Security news, decoded.

Adobe has issued emergency patches for a critical remote code execution vulnerability affecting Adobe Commerce and Magento Open Source, confirmed to be under active attack. Tracked as CVE-2026-75650 with a maximum CVSS score of 10.0, this flaw allows attackers to execute arbitrary code by abusing the platform's template processing mechanisms. Threat actors have already leveraged the zero-day to install persistent threats, including a custom Rust-based Linux backdoor and PHP web shells on compromised stores. To mitigate the risk, administrators must immediately apply the VULN-39341 hotfix and rotate all encryption keys across vulnerable versions of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.

Check Point's weekly threat intelligence report confirms active exploitation of SonicWall SMA 1000 gateways via two critical flaws, CVE-2026-83548 and CVE-2026-83549, alongside a newly discovered authentication bypass in self-hosted JFrog Artifactory deployments tracked as CVE-2026-82329. The briefing also covers the release of "FalconFlank," a proof-of-concept privilege escalation technique targeting CrowdStrike Falcon on recent Windows versions, as well as ongoing breaches at major organizations including Thomson Reuters and Dropbox.

This week's security landscape is dominated by active exploitation campaigns targeting Google Chrome, MikroTik RouterOS, and N-able N-central. Google addressed a high-severity type confusion bug in the V8 engine (CVE-2026-85046) that is currently under attack, while CERT Polska warned of a critical zero-day chain dubbed MikroTrick being used to hijack routers via SSH. N-able released urgent hotfixes for two severe authentication bypass flaws (CVE-2026-86206 and CVE-2026-86207) and a CVSS 10.0 remote code execution vulnerability (CVE-2026-86218), with evidence suggesting attackers are already leveraging these weaknesses. Additionally, e-commerce platforms are suffering from an unpatched Magento and Adobe Commerce zero-day known as StyleSmuggler, which allows unauthenticated attackers to inject backdoors into online stores.

CERT Polska reported active exploitation of a vulnerability chain in MikroTik RouterOS that allows attackers to seize full control of devices with internet-exposed SSH services without prior authentication. The attack leverages CVE-2026-67276, an SSH authentication bypass, combined with CVE-2026-86060, a privilege escalation flaw, to establish administrative access. Additionally, CVE-2026-67277 was identified alongside three other lower-severity issues affecting certificate handling and web interfaces. Vendors have released fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Administrators are urged to apply these updates immediately, disable exposed services like SSH as a temporary mitigation, and audit device configurations for unauthorized users such as 'ops' or suspicious script entries.

N-able has issued an urgent security update for its N-central remote monitoring and management platform, addressing a critical vulnerability identified as CVE-2026-86218. This flaw allows for pre-authenticated remote code execution on the N-central server, posing a significant risk to both hosted and on-premises deployments. While the vendor's initial public advisory did not confirm active exploitation, subsequent customer notifications explicitly stated that the vulnerability was observed being exploited in the wild, characterizing it as a zero-day issue. Affected organizations are advised to upgrade immediately to N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to mitigate the threat.

Security researchers at TantoSec have published a proof-of-concept exploit that enables unauthenticated remote code execution in Telerik UI for ASP.NET AJAX by chaining a padding oracle vulnerability with unsafe deserialization. This attack targets the RadAsyncUpload control in versions 2010.1.309 through 2026.2.519, specifically leveraging CVE-2026-13181 (CVSS 8.1), CVE-2026-13182, and CVE-2026-13183 to bypass encryption protections and load malicious payloads. Although Progress Software patched the issues in version 2026.2.708 released on July 8, the recent release of ready-to-run tooling lowers the barrier for attackers who meet specific non-default configuration requirements.

Attackers are actively leveraging a combination of two recently disclosed vulnerabilities in MikroTik RouterOS to gain full administrative control over devices with SSH services exposed to the internet. The exploit chain involves CVE-2026-67276, an authentication bypass flaw stemming from incomplete RSA public key validation, and CVE-2026-86060, a privilege escalation bug triggered by specially crafted usernames. This threat was identified by Poland's CERT agency, which confirmed active in-the-wild exploitation under the name "MikroTrick." A related issue, CVE-2026-67277, also affects the bandwidth-test service, potentially allowing remote denial-of-service conditions.

ConnectWise has published an emergency security advisory for a new vulnerability in ScreenConnect Remote Access that impacts file transfer behavior in Support and Access sessions. Because the company has not yet released a permanent fix, administrators are instructed to manually revoke the TransferFiles (or TransferFilesInSession) permission from user roles as a temporary mitigation. While no CVE ID has been assigned to this specific issue, Shadowserver data indicates nearly 6,000 ScreenConnect instances remain exposed to the internet, increasing the risk of exploitation given the product's history of targeting by ransomware groups and state-sponsored actors.

