Vulnerabilities & CVEs

Google has disclosed that a high-severity privilege escalation flaw in its Pixel Cellular Modem has been exploited in the wild. The vulnerability is tracked as CVE-2026-58704 and carries a CVSS score of 8.0. According to the description in the NIST National Vulnerability Database, the issue is a possible permission bypass caused by a logic error in the code. Google's disclosure indicates the flaw has seen limited, targeted exploitation, making patching a priority for affected Pixel users. Affected component: Pixel Cellular Modem Vulnerability type: privilege escalation / permission bypass Identifier: CVE-2026-58704 Severity: CVSS 8.0 (high) Root cause: logic error in the code Status: patches released by Google; exploitation observed in the wild Users should apply the latest available Pixel security updates as soon as possible. As always, watch for any follow-up advisories from Google that clarify affected models, build numbers, or additional mitigation guidance. Source: The Hacker News Have you already pushed the latest Pixel updates across your fleet, or are you waiting on further vendor details before rolling out?

Parallels Desktop for Mac carries a local privilege escalation flaw that allows a standard, non-administrative user account to execute code as root, according to research published this week by JFrog. The vulnerability is not remotely exploitable. An attacker must already have code running on the target machine under a normal user context before the flaw can be leveraged, which limits it to scenarios where an adversary has some form of existing local access. Exploitation requires pre-existing code execution as a regular user Attack path is local only; it cannot be triggered over the network Successful exploitation yields root, the highest privilege level on macOS A fix is available in Parallels Desktop 27. However, Intel Macs cannot install that release, leaving owners of those systems without a supported patched version. The research was led by Yuval Moravchick of JFrog. Source: The Hacker News If your fleet still includes Intel Macs running Parallels Desktop, how are you handling the lack of a patched release?

Cisco has issued a warning about a maximum-severity vulnerability in Identity Services Engine (ISE) that is being actively exploited in the wild. Tracked as CVE-2026-76460 with a CVSS score of 10.0, the flaw allows an unauthenticated, remote attacker to bypass authentication. According to Cisco, the issue stems from insufficient authentication control on an API endpoint. This means an attacker could potentially gain access without valid credentials, making it a critical risk for organizations relying on ISE for network access control. Affected product: Cisco Identity Services Engine (ISE) Vulnerability type: Authentication bypass Severity: CVSS 10.0 (maximum) Exploitation status: Active attacks observed Attack vector: Remote, unauthenticated Cisco has not yet provided specific patch details or workarounds in the available information, but given the active exploitation and maximum severity, administrators should treat this as an urgent priority. Monitor official Cisco advisories for updates and mitigation guidance. Source: The Hacker News Is your organization running Cisco ISE, and if so, what steps are you taking to mitigate this zero-day?

The Internet Systems Consortium (ISC) has shipped BIND 9.20.29 and 9.21.26, addressing fourteen security flaws disclosed on 16 September in the open-source DNS server software. The most serious concern for many operators involves any BIND server that answers DNS-over-HTTPS (DoH) queries. An unauthenticated sender can crash the named server process with a single request containing an invalid SIG record. No credentials are required, making this remotely triggerable by anyone who can reach the DoH endpoint. Affected releases: BIND 9.20.29 and 9.21.26 contain the fixes Administrators running earlier versions in those branches should upgrade promptly Given that the DoH crash needs only one malformed request, patching should be treated as high priority, particularly for any deployment exposing DoH to untrusted networks. There is no indication of a workaround in the advisory, so upgrading to the fixed versions is the recommended path. Source: The Hacker News Does your organization run BIND with DoH enabled, and are you planning to upgrade to 9.20.29 or 9.21.26 right away?

