{ "ok": true, "schemaVersion": "1.1", "service": "Ahmed Rabeeah Vulnerability Watch", "generatedAt": "2026-10-05T20:00:27.022Z", "health": { "overall": "healthy", "nvd": { "stats": "healthy", "recentFeed": "healthy" }, "cisaKev": "healthy", "epss": "healthy" }, "dataFreshness": { "nvd": "2026-10-05T20:00:28.285", "cisaKev": "2026-10-04T18:52:56.0635Z", "epss": "2026-10-05" }, "sources": [ { "id": "nvd", "name": "NIST National Vulnerability Database", "url": "https://nvd.nist.gov/", "healthy": true }, { "id": "cisa-kev", "name": "CISA Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "healthy": true }, { "id": "epss", "name": "FIRST Exploit Prediction Scoring System", "url": "https://www.first.org/epss/", "healthy": true } ], "stats": { "periodDays": 30, "cvesPublished": 14511, "knownExploited": { "totalCatalog": 1734, "addedLast30Days": 39 }, "candidateSeverity": { "critical": 55, "high": 92, "medium": 180, "low": 44, "unknown": 43 } }, "feed": { "recentNvdWindowHours": 48, "recentNvdResults": 376, "recentKevResults": 39, "combinedCandidates": 414, "filteredCandidates": 414, "returned": 15, "limit": 15, "sort": "risk-priority", "filters": { "severity": null, "kev": null, "ransomware": null, "minEpss": null, "q": null }, "items": [ { "id": "CVE-2026-20079", "identity": { "cve": "CVE-2026-20079", "aliases": [] }, "status": "Analyzed", "title": "Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability", "description": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. \r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. ", "dates": { "published": "2026-03-04T18:16:24.230", "lastModified": "2026-09-16T17:17:16.340", "kevAdded": "2026-09-09", "kevDueDate": "2026-09-12" }, "severity": { "label": "CRITICAL", "score": 10, "cvss": { "version": "3.1", "source": "psirt@cisco.com", "type": "Secondary", "baseScore": 10, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 6 } }, "risk": { "priority": "IMMEDIATE", "priorityScore": 100, "knownExploited": true, "publicExploit": true, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.8818, "percentage": 88.18, "percentile": 0.99765, "percentilePercentage": 99.77, "date": "2026-10-05" }, "reasons": [ "CVSS 10 CRITICAL", "CISA Known Exploited Vulnerability", "EPSS 88.2% exploitation probability", "Public exploit reference available", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-288", "source": "psirt@cisco.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED" }, "affected": { "vendors": [ "cisco", "Cisco" ], "products": [ "secure firewall management center", "Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "DFA94312-376E-4785-888F-3C07612E1DF7", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "29E73FBF-2579-4660-AFFA-7F9607004226", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.0.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "87FAAFFB-0589-441B-8289-8B8A6E18F705", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "73B92119-793D-4A43-A056-24DB6826E759", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.1.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "093A0BC2-037C-463F-AFC5-EF11C2954EAD", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "C4F434FC-CAA4-4DBB-8094-C4ECC28B31E7", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.2.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "68C70BB3-33B3-4E7E-99D5-FF76D4ED96AE", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "B881B8DF-A96D-4B64-B98A-71F0D3388641", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "F6A97625-D39C-42D5-89E4-415A868A0972", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "5E4D83B4-9697-4071-AC9F-7ADC86A6B529", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "8F81F708-ACED-4E42-8CA9-116B5C4F5141", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.6.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "3C86116B-8475-40A0-A507-D4A7947F5F2C", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.6.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "B98BFDB6-0884-4A5B-B2F6-102AE22665C9", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.6.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "44D21149-BF7B-4188-A336-49AA5683BDC1", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.7", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "708A721E-11D2-4E9B-9F11-5B82F3FA742C", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.8", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "943BDA7B-0E37-4914-B7B2-EDFD58FAF653", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.8.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "E7B79D39-81E4-40B7-BB00-79F7B4F031F0", "vendor": "cisco", "product": "secure firewall management center", "version": "7.0.9", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "A58A2DA5-3EE7-408D-AAFA-82330F0325B2", "vendor": "cisco", "product": "secure firewall management center", "version": "7.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "7FA98EEC-2059-4CA9-92F1-72C1E0BB7EC6", "vendor": "cisco", "product": "secure firewall management center", "version": "7.1.0.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "F4C51EE7-866B-410C-B75E-EF260D5062B0", "vendor": "cisco", "product": "secure firewall management center", "version": "7.1.0.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "5F1FFD07-B874-4D3C-8E2C-9A204F1E994E", "vendor": "cisco", "product": "secure firewall management center", "version": "7.1.0.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "FB5ACB9E-86AF-4EC1-9F36-A202429CD0F4", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "AD1E4527-AAE2-4DA9-AFDA-6375839F7843", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.0.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "2F0AF047-EAE9-4C77-BCEF-5CB26F84C742", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "2ED03874-4071-4382-8A46-8B3A59E601FF", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "BF84E043-DF3C-4A95-8FDA-B0FDCD795377", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "B9498087-9642-4A86-B3EE-1513C55A86E2", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.3.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "36C229AB-2851-48D4-815A-63AAB4462A24", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "6DA4BCFC-8237-4F5C-9863-523EE7D8619B", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.4.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "07693A92-7D84-45A1-ACD6-D83AE41D504B", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "2C78050A-A5FB-427B-BF0D-0353B240A4FF", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.5.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "85E76AE7-12AC-4419-AE66-43730B173B4E", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.5.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "4D803EC9-26EE-4799-A435-C782C92739CF", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "6EEF87CD-2335-4886-A65C-4E33775AEC52", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.7", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "953EB81A-1B53-4A57-9F59-D4A7D37E657E", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.8", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "1CB534BC-3E4D-4484-AFD0-69524B1F07F9", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.8.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "D6514BF0-5A21-4C3A-9D9D-49677D7A2409", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.9", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "B291AF23-55FF-4F9A-87AC-76AA3BB3562F", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "4170B357-C086-483A-BC6C-CB1391FA5831", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.10.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "0B72005B-FBF0-4B0D-975B-178B511598B1", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.10.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "FBA0C228-2C5F-49C9-BF09-64CB101E98E9", "vendor": "cisco", "product": "secure firewall management center", "version": "7.2.11", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "5D401072-6709-4921-8918-720F28D61E24", "vendor": "cisco", "product": "secure firewall management center", "version": "7.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "C0EA3467-4205-4C41-AF24-689330F7396B", "vendor": "cisco", "product": "secure firewall management center", "version": "7.3.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "9BE94E38-5F29-4AE1-8129-7F7582C2CC75", "vendor": "cisco", "product": "secure firewall management center", "version": "7.3.1.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "FEF603AD-D69B-4DD8-A7F4-6BEFD355EF29", "vendor": "cisco", "product": "secure firewall management center", "version": "7.3.1.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "D6BD1665-7824-4D98-A930-432CBDA4EAD5", "vendor": "cisco", "product": "secure firewall management center", "version": "7.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "F8056E69-22FA-4935-A576-916805D90C62", "vendor": "cisco", "product": "secure firewall management center", "version": "7.4.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "6A80BBBE-DB5E-460A-8621-6E28D2BD6E44", "vendor": "cisco", "product": "secure firewall management center", "version": "7.4.1.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "2B33F953-FEF3-4C46-A12A-2A42D8339D6E", "vendor": "cisco", "product": "secure firewall management center", "version": "7.4.2", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B2C8DF03-2280-48B8-AC1E-4AAA31A36BDC", "vendor": "cisco", "product": "secure firewall management center", "version": "7.4.2.1", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Cisco", "product": "Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management", "vulnerabilityName": "Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability", "dateAdded": "2026-09-09", "dueDate": "2026-09-12", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20079", "cwes": [ "CWE-288" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-12", "vendorAdvisories": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2" ] }, "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "source": "psirt@cisco.com", "tags": [ "Vendor Advisory" ] }, { "url": "http://seclists.org/fulldisclosure/2026/Aug/80", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Mailing List", "Third Party Advisory" ] }, { "url": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-20079", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "IMMEDIATE", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-85706", "identity": { "cve": "CVE-2026-85706", "aliases": [] }, "status": "Analyzed", "title": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "description": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.", "dates": { "published": "2026-09-12T03:16:30.473", "lastModified": "2026-09-24T12:52:28.143", "kevAdded": "2026-09-11", "kevDueDate": "2026-09-14" }, "severity": { "label": "CRITICAL", "score": 10, "cvss": { "version": "3.1", "source": "cve@gitlab.com", "type": "Secondary", "baseScore": 10, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "exploitabilityScore": 3.9, "impactScore": 5.8 } }, "risk": { "priority": "IMMEDIATE", "priorityScore": 98.9, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.92956, "percentage": 92.96, "percentile": 0.9983, "percentilePercentage": 99.83, "date": "2026-10-05" }, "reasons": [ "CVSS 10 CRITICAL", "CISA Known Exploited Vulnerability", "EPSS 93% exploitation probability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-22", "source": "cve@gitlab.