Security news, decoded.

watchTowr Labs found that CVE-2026-94127 in F5 BIG-IP APM lets an unauthenticated attacker send an oversized Authorization header during an OAuth request, causing a heap overflow that can be developed into remote code execution. The issue affects BIG-IP APM 21.x and 17.x, and F5 reports active exploitation, making prompt installation of the available hotfixes important for exposed deployments.

Check Point confirmed attackers are exploiting CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway VPN certificate handling, and CVE-2026-93616, a pre-authentication path traversal issue in the Management web service that can enable script execution and Java class loading. Organizations should deploy the recommended LivePatch or Jumbo Hotfix updates for supported gateways and update Spark firewalls, while applying access-rule mitigations where patching is not possible.

Threat actors are actively exploiting the critical unauthenticated path traversal flaw CVE-2026-87902 in WordPress to write PHP files that can run shell commands when accessed. WordPress fixed the issue in version 7.1.2 and backported fixes to branches down to 4.7; administrators should update promptly and review logs for double-encoded traversal probes and suspicious files in /tmp or /var/tmp.

Attackers have exploited the MikroTrick chain, combining CVE-2026-67279 and CVE-2026-86060 to gain administrator control of Internet-exposed MikroTik RouterOS devices without credentials. MikroTik fixed the flaws in RouterOS 6.49.21, 7.23.4, and 7.24.2, but organizations should also investigate systems for signs of prior compromise, including SSH logins using -2 and unknown ops accounts. Exposed SSH services face the greatest risk; compromised routers should be isolated, reset, rebuilt from trusted configurations, and have credentials rotated.

CISA added actively exploited Linux kernel flaws CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its KEV Catalog, with the shortest BOD 26-04 remediation deadline expiring on September 21, 2026. CVE-2025-39682 can expose memory or cause denial of service, CVE-2026-53266 can corrupt memory and potentially enable local privilege escalation, and CVE-2025-39964 can crash systems or produce corrupted cryptographic output. Organizations should urgently update affected Linux systems, prioritizing internet-facing assets.

Eclypsium's InfraTrust report says attackers are increasingly targeting network administration platforms, where compromise can provide broad control over managed infrastructure. Actively exploited vulnerabilities include Cisco Secure Firewall Management Center flaws CVE-2026-20079 and CVE-2026-20316, Cisco Identity Services Engine flaw CVE-2026-76460, and SonicWall SMA 1000 flaws CVE-2026-83548 and CVE-2026-83549. Organizations should apply vendor hotfixes and updates, restrict access to management interfaces, and investigate potentially compromised appliances.

Arista Networks has issued patches for CVE-2026-93952, an actively exploited zero-day in VeloCloud Orchestrator (VCO) On-Prem deployments using certificate-based VeloCloud Edge-to-VCO authentication. The input-validation flaw can let remote attackers with network access to the VCO web interface reach privileged internal host functions without VCO credentials; hosted VCO 5.2.3.16 or later and VCO 6.4.2.8 or later are patched, while fixes are planned for 6.1.3.7 and below and 7.0.0.2 and below.

cPanel has fixed CVE-2026-87899 in CalDAV and CardDAV, which could allow an authenticated hosting account to execute code as root on cPanel & WHM version 120 and later. The updates also address CVE-2026-68490, exposing other accounts' calendar and contact data, and CVE-2026-87900 in WP Toolkit 6.11.2-10794 and older, which permits cross-account database changes; administrators should update cPanel & WHM to 11.134.0.57, 11.136.0.41, 11.138.0.8, or later, and WP Toolkit to 6.11.3 or later.

Adobe has issued updates for 36 vulnerabilities, including critical flaws in Adobe Connect and AEM Forms that could enable code execution or privilege escalation. The Adobe Connect issues are CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, involving SQL injection, XSS, and input-validation weaknesses. AEM Forms fixes CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000, while Adobe also patched other products; the company reports no known in-the-wild exploitation and recommends applying the priority 2 updates within 30 days.

DepthFirst released proof-of-concept code for CVE-2026-80521, a Linux Kernel AFUNIX socket use-after-free that can let a containerized attacker obtain root access on the host. Ubuntu 26.04, 24.04, and 22.04 LTS remain unpatched, including newer kernel packages used for AWS, Azure, and GCP workloads. The upstream Linux Kernel fix is available, but Ubuntu lists the issue as work in progress; no confirmed in-the-wild exploitation has been reported.

Check Point has issued emergency fixes for CVE-2026-93616, a pre-authentication path traversal flaw affecting its Management Server products, after attacks dating to July 23, 2026. Exploitation attempts are also targeting Check Point Spark Firewalls through CVE-2026-85102, an authentication bypass and RCE vulnerability; organizations should patch, review Mobile Access activity, and limit Management Server access where fixes cannot be applied. CISA also added CVE-2026-93952 in Arista VeloCloud Orchestrator and CVE-2026-94127 in F5 Networks’ BIG-IP APM to its Known Exploited Vulnerabilities catalog, highlighting the need to check affected systems for compromise.

WordPress has released 7.1.2 to address CVE-2026-87902, an unauthenticated path traversal vulnerability affecting versions 4.7.0 through 7.1.1. The flaw in getpagetemplate() can let remote attackers cause WordPress to include readable PHP files outside the active theme directories, potentially leading to server-side code execution under certain configurations. WordPress also backported the fix to supported older branches, and site operators should update promptly.

Arista has released emergency fixes for CVE-2026-93952, a CVSS 10 improper input validation flaw actively exploited against on-premises VeloCloud Orchestrator deployments. The issue can let a remote attacker reach privileged internal functions, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data. Arista fixed the affected 5.2.x and 6.1.x trains in VCO versions 5.2.3.16 and 6.4.2.8, respectively, and advises organizations to update immediately.

F5 has released engineering hotfixes for CVE-2026-94127, an exploited heap-based buffer overflow in BIG-IP Access Policy Manager when it operates as an OAuth authorization server. Unauthenticated attackers can send crafted traffic to an affected virtual server and execute code; impacted releases are 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3 before their respective hotfixes. Organizations should install the applicable F5 hotfix, or obtain F5's iRule mitigation while investigating for compromise.