CVSSv3.1

GitLab Issues Critical Patches for CVE-2026-110264 Affecting Wide Range of Versions

GitLab has released emergency security updates to address multiple vulnerabilities, including one rated critical that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-110264, stems from an integer overflow in the regular expression compiler and carries a maximum CVSSv3.1 base score of 10.0. It impacts GitLab Community Edition and Enterprise Edition starting from version 7.0, with patches now available for both current and older branches. The company strongly urges immediate updates due to the severity and potential for arbitrary code execution on affected servers. Additional lower-severity issues were also resolved in the same release cycle.

Critical Sandbox Bypass Flaw in GitLab AI Gateway Enables Remote Command Execution

GitLab has released patches for a critical vulnerability in its GitLab AI Gateway component that allows authenticated users to bypass sandbox restrictions and execute arbitrary commands. The flaw, tracked as CVE-2026-90970, resides in the custom flow prompt template processing of the Duo Agent Platform and carries a CVSS v3.1 base score of 9.9. Self-hosted deployments are affected, while GitLab’s own hosted AI Gateway service has already been updated. The company urges immediate upgrades to versions 19.4.1, 19.3.2, or 19.2.4. The vulnerability can be triggered under specific conditions by users with access to the Duo Agent Platform through crafted flow configurations.

Critical Zero-Day Vulnerability in FortiMail Allows Unauthenticated File Writes

Fortinet disclosed a critical zero-day vulnerability in its FortiMail email security product that is already being exploited in attacks. The flaw, tracked as CVE-2026-104286, affects the graphical user interface component and stems from improper sanitization of path traversal and NULL byte sequences. Attackers can craft malicious HTTP requests to write arbitrary files to the system without authentication. The vulnerability received a CVSS v3.1 base score of 9.8, classifying it as Critical. Fortinet discovered the issue internally but has also received reports of active exploitation. Planned patches include FortiMail 8.0.2, 7.6.7, and 7.4.9, while users on the 7.2 branch are advised to migrate to 7.4 or later.

Critical Vulnerability CVE-2026-12342 Allows Remote Code Execution in SailPoint IdentityIQ

SailPoint has disclosed a critical vulnerability in its identity management product IdentityIQ that stems from insufficient input validation in the web service API. The flaw, identified as CVE-2026-12342, permits an attacker on an adjacent network to execute arbitrary code on the IdentityIQ server without requiring authentication. The vulnerability received a CVSSv3.1 base score of 9.6 and is rated Critical. SailPoint published a security advisory on September 28, 2026, and has released patches for all supported affected versions. The company also plans to include the fix in future patch levels. The issue affects the processing of content sent to the web service API, where improper validation allows malicious input to trigger code execution.

GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws

GitLab has issued critical security updates for its development platform to address 11 vulnerabilities across Community Edition and Enterprise Edition. The patches cover versions 19.4.1, 19.3.3, and 19.2.7 and were released on September 23, 2026. Two vulnerabilities rated Critical allow authenticated users to achieve arbitrary code execution on the server. CVE-2026-89078 involves a double-free issue in CI/CD configuration parsing triggered by crafted regular expressions, while CVE-2026-93577 is an integer overflow in the regular expression compiler. Additional High-severity issues include cross-site scripting in merge request diffs and unauthorized access to sensitive CI/CD variables via the Duo AI job troubleshooting feature. The update also resolves five Medium and two Low severity flaws.

F5 BIG-IP APM Vulnerability CVE-2026-94127 Allows Remote Code Execution, Already Exploited in the Wild

F5 has disclosed a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager that is already being actively exploited. The flaw, tracked as CVE-2026-94127, affects systems configured as an OAuth authorization server with both an access policy and OAuth profile applied to a virtual server. Successful exploitation can result in arbitrary code execution from crafted network traffic. The issue also impacts appliance mode configurations. F5 rates the vulnerability 9.3 under CVSS v4.0 and 9.8 under CVSS v3.1, classifying it as Critical. The company discovered the flaw internally and has confirmed real-world exploitation, urging immediate patching and compromise assessment.