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED" }, "affected": { "vendors": [ "gitlab", "GitLab" ], "products": [ "gitlab", "Community Edition and Enterprise Edition" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "16F1EDAF-FD17-4B50-B9D2-643DF2770CAA", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "18.7.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "18.11.12" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "BFC013D4-560D-444B-A63F-6128E0CB8EC1", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "18.7.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "18.11.12" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "785E6802-2B47-414C-A0D7-910EBF325B9B", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.0.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.0.9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "94A5B71B-5FDA-4758-9095-77AA1225282F", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.0.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.0.9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "202657EE-3BCA-4770-BD25-EA7BF5139394", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.1.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "A7AFE4A6-85DB-4CA2-AE8A-A5EC6521520C", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.1.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "4A6AAECA-E557-43EF-B109-B92D1281E48B", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.2.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "8598AF82-D212-4B5D-ABC3-C12C9B217BF3", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.2.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "198FF0EF-1A45-484F-9268-F7821E006BA8", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.3.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.3.2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "03B1901F-AAF4-421E-B704-5345CB840DEF", "vendor": "gitlab", "product": "gitlab", "version": null, "versionStartIncluding": "19.3.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "19.3.2" } ] }, "kev": { "isKnownExploited": true, "vendorProject": "GitLab", "product": "Community Edition and Enterprise Edition", "vulnerabilityName": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "dateAdded": "2026-09-11", "dueDate": "2026-09-14", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706", "cwes": [ "CWE-35" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-14", "vendorAdvisories": [] }, "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "source": "cve@gitlab.com", "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3909881", "source": "cve@gitlab.com", "tags": [ "Permissions Required" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Third Party Advisory", "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-85706", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "IMMEDIATE", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-71362", "identity": { "cve": "CVE-2026-71362", "aliases": [] }, "status": "Analyzed", "title": "Adobe Commerce and Magento Incorrect Authorization Vulnerability ", "description": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.", "dates": { "published": "2026-08-11T18:18:21.610", "lastModified": "2026-09-25T12:53:15.757", "kevAdded": "2026-09-24", "kevDueDate": "2026-09-27" }, "severity": { "label": "CRITICAL", "score": 9.1, "cvss": { "version": "3.1", "source": "psirt@adobe.com", "type": "Secondary", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "exploitabilityScore": 3.9, "impactScore": 5.2 } }, "risk": { "priority": "IMMEDIATE", "priorityScore": 94.5, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.87507, "percentage": 87.51, "percentile": 0.99755, "percentilePercentage": 99.76, "date": "2026-10-05" }, "reasons": [ "CVSS 9.1 CRITICAL", "CISA Known Exploited Vulnerability", "EPSS 87.5% exploitation probability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-863", "source": "psirt@adobe.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED" }, "affected": { "vendors": [ "adobe", "Adobe" ], "products": [ "commerce", "commerce b2b", "magento", "Commerce and Magento " ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "76AAB57F-7723-44E0-B91A-9F120C849AC4", "vendor": "adobe", "product": "commerce", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "2.4.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*", "matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*", "matchCriteriaId": "1C3D7164-1C5F-40BC-9EEC-B0E00CD45808", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*", "matchCriteriaId": "68AAE162-5957-42AF-BE20-40F341837FAC", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*", "matchCriteriaId": "D9D01159-3309-4F6B-93B0-2D89DDD33DEE", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*", "matchCriteriaId": "91736E79-D8E7-4AF2-8E01-A7B4EB8AD6F4", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*", "matchCriteriaId": "8412C043-64E7-4DFF-A303-13A6FE113BFB", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*", "matchCriteriaId": "BBDA2BCF-E784-4CF3-B30D-6FF5BEE2055F", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*", "matchCriteriaId": "00909C10-6C93-4735-94ED-18DCBD608A28", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p17:*:*:*:*:*:*", "matchCriteriaId": "C6F35FE6-853D-4EC6-8A4F-07F4ABD6301A", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p18:*:*:*:*:*:*", "matchCriteriaId": "5FD50C55-E296-4F3C-8035-C1E9256D3773", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*", "matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*", "matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*", "matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*", "matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*", "matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*", "matchCriteriaId": "6A56E96C-6CE5-442C-AA88-F0059B02B5E7", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*", "matchCriteriaId": "8867F510-201C-4199-8554-53DE156CE669", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*", "matchCriteriaId": "23988132-DD4E-4968-B6B8-954122F76081", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*", "matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*", "matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:*", "matchCriteriaId": "5764CC97-C866-415D-A3A1-5B5B9E1C06A6", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:*", "matchCriteriaId": "E82D10D8-2894-4E5B-B47B-F00964DD5CDE", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:*", "matchCriteriaId": "B044F2D9-E888-4852-8A40-DCE688860ED3", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:*", "matchCriteriaId": "6423C754-36F9-4680-9211-60940ED63E79", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p14:*:*:*:*:*:*", "matchCriteriaId": "3472064A-8C79-436B-965A-96834AE8D346", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p15:*:*:*:*:*:*", "matchCriteriaId": "CDA8ABEB-F955-4D34-8219-C518B49F5543", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p16:*:*:*:*:*:*", "matchCriteriaId": "55D6A6BD-9E63-448A-A286-437EA1580CEF", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p17:*:*:*:*:*:*", "matchCriteriaId": "5BF962FF-2CCF-48A5-AAA3-85639EAC64BB", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*", "matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*", "matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*", "matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*", "matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*", "matchCriteriaId": "6DF0E74D-9293-4209-97D1-A3BA13C3DDE9", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*", "matchCriteriaId": "8922D646-1A97-47ED-91C6-5A426781C98A", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*", "matchCriteriaId": "952787C6-9BF1-49FB-9824-1236678E1902", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:*", "matchCriteriaId": "898A8679-3C46-4718-9EDF-583ADDFCF2EC", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*", "matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*", "matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p10:*:*:*:*:*:*", "matchCriteriaId": "E57889CC-3E90-46AF-9CD6-3328DD501AD1", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p11:*:*:*:*:*:*", "matchCriteriaId": "47A86566-DE38-4032-947D-B6181F0BC120", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p12:*:*:*:*:*:*", "matchCriteriaId": "B7D1D684-CE7E-4D6D-95B5-1F86A8DB6C66", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p13:*:*:*:*:*:*", "matchCriteriaId": "CABF5BD0-1D06-483D-91D3-A773D99EF217", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p14:*:*:*:*:*:*", "matchCriteriaId": "33512239-B316-4FE7-94F0-ABD30900238B", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p15:*:*:*:*:*:*", "matchCriteriaId": "95FD09E4-BB76-47F4-A2B3-569B0E4CB737", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*", "matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*", "matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p4:*:*:*:*:*:*", "matchCriteriaId": "0E05F4AC-2A28-47E3-96DE-0E31AF73CD43", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*", "matchCriteriaId": "3A9A62EE-1649-4815-8EC9-7AEF7949EB2F", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Adobe", "product": "Commerce and Magento ", "vulnerabilityName": "Adobe Commerce and Magento Incorrect Authorization Vulnerability ", "dateAdded": "2026-09-24", "dueDate": "2026-09-27", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://helpx.adobe.com/security/products/magento/apsb26-92.html ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-71362", "cwes": [ "CWE-863" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-27", "vendorAdvisories": [ "https://helpx.adobe.com/security/products/magento/apsb26-92.html" ] }, "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "source": "psirt@adobe.