High-severity vulnerabilities worth immediate patch decisions, with CVSS context, affected software, and practical mitigation steps.
CVE-2026-76504 is a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, exploited in the wild since September 2026. CISA gave federal agencies until October 3 to patch. Here is what to check and how to fix it.
With no fix available for two exploited Citrix NetScaler RCE zero-days, operators must isolate or shut down appliances before Monday.
CVE-2026-80521 enables a container escape to host root via a Linux kernel use-after-free. Ubuntu has no LTS patch 50 days after the upstream fix.
Exploited since August 2026, Orkes Conductor CVE-2026-58138 is a CVSS 9.8 unauthenticated RCE in GraalVM script evaluators. Upgrade to 3.30.2.
Attackers are exploiting CVE-2026-76460, a CVSS 10.0 auth bypass in Cisco ISE and ISE-PIC. CISA gave federal agencies three days to patch.
CISA confirmed active exploitation of CVE-2026-76461, a root-level SQL injection in Cisco Secure Email Gateway, and set a 3-day patch deadline.
Cisco FMC CVE-2026-20079 lets unauthenticated attackers gain root on firewall managers. Three threat clusters are exploiting it, including Qilin ransomware and suspected Sandworm activity.
Nearly 1 in 10 internet-facing LiteLLM AI gateways accepted the default admin key sk-1234, exposing model provider keys, database credentials, and cloud IAM roles to attackers. CVE-2026-59822 is on CISA KEV and the fix is a config change, not an upgrade.
Microsoft shipped a record 974 CVEs in September 2026 Patch Tuesday, including two actively exploited Windows zero-days. Operators now face a deployment crisis as patch volume overwhelms testing capacity.
About 1,500 N-central servers are exposed to CVE-2026-86218, a CVSS 10.0 pre-auth RCE, with attacks reported. On-prem needs build 2026.3.1.14 now.
Langflow RCE flaws face active exploitation with over 15,000 successful attacks. Attackers harvest AI provider keys and cloud credentials from exposed instances.
PaperCut NG/MF zero-day chain CVE-2026-81578 and CVE-2026-82078 enables pre-auth RCE on print servers. CISA added both to KEV with a September 14 patch deadline.
Web shells are turning up on devices hit through Citrix NetScaler RCE flaw CVE-2026-8452. CISA orders patching by Saturday, August 29.
Next.js patches two critical unauthenticated RCE vulnerabilities in the August 2026 security release. AVIF image optimization and Windows filesystem path traversal both expose self-hosted servers. Upgrade to 15.5.24 or 16.3.3 immediately.
Rated CVSS 9.1, CVE-2026-18963 in Keycloak's password reset flow lets unauthenticated attackers skip email checks and take over any account.
GitLab CVE-2026-19478, a CVSS 9.4 GraphQL injection flaw, lets unauthenticated attackers delete repos and forge merges. It is already exploited in the wild.
MLflow SSRF vulnerability CVE-2026-64849 exposes cloud credentials on 238 servers. Attackers stole secrets from 103 within hours of disclosure.
Attackers are exploiting CVE-2025-62593 in Ray through Firefox and Safari. CISA gave agencies 72 hours to patch or stop using it.
Attackers began exploiting the SharePoint auth bypass CVE-2026-55040, rated CVSS 9.1 and patched in July, after Rapid7 released a PoC on August 11.
Hugging Face Diffusers vulnerabilities bypass trust_remote_code in three CVEs rated 8.8 and 7.5, enabling silent RCE from model repos. Patch now.
Fastjson 1.x RCE (CVE-2026-16723) is a critical CVSS 9.0 flaw actively exploited in Spring Boot apps with no official patch available. Block Fastjson 1.x endpoints, migrate to Jackson, and demand autotype safelists.
Rated CVSS 9.3 and listed in CISA KEV, the Check Point SmartConsole auth bypass CVE-2026-16232 is actively exploited. Patch management servers now.
A CVSS 9.5 pre-auth sandbox escape in the AI Platform, ServiceNow CVE-2026-6875 is now actively exploited. Patch self-hosted instances immediately.
Two WordPress Core CVEs form wp2shell, a pre-auth RCE chain that lets anonymous attackers run code on 6.9 and 7.0 sites with no plugins.
Two SonicWall SMA 1000 zero-day vulnerabilities including a CVSS 10.0 SSRF are under active exploitation. CISA KEV-listed with a July 17 patch deadline.
Unprivileged users get root on Linux v6.4+ and Android through Bad Epoll (CVE-2026-46242). No workaround exists; apply patch a6dc643c6931 now.
Listed in CISA KEV, SharePoint CVE-2026-45659 is an actively exploited RCE risk. Patch exposed servers and check for compromise now.
Patch the exploited SimpleHelp auth bypass CVE-2026-48558 to 5.5.16 or 6.0 RC2, then hunt for TaskWeaver and Djinn.
After active exploitation of CVE-2026-20230, CISA set a June 28 deadline: the Cisco Unified CM flaw is now a patch-or-isolate job.
Four exploited Lantronix and UniFi OS bugs joined the CISA KEV list, and edge devices now need inventory and compromise checks.
Exposed Splunk Enterprise 10.0 and 10.2 nodes need patching by June 21 for the actively exploited critical flaw CVE-2026-20253.