Docker has disclosed a critical vulnerability in Docker Sandboxes on macOS that allows malicious code running inside the sandboxed virtual machine to break out of the shared project directory and access the wider host filesystem. According to Docker's security announcement on September 15, code executing inside the sandbox can escape the project directory that is shared into the VM and then read or modify files anywhere else on the host. The escaped code operates with the privileges of the host account that launched the virtual machine, meaning the impact is limited only by what that user account is permitted to do. The flaw is tracked as CVE-2026-77179 and carries a Critical severity rating. Affected versions were noted in the advisory, so users should check their installed release against Docker's guidance. Mitigation steps: Review Docker's security announcement for the list of affected versions. Update Docker Sandboxes to a patched release as soon as one is available. Avoid running untrusted or malicious code inside a sandbox on an unpatched installation. Where patching is not immediately possible, limit the host privileges of the account used to run the virtual machine and restrict what is shared into the sandbox. Source: The Hacker News Are you running Docker Sandboxes on macOS, and have you already checked whether your version is affected?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. One of the flagged issues is CVE-2025-39682, which carries a CVSS score of 9.8. It is described as an improper check for unusual or exceptional conditions in the TLS receive path. The article does not provide further technical details or additional identifiers for the remaining vulnerabilities. Review the CISA KEV catalog entry for the affected Linux kernel flaws Confirm whether your systems run a vulnerable kernel version Apply available kernel updates and mitigations as advised by your distribution vendor Monitor for signs of exploitation tied to the TLS receive path flaw Source: The Hacker News Are any of your organization's Linux systems affected by these actively exploited kernel flaws, and how are you handling remediation?

SolarWinds has released security updates to fix a high-severity vulnerability in Access Rights Manager (ARM) that could allow unauthenticated remote code execution. The flaw is tracked as CVE-2026-28326 and carries a CVSS score of 8.8 out of 10.0. It affects all versions of Access Rights Manager 2026.2 and prior. According to the available details, the issue involves a hard-coded key. Successful exploitation could let an unauthenticated attacker execute code remotely, which makes timely patching important for any organization running the affected product. Affected versions: Access Rights Manager 2026.2 and all earlier versions Recommended actions: Update Access Rights Manager to a version later than 2026.2 as provided by SolarWinds Review exposure of ARM instances and restrict network access where possible Monitor for signs of exploitation while applying the fix Source: The Hacker News Does your organization run SolarWinds ARM, and if so, how quickly are you able to roll out this patch?

Orkes Conductor is affected by a critical pre-authentication remote code execution flaw that is now being exploited in the wild, according to Fortinet. The vulnerability is tracked as CVE-2026-58138, with a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3. It allows unauthenticated remote code execution, meaning an attacker can run arbitrary code without needing valid credentials. Affected versions: Orkes Conductor 3.21.21 up to (but not including) 3.30.2 Fixed in: 3.30.2 Given active exploitation and the pre-auth nature of the flaw, the priority should be upgrading to 3.30.2 or later as soon as possible if you run an affected version. Until patching is complete, restricting network access to the Conductor interface and monitoring for unexpected process or command execution are reasonable interim measures. Source: The Hacker News Is your organization running an affected version of Orkes Conductor, and have you already applied the fix?

A flaw dubbed Plugin4Shell affects four widely used AI coding agents, according to security firm Air Security. The issue allows anyone who controls a plugin's code repository to swap the plugin an agent installs for a malicious one, even when the agent has pinned that plugin to a specific reviewed version. In other words, the version lock a developer relies on for integrity does not prevent the underlying repository from serving different code at install time. Patch status reported by Air Security: Anthropic has patched the issue in Claude Code 2.1.179 OpenAI has patched the issue in Codex 0.146.0 GitHub Copilot currently has no fix, according to the firm The full details on affected versions across all four agents, along with technical specifics of the attack, were not included in the available excerpt. Organizations running these agents should verify their installed versions and update where a fix exists. Source: The Hacker News If your team uses any of these AI coding agents, have you confirmed which version you're running and whether your plugin sources are pinned to trusted repositories?

Microsoft has addressed a maximum-severity vulnerability in Azure AI Foundry that could allow an unauthorized attacker to escalate privileges. The flaw is tracked as CVE-2026-85889 and carries a CVSS score of 10.0, the highest possible severity rating. According to the advisory, the issue stems from missing authentication for a critical function in Azure AI Foundry, which permits an unauthenticated attacker to elevate privileges over a network. No customer action is required, as Microsoft has already deployed the fix. The vulnerability affects Azure AI Foundry deployments reliant on the impacted critical function. Exploitation occurs over the network and does not require prior authentication. Given the maximum severity score and the network-based attack vector, organizations using Azure AI Foundry should confirm their environments are receiving Microsoft's automatic updates and monitor for any related anomalous activity. Source: The Hacker News Does your organization rely on Azure AI Foundry, and if so, how are you verifying that the automatic fix has been applied across your environments?