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-71362", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "IMMEDIATE", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2025-25249", "identity": { "cve": "CVE-2025-25249", "aliases": [] }, "status": "Analyzed", "title": "Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability", "description": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets", "dates": { "published": "2026-01-13T17:15:56.910", "lastModified": "2026-09-10T12:47:59.933", "kevAdded": "2026-09-09", "kevDueDate": "2026-09-12" }, "severity": { "label": "CRITICAL", "score": 9.8, "cvss": { "version": "3.1", "source": "nvd@nist.gov", "type": "Primary", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "risk": { "priority": "CRITICAL", "priorityScore": 89.8, "knownExploited": true, "publicExploit": true, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.03859, "percentage": 3.86, "percentile": 0.89856, "percentilePercentage": 89.86, "date": "2026-10-05" }, "reasons": [ "CVSS 9.8 CRITICAL", "CISA Known Exploited Vulnerability", "Public exploit reference available", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-122", "source": "psirt@fortinet.com", "type": "Secondary" }, { "id": "CWE-787", "source": "nvd@nist.gov", "type": "Primary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED" }, "affected": { "vendors": [ "fortinet", "siemens", "Fortinet" ], "products": [ "fortios", "fortiswitchmanager", "fortisase", "ruggedcom ape1808 firmware", "ruggedcom ape1808", "Multiple Products" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B071609-D589-44A8-8E7A-010B5BAA36EE", "vendor": "fortinet", "product": "fortios", "version": null, "versionStartIncluding": "6.4.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.0.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8FAAA2E-7A53-4F6B-A9C7-1E2B4CB5F7EB", "vendor": "fortinet", "product": "fortios", "version": null, "versionStartIncluding": "7.2.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.2.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "2093EFE3-4B7F-4806-9850-C42B26BC64AC", "vendor": "fortinet", "product": "fortios", "version": null, "versionStartIncluding": "7.4.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.4.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1C30E0D-7F09-42D2-9EB1-E2196BD50D75", "vendor": "fortinet", "product": "fortios", "version": null, "versionStartIncluding": "7.6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.6.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1B9AA70-BB46-403B-94C1-D94C64E22334", "vendor": "fortinet", "product": "fortiswitchmanager", "version": null, "versionStartIncluding": "7.0.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.0.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE22A407-02CB-4979-A38D-9EBAFEB350F6", "vendor": "fortinet", "product": "fortiswitchmanager", "version": null, "versionStartIncluding": "7.2.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.2.7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fortinet:fortisase:25.1.39:*:*:*:-:*:*:*", "matchCriteriaId": "77B84900-E96D-4E2C-8797-B1460E71874E", "vendor": "fortinet", "product": "fortisase", "version": "25.1.39", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:fortinet:fortisase:25.1.51:*:*:*:-:*:*:*", "matchCriteriaId": "12A8EE3F-EEAF-460D-B2DB-551509DF0814", "vendor": "fortinet", "product": "fortisase", "version": "25.1.51", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "37FDCA69-9049-40B4-88AF-F476901022B6", "vendor": "siemens", "product": "ruggedcom ape1808 firmware", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*", "matchCriteriaId": "B89A6863-B602-4404-8D26-337FECABFFF0", "vendor": "siemens", "product": "ruggedcom ape1808", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Fortinet", "product": "Multiple Products", "vulnerabilityName": "Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability", "dateAdded": "2026-09-09", "dueDate": "2026-09-12", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-25249", "cwes": [ "CWE-122", "CWE-787" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-12", "vendorAdvisories": [ "https://fortiguard.fortinet.com/psirt/FG-IR-25-084" ] }, "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "source": "psirt@fortinet.com", "tags": [ "Vendor Advisory", "Mitigation" ] }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "tags": [ "Third Party Advisory" ] }, { "url": "https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2025-25249", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-76461", "identity": { "cve": "CVE-2026-76461", "aliases": [] }, "status": "Analyzed", "title": "Cisco Secure Email Gateway SQL Injection Vulnerability", "description": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.", "dates": { "published": "2026-09-14T17:17:51.113", "lastModified": "2026-09-15T12:47:32.497", "kevAdded": "2026-09-14", "kevDueDate": "2026-09-17" }, "severity": { "label": "CRITICAL", "score": 9.8, "cvss": { "version": "3.1", "source": "psirt@cisco.com", "type": "Secondary", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "risk": { "priority": "CRITICAL", "priorityScore": 88.4, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.28269, "percentage": 28.27, "percentile": 0.9807, "percentilePercentage": 98.07, "date": "2026-10-05" }, "reasons": [ "CVSS 9.8 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-89", "source": "psirt@cisco.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED" }, "affected": { "vendors": [ "cisco", "Cisco" ], "products": [ "asyncos", "secure email gateway virtual appliance c100v", "secure email gateway virtual appliance c300v", "secure email gateway virtual appliance c600v", "secure email gateway c195", "secure email gateway c395", "secure email gateway c695", "Secure Email Gateway" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "matchCriteriaId": "E78A2134-478B-4F8A-AE74-C1D85C8426F5", "vendor": "cisco", "product": "asyncos", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "15.5.5-014" }, { "vulnerable": true, "criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "matchCriteriaId": "930177FE-C639-42C2-ACB2-16DA3D1E4F1C", "vendor": "cisco", "product": "asyncos", "version": null, "versionStartIncluding": "16.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "16.0.4-302" }, { "vulnerable": true, "criteria": "cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*", "matchCriteriaId": "44348B0F-6723-4FC1-81CD-F204BBC15F76", "vendor": "cisco", "product": "asyncos", "version": null, "versionStartIncluding": "16.5", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "16.5.0-780" }, { "vulnerable": false, "criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c100v:-:*:*:*:*:*:*:*", "matchCriteriaId": "5B6FBC8A-8187-4903-B786-6CF341C142B5", "vendor": "cisco", "product": "secure email gateway virtual appliance c100v", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c300v:-:*:*:*:*:*:*:*", "matchCriteriaId": "68864429-9730-43E9-96C3-20B9035BB291", "vendor": "cisco", "product": "secure email gateway virtual appliance c300v", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:a:cisco:secure_email_gateway_virtual_appliance_c600v:-:*:*:*:*:*:*:*", "matchCriteriaId": "B52D8B2B-E9AE-4B02-87BD-9CF9FA95906A", "vendor": "cisco", "product": "secure email gateway virtual appliance c600v", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:cisco:secure_email_gateway_c195:-:*:*:*:*:*:*:*", "matchCriteriaId": "7B1322B8-1CF9-4B17-9A58-38788051ED4F", "vendor": "cisco", "product": "secure email gateway c195", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:cisco:secure_email_gateway_c395:-:*:*:*:*:*:*:*", "matchCriteriaId": "139A640B-1957-4953-AA88-9D373A5152D1", "vendor": "cisco", "product": "secure email gateway c395", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:cisco:secure_email_gateway_c695:-:*:*:*:*:*:*:*", "matchCriteriaId": "F08EA2AD-618B-4834-A52D-73F6A4502DF1", "vendor": "cisco", "product": "secure email gateway c695", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Cisco", "product": "Secure Email Gateway", "vulnerabilityName": "Cisco Secure Email Gateway SQL Injection Vulnerability", "dateAdded": "2026-09-14", "dueDate": "2026-09-17", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76461", "cwes": [ "CWE-89" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-17", "vendorAdvisories": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX" ] }, "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "source": "psirt@cisco.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-76461", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-86060", "identity": { "cve": "CVE-2026-86060", "aliases": [] }, "status": "Analyzed", "title": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability", "description": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "dates": { "published": "2026-09-05T20:17:18.703", "lastModified": "2026-09-11T12:52:16.507", "kevAdded": "2026-09-10", "kevDueDate": "2026-09-13" }, "severity": { "label": "CRITICAL", "score": 9.2, "cvss": { "version": "4.0", "source": "cvd@cert.pl", "type": "Secondary", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitabilityScore": null, "impactScore": null } }, "risk": { "priority": "CRITICAL", "priorityScore": 87.8, "knownExploited": true, "publicExploit": true, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.06392, "percentage": 6.39, "percentile": 0.9347, "percentilePercentage": 93.47, "date": "2026-10-05" }, "reasons": [ "CVSS 9.2 CRITICAL", "CISA Known Exploited Vulnerability", "Public exploit reference available", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-88", "source": "cvd@cert.pl", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": null }, "affected": { "vendors": [ "mikrotik", "MikroTik" ], "products": [ "routeros", "RouterOS" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFC981EC-B44C-40B5-945B-2283FADEC961", "vendor": "mikrotik", "product": "routeros", "version": null, "versionStartIncluding": "6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "6.49.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "881306AB-32B1-4B5F-96D8-9532D25F7AE4", "vendor": "mikrotik", "product": "routeros", "version": null, "versionStartIncluding": "7.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.23.