Cisco Patches 29 Vulnerabilities in Secure Firewall ASA, FTD and FMC Products

Cisco Systems has disclosed multiple vulnerabilities affecting its Cisco Secure Firewall product line and released corresponding security updates. The advisory covers 14 security bulletins addressing 29 CVEs across Adaptive Security Appliance (ASA), Threat Defense (FTD), and Management Center (FMC) software. Five of the advisories are rated Critical, covering 18 CVEs that include remote code execution without authentication and privilege escalation to administrator level. Several issues have already been confirmed as exploited in the wild. The company also consolidated related weaknesses under single CVE identifiers where appropriate and provided CVSS v3.1 base scores ranging up to 9.9. Affected products include the Secure Firewall 3100 and 4200 Series along with multiple software hardening releases issued on 16 September 2026.

Cisco Releases Critical Patches for Exploited SQL Injection Flaw in Secure Email Gateway

Cisco Systems has issued security updates for Cisco Secure Email Gateway to address a critical SQL injection vulnerability tracked as CVE-2026-76461. The flaw stems from insufficient input validation during email parsing and allows unauthenticated remote attackers to execute arbitrary SQL commands. Successful exploitation can lead to root-level access on the underlying operating system, enabling full command execution. The vulnerability carries a CVSSv3.1 base score of 9.8 and is rated Critical. Cisco confirmed active exploitation of the issue in September 2026. Recommended fixes include upgrading to versions 16.5.0-780, 16.0.4-3021, or 15.5.5-0141, with strong preference given to the newest release.

Adobe Issues Critical Security Updates for ColdFusion Fixing Nine CVEs Including Eval Injection Flaws

Adobe has released security updates for Adobe ColdFusion to address nine vulnerabilities, urging users to apply the patches immediately. The update coincides with Patch Tuesday on September 8, 2026, and covers issues such as Eval injection, SQL injection, cross-site scripting, and access control weaknesses. Six of the vulnerabilities are rated Critical, with the highest CVSS v3.1 base score reaching 9.9 for CVE-2026-48273. The remaining three vulnerabilities are classified as Important. Adobe ColdFusion users are advised to update without delay to mitigate risks of code injection and unauthorized access. The advisory also references related security issues in other products including Canva, BIG-IP, and Dell SCG.

Critical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited

Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.

CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog

The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.

Adobe Releases Third Emergency Patch for Campaign Classic in Two Weeks, Fixing Critical RCE Vulnerabilities

Adobe has issued another urgent security update for Adobe Campaign Classic after discovering multiple critical vulnerabilities that affect the previous patches released on July 29 and August 3. The new advisory, published on August 11, 2026, addresses three CVEs rated Critical, including two remote code execution flaws with CVSSv3.1 base scores of 10.0. These authorization bypass issues allow unauthenticated attackers to execute arbitrary code remotely. The affected versions include 7.4.3 build 9398 and build 9399, which were themselves emergency fixes issued only days earlier. Adobe urges all customers to apply the latest update immediately due to the high risk of exploitation. This marks the third high-severity patch for the product within a two-week period.

Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities

Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.

Adobe Releases Emergency Update for Campaign Classic Fixing Multiple Critical Vulnerabilities

Adobe has issued an urgent security update for Adobe Campaign Classic to address seven critical vulnerabilities, including several with a maximum CVSSv3.1 base score of 10.0. The flaws affect on-premises deployments on Windows and Linux as well as the on-premises components of hybrid setups. Notably, the newly released fixes also impact the previous emergency update from July 29, version 7.4.3 build 9398, requiring users to apply the latest patch immediately. Among the most severe issues are a server-side request forgery vulnerability tracked as CVE-2026-48331, an input handling flaw in the template engine identified as CVE-2026-48323, and an SQL injection vulnerability labeled CVE-2026-48330. Adobe published the corresponding security advisory on August 3, 2026, urging rapid remediation despite the short interval since the prior update.

MongoDB Server Patches 24 Vulnerabilities Including Critical Flaw in mongod Compute Mode

MongoDB has released updates addressing 24 vulnerabilities in MongoDB Server, with one rated critical. The patches cover multiple branches and include fixes for CVE-2026-13072, which carries a CVSSv3.1 base score of 9.2. The critical issue affects standalone mongod instances with compute mode enabled and stems from insufficient validation of external input that can lead to memory corruption. Additional fixes resolve 16 high-severity issues, seven medium, and one low, including CVE-2026-13059 that could allow unauthorized read-write actions by low-privileged authenticated users. Updated versions MongoDB 8.3.7, 8.2.12, 8.0.28, and 7.0.39 are now available. The company published the updates on July 22, 2026, and urges immediate application to maintain system integrity.