Threat actors are actively exploiting a file transfer vulnerability in ConnectWise ScreenConnect to distribute malware across remote access sessions. According to Huntress research, attackers deploy rogue client instances that spawn VBScript files to establish persistence and create a worm-like infection pattern on newly connected systems. This compromise affects both cloud-hosted and on-premise deployments. As a mitigation pending an official patch, ConnectWise advises administrators to disable file transfer permissions within their role settings.

N-able has released Hotfix 4 for the N-central Remote Monitoring and Management platform to address a critical, pre-authentication remote code execution vulnerability identified as CVE-2026-86218. This flaw, which carries a CVSS score of 10.0 and allows unauthenticated attackers to execute arbitrary code on the server, has reportedly been actively exploited in the wild according to N-able's incident notice, although the company's official release notes currently state that such exploitation remains unconfirmed. This update is particularly urgent because it supersedes Hotfix 3, meaning systems patched just one day prior to this release remain vulnerable. All on-premises installations running builds older than 2026.3.1.14 must be updated immediately to prevent unauthorized access and potential endpoint compromise. N-able advises administrators to restrict network exposure and audit user accounts while waiting for deployment completion, noting that hosted instances have already been secured.

N-able has issued an emergency hotfix for a maximum-severity remote code execution vulnerability, identified as CVE-2026-86218, in its N-central platform. This flaw allows unauthenticated attackers to execute malicious code on exposed systems. While N-able has not confirmed widespread production exploitation, security firm Huntress has flagged the issue as part of ongoing active attack campaigns involving related vulnerabilities. Organizations using N-central are advised to install N-central 2026.3 HF4 immediately to mitigate the risk.

This weekly security briefing highlights active exploitation of two zero-day vulnerabilities in SonicWall SMA 1000 appliances, identified as CVE-2026-83548 and CVE-2026-83549. Additionally, Shadowserver Foundation scans reveal that approximately 22,000 Microsoft Exchange servers remain unprotected against critical authentication bypass flaw CVE-2026-62911. The report also covers active targeting of Sangoma Switchvox via recently patched SQL injection defect CVE-2026-9586, alongside broader updates on threats including Claude account compromises via infostealer malware and the September 2026 Patch Tuesday landscape.

Unidentified threat actors compromised JetBrains' hosted service, Cadence, by exploiting the critical TeamCity vulnerability CVE-2026-63077 between August 8 and 24, 2026. This active exploitation allowed attackers to extract multiple AWS IAM credentials from a server backup and access sensitive user data, including personal information and project source code. JetBrains is urgently advising all Cadence users to revoke and rotate their credentials, as well as invalidating all plugin access tokens to mitigate the risk of further unauthorized access.

Broadcom has issued security updates for VMware Workstation and VMware Fusion to remediate two distinct vulnerabilities, including a critical integer-overflow flaw. The primary issue, identified as CVE-2026-59346 with a CVSS score of 9.3, permits a local administrator within a guest virtual machine using the VMXNET3 adapter to execute arbitrary code on the host system. Additionally, a high-severity stack-based buffer overflow in HGFS (CVE-2026-59347, CVSS 8.1) was addressed, allowing similar privilege escalation to the host's VMX process. Both flaws affect versions 25H2 and 26H1 of the software, and users should update to the fixed releases, VMware Workstation 26H1u1 and VMware Fusion 26H1u1, as no workarounds are available.

Hardware wallet vendor Trezor has disclosed that the recent compromise of its shipping provider, ShipMonk, has affected an additional 67,000 U.S. customers, exposing personal details including names, contact information, and shipping addresses for orders placed between November 2019 and August 2021. This expansion follows a previous disclosure involving roughly 13,600 users and contradicts written assurances previously provided by ShipMonk stating that such data had been deleted per contractual agreements. The intrusion stems from the active exploitation of CVE-2026-72898, a critical zero-day SQL injection vulnerability in Metabase, which allowed the ShinyHunters group to access customer records stored by the logistics firm. While Trezor confirmed that the security of its hardware wallets remains intact, the company warned customers to remain vigilant against targeted phishing campaigns and social engineering attacks leveraging the stolen information.