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "A41D6B3C-D321-4C61-B3D5-00F8276CB4AC", "vendor": "mikrotik", "product": "routeros", "version": null, "versionStartIncluding": "7.24", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.24.2" } ] }, "kev": { "isKnownExploited": true, "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability", "dateAdded": "2026-09-10", "dueDate": "2026-09-13", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://mikrotik.com/supportsec/september-2026-vulnerability ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86060", "cwes": [ "CWE-88" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-13", "vendorAdvisories": [ "https://mikrotik.com/supportsec/september-2026-vulnerability/" ] }, "references": [ { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "source": "cvd@cert.pl", "tags": [ "Third Party Advisory" ] }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "source": "cvd@cert.pl", "tags": [ "Mitigation", "Third Party Advisory" ] }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "source": "cvd@cert.pl", "tags": [ "Release Notes" ] }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "source": "cvd@cert.pl", "tags": [ "Release Notes" ] }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "source": "cvd@cert.pl", "tags": [ "Release Notes" ] }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "source": "cvd@cert.pl", "tags": [ "Vendor Advisory" ] }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "source": "cvd@cert.pl", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-86060", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-76460", "identity": { "cve": "CVE-2026-76460", "aliases": [] }, "status": "Analyzed", "title": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability", "description": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.", "dates": { "published": "2026-09-16T21:17:21.430", "lastModified": "2026-09-25T16:53:35.463", "kevAdded": "2026-09-16", "kevDueDate": "2026-09-19" }, "severity": { "label": "CRITICAL", "score": 10, "cvss": { "version": "3.1", "source": "psirt@cisco.com", "type": "Secondary", "baseScore": 10, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 6 } }, "risk": { "priority": "CRITICAL", "priorityScore": 87.1, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.14026, "percentage": 14.03, "percentile": 0.96457, "percentilePercentage": 96.46, "date": "2026-10-05" }, "reasons": [ "CVSS 10 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-648", "source": "psirt@cisco.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED" }, "affected": { "vendors": [ "cisco", "Cisco" ], "products": [ "identity services engine", "identity services engine passive identity connector", "Identity Services Engine" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "7A789B44-7E6C-4FE9-BD40-702A871AB8AC", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "93920663-445E-4456-A905-81CEC6CA1833", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch10:*:*:*:*:*:*", "matchCriteriaId": "DF9CCBFA-0004-48F7-B142-6FDD4B3E1081", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch11:*:*:*:*:*:*", "matchCriteriaId": "C91717BE-76EF-410C-970D-01C5FDC52A0B", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "33DA5BB8-4CFE-44BD-9CEB-BC26577E8477", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "D3AEFA85-66B5-4145-A4AD-96D1FF86B46D", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "7A6A0697-6A9E-48EF-82D8-36C75E0CDFDC", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "E939B65A-7912-4C36-8799-03A1526D7BD3", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "833B438F-0869-4C0D-9952-750C00702E8D", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "E8B2588D-01F9-450B-B2E3-ADC4125E354E", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:*:*:*:*:*:*", "matchCriteriaId": "E41016C0-19E6-4BCC-A8DD-F6C9A2B0003E", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch9:*:*:*:*:*:*", "matchCriteriaId": "654E946A-07C5-4036-BC54-85EF42B808DD", "vendor": "cisco", "product": "identity services engine", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:*", "matchCriteriaId": "7932D5D5-83E1-4BEF-845A-D0783D4BB750", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "1B818846-4A6E-4256-B344-281E8C786C43", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch10:*:*:*:*:*:*", "matchCriteriaId": "1EEC9040-9BD3-43D0-A33E-1EBD941EB65F", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "A44858A2-922A-425A-8B38-0C47DB911A3C", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "53484A32-757B-42F8-B655-554C34222060", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "0CCAC61F-C273-49B3-A631-31D3AE3EB148", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "51AEFCE6-FB4A-4B1C-A23D-83CC3CF3FBBD", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "B452B4F0-8510-475E-9AE8-B48FABB4D7D3", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "5733512D-12B5-4098-AF90-9D68217FAC27", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch8:*:*:*:*:*:*", "matchCriteriaId": "4ED98020-7BAF-4E5E-8B7B-22537200C283", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch9:*:*:*:*:*:*", "matchCriteriaId": "4C6839DC-F3A2-4133-BF60-2E678E6DD4A4", "vendor": "cisco", "product": "identity services engine", "version": "3.2.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "F1B9C2C1-59A4-49A0-9B74-83CCB063E55D", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch10:*:*:*:*:*:*", "matchCriteriaId": "43F3A55D-D4FC-4D93-9513-94B64B21A2B4", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch11:*:*:*:*:*:*", "matchCriteriaId": "F0F60A00-E952-400A-B553-BE96E7FF746F", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "E6C94CC4-CC08-4DAF-A606-FDAFC92720A9", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "BB069EA3-7B8C-42B5-8035-2EE5ED3F56E4", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "FF8B81A6-BF44-4E5F-B167-39F61DDCA026", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "56E0F0EC-3E66-4866-89F5-89B331F3F517", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "2E3E8937-2859-4A2A-91C0-05F674EF0466", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "D4B14684-EB9E-405B-85FA-B62E57CB292C", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch8:*:*:*:*:*:*", "matchCriteriaId": "22B752D1-9E8F-4FB7-8EEB-F9234492372B", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch9:*:*:*:*:*:*", "matchCriteriaId": "85A1CC7D-FE54-4AC0-B98F-972C4B1F3189", "vendor": "cisco", "product": "identity services engine", "version": "3.3.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*", "matchCriteriaId": "D23905E0-E525-49B1-8E5F-4EB42D186768", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "74509498-38EF-4345-9583-CEF5C26CA1D8", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "CD05FF93-7B8C-4283-9DB7-E03FE98FAADF", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "0F9B6A8E-E773-44A3-9266-878F0C58EB41", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "D3727619-E0CA-4CA9-BE35-0C732BCF1741", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "2CFB7565-3930-409C-B5DB-CE77E6ED7C42", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "A388D916-D6A1-4D3A-A48A-A150F387B755", "vendor": "cisco", "product": "identity services engine", "version": "3.4.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "2610FD35-BC4B-41B7-9C92-E6E5264FEE54", "vendor": "cisco", "product": "identity services engine", "version": "3.5.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "3FEE4377-B238-4442-9892-28CECFB2319E", "vendor": "cisco", "product": "identity services engine", "version": "3.5.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "6598563B-7E32-43FB-96A7-88C53E4CE226", "vendor": "cisco", "product": "identity services engine", "version": "3.5.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "719C8E82-269D-4F21-B2B4-4CD3033A17F9", "vendor": "cisco", "product": "identity services engine", "version": "3.5.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "006E0D77-534C-447F-8E97-EC0AB906D978", "vendor": "cisco", "product": "identity services engine passive identity connector", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "AC07A742-D194-425C-945C-3977E96B61B8", "vendor": "cisco", "product": "identity services engine passive identity connector", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch10:*:*:*:*:*:*", "matchCriteriaId": "00D4B446-EDCE-41DC-A03B-97D8A371B0D9", "vendor": "cisco", "product": "identity services engine passive identity connector", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch11:*:*:*:*:*:*", "matchCriteriaId": "BE3B2985-AC34-4628-8564-517C48B9F475", "vendor": "cisco", "product": "identity services engine passive identity connector", "version": "3.1.0", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Cisco", "product": "Identity Services Engine", "vulnerabilityName": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability", "dateAdded": "2026-09-16", "dueDate": "2026-09-19", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76460", "cwes": [ "CWE-648" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-19", "vendorAdvisories": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5" ] }, "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "source": "psirt@cisco.com", "tags": [ "Mitigation", "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-76460", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-93616", "identity": { "cve": "CVE-2026-93616", "aliases": [] }, "status": "Analyzed", "title": "Check Point Multiple Products Path Traversal Vulnerability", "description": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.", "dates": { "published": "2026-09-22T13:17:11.963", "lastModified": "2026-09-23T16:38:38.987", "kevAdded": "2026-09-22", "kevDueDate": "2026-09-25" }, "severity": { "label": "CRITICAL", "score": 9.8, "cvss": { "version": "3.1", "source": "cve@checkpoint.com", "type": "Secondary", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "risk": { "priority": "CRITICAL", "priorityScore": 87.1, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.19654, "percentage": 19.65, "percentile": 0.97323, "percentilePercentage": 97.32, "date": "2026-10-05" }, "reasons": [ "CVSS 9.8 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-22", "source": "cve@checkpoint.