The CyberSec Intelligence team presents the daily summary of cybersecurity incidents and vulnerabilities identified on September 17, 2026. Today’s analysis includes security issues actively exploited in operating systems, network equipment, and enterprise platforms, alongside new vulnerabilities with severe impact.
n
Actively exploited vulnerabilities
n
- n
- CVE-2026-58704 (Google Pixel): A logic error in the cellular modem allows bypassing permission checks and privilege escalation. Details: NVD.
- CVE-2026-76460 (Cisco Identity Services Engine): Incorrect use of privileged APIs allows unauthenticated remote attackers to bypass the administrative web interface. Details: NVD.
- CVE-2026-87886 (Acronis Backup): Incorrect default permissions in the cPanel & WHM plugin and Plesk extension allow privilege escalation. Details: NVD.
- CVE-2026-76461 (Cisco Secure Email Gateway): An SQL injection vulnerability in AsyncOS allows remote attackers to execute arbitrary commands with root privileges. Details: NVD.
- CVE-2026-84869 (ConnectWise ScreenConnect): Improper management of privileges allows transferring and executing files through active sessions without host confirmation. Details: NVD.
- CVE-2026-42016 (JFrog Artifactory): An authorization error related to the signature/issuer validation of the token allows privilege escalation. Details: NVD.
- CVE-2026-42018 (JFrog Artifactory): Faulty authentication allows returning an anonymous user token even when anonymous access is disabled. Details: NVD.
- CVE-2026-85706 (GitLab Community/Enterprise Edition): Path traversal in the commits API allows unauthenticated users to read arbitrary files. Details: NVD.
- CVE-2026-86060 (MikroTik RouterOS): Improper neutralization of argument delimiters in a command allows modifying the policy mask and privilege escalation. Details: NVD.
- CVE-2026-67277 (MikroTik RouterOS): Missing authentication for critical functions in the btest service allows disclosure of kernel memory and Denial of Service attacks. Details: NVD.
n
n
n
n
n
n
n
n
n
n
n
New critical vulnerabilities
n
- n
- CVE-2026-91995 (pig): Authentication bypass in the /register/password endpoint allows taking full administrative control. Details: NVD.
- CVE-2026-91998 (Casdoor): Authorization bypass in the /api/mcp endpoint allows unrestricted access to user administration across all organizations. Details: NVD.
- CVE-2026-39919 (Ghostscript): A heap-based buffer overflow vulnerability in the JPEG 2000 adapter allows remote code execution through specially crafted PDF files. Details: NVD.
- CVE-2026-91949 (FreeRDP): Bypassing protocol negotiation allows unauthenticated attackers to establish RDSTLS connections. Details: NVD.
- CVE-2024-58385 (Yonyou U8 CRM): Unauthenticated SQL injection that can lead to operating system command execution via xp_cmdshell. Details: NVD.
- CVE-2026-89026 (Issabel Framework): Hardcoded JWT HS256 signing key identical on all installations, allowing arbitrary command execution as the Asterisk user. Details: NVD.
- CVE-2026-83055, CVE-2026-83056, CVE-2026-83057, CVE-2026-83058 (Oracle Internet Directory): Vulnerabilities in the OID LDAP server that allow a low-privileged attacker to fully compromise the system. Details: CVE-2026-83055, CVE-2026-83056, CVE-2026-83057, CVE-2026-83058.
- CVE-2026-83064 (Oracle WebCenter Portal): Critical vulnerability that allows a highly privileged attacker to take control of the portal. Details: NVD.
- CVE-2026-83103 (Oracle Forms): Vulnerability that allows a highly privileged attacker to compromise Forms services via HTTP. Details: NVD.
n
n
n
n
n
n
n
n
n
n
From the security press
n
- n
- WooCommerce Wholesale Lead Capture (no CVE): Attackers exploit a security flaw in this plugin to upload PHP web shells and execute remote code. Details: The Hacker News.
- CVE-2026-5430 (WSO2 API Manager): Active exploitation attempts targeting the bypass of JWT signature verification with forged administrator tokens. Details: The Hacker News.
- LiteSpeed Enterprise (no CVE): A critical flaw allows low-privileged users on shared hosting servers to obtain root access. Details: The Hacker News.
- China-Linked Attacks (no CVE): Exploitation of a Chrome-Windows Zero-Day vulnerability chain to distribute the GRIMWEDGE malware. Details: The Hacker News.
n
n
n
n
n
What we recommend
n
- n
- Patch Management: Immediately apply security updates issued by affected software vendors, prioritizing internet-exposed systems (Cisco, GitLab, Oracle).
- Authentication and secrets audit: Verify configured JWT keys, ensure no default or hardcoded values are used, and disable anonymous access where not strictly necessary.
- IT Asset Inventory (Asset Inventory): Monitor and maintain a strict list of network equipment (e.g., MikroTik routers), email servers, and web applications used to ensure the rapid patching of flaws.
- Privileged access monitoring: Implement rigorous log monitoring policies, specifically tracking unusual use of administrative APIs or authentication bypass attempts.
n
n
n
n
n
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
