Security Digest: November 2, 2026 - 21 Critical Vulnerabilities

Today’s highest-risk issues are dominated by remote command injection, buffer overflow, path traversal, and auth bypass flaws affecting edge devices and widely deployed Java applications. Several of the router and Wicket issues are publicly disclosed or already have exploit code available, which means defenders should treat them as active threat exposure rather than theoretical bugs.

· 14 min read

Security Digest: November 2, 2026

Executive Summary

Today’s highest-risk issues are dominated by remote command injection, buffer overflow, path traversal, and auth bypass flaws affecting edge devices and widely deployed Java applications. Several of the router and Wicket issues are publicly disclosed or already have exploit code available, which means defenders should treat them as active threat exposure rather than theoretical bugs.

Act now: prioritize internet-facing appliances first, then patch application platforms and validate no exposed admin interfaces remain reachable from untrusted networks.

Critical Vulnerabilities

  • CVE-2025-11969: WSO2 API Manager system REST API access-control bypass
    • Impact: Lower-privileged users may perform administrative actions through improperly protected system REST APIs.
    • Affected Systems: WSO2 API Manager system REST APIs; API Gateway-exposed APIs are not affected.
    • Immediate Action: Restrict access to system APIs, review admin role assignments, and check for unexpected privileged API activity.
    • Mitigation: Apply vendor remediation as soon as available; temporarily limit network exposure and enforce least privilege.
  • CVE-2026-120345: WAVLINK WN551X3-A DNS resolution handler command injection
    • Impact: Remote attackers can execute OS commands; public exploit code is available.
    • Affected Systems: WAVLINK WN551X3-A M51X3_V251020-WO-182e965.
    • Immediate Action: Remove from direct internet exposure, disable remote management, and isolate affected devices.
    • Mitigation: Patch or replace immediately; if no fix exists, take the device out of service.
  • CVE-2026-120344: WAVLINK WN551X3-A WireGuard CLI group handler command injection
    • Impact: Remote command execution with public exploit availability.
    • Affected Systems: WAVLINK WN551X3-A M51X3_V251020-WO-182e965.
    • Immediate Action: Block WAN access and hunt for unauthorized command activity.
    • Mitigation: Apply vendor fix or replace the device.
  • CVE-2026-120283: Linksys E8450 portal.cgi stack buffer overflow
    • Impact: Remote code execution via crafted timezone input.
    • Affected Systems: Linksys E8450 1.2.00.360516.
    • Immediate Action: Disconnect exposed units from the public internet immediately.
    • Mitigation: Upgrade firmware or retire the device if no patch is available.
  • CVE-2026-120280: WAVLINK WN536AX6-A WireGuard CLI command injection
    • Impact: Remote attackers can inject OS commands; exploit is public.
    • Affected Systems: WAVLINK WN536AX6-A V260507.
    • Immediate Action: Disable remote admin and segment the device behind trusted controls.
    • Mitigation: Patch or replace urgently.
  • CVE-2026-120281: WAVLINK WN536AX6-A OpenVPN handler stack buffer overflow
    • Impact: Remote code execution with public exploit availability.
    • Affected Systems: WAVLINK WN536AX6-A V260507.
    • Immediate Action: Remove WAN exposure and rotate any credentials used on the device.
    • Mitigation: Apply vendor update or decommission.
  • CVE-2026-120279: WAVLINK WN536AX6-A openvpn_cli command injection
    • Impact: Remote OS command injection.
    • Affected Systems: WAVLINK WN536AX6-A V260507.
    • Immediate Action: Treat as compromised if exposed to the internet; inspect logs for suspicious requests.
    • Mitigation: Patch immediately or replace the hardware.
  • CVE-2026-120277: WAVLINK WN536AX6-A 2.0.0 WireGuard CLI command injection
    • Impact: Remote command execution; exploit disclosed publicly.
    • Affected Systems: WAVLINK WN536AX6-A V260507_2.0.0.
    • Immediate Action: Block external access and isolate affected units.
    • Mitigation: Apply vendor remediation or retire the product.
  • CVE-2026-120276: WAVLINK WN536AX6-A 2.0.0 web management command injection
    • Impact: Remote OS command injection through the web interface.
    • Affected Systems: WAVLINK WN536AX6-A V260507_2.0.0.
    • Immediate Action: Disable management access from untrusted networks now.
    • Mitigation: Update firmware or remove the device from service.
  • CVE-2026-18199: ManageEngine Password Manager Pro / PAM360 authenticated RCE
    • Impact: Authenticated attackers can execute code on the server.
    • Affected Systems: Password Manager Pro before 13236; PAM360 before 8601.
    • Immediate Action: Patch immediately and review admin and service accounts for misuse.
    • Mitigation: Upgrade to the fixed versions and review logs for suspicious authenticated activity.
  • CVE-2026-120311: Network-AI FileJobStore path traversal
    • Impact: Attackers can read or delete arbitrary JSON files, exposing credentials or weakening authorization.
    • Affected Systems: Network-AI 5.13.4 through 5.15.4.
    • Immediate Action: Restrict access to job APIs and inspect for unexpected file reads/deletes.
    • Mitigation: Upgrade to 5.15.5 or later.
  • CVE-2026-120322: Termix-SSH path traversal in file transfer
    • Impact: Remote attackers can write files outside intended paths; exploit is public.
    • Affected Systems: Termix up to 2.9.2.
    • Immediate Action: Disable exposed file-transfer features and restrict access to trusted users only.
    • Mitigation: Upgrade to core v26.10.0 or standalone File Manager plugin v1.0.0.
  • CVE-2026-83594: Apache Wicket upload resource heap exhaustion
    • Impact: Attackers can trigger excessive memory allocation and crash services; some paths can lead to application abuse.
    • Affected Systems: Apache Wicket 9.14.0-9.24.0 and 10.0.0-10.11.0 using FileUploadToResourceField.
    • Immediate Action: Identify any use of FileUploadToResourceField and disable the mount if possible.
    • Mitigation: Upgrade to Wicket 9.25.0 or 10.12.0.
  • CVE-2026-84170: Apache Wicket upload resource unlimited resource consumption
    • Impact: Attackers can force excessive disk or heap usage through uncontrolled upload limits.
    • Affected Systems: Apache Wicket 9.14.0-9.24.0 and 10.0.0-10.9.1 using FileUploadToResourceField or FileUploadResourceReference.
    • Immediate Action: Remove exposed upload resources from unauthenticated paths and enforce resource authorization.
    • Mitigation: Upgrade to Wicket 9.25.0 or 10.12.0.
  • CVE-2026-120317: http4k auth-int digest body integrity bypass
    • Impact: On-path attackers on non-TLS channels can alter authenticated request bodies while preserving the Authorization header.
    • Affected Systems: http4k 4.9.10.0 through 6.59.0.0.
    • Immediate Action: Enforce TLS everywhere and remove any reliance on digest auth over cleartext links.
    • Mitigation: Upgrade to 6.60.0.0 or later.
  • CVE-2026-111089: Apache Wicket output encoding flaws in JavaScript and markup
    • Impact: Malicious text from resource bundles can execute script or break markup in affected Wicket apps.
    • Affected Systems: Apache Wicket 8.0.0-8.19.0, 9.0.0-9.24.0, 10.0.0-10.11.0.
    • Immediate Action: Audit resource bundle content and treat any user-controlled labels as untrusted.
    • Mitigation: Upgrade to Wicket 8.20.0, 9.25.0, or 10.12.0.
  • CVE-2026-82956: Apache Wicket AjaxNewWindowNotifyingBehavior script injection
    • Impact: Client-supplied window names can become script in the application origin.
    • Affected Systems: Apache Wicket 8.0.0-8.19.0, 9.0.0-9.24.0, 10.0.0-10.11.0 where the behavior is explicitly used.
    • Immediate Action: Remove or disable the behavior if not required.
    • Mitigation: Upgrade to Wicket 8.20.0, 9.25.0, or 10.12.0.
  • CVE-2026-95863: Apache Wicket markup-id and input-name script injection
    • Impact: Crafted IDs can break out of JavaScript literals and run code in the browser.
    • Affected Systems: Apache Wicket 8.0.0-8.19.0, 9.0.0-9.24.0, 10.0.0-10.11.0.
    • Immediate Action: Search for custom markup IDs and component IDs derived from data.
    • Mitigation: Upgrade to Wicket 8.20.0, 9.25.0, or 10.12.0.
  • CVE-2026-83559: Apache Wicket JavaScriptUtils escaping flaw
    • Impact: Escaped values can still break JavaScript strings and execute attacker-controlled script.
    • Affected Systems: Apache Wicket 8.0.0-8.19.0, 9.0.0-9.24.0, 10.0.0-10.11.0 where the method is used.
    • Immediate Action: Find any direct use of JavaScriptUtils.escapeQuotes() and stop relying on it for safety.
    • Mitigation: Upgrade to Wicket 8.20.0, 9.25.0, or 10.12.0.
  • CVE-2026-83539: Apache Wicket SmartLinkLabel scheme injection
    • Impact: Malicious URLs can become clickable script execution if users activate the link.
    • Affected Systems: Apache Wicket 8.0.0-8.19.0, 9.0.0-9.24.0, 10.0.0-10.11.0 using SmartLinkLabel or SmartLinkMultiLineLabel.
    • Immediate Action: Disable linkification for untrusted text or strip dangerous schemes at input.
    • Mitigation: Upgrade to Wicket 8.20.0, 9.25.0, or 10.12.0.
  • CVE-2026-84231: Apache Wicket ExternalLink onclick injection
    • Impact: Clicking a non-anchor ExternalLink can execute attacker-controlled script.
    • Affected Systems: Apache Wicket 8.0.0-8.19.0 when ExternalLink is bound to non-anchor markup.
    • Immediate Action: Review any ExternalLink rendered on buttons, spans, or custom elements.
    • Mitigation: Upgrade to Wicket 8.20.0 and avoid binding this component to non-anchor tags.