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED" }, "affected": { "vendors": [ "checkpoint", "Check Point" ], "products": [ "multi-domain security management", "quantum security management", "Multiple Products" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "46543FA9-C054-4F64-B6A9-37191C09C8BC", "vendor": "checkpoint", "product": "multi-domain security management", "version": null, "versionStartIncluding": "r80", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "r81.10" }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:-:*:*:*:*:*:*", "matchCriteriaId": "A2428B4E-3754-44B5-9C21-AE9F7746A440", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_106:*:*:*:*:*:*", "matchCriteriaId": "BA42413E-A16A-4D83-BD08-C44D2272B352", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_107:*:*:*:*:*:*", "matchCriteriaId": "B55EFDA0-B970-4EB0-A1B8-FE10E3FF1D39", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_109:*:*:*:*:*:*", "matchCriteriaId": "8A5711F6-13C5-4C50-ADE2-8E9465BEABCB", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_110:*:*:*:*:*:*", "matchCriteriaId": "8F71DADF-125C-458F-81E2-A572527C10C6", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_113:*:*:*:*:*:*", "matchCriteriaId": "2C1FE1CC-4FA9-420A-8F7A-E180027F1A33", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_128:*:*:*:*:*:*", "matchCriteriaId": "C38E5B49-3074-48F3-A623-7C86C27204C6", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_129:*:*:*:*:*:*", "matchCriteriaId": "CD9E8386-0220-4A94-87FD-D9E663983AFA", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_130:*:*:*:*:*:*", "matchCriteriaId": "A5ACC58D-34A8-4D04-98C6-8DFF9465DC60", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_131:*:*:*:*:*:*", "matchCriteriaId": "78074569-7B81-440B-BEDA-5F1B6002CA57", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_132:*:*:*:*:*:*", "matchCriteriaId": "CD9E6258-DF53-4E47-9DE5-109F3E5F5A71", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_135:*:*:*:*:*:*", "matchCriteriaId": "BB44CD33-CDC4-4D51-A897-2EF8E108546B", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_139:*:*:*:*:*:*", "matchCriteriaId": "8DBDF8B8-5A70-427B-91F1-7678D3CC281C", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_14:*:*:*:*:*:*", "matchCriteriaId": "964C5CDC-D605-4A4F-B1E8-92BE59EDA34A", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_141:*:*:*:*:*:*", "matchCriteriaId": "B6A031A8-D79B-461C-A613-C9D922709A8C", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_150:*:*:*:*:*:*", "matchCriteriaId": "4DACDF4E-DDDF-4C32-9E36-8F41370BDBBA", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_152:*:*:*:*:*:*", "matchCriteriaId": "C25851DF-54C5-40EE-BCFF-3E65EBBB1564", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_156:*:*:*:*:*:*", "matchCriteriaId": "B029BBE5-EAEC-4E10-A7FE-45ABB458D85B", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_158:*:*:*:*:*:*", "matchCriteriaId": "75529BA5-943C-46D6-9C33-18D1EEB8063A", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_165:*:*:*:*:*:*", "matchCriteriaId": "F08CD952-5857-4C7D-8982-389A9DCC8309", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_169:*:*:*:*:*:*", "matchCriteriaId": "75BBDB88-78C3-47E1-848C-B8BAA7B284E0", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_170:*:*:*:*:*:*", "matchCriteriaId": "AB9581B4-B2FA-4946-9674-391FE35E5B67", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_171:*:*:*:*:*:*", "matchCriteriaId": "5E34C44D-5F7A-4260-9B48-D333932F9A61", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_172:*:*:*:*:*:*", "matchCriteriaId": "5C9D465A-61AF-4921-B814-9917F7ADE4CA", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_173:*:*:*:*:*:*", "matchCriteriaId": "4B3D629E-119E-46DE-ACF0-F939E0E44B32", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_174:*:*:*:*:*:*", "matchCriteriaId": "F55AD3DF-EE8A-421D-B430-77ABC7670AB4", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_177:*:*:*:*:*:*", "matchCriteriaId": "AB895616-A0B0-4CF8-A915-AEFBFADECF75", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_181:*:*:*:*:*:*", "matchCriteriaId": "11BD9477-949D-436C-A724-7C0DD5755C1A", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_183:*:*:*:*:*:*", "matchCriteriaId": "20A8D3F6-45C7-4985-8EF2-399274E6466A", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_187:*:*:*:*:*:*", "matchCriteriaId": "043058AE-6D16-494F-8489-B9F87F0CBDD9", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_190:*:*:*:*:*:*", "matchCriteriaId": "CFC597DF-66DC-46E7-A31A-82D253A70E7F", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_22:*:*:*:*:*:*", "matchCriteriaId": "8793BA9A-096E-4E58-A73C-E60C6E010019", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_30:*:*:*:*:*:*", "matchCriteriaId": "993ECDA4-9028-46DB-853E-AF07153A6F94", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_38:*:*:*:*:*:*", "matchCriteriaId": "7A4F9499-F5B5-4CA3-BED3-F2909AEB7F7C", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_44:*:*:*:*:*:*", "matchCriteriaId": "4809F58C-906A-4DFB-8520-EC92A4A6FE43", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_45:*:*:*:*:*:*", "matchCriteriaId": "3EDB5D74-5C06-472B-A442-D9940B7885D0", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_55:*:*:*:*:*:*", "matchCriteriaId": "CEB4451F-3296-49E8-B171-BD06167C16D0", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_61:*:*:*:*:*:*", "matchCriteriaId": "FA3DEADA-8C44-4F7D-BE4D-004C3B97950C", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_66:*:*:*:*:*:*", "matchCriteriaId": "FFFA1CC6-612A-4701-BFE1-B7AC97B2921F", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_75:*:*:*:*:*:*", "matchCriteriaId": "1778DF16-6C1E-4228-ACF8-EC94EF0BC884", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_78:*:*:*:*:*:*", "matchCriteriaId": "EABB856E-E059-493F-B359-ED9FE39E2637", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_79:*:*:*:*:*:*", "matchCriteriaId": "AE129711-6F49-4A3E-A0A1-F64A7655E18F", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_81:*:*:*:*:*:*", "matchCriteriaId": "EAC196AC-EF63-43F9-BE27-11807E4200DC", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_82:*:*:*:*:*:*", "matchCriteriaId": "527ED156-030A-4785-811A-9A1D226B9F76", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_85:*:*:*:*:*:*", "matchCriteriaId": "C99694F6-A7D0-47A4-BC54-938BC81F7D54", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_87:*:*:*:*:*:*", "matchCriteriaId": "4410B9E8-BB15-4A3C-98E2-CF6E259FF74E", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_9:*:*:*:*:*:*", "matchCriteriaId": "68864C91-5D68-46A3-A671-61EBA3D86762", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_93:*:*:*:*:*:*", "matchCriteriaId": "336F50C0-B258-406F-9C56-A20C1ADF9F36", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:checkpoint:multi-domain_security_management:r81.10:take_94:*:*:*:*:*:*", "matchCriteriaId": "5CFFD6BE-1679-4462-A20F-8AF76E3566CD", "vendor": "checkpoint", "product": "multi-domain security management", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Check Point", "product": "Multiple Products", "vulnerabilityName": "Check Point Multiple Products Path Traversal Vulnerability", "dateAdded": "2026-09-22", "dueDate": "2026-09-25", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://support.checkpoint.com/results/sk/sk1000171/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93616", "cwes": [ "CWE-22" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-25", "vendorAdvisories": [ "https://support.checkpoint.com/results/sk/sk1000171", "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/" ] }, "references": [ { "url": "https://support.checkpoint.com/results/sk/sk1000171", "source": "cve@checkpoint.com", "tags": [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-93616", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-86218", "identity": { "cve": "CVE-2026-86218", "aliases": [] }, "status": "Analyzed", "title": "N-able N-central Static Code Injection Vulnerability", "description": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.", "dates": { "published": "2026-09-06T03:17:17.373", "lastModified": "2026-09-09T05:18:19.490", "kevAdded": "2026-09-08", "kevDueDate": "2026-09-11" }, "severity": { "label": "CRITICAL", "score": 10, "cvss": { "version": "4.0", "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "baseScore": 10, "baseSeverity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitabilityScore": null, "impactScore": null } }, "risk": { "priority": "CRITICAL", "priorityScore": 86.9, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.12928, "percentage": 12.93, "percentile": 0.96206, "percentilePercentage": 96.21, "date": "2026-10-05" }, "reasons": [ "CVSS 10 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-96", "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": null }, "affected": { "vendors": [ "n-able", "N-able" ], "products": [ "n-central", "N-central" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CEC2750-AFFB-40A4-97E0-88BDAC106F5E", "vendor": "n-able", "product": "n-central", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "2026.3" }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*", "matchCriteriaId": "EB21160B-DDC4-4F70-A703-E313DED8CAF2", "vendor": "n-able", "product": "n-central", "version": "2026.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*", "matchCriteriaId": "B28786B6-1DFC-4088-B3CC-C099719EDA17", "vendor": "n-able", "product": "n-central", "version": "2026.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*", "matchCriteriaId": "24B69FFD-40FD-4DE2-AC51-A2101AD28EB3", "vendor": "n-able", "product": "n-central", "version": "2026.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*", "matchCriteriaId": "BFA703C2-2F80-4FAC-9DA8-EE33A0F0646F", "vendor": "n-able", "product": "n-central", "version": "2026.3", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "N-able", "product": "N-central", "vulnerabilityName": "N-able N-central Static Code Injection Vulnerability", "dateAdded": "2026-09-08", "dueDate": "2026-09-11", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ ; https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86218", "cwes": [ "CWE-96" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-11", "vendorAdvisories": [ "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution" ] }, "references": [ { "url": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-86218", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-19490", "identity": { "cve": "CVE-2026-19490", "aliases": [] }, "status": "Analyzed", "title": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "description": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.", "dates": { "published": "2026-08-19T13:17:45.000", "lastModified": "2026-09-10T12:48:10.453", "kevAdded": "2026-09-09", "kevDueDate": "2026-09-12" }, "severity": { "label": "CRITICAL", "score": 9.3, "cvss": { "version": "4.0", "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "type": "Secondary", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitabilityScore": null, "impactScore": null } }, "risk": { "priority": "CRITICAL", "priorityScore": 85.7, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.23158, "percentage": 23.16, "percentile": 0.97709, "percentilePercentage": 97.71, "date": "2026-10-05" }, "reasons": [ "CVSS 9.3 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-288", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": null }, "affected": { "vendors": [ "citrix", "Citrix" ], "products": [ "netscaler application delivery controller", "netscaler gateway", "NetScaler" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*", "matchCriteriaId": "2F90F173-E24C-4189-87FF-2157DBBECE4A", "vendor": "citrix", "product": "netscaler application delivery controller", "version": null, "versionStartIncluding": "13.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "13.1-37.277" }, { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*", "matchCriteriaId": "2CD7AEA1-F0D9-47E9-A4BF-6E72E2083934", "vendor": "citrix", "product": "netscaler application delivery controller", "version": null, "versionStartIncluding": "13.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "13.1-37.277" }, { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*", "matchCriteriaId": "07826E3F-A0BA-42DB-97DD-677E2F1E99B8", "vendor": "citrix", "product": "netscaler application delivery controller", "version": null, "versionStartIncluding": "13.