Security firm Defiant reports active exploitation of a critical vulnerability identified as CVE-2026-32475 within the Elementor Pro WordPress plugin. This flaw, assigned a CVSS score of 9.8, allows unauthenticated attackers to bypass file validation by manipulating form submission arrays, enabling them to upload and execute malicious PHP payloads directly on the server. All versions of Elementor Pro prior to 4.2.1 are affected, with the fix available in version 4.2.2 released on August 19. Because attackers began exploiting the issue immediately after the patch dropped, site administrators must update urgently. Defiant has already blocked over 190,000 attack attempts and advises users to inspect the /wp-content/uploads/elementor/forms/ directory for unauthorized PHP files and review logs for suspicious activity related to /wp-admin/admin-ajax.php.

Arctic Wolf has confirmed active exploitation of CVE-2026-81578 and CVE-2026-82078, a combined authentication bypass and remote code execution vulnerability affecting PaperCut Application Server. Threat actors are leveraging this chain against K-12 schools and universities across the U.S. and Europe to perform system reconnaissance and establish persistent privileged access. Post-compromise activity includes the deployment of credential harvesting tools such as lsacollect.exe and savehives.exe, alongside Metasploit payloads intended to extract sensitive configuration data and SAM database access. To mitigate these risks, administrators should immediately restrict direct internet exposure of PaperCut servers and monitor for anomalous command executions involving cmd.exe or PowerShell processes with pc-app.exe as the parent.

Microsoft applied server-side patches to fix nine vulnerabilities affecting services including Entra ID, Azure Cosmos DB, Power Automate, and Copilot Studio. Meanwhile, public exploit code has emerged for CVE-2026-62911, a high-severity flaw in Microsoft Exchange Server that previously received an August patch but still affects more than 21,000 exposed systems.

Hewlett Packard Enterprise has deployed security updates for the Aruba Networking ArubaOS-CX platform, resolving 34 vulnerabilities including a critical remote code execution flaw identified as CVE-2026-73749. The advisory covers fixes for multiple software releases, specifically 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, and 10.10.1181, addressing issues ranging from denial-of-service attacks to authentication bypasses. This specific cluster of critical defects allows unauthenticated attackers to execute arbitrary commands with elevated privileges by sending malformed input to an internal service. While HPE reports that these flaws were found internally and there is no evidence of active exploitation yet, network administrators are advised to apply the latest patches and restrict management interface access.

Security researchers at Previdian have observed active exploitation attempts against CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and Gateway appliances. This flaw enables unprivileged attackers to remotely circumvent authentication controls on devices configured as AAA virtual servers or Gateways (including SSL VPN and RDP proxies). While Citrix issued a patch in mid-August, recent data indicates that adversaries began targeting this weakness following the publication of a proof-of-concept exploit. Belgian cyber authorities have also warned organizations to prioritize upgrading vulnerable NetScaler instances to the recommended builds.

PostgreSQL has released security updates to address CVE-2026-6471, a high-severity vulnerability present since version 9.4 in 2014 that permits users with the REPLICATION attribute to execute arbitrary code as the database server's operating system user. The flaw arises because the logical decoding mechanism allows malicious specification of output plugin libraries, bypassing standard load restrictions. Affected versions include those prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24; administrators must apply these updates and configure the new outputpluginlibraries parameter to whitelist permitted plugins, particularly if using third-party tools like wal2json.

Horizon3 has confirmed active exploitation of CVE-2026-9586, a critical-severity vulnerability in Sangoma Switchvox with a CVSS score of 9.3. This unauthenticated SQL injection flaw allows attackers to achieve remote code execution against the backend PostgreSQL database by sending crafted requests. In response to the ongoing attacks, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog alongside five other issues affecting products such as JFrog Artifactory, SonicWall SMA1000, Starlette, Kestra, and LiteLLM. Federal agencies are directed to remediate the Switchvox flaw within three days, while patches for the associated Kestra and Starlette vulnerabilities must be applied within two weeks.

Google has addressed twelve security flaws in its browser, including a high-severity vulnerability in the V8 engine known as CVE-2026-85046. This bug is currently being leveraged by attackers to run arbitrary code within the browser's sandbox through malicious web content. The patch has been distributed in Chrome version 152.0.7977.82 and 152.0.7977.83 for desktop platforms. Users should ensure their browsers are updated to mitigate the risk of remote exploitation.

Cyera researchers disclosed a high-severity flaw, tracked as CVE-2026-6471 (CVSS 7.2) and dubbed "PostGREShell," affecting all PostgreSQL releases from 2014 onward. This unauthorized access issue exists within the logical decoding mechanism, allowing an attacker holding specific Replication privileges to execute arbitrary code on the server operating system. By exploiting the defect, threat actors can escalate permissions to full superuser status, extract sensitive data, and establish persistent backdoors. The PostgreSQL Global Development Group has resolved the vulnerability in recent point releases, specifically versions 18.6, 17.11, 16.15, 15.19, and 14.24.

