; block untrusted input now.
    • Mitigation: Apply SAP guidance and restrict outbound token endpoints until patched.
  • CVE-2026-109110: Wavlink WL-WN592AX6 remote command injection
    • Impact: Remote attackers can execute OS commands; exploit code is public.
    • Affected Systems: Wavlink WL-WN592AX6 250422.
    • Immediate Action: Remove from the internet immediately; disable remote admin access.
    • Mitigation: Apply vendor firmware or isolate the device behind a trusted management network.
  • CVE-2026-109109: Wavlink WL-WN530BE1-A stack buffer overflow
    • Impact: Remote code execution via crafted cookie/header input; exploit is public.
    • Affected Systems: Wavlink WL-WN530BE1-A 251117.
    • Immediate Action: Treat as actively exploitable and isolate immediately.
    • Mitigation: Patch firmware; if unavailable, replace or quarantine the device.
  • CVE-2026-89110: SAP NetWeaver Visual Composer authorization bypass
    • Impact: Low-privilege users may trigger internal operations on remote systems and potentially compromise them.
    • Affected Systems: SAP NetWeaver Visual Composer portal functionality.
    • Immediate Action: Restrict access to portal functions and review privileged user activity.
    • Mitigation: Apply SAP fix and tighten remote connection permissions.
  • CVE-2026-109108: Wavlink WL-WN530BE1-A command injection
    • Impact: Remote command execution through VPN upload handling; exploit is public.
    • Affected Systems: Wavlink WL-WN530BE1-A 251117.
    • Immediate Action: Pull from service or block WAN exposure now.
    • Mitigation: Install vendor update and verify no unauthorized configuration changes.
  • CVE-2026-96119: IBM i HTTP Server Administration web app
    • Impact: Authenticated attackers can steal sensitive data or run arbitrary code.
    • Affected Systems: IBM i 7.3, 7.4, 7.5, 7.6.
    • Immediate Action: Restrict admin access and review authenticated accounts immediately.
    • Mitigation: Apply IBM fixes and rotate exposed credentials.
  • CVE-2026-89107: SAP S/4HANA rule processing RCE
    • Impact: Authenticated users with specific privileges can execute ABAP code and fully compromise the system.
    • Affected Systems: SAP S/4HANA Manage Substitution/Validation Rules.
    • Immediate Action: Audit business-privileged accounts and suspend unnecessary access.
    • Mitigation: Patch SAP and review all rule-definition inputs.
  • CVE-2026-87689: Metasploit Framework credential store exposure
    • Impact: Anyone reaching the default web service can read, modify, or delete all stored credentials.
    • Affected Systems: Metasploit Framework through 6.5.4.
    • Immediate Action: Take msf-ws off public interfaces now.
    • Mitigation: Upgrade to 6.5.5 and rotate any credentials stored in affected instances.
  • CVE-2026-82110: IBM DataStage path traversal to RCE
    • Impact: Remote authenticated attackers may execute code through pathname abuse.
    • Affected Systems: IBM DataStage on Cloud Pak for Data 5.4.0.0.
    • Immediate Action: Limit access to trusted admins and inspect file-handling endpoints.
    • Mitigation: Apply IBM updates and validate path controls.
  • CVE-2026-63353 / CVE-2026-63350 / CVE-2026-63354: PLC trace-file injection
    • Impact: Crafted trace files can trigger JavaScript in an authorized user’s browser and drive PLC operations.
    • Affected Systems: Devices exposing Trace page import features.
    • Immediate Action: Stop importing untrusted trace files.
    • Mitigation: Patch affected devices and restrict diagnostics rights.
  • CVE-2026-108971: D-Link DCS-930L bootloader signature bypass
    • Impact: Remote attackers may load malicious firmware.
    • Affected Systems: D-Link DCS-930L B1.08B4.
    • Immediate Action: Remove from exposed networks and verify firmware integrity.
    • Mitigation: Apply vendor remediation or replace the device.
  • CVE-2026-89108: SAP Manufacturing Integration and Intelligence privilege escalation
    • Impact: Admins can gain control of the underlying Java server.
    • Affected Systems: SAP MII.
    • Immediate Action: Restrict admin rights and review provisioning activity.
    • Mitigation: Patch SAP and enforce least privilege.
  • CVE-2026-59241, CVE-2026-109667, CVE-2026-82108, CVE-2026-19620, CVE-2026-82096, CVE-2026-109652, CVE-2026-19622, CVE-2026-89199, CVE-2026-109608, CVE-2026-89113: multiple IBM, Frappe ERPNext, SAP Commerce Cloud, and related flaws enabling command injection, SQL injection, auth bypass, and privilege escalation.
  • CVE-2026-92883, CVE-2026-16301, CVE-2026-14814, CVE-2026-81839, CVE-2026-96893: GitLab issues that can lead to cross-site scripting, pipeline abuse, cache poisoning, and AI instruction injection.
  • CVE-2026-78557, CVE-2026-78556, CVE-2026-84418: Industrial Edge and IBM DataStage client-side trust failures that can expose tokens or enable man-in-the-middle attacks.
  • CVE-2026-35001: OpenS100 crafted file parsing can cause heap overflow and possible code execution.
  • CVE-2026-101020: AssetView local attacker may gain SYSTEM privileges.
  • CVE-2026-109573, CVE-2026-109687, CVE-2026-108179: SQL injection in phpMyFAQ, Link Whisper, and WOLF bulk-editor.
  • CVE-2026-102562, CVE-2026-102007: WordPress plugin stored XSS risks that can hit admins and subscribers.

Previously Alerted

What to Do Now

  1. Patch or isolate first: internet-facing SAP, Wavlink, IBM, GitLab, and industrial systems with public exploits or CVSS 9.8–10.0 issues.
  2. Disable exposed admin services: restrict management ports, VPN upload endpoints, web service listeners, and trace import features.
  3. Rotate secrets: client credentials, API keys, bearer tokens, admin passwords, and any credentials stored in Metasploit or exposed apps.
  4. Review privileged accounts: look for new admins, unexpected role changes, unusual CI/CD pipeline runs, and unauthorized document or record edits.
  5. Contain risky clients: block untrusted file imports, especially trace files, CSVs, and crafted repository content.

Verification steps: confirm vendor-fixed versions are deployed, check exposed services on public IPs, and search logs for suspicious requests to credentials, upload, admin, and pipeline endpoints. Validate that no affected device is still reachable from the internet.

Monitoring recommendations: alert on new admin creation, outbound connections from SAP and ERP systems, unexpected firmware upload attempts, SQL error spikes, and browser-side script injection indicators. Watch for signs of credential theft and token replay across cloud and on-prem systems.

Related Resources

  • Internal: Security team follow-up brief on today’s critical SAP, IBM, GitLab, and Wavlink exposure trends.
  • Official vendor advisories: SAP Security Notes, IBM Security Bulletins, GitLab Security Releases, Wavlink firmware advisories, D-Link support notices, and Microsoft/WordPress ecosystem plugin advisories where applicable.

Keep reading