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "13.1-63.21" }, { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*", "matchCriteriaId": "12664220-1266-43A3-A5B9-011E06C56A3E", "vendor": "citrix", "product": "netscaler application delivery controller", "version": null, "versionStartIncluding": "14.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "14.1-73.32" }, { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*", "matchCriteriaId": "98857F06-6895-4454-A52D-E200D2109B19", "vendor": "citrix", "product": "netscaler application delivery controller", "version": null, "versionStartIncluding": "14.1-66.68", "versionStartExcluding": null, "versionEndIncluding": "14.1-73.32", "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ACEC99D-8145-45D4-BFCC-ADC11999D2CF", "vendor": "citrix", "product": "netscaler gateway", "version": null, "versionStartIncluding": "13.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "13.1-63.21" }, { "vulnerable": true, "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "45606A9C-06AF-4A4B-80B4-CB1A29230C85", "vendor": "citrix", "product": "netscaler gateway", "version": null, "versionStartIncluding": "14.1", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "14.1-73.32" } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Citrix", "product": "NetScaler", "vulnerabilityName": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "dateAdded": "2026-09-09", "dueDate": "2026-09-12", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19490", "cwes": [ "CWE-288" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-12", "vendorAdvisories": [ "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939" ] }, "references": [ { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-19490", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-75650", "identity": { "cve": "CVE-2026-75650", "aliases": [] }, "status": "Analyzed", "title": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability", "description": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "dates": { "published": "2026-09-07T21:17:30.863", "lastModified": "2026-09-09T05:18:07.237", "kevAdded": "2026-09-08", "kevDueDate": "2026-09-11" }, "severity": { "label": "CRITICAL", "score": 10, "cvss": { "version": "3.1", "source": "psirt@adobe.com", "type": "Secondary", "baseScore": 10, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 6 } }, "risk": { "priority": "CRITICAL", "priorityScore": 85.6, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.03949, "percentage": 3.95, "percentile": 0.90102, "percentilePercentage": 90.1, "date": "2026-10-05" }, "reasons": [ "CVSS 10 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-1336", "source": "psirt@adobe.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED" }, "affected": { "vendors": [ "adobe", "Adobe" ], "products": [ "commerce", "commerce b2b", "magento", "Commerce and Magento" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "76AAB57F-7723-44E0-B91A-9F120C849AC4", "vendor": "adobe", "product": "commerce", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "2.4.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*", "matchCriteriaId": "4E5CF6F0-2388-4D3F-8FE1-43B8AF148564", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p10:*:*:*:*:*:*", "matchCriteriaId": "1C3D7164-1C5F-40BC-9EEC-B0E00CD45808", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p11:*:*:*:*:*:*", "matchCriteriaId": "68AAE162-5957-42AF-BE20-40F341837FAC", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p12:*:*:*:*:*:*", "matchCriteriaId": "D9D01159-3309-4F6B-93B0-2D89DDD33DEE", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p13:*:*:*:*:*:*", "matchCriteriaId": "91736E79-D8E7-4AF2-8E01-A7B4EB8AD6F4", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p14:*:*:*:*:*:*", "matchCriteriaId": "8412C043-64E7-4DFF-A303-13A6FE113BFB", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p15:*:*:*:*:*:*", "matchCriteriaId": "BBDA2BCF-E784-4CF3-B30D-6FF5BEE2055F", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p16:*:*:*:*:*:*", "matchCriteriaId": "00909C10-6C93-4735-94ED-18DCBD608A28", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p17:*:*:*:*:*:*", "matchCriteriaId": "C6F35FE6-853D-4EC6-8A4F-07F4ABD6301A", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p18:*:*:*:*:*:*", "matchCriteriaId": "5FD50C55-E296-4F3C-8035-C1E9256D3773", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*", "matchCriteriaId": "D6D6F1A7-ABB5-4EDC-9EA8-98B74518847A", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*", "matchCriteriaId": "CFEBDDF2-6443-4482-83B2-3CD272CF599F", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*", "matchCriteriaId": "6661093F-8D22-450F-BC6C-A8894A52E6A9", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*", "matchCriteriaId": "2515DA6D-2E74-4A05-BD29-FEEF3322BCB6", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*", "matchCriteriaId": "69A1F1F7-E53C-40F3-B3D9-DC011FC353BF", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p7:*:*:*:*:*:*", "matchCriteriaId": "6A56E96C-6CE5-442C-AA88-F0059B02B5E7", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*", "matchCriteriaId": "8867F510-201C-4199-8554-53DE156CE669", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.4:p9:*:*:*:*:*:*", "matchCriteriaId": "23988132-DD4E-4968-B6B8-954122F76081", "vendor": "adobe", "product": "commerce", "version": "2.4.4", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*", "matchCriteriaId": "9B07F7B2-E915-4EFF-8FFC-91143CEF082E", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*", "matchCriteriaId": "7F5E9DB6-1386-4274-8270-2FE0F0CAF7FD", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p10:*:*:*:*:*:*", "matchCriteriaId": "5764CC97-C866-415D-A3A1-5B5B9E1C06A6", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p11:*:*:*:*:*:*", "matchCriteriaId": "E82D10D8-2894-4E5B-B47B-F00964DD5CDE", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p12:*:*:*:*:*:*", "matchCriteriaId": "B044F2D9-E888-4852-8A40-DCE688860ED3", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p13:*:*:*:*:*:*", "matchCriteriaId": "6423C754-36F9-4680-9211-60940ED63E79", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p14:*:*:*:*:*:*", "matchCriteriaId": "3472064A-8C79-436B-965A-96834AE8D346", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p15:*:*:*:*:*:*", "matchCriteriaId": "CDA8ABEB-F955-4D34-8219-C518B49F5543", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p16:*:*:*:*:*:*", "matchCriteriaId": "55D6A6BD-9E63-448A-A286-437EA1580CEF", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p17:*:*:*:*:*:*", "matchCriteriaId": "5BF962FF-2CCF-48A5-AAA3-85639EAC64BB", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*", "matchCriteriaId": "8605E4E6-0F7D-42C8-B35B-2349A0BEFC69", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*", "matchCriteriaId": "B6318F97-E59A-4425-8DC7-045C78A644F8", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*", "matchCriteriaId": "324A573E-DBC8-42A0-8CB8-EDD8FBAB7115", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*", "matchCriteriaId": "54151A00-CFB8-4E6A-8E74-497CB67BF7E2", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p6:*:*:*:*:*:*", "matchCriteriaId": "6DF0E74D-9293-4209-97D1-A3BA13C3DDE9", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*", "matchCriteriaId": "8922D646-1A97-47ED-91C6-5A426781C98A", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p8:*:*:*:*:*:*", "matchCriteriaId": "952787C6-9BF1-49FB-9824-1236678E1902", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.5:p9:*:*:*:*:*:*", "matchCriteriaId": "898A8679-3C46-4718-9EDF-583ADDFCF2EC", "vendor": "adobe", "product": "commerce", "version": "2.4.5", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*", "matchCriteriaId": "7C7AFBB1-F9C9-4BDE-BCEF-94C9F0AC6798", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*", "matchCriteriaId": "D6086841-C175-46A1-8414-71C6163A0E7A", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p10:*:*:*:*:*:*", "matchCriteriaId": "E57889CC-3E90-46AF-9CD6-3328DD501AD1", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p11:*:*:*:*:*:*", "matchCriteriaId": "47A86566-DE38-4032-947D-B6181F0BC120", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p12:*:*:*:*:*:*", "matchCriteriaId": "B7D1D684-CE7E-4D6D-95B5-1F86A8DB6C66", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p13:*:*:*:*:*:*", "matchCriteriaId": "CABF5BD0-1D06-483D-91D3-A773D99EF217", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p14:*:*:*:*:*:*", "matchCriteriaId": "33512239-B316-4FE7-94F0-ABD30900238B", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p15:*:*:*:*:*:*", "matchCriteriaId": "95FD09E4-BB76-47F4-A2B3-569B0E4CB737", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*", "matchCriteriaId": "D2E0DDD1-0F4A-4F96-B25D-40A39A1A535A", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*", "matchCriteriaId": "A576B1B5-73A2-431E-998F-7E5458B51D6A", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p4:*:*:*:*:*:*", "matchCriteriaId": "0E05F4AC-2A28-47E3-96DE-0E31AF73CD43", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*", "matchCriteriaId": "3A9A62EE-1649-4815-8EC9-7AEF7949EB2F", "vendor": "adobe", "product": "commerce", "version": "2.4.6", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Adobe", "product": "Commerce and Magento", "vulnerabilityName": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability", "dateAdded": "2026-09-08", "dueDate": "2026-09-11", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://helpx.adobe.com/security/products/magento/apsb26-146.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "cwes": [ "CWE-1336" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-11", "vendorAdvisories": [ "https://helpx.adobe.com/security/products/magento/apsb26-146.html" ] }, "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "source": "psirt@adobe.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-67277", "identity": { "cve": "CVE-2026-67277", "aliases": [] }, "status": "Analyzed", "title": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability", "description": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "dates": { "published": "2026-09-05T20:17:18.120", "lastModified": "2026-09-11T12:52:29.533", "kevAdded": "2026-09-10", "kevDueDate": "2026-09-13" }, "severity": { "label": "HIGH", "score": 8.8, "cvss": { "version": "4.0", "source": "cvd@cert.pl", "type": "Secondary", "baseScore": 8.8, "baseSeverity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitabilityScore": null, "impactScore": null } }, "risk": { "priority": "CRITICAL", "priorityScore": 85.4, "knownExploited": true, "publicExploit": true, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.0156, "percentage": 1.56, "percentile": 0.74384, "percentilePercentage": 74.38, "date": "2026-10-05" }, "reasons": [ "CVSS 8.8 HIGH", "CISA Known Exploited Vulnerability", "Public exploit reference available", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-306", "source": "cvd@cert.pl", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": null }, "affected": { "vendors": [ "mikrotik", "MikroTik" ], "products": [ "routeros", "RouterOS" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFC981EC-B44C-40B5-945B-2283FADEC961", "vendor": "mikrotik", "product": "routeros", "version": null, "versionStartIncluding": "6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "6.49.