WordPress has released patches addressing a set of core vulnerabilities, one of which enables an attack dubbed Click2Shell. According to the security firm pwn.ai, whose researchers reported the issue, a specially crafted web link opened by a logged-in administrator can trigger the installation of a theme from the official WordPress.org directory without the admin ever clicking an Install button. On its own, the flaw is limited in scope, but it can be chained with other weaknesses to achieve code execution, which is where the Click2Shell name comes from. The attack requires an authenticated administrator to open the malicious link, making social engineering or a compromised admin session a prerequisite. Key points: WordPress core patches are now available and should be applied promptly. The vulnerability allows forced theme installation from the official directory via a crafted link. Exploitation requires a logged-in administrator to open the link. The issue can be chained to reach code execution. The flaw was reported by researchers at pwn.ai. Administrators should prioritize updating to the latest WordPress release and review any unexpected theme installations on their sites. Source: The Hacker News Has your organization applied the latest WordPress core update, and are you auditing for unauthorized theme changes?

A security researcher has publicly released working exploit code for four Linux kernel flaws, each of which allows a local user to escalate to root — the highest privilege level on the system. According to the report, kernel maintainers have already patched all four issues over the past few weeks, meaning systems running an up-to-date kernel are not affected. However, with the exploit code now public, any machine still on an older kernel should be updated promptly. Key points to note: All four flaws enable local privilege escalation to root. Fixes have been available for several weeks. Systems with current kernel patches are protected. Unpatched or older kernels remain at risk now that working exploits are public. No specific CVE IDs are provided in the source article, so reference the kernel versions and advisories from your distribution to identify the relevant fixes. Administrators should prioritize applying kernel updates and rebooting affected systems to load the patched kernel. Source: The Hacker News Has your organization already applied the latest kernel updates, or are you still tracking down which systems need patching?

Check Point has released security updates to address a critical vulnerability in its Security Management Server and Multi-Domain Security Management Server products. The flaw allows attackers to execute code with root privileges on management systems, making it a serious risk for organizations relying on Check Point's management infrastructure. According to the vendor's advisory, the vulnerability stems from improper validation of user-supplied data, which can be exploited to run arbitrary code with elevated permissions. Successful exploitation could give an attacker full control over the affected management server. Affected deployments include: Check Point Security Management Server Check Point Multi-Domain Security Management Server Check Point has issued patches to address the issue. Administrators are advised to apply the available updates as soon as possible to prevent potential exploitation on exposed management interfaces. While no specific CVE identifier was provided in the source, the vendor has confirmed the severity of the issue and released fixes. Source: BleepingComputer Has your organization already applied the Check Point updates, or are you still assessing exposure?

Attackers continue to find new ways in, and this week's roundup shows the entry points are as varied as ever: AI tooling, exposed services, long-standing bugs, weak credentials, and subscription-based software. Some of the techniques are novel; others simply recycle what was already sitting around unpatched. Either way, the results speak for themselves. The most notable item is the emergence of self-rewriting AI agents — malicious or autonomous tooling capable of modifying its own code to evade detection or adapt to defenses. This represents a shift in how AI-assisted threats may evolve, moving beyond static payloads toward continuously morphing behavior. On the patching front, more than 800 flaws were addressed across various vendors and products this cycle, a reminder that keeping up with updates remains one of the most effective — if tedious — defensive measures available. The roundup also covers insider-driven SIM swap attacks, where trusted individuals abuse their access to hijack phone numbers and bypass SMS-based authentication. Alongside these, the report bundles 22 additional stories, a mix of new tricks and recycled techniques that continue to work often enough to stay relevant. The broader takeaway: the threat landscape isn't getting cleaner, just more inventive about where it hides. Source: [email protected] (The Hacker News) Are self-rewriting AI agents a genuine near-term concern for your organization, or is this still more hype than practical threat?

A critical vulnerability has been disclosed in Check Point's Security Management and Log Servers, and it carries serious weight for anyone running that infrastructure. According to the report, the flaw could let an attacker without any login credentials execute code as root on those servers, and the attack vector is the network itself. In other words, no valid account and no prior foothold are required to reach the impacted systems. The Security Management Server is the component that controls firewall policy and administrator access, which makes it a high-value target. Compromise at that level means an intruder could potentially reshape policy and administrative control rather than being limited to a single host. Check Point has released a fix through its LivePatch update channel. The article also notes the vendor says it has no indication regarding exploitation, though the excerpt does not elaborate further. Key points to keep in mind: Affected products: Check Point Security Management Server and Log Server Impact: unauthenticated remote code execution as root Attack vector: network-based, no credentials needed Remediation: apply the fix via Check Point's LivePatch update channel No CVE identifier was provided in the source material, so none is cited here If you manage Check Point infrastructure, prioritize patching through LivePatch and review exposure of management and log interfaces to untrusted networks. Source: The Hacker News Has your organization already applied the LivePatch fix, or are you still assessing exposure on your management and log servers?