What to Do Now

  1. Prioritize exposed network devices first. Patch or remove the WAVLINK, Linksys, and Termix systems from internet-facing networks immediately.
  2. Patch application platforms next. Upgrade ManageEngine, Network-AI, http4k, and Apache Wicket to fixed releases without delay.
  3. Disable risky features where patching is delayed. Turn off remote admin, file-transfer mounts, and unused Wicket behaviors/components.
  4. Verify exposure. Inventory all instances of the affected products, especially public-facing appliances and Java apps using Wicket upload or link components.
  5. Check for compromise. Review logs for suspicious admin actions, unexpected file writes, command execution, and abnormal upload activity.
  6. Hunt for web-shell and config tampering. On routers and app servers, look for new files, modified startup scripts, and unusual outbound traffic.

Verification steps: Confirm version numbers against the affected ranges, identify whether vulnerable Wicket components are actually in use, and validate that any exposed management interfaces are restricted. If you cannot confirm patch status, assume exposure.

Monitoring recommendations: Alert on new admin logins, repeated 4xx/5xx bursts on management endpoints, unexpected upload spikes, changes to JSON/config files, and outbound connections from devices that should not initiate them.

Related Resources

  • Internal: Add links to your internal incident response update and patch validation checklist when published.
  • Official vendor advisories: WSO2, WAVLINK, Linksys, Zoho ManageEngine, Apache Wicket, http4k, Network-AI, and Termix release/security advisories.

Keep reading