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "881306AB-32B1-4B5F-96D8-9532D25F7AE4", "vendor": "mikrotik", "product": "routeros", "version": null, "versionStartIncluding": "7.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.23.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*", "matchCriteriaId": "A41D6B3C-D321-4C61-B3D5-00F8276CB4AC", "vendor": "mikrotik", "product": "routeros", "version": null, "versionStartIncluding": "7.24", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "7.24.2" } ] }, "kev": { "isKnownExploited": true, "vendorProject": "MikroTik", "product": "RouterOS", "vulnerabilityName": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability", "dateAdded": "2026-09-10", "dueDate": "2026-09-13", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://mikrotik.com/supportsec/september-2026-vulnerability/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67277", "cwes": [ "CWE-306" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-13", "vendorAdvisories": [ "https://mikrotik.com/supportsec/september-2026-vulnerability/" ] }, "references": [ { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "source": "cvd@cert.pl", "tags": [ "Third Party Advisory" ] }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "source": "cvd@cert.pl", "tags": [ "Mitigation", "Third Party Advisory" ] }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "source": "cvd@cert.pl", "tags": [ "Release Notes" ] }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "source": "cvd@cert.pl", "tags": [ "Release Notes" ] }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "source": "cvd@cert.pl", "tags": [ "Release Notes" ] }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "source": "cvd@cert.pl", "tags": [ "Vendor Advisory" ] }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "source": "cvd@cert.pl", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-67277", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "HIGH", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-85102", "identity": { "cve": "CVE-2026-85102", "aliases": [] }, "status": "Analyzed", "title": "Check Point Multiple Products Improper Certificate Validation Vulnerability", "description": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "dates": { "published": "2026-09-09T13:20:43.793", "lastModified": "2026-09-23T18:22:07.453", "kevAdded": "2026-09-22", "kevDueDate": "2026-09-25" }, "severity": { "label": "CRITICAL", "score": 9.8, "cvss": { "version": "3.1", "source": "cve@checkpoint.com", "type": "Secondary", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "risk": { "priority": "CRITICAL", "priorityScore": 85.3, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.07546, "percentage": 7.55, "percentile": 0.9434, "percentilePercentage": 94.34, "date": "2026-10-05" }, "reasons": [ "CVSS 9.8 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-295", "source": "cve@checkpoint.com", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED" }, "affected": { "vendors": [ "checkpoint", "Check Point" ], "products": [ "gaia embedded", "quantum spark 1530", "quantum spark 1535", "quantum spark 1550", "quantum spark 1555", "quantum spark 1570", "quantum spark 1570r", "quantum spark 1575", "quantum spark 1575r", "quantum spark 1590", "quantum spark 1595", "quantum spark 1595r", "quantum spark 1600", "quantum spark 1800", "quantum spark 1900", "quantum spark 2000", "quantum spark 2530", "quantum spark 2550", "quantum spark 2560", "quantum spark 2570", "quantum spark 2580", "quantum spark 2590", "gaia os", "quantum 3600", "quantum 3800", "quantum force 19100", "quantum force 19200", "quantum force 29100", "quantum force 29200", "quantum force 3920", "quantum force 3950", "quantum force 3970", "quantum force 3980", "quantum force 9100", "quantum force 9200", "quantum force 9300", "quantum force 9400", "quantum force 9700", "quantum force 9800", "quantum lightspeed mls200", "quantum lightspeed mls400", "quantum lightspeed qls250", "quantum lightspeed qls450", "quantum lightspeed qls650", "quantum lightspeed qls800", "Multiple Products" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A2AB3C0-2137-4578-90B5-991AD53EBA10", "vendor": "checkpoint", "product": "gaia embedded", "version": null, "versionStartIncluding": "r81.10.00", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "r81.10.17" }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*", "matchCriteriaId": "15CFBECE-AB4D-4F1F-87B9-5444FC482201", "vendor": "checkpoint", "product": "gaia embedded", "version": null, "versionStartIncluding": "r82.00.00", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "r82.00.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*", "matchCriteriaId": "FA48FB0C-7CE1-475D-B685-FF59593C00F7", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*", "matchCriteriaId": "F822BD5E-8829-4752-A979-81D0608FADBE", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*", "matchCriteriaId": "F1A17167-24E5-4A3A-9C72-390518F1E092", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*", "matchCriteriaId": "E5A0620A-3F9E-4044-87CC-C6382308B59F", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*", "matchCriteriaId": "DB03BA80-3775-44AB-AA24-0D3F381846B6", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*", "matchCriteriaId": "92DF5CB3-6368-452F-9E57-1D18D238D2BB", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004901:*:*:*:*:*:*", "matchCriteriaId": "9FE29C85-1DF1-40CE-8936-CFC790DCE12E", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004914:*:*:*:*:*:*", "matchCriteriaId": "AE7513D6-4471-41D4-A77F-84B070310194", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004936:*:*:*:*:*:*", "matchCriteriaId": "48A8B7DE-B096-4BFB-B435-6694ABBC628F", "vendor": "checkpoint", "product": "gaia embedded", "version": "r81.10.17", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*", "matchCriteriaId": "DECDEDBC-6CEF-45A6-8EEE-C6E053502BEF", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*", "matchCriteriaId": "C413370D-0432-485C-BEA1-3D4F95486DF1", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*", "matchCriteriaId": "9DE1FA66-FD77-4117-9993-A84D871F3B4B", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*", "matchCriteriaId": "2DAB048C-BF9F-4B60-B99B-21CF61FBD377", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*", "matchCriteriaId": "49932FF8-7281-4F6F-85F9-66A3BF1BCF29", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*", "matchCriteriaId": "B51A9398-AA4B-407B-9EE6-1C253E99C8CA", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*", "matchCriteriaId": "F0C5B191-9167-4DD8-89F8-1526AA6B37BA", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002216:*:*:*:*:*:*", "matchCriteriaId": "73292FCF-3309-475D-A86A-9F1D8D04BD55", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002242:*:*:*:*:*:*", "matchCriteriaId": "C6C5B20A-E73E-4396-A1F9-60CE22DBF4E6", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002279:*:*:*:*:*:*", "matchCriteriaId": "10FA2891-B75A-4C4B-8D95-2AC54F786F73", "vendor": "checkpoint", "product": "gaia embedded", "version": "r82.00.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1530:-:*:*:*:*:*:*:*", "matchCriteriaId": "FD21C289-F0A7-40B1-ABA6-DE973A5C12FB", "vendor": "checkpoint", "product": "quantum spark 1530", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1535:-:*:*:*:*:*:*:*", "matchCriteriaId": "603082FA-896F-4F43-9298-EA821AC8746D", "vendor": "checkpoint", "product": "quantum spark 1535", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1550:-:*:*:*:*:*:*:*", "matchCriteriaId": "0691ED2B-98E4-4BEF-88CD-90737C7B54CD", "vendor": "checkpoint", "product": "quantum spark 1550", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1555:-:*:*:*:*:*:*:*", "matchCriteriaId": "D432C69F-B100-4D29-AD10-D02DF4D637F6", "vendor": "checkpoint", "product": "quantum spark 1555", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1570:-:*:*:*:*:*:*:*", "matchCriteriaId": "9787C7C5-FCB2-424A-B593-0216CE86808F", "vendor": "checkpoint", "product": "quantum spark 1570", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1570r:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F000ECB-4189-4B32-8699-421A67C17BDB", "vendor": "checkpoint", "product": "quantum spark 1570r", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1575:-:*:*:*:*:*:*:*", "matchCriteriaId": "D826E703-003D-449C-B190-801FD99CF832", "vendor": "checkpoint", "product": "quantum spark 1575", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1575r:-:*:*:*:*:*:*:*", "matchCriteriaId": "618E00E8-09D7-4A64-905F-04650781DB63", "vendor": "checkpoint", "product": "quantum spark 1575r", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1590:-:*:*:*:*:*:*:*", "matchCriteriaId": "C68DBC96-4248-41AE-8581-8C792ED0A58D", "vendor": "checkpoint", "product": "quantum spark 1590", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1595:-:*:*:*:*:*:*:*", "matchCriteriaId": "509274E9-ADF6-482B-8163-E30C5AF9AF4C", "vendor": "checkpoint", "product": "quantum spark 1595", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1595r:-:*:*:*:*:*:*:*", "matchCriteriaId": "61E5A939-A111-401E-A718-0562F3DA6C35", "vendor": "checkpoint", "product": "quantum spark 1595r", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1600:-:*:*:*:*:*:*:*", "matchCriteriaId": "194E2E0B-23E3-4175-805D-506DF5C491DB", "vendor": "checkpoint", "product": "quantum spark 1600", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1800:-:*:*:*:*:*:*:*", "matchCriteriaId": "0ECBC553-2864-40D2-8EF3-B15BB002ECEE", "vendor": "checkpoint", "product": "quantum spark 1800", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_1900:-:*:*:*:*:*:*:*", "matchCriteriaId": "69D14FCF-84E2-41A1-9EBF-6264F1AFD85A", "vendor": "checkpoint", "product": "quantum spark 1900", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2000:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5A672E9-4243-4852-9B91-B0393C98C471", "vendor": "checkpoint", "product": "quantum spark 2000", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2530:-:*:*:*:*:*:*:*", "matchCriteriaId": "D363A133-C9E8-4289-9D51-A8284ABF0E9B", "vendor": "checkpoint", "product": "quantum spark 2530", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2550:-:*:*:*:*:*:*:*", "matchCriteriaId": "492D42C7-BA79-42AC-903E-5A3EF4D00BDA", "vendor": "checkpoint", "product": "quantum spark 2550", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2560:-:*:*:*:*:*:*:*", "matchCriteriaId": "3FE64FE4-F3C6-4924-8E65-BC336D416739", "vendor": "checkpoint", "product": "quantum spark 2560", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2570:-:*:*:*:*:*:*:*", "matchCriteriaId": "707EC21A-2F9B-4E72-9C60-4382C736D191", "vendor": "checkpoint", "product": "quantum spark 2570", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2580:-:*:*:*:*:*:*:*", "matchCriteriaId": "994F4EE1-1ADE-4EA3-AD9A-840E96C353A1", "vendor": "checkpoint", "product": "quantum spark 2580", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:checkpoint:quantum_spark_2590:-:*:*:*:*:*:*:*", "matchCriteriaId": "C49FBD30-C627-4DDC-90B0-F0C4E6DD927C", "vendor": "checkpoint", "product": "quantum spark 2590", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD99C40B-B170-47CE-B79D-CB5BB72150A0", "vendor": "checkpoint", "product": "gaia os", "version": null, "versionStartIncluding": "r80", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "r81.