Google has released updates for Chrome, upgrading desktop versions to 152.0.7977.82 and .83 on Windows/macOS and 152.0.7977.82 on Linux, to remediate an actively exploited high-severity zero-day vulnerability in the V8 engine. The flaw, identified as CVE-2026-85046, is a type confusion issue reported by researcher Salvatore Gulizia that could potentially lead to remote code execution via malicious JavaScript. This marks the sixth time Google has patched an in-the-wild Chrome exploit in 2026; users are advised to update promptly to protect their systems.

Broadcom has released updates for VMware Workstation and VMware Fusion to address two security flaws affecting versions 25H2 and 26H1. The most severe issue, identified as CVE-2026-59346 with a CVSS score of 9.3, allows an attacker with local administrator access on a guest VM equipped with a VMXNET3 adapter to execute code on the host via an integer overflow. A second vulnerability, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow that similarly permits code execution within the host's VMX process under specific privilege conditions. No workarounds are available for these defects, so Broadcom strongly advises users to update to version 26H1u1 immediately. While there is no current evidence of active exploitation and both bugs were reported privately, the frequent targeting of VMware products by threat actors underscores the urgency of applying this patch.

Google has released security updates for Chrome 152 to address twelve vulnerabilities, most notably an actively exploited zero-day tracked as CVE-2026-85046. This high-severity flaw is a type confusion bug within the V8 JavaScript and WebAssembly engine, which attackers can leverage via crafted HTML pages to execute remote code. This marks the sixth zero-day patched in Chrome during 2026, following previous fixes in earlier releases. Users are advised to update immediately to version 152.0.7977.82 or 152.0.7977.83 depending on their operating system.

Wordfence has reported active exploitation of two critical remote code execution vulnerabilities affecting the WordPress plugins Super Forms and Elementor Pro, with over 440,000 attempted attacks recorded so far. CVE-2026-14894 (CVSS 9.8) in Super Forms – Drag & Drop Form Builder enables unauthenticated users to upload arbitrary PHP files due to missing file type validation, a flaw fixed in version 6.3.314. Similarly, CVE-2026-32475 (CVSS 9.0/9.8) in Elementor Pro allows unrestricted file uploads through form widgets, leading to code execution on systems patched in version 4.2.2. Attackers are using these flaws to deploy web shells, such as "Mushr00wupl.php," to gain full control of compromised sites. Site administrators should update both plugins immediately and scan for unauthorized modifications to mitigate this ongoing threat.

Plex has released version 1.43.3 of Plex Media Server and version 1.115.0 of Plex Desktop to remediate multiple undisclosed security vulnerabilities, with CVE identifiers currently pending assignment. The company advises all administrators and users to apply these updates as soon as possible, noting that NAS installations may require manual package installation until local repositories update. Although specific details remain private, this release follows previous incidents involving high-severity authentication flaws and infrastructure exposure risks affecting the platform.

Google has released an emergency update for Chrome to address CVE-2026-85046, a high-severity type confusion vulnerability in the V8 engine that is currently being exploited in the wild. The flaw allows remote attackers to execute arbitrary code within the browser sandbox via crafted web content. Users are urged to upgrade immediately to version 152.0.7977.82 on Windows and macOS, or 152.0.7977.82 on Linux, to mitigate this active threat.

Security professionals face a continued surge in vulnerabilities heading into the September 2026 Patch Tuesday, driven by AI-assisted discovery techniques that have expanded the patch backlog significantly. While the previous update cycle resolved nearly four hundred issues, urgent attention is required for specific threats where exploitation has already begun or proof-of-concept code is available. Notably, threat actors are chaining CVE-2026-55040 and CVE-2026-63520 to achieve authentication bypass and remote code execution on SharePoint servers, while Exchange Server faces pressure from CVE-2026-62911, a high-severity elevation of privilege flaw. Additionally, Microsoft Defender is under scrutiny due to CVE-2026-69414, nicknamed 'ShieldBreak,' which grants system privileges through the malware engine and currently has public exploit code, though a fix is pending. Administrators must also prepare for several products reaching end of life this month, including specific Windows 11 editions and older Exchange Server versions, necessitating immediate upgrade planning. As the monthly cadence approaches, similar updates are expected from Adobe, Apple, and Mozilla, with recent Chrome releases already addressing actively exploited bugs.

