Critical Exploits Target SonicWall, JFrog, Cisco; TOTOLINK Routers Vulnerable

SonicWall SMA1000 Appliance is under active exploitation due to a pre-authentication SSRF vulnerability (CVE-2026-83548). This flaw arises from an unintended alternate access path within the Work Place interface, allowing unauthenticated remote attackers to potentially gain unauthorized access. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, highlighting the urgency for patching. As reported by CyberScoop, attackers are chaining this with other vulnerabilities to achieve remote code execution.

JFrog Artifactory is facing active exploitation of a critical authentication weakness (CVE-2026-82329) that, under default configurations, permits unauthenticated attackers with network access to gain administrative privileges. This vulnerability has been observed being exploited shortly after its disclosure, with attackers reportedly minting administrative tokens. The Hacker News detailed how this flaw can be used to gain full admin access, and it has also been added to the CISA KEV catalog.

Sangoma Switchvox SMB Edition is targeted by an unauthenticated SQL injection vulnerability (CVE-2026-9586) in versions prior to 8.3 (104997). The vulnerability lies within the /pa endpoint, which processes XML content and directly concatenates user-controlled data into SQL queries. Exploitation of this flaw allows attackers to execute arbitrary SQL commands, potentially leading to data compromise or system control. SecurityWeek and Help Net Security report that this vulnerability is already being exploited in the wild, with The Hacker News noting that attackers are deploying reverse shells without credentials. This has also been added to the CISA KEV catalog.

Cisco is addressing multiple critical vulnerabilities across its product lines. A flaw in the Silicon One integration for Cisco Nexus 9000 Series Switches (CVE-2026-20212) allows unauthenticated, remote attackers to execute code with root privileges by exploiting open TCP ports 43210 and 43211. Additionally, Cisco IOS XR Software has received hardening releases addressing an unspecified number of vulnerabilities identified through internal reviews, as detailed by The Register Security. SecurityWeek and The Hacker News also highlighted the Nexus 9000 vulnerability.

A wave of critical vulnerabilities has been disclosed affecting TOTOLINK T6 routers (versions 4.1.5cu.748_B20211015). These include incorrect access control flaws in functions such as sendToMasterQosConfig (CVE-2026-51770), remoteCloudUpdateCheck (CVE-2026-51769), recvIndirectMeshInfo (CVE-2026-51765), and setWiFiMeshName (CVE-2026-51705). These vulnerabilities allow unauthenticated attackers to manipulate QoS settings, trigger update checks, alter mesh neighbor records, or rename mesh entries via crafted MQTT messages or HTTP requests. Another critical flaw (CVE-2026-51611) allows attackers to force a reboot of the device. Vypr Intelligence reported on these numerous access control issues.

ServiceNow has patched an improper access control vulnerability (CVE-2026-18886) in its AI platform. This flaw could allow an unauthenticated user, under specific circumstances, to create or modify instance data beyond their intended permissions. GovInfoSecurity noted that ServiceNow addressed three critical flaws in its AI platform, including this one.

Kestra, an open-source orchestration platform, has a critical vulnerability (CVE-2026-49869) in its AuthenticationFilter prior to versions 1.0.45 and 1.3.21. The filter incorrectly uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. This allows unauthenticated attackers to bypass authentication and access sensitive configuration data. This vulnerability has been added to the CISA KEV catalog.

Mozilla has released security updates for Firefox and Thunderbird, addressing a critical site isolation issue in the DOM: Navigation component (CVE-2026-84129). This vulnerability, fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2, could potentially allow for sandbox escapes or other security bypasses. Vypr Intelligence reported on these updates.

Critical vulnerabilities have been disclosed in WordPress themes and plugins. The Nokri - Job Board theme (up to version 1.6.6) suffers from a privilege escalation vulnerability (CVE-2026-18550) due to insufficient reset token validation in the nokri_reset_password() function, enabling account takeover. Separately, the MemberHero plugin through version 6.9 (CVE-2026-10522) allows unauthenticated attackers to register new users with arbitrary roles, including Administrator, by not restricting account field inputs during frontend registration.

A path traversal vulnerability (CVE-2023-7309) exists in the Dahua Smart Park Integrated Management Platform, also known as the Dahua Smart Campus Integrated Management Platform. The flaw affects the SOAP-based GIS bitmap upload interface, allowing attackers to traverse directories and potentially access or modify sensitive files.

Delinea has a vulnerability where an attacker can register a FIDO2 credential against a target account and then authenticate as that user (CVE-2026-19117). This issue affects on-premises deployments only and requires specific conditions for exploitation.

OpenAI Codex Desktop for Windows and macOS has a vulnerability (CVE-2026-19593) where it automatically inspects Git metadata and working-tree status. If a workspace contains a repository with a preserved attacker-controlled .git/config file, the attr.tree setting could be exploited.

A Spring WebFlux application utilizing the Aalto XML processor has a vulnerability (CVE-2026-47891) where it does not correctly enforce the maxInMemorySize limit. This affects multiple versions of Spring Framework, including 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, and 6.1.0 - 6.1.28.

WWBN AVideo contains an authentication failure vulnerability (CVE-2026-85154) where the video_id_hash credential acts as a non-expiring, non-revocable bearer token, granting full administrator session access to the video owner's account. Attackers who obtain this hash can gain complete control.