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:-:*:*:*:*:*:*", "matchCriteriaId": "B3572E39-423B-4D8F-AE31-C87721DDE8D1", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:take_106:*:*:*:*:*:*", "matchCriteriaId": "DA7BB88F-163D-458B-8F8D-6E94BB034777", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:take_107:*:*:*:*:*:*", "matchCriteriaId": "7586C06B-FA32-43CA-A246-B0152186A873", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:take_109:*:*:*:*:*:*", "matchCriteriaId": "AC5D7113-739A-4CFF-9974-97EB393B3A3B", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:take_110:*:*:*:*:*:*", "matchCriteriaId": "22C4D08E-FCCA-4BB2-8DA4-95FBB6D256D4", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:take_113:*:*:*:*:*:*", "matchCriteriaId": "712677D9-330D-4E54-8CB7-5B0A2CFACD4E", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.10:take_128:*:*:*:*:*:*", "matchCriteriaId": "F5103196-075D-4F71-804B-63E2A3685C8F", "vendor": "checkpoint", "product": "gaia os", "version": "r81.10", "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": null } ] }, "kev": { "isKnownExploited": true, "vendorProject": "Check Point", "product": "Multiple Products", "vulnerabilityName": "Check Point Multiple Products Improper Certificate Validation Vulnerability", "dateAdded": "2026-09-22", "dueDate": "2026-09-25", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102", "cwes": [ "CWE-295" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-25", "vendorAdvisories": [ "https://support.checkpoint.com/results/sk/sk1000117", "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/" ] }, "references": [ { "url": "https://support.checkpoint.com/results/sk/sk1000117", "source": "cve@checkpoint.com", "tags": [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-85102", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-5430", "identity": { "cve": "CVE-2026-5430", "aliases": [] }, "status": "Analyzed", "title": "WSO2 Multiple Products Path Traversal Vulnerability ", "description": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.", "dates": { "published": "2026-08-06T08:16:33.240", "lastModified": "2026-09-25T12:53:05.517", "kevAdded": "2026-09-24", "kevDueDate": "2026-09-27" }, "severity": { "label": "CRITICAL", "score": 10, "cvss": { "version": "3.1", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "baseScore": 10, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "exploitabilityScore": 3.9, "impactScore": 6 } }, "risk": { "priority": "CRITICAL", "priorityScore": 85.1, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": false, "requiresUserInteraction": false, "epss": { "score": 0.00588, "percentage": 0.59, "percentile": 0.46265, "percentilePercentage": 46.27, "date": "2026-10-05" }, "reasons": [ "CVSS 10 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No authentication/privileges required", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-347", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED" }, "affected": { "vendors": [ "wso2", "WSO2" ], "products": [ "api control plane", "api manager", "traffic manager", "universal gateway", "Multiple Products" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F568AE3-DBF2-41B6-B4C8-20B655067056", "vendor": "wso2", "product": "api control plane", "version": null, "versionStartIncluding": "4.5.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.5.0.58" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C020DC7-BD0F-4C0B-8CBC-4B93671D4CAC", "vendor": "wso2", "product": "api control plane", "version": null, "versionStartIncluding": "4.6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.6.0.22" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE140289-0624-4385-8D46-D6E5052D3B28", "vendor": "wso2", "product": "api manager", "version": null, "versionStartIncluding": "4.1.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.1.0.257" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "31FC9528-42DB-4E23-BCF4-674397F2E626", "vendor": "wso2", "product": "api manager", "version": null, "versionStartIncluding": "4.2.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.2.0.197" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F10E50C-D77F-4779-936C-0ADDF8B1B1F6", "vendor": "wso2", "product": "api manager", "version": null, "versionStartIncluding": "4.3.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.3.0.108" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8774AF32-FAEC-4EF3-8399-8E76D55A8DEB", "vendor": "wso2", "product": "api manager", "version": null, "versionStartIncluding": "4.4.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.4.0.72" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4DD9A69-BED3-45B4-9521-DBCA9AEBBF6F", "vendor": "wso2", "product": "api manager", "version": null, "versionStartIncluding": "4.5.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.5.0.57" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "07437626-95AF-4468-8479-ACC2835DF708", "vendor": "wso2", "product": "api manager", "version": null, "versionStartIncluding": "4.6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.6.0.21" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "066D4334-A3B2-4D0D-9830-1CBE6C91B053", "vendor": "wso2", "product": "traffic manager", "version": null, "versionStartIncluding": "4.5.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.5.0.56" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F904CBB-EC8F-49F3-B85D-E934E785813B", "vendor": "wso2", "product": "traffic manager", "version": null, "versionStartIncluding": "4.6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.6.0.21" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AA06D88-B2E9-4474-A12E-3D44FC7E6A6B", "vendor": "wso2", "product": "universal gateway", "version": null, "versionStartIncluding": "4.5.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.5.0.57" }, { "vulnerable": true, "criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "7BD535B3-3554-4F39-AA9A-8A0178A44490", "vendor": "wso2", "product": "universal gateway", "version": null, "versionStartIncluding": "4.6.0", "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "4.6.0.21" } ] }, "kev": { "isKnownExploited": true, "vendorProject": "WSO2", "product": "Multiple Products", "vulnerabilityName": "WSO2 Multiple Products Path Traversal Vulnerability ", "dateAdded": "2026-09-24", "dueDate": "2026-09-27", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-5430", "cwes": [ "CWE-347" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-27", "vendorAdvisories": [ "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/" ] }, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-5430", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } }, { "id": "CVE-2026-84869", "identity": { "cve": "CVE-2026-84869", "aliases": [] }, "status": "Analyzed", "title": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability", "description": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.", "dates": { "published": "2026-09-08T20:18:51.147", "lastModified": "2026-09-12T04:16:42.757", "kevAdded": "2026-09-11", "kevDueDate": "2026-09-14" }, "severity": { "label": "CRITICAL", "score": 9.9, "cvss": { "version": "3.1", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary", "baseScore": 9.9, "baseSeverity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "exploitabilityScore": 3.1, "impactScore": 6 } }, "risk": { "priority": "CRITICAL", "priorityScore": 85, "knownExploited": true, "publicExploit": false, "ransomwareUse": false, "internetExploitable": true, "requiresAuthentication": true, "requiresUserInteraction": false, "epss": { "score": 0.00924, "percentage": 0.92, "percentile": 0.59076, "percentilePercentage": 59.08, "date": "2026-10-05" }, "reasons": [ "CVSS 9.9 CRITICAL", "CISA Known Exploited Vulnerability", "Network exploitable", "No user interaction required" ] }, "classification": { "cwe": [ { "id": "CWE-269", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary" }, { "id": "CWE-862", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "type": "Secondary" } ], "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED" }, "affected": { "vendors": [ "connectwise", "ConnectWise" ], "products": [ "screenconnect", "ScreenConnect" ], "cpe": [ { "vulnerable": true, "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*", "matchCriteriaId": "270783CF-B4ED-4608-A583-A9F7B80DC877", "vendor": "connectwise", "product": "screenconnect", "version": null, "versionStartIncluding": null, "versionStartExcluding": null, "versionEndIncluding": null, "versionEndExcluding": "26.6.5.9742" } ] }, "kev": { "isKnownExploited": true, "vendorProject": "ConnectWise", "product": "ScreenConnect", "vulnerabilityName": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability", "dateAdded": "2026-09-11", "dueDate": "2026-09-14", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "knownRansomwareCampaignUse": "Unknown", "notes": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869", "cwes": [ "CWE-269", "CWE-862" ] }, "remediation": { "available": true, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-09-14", "vendorAdvisories": [ "https://www.connectwise.com/company/trust/advisories", "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin" ] }, "references": [ { "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.connectwise.com/company/trust/advisories", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] }, { "url": "https://www.huntress.com/blog/rogue-screenconnect-installations", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Third Party Advisory" ] } ], "links": { "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2026-84869", "cisaKev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, "sourceData": { "nvd": true, "cisaKev": true, "epss": true }, "display": { "badge": "CRITICAL", "severityBadge": "CRITICAL", "featured": true, "showOnHomepage": true } } ] }, "delivery": { "storage": "Cloudflare KV", "generatedAt": "2026-10-05T20:00:27.022Z", "servedAt": "2026-10-05T20:01:43.487Z" } }