Hewlett Packard Enterprise has released security updates for ArubaOS-CX to address CVE-2026-73749, a critical buffer overflow vulnerability that permits unauthenticated remote attackers to execute code with elevated privileges. By sending specially crafted packets to an affected daemon process, malicious actors can compromise enterprise network switches running the operating system. The vendor advises administrators to upgrade affected devices to specific fixed releases, such as version 10.18.1002 or higher, depending on their current branch. While no active exploitation or public proof-of-concept tools have been identified yet, the bulletin also details 23 additional high-severity flaws affecting various components of the platform.

Cisco has issued updates for a critical vulnerability, identified as CVE-2026-20212 with a CVSS score of 9.8, affecting ten models of Silicon One-based Nexus 9000 switches. This defect allows unauthenticated remote attackers to achieve root-level code execution by sending crafted input to exposed TCP ports 43210 and 43211 within the default Layer 3 VRF instance. Alongside this specific fix, Cisco released an IOS XR hardening update addressing seven umbrella CVEs, two of which carry a maximum severity rating of 9.8, impacting all versions without available workarounds.

Attackers are actively exploiting a critical vulnerability in the Elementor Pro WordPress plugin, identified as CVE-2026-32475, to gain remote command execution on affected servers. The flaw, which affects versions 4.2.1 and earlier, permits malicious PHP uploads by bypassing file-validation checks in form elements, resulting in webshell installation. Wordfence reports blocking approximately 200,000 related attack attempts since the fix was released on August 19. Site administrators should immediately update to Elementor Pro 4.2.2 or later and audit the /wp-content/uploads/elementor/forms/ directory for unauthorized files.

Bishop Fox researchers have disclosed CVE-2026-28323, a critical unauthenticated SAML authentication bypass affecting SolarWinds Web Help Desk versions 2026.1 and earlier, with a proof-of-concept exploit now available. The flaw permits attackers to forge a SAML Response and bypass signature verification entirely if no certificate is configured or if the assertion lacks a valid signature, enabling them to assume the identity of any known user. SolarWinds released version 2026.2.1 to address this issue by replacing the legacy SAML stack with Spring Security’s enforced validation mechanisms.

Plex has issued an urgent advisory urging users to immediately upgrade their installations to remediate several newly identified security vulnerabilities. These flaws, which have not yet been assigned official CVE identifiers, affect Plex Media Server versions up to and including v1.43.2, prompting the vendor to send direct email notifications to affected customers. The company recommends deploying Plex Media Server 1.43.3 and Plex Desktop 1.115.0 as soon as possible to mitigate potential risks, particularly for those using NAS devices who may need to install the updates manually.

Security firm Defiant has issued a warning regarding a high-severity flaw in the All-in-One WP Migration and Backup plugin, which leaves approximately 3.2 million WordPress sites exposed to remote code execution attacks. Identified as CVE-2026-19949 with a CVSS score of 8.8, this second-order SQL injection vulnerability resides in the archive restore feature due to inadequate input escaping. An unauthenticated attacker can exploit this by submitting specific trackbacks that allow them to steal a secret key and subsequently upload a malicious plugin, resulting in full site compromise. The issue affects all versions prior to 7.110, so administrators should update their plugins to the latest release to mitigate the risk.

Cisco has issued security advisories addressing unpatched S/MIME decryption flaws in Secure Email, identified as CVE-2026-20354 and CVE-2026-20355, which expose users to man-in-the-middle attacks capable of revealing plaintext content. Simultaneously, the vendor deployed urgent patches for critical vulnerabilities in IOS XR and Nexus 9000 series switches, including high-severity defects like CVE-2026-20274 and CVE-2026-20212 that enable remote code execution and authentication bypass. While Cisco reports no active in-the-wild exploitation for these issues, the potential for severe compromise necessitates immediate attention for administrators managing affected network and mail infrastructure.

Security researcher Chaotic Eclipse has released a proof-of-concept exploit named FalconFlank, which targets a zero-day privilege escalation vulnerability in the Crowdstrike Falcon Sensor. The flaw enables attackers to escalate privileges by abusing the sensor’s office malicious macros remediation mechanism on fully patched systems, including Windows 11 25H2 and Windows Server 2025. This disclosure follows recent releases by the same researcher demonstrating similar vulnerabilities in Kaspersky and Microsoft Defender products.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active real-world attacks. Among the critical additions are CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA 1000 Appliances, alongside CVE-2026-82329 in JFrog Artifactory and CVE-2026-9586 in Sangoma Switchvox. Microsoft and other researchers report that threat actors are leveraging these flaws to deploy reverse shells and cryptocurrency miners, with particular focus on AI infrastructure components like Kestra OSS and LiteLLM.