A newly disclosed CVE can show up in your scanner with an alarming severity score, but that still leaves the most important question unanswered: is it actually exploitable in your specific environment? A high score alone does not confirm real-world risk, and treating it as proof of exploitability can send teams chasing threats that do not apply to their setup. The pressure behind that question is growing. Mythos-class AI is compressing the window between public disclosure and working exploitation, while many security programs continue to validate risk on weekly or quarterly cycles. That mismatch creates a gap that is no longer purely technical, since defenders may still be assessing a vulnerability long after attackers have a functional exploit in hand. The source material points to a webinar that addresses how to prove exploitability before attackers do, aimed at teams that need faster, evidence-based validation rather than relying on severity scores alone. No specific product versions, indicators of compromise, or mitigation steps were detailed in the available content. Source: The Hacker News How does your organization currently validate whether a newly disclosed CVE is genuinely exploitable in your environment?

Every release of the Unbound DNS resolver prior to 1.26.1 contains a critical heap overflow vulnerability in its DNSSEC validator, according to an advisory published by maintainer NLnet Labs. The flaw can be triggered when an attacker who controls a malicious DNS zone sends queries to a vulnerable resolver, potentially allowing remote code execution. The vulnerability is tracked as CVE-2026-81642 and is addressed in Unbound 1.26.1, which was released on the same day as the advisory. Affected versions: All Unbound releases before 1.26.1 Mitigation: Upgrade to Unbound 1.26.1 as soon as possible. Source: The Hacker News Has your organization already patched to Unbound 1.26.1, or are you still assessing exposure?

Cisco has released security updates to fix a maximum-severity vulnerability in its Identity Services Engine (ISE) product, and the company warns the flaw is being actively exploited in the wild. ISE is used for network access control and identity management, making it an attractive target for attackers seeking a foothold in enterprise environments. The vulnerability carries a maximum severity rating, and Cisco has confirmed in-the-wild exploitation. Administrators running affected ISE deployments should treat this as an urgent patching priority. Details on the specific affected versions and fixed releases are available in Cisco's official advisory. Apply the security updates released by Cisco as soon as possible. Check whether your ISE deployments are exposed and review logs for signs of exploitation. Monitor Cisco's advisory for version-specific guidance and any updates. Given the active exploitation, don't delay remediation. Source: BleepingComputer Is your organization running Cisco ISE, and have you already applied the patch?

A critical flaw in the Issabel Framework, the web-based framework that underpins the open-source unified communications PBX software, is now being actively exploited in the wild. Tracked as CVE-2026-89026, the vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. It allows an unauthenticated remote attacker to run arbitrary operating system commands, with the root cause being a hard-coded value in the framework. Because no authentication is required, any reachable instance could potentially be abused without valid credentials. Key points to note: CVE-2026-89026 affects the Issabel Framework Attack type: unauthenticated remote OS command execution Severity: 9.8 (CVSS v3.1) / 9.3 (CVSS v4.0) Exploitation status: active, confirmed in the wild If your organization runs Issabel-based PBX or unified communications infrastructure, treat any internet-exposed instance as high risk and review your exposure and patch posture immediately. Source: The Hacker News Does your organization run Issabel or a related PBX platform, and if so, how are you handling exposure and mitigation?

ConnectWise ScreenConnect is facing active exploitation of a critical-severity flaw, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirming attacks in the wild. According to the reporting, attackers are now leveraging the vulnerability in real-world campaigns, elevating it from a theoretical risk to an urgent patch priority for anyone running the remote support software. Key points so far: The flaw is rated critical severity CISA has observed active exploitation in attacks ScreenConnect is the affected ConnectWise product If your organization uses ScreenConnect, treat this as a priority: verify your version, apply any available vendor mitigations or updates, and review logs for signs of unauthorized access. A specific CVE ID was not provided in the source article, so check ConnectWise's official advisory for the exact identifier and affected builds. Source: BleepingComputer Is your organization running ScreenConnect, and if so, have you already applied mitigations or are you still assessing exposure?