Critical Flaws Hit Linux Kernel, Microsoft Azure, and IoT Devices
Critical vulnerabilities disclosed in Linux kernel, Microsoft Azure, Tenda devices, and ASUS Control Center pose significant risks.
A critical vulnerability in the Linux kernel, CVE-2026-31431, has been identified and is being tracked as a high-risk item. This flaw, described as a regression in the crypto subsystem, allows for potential privilege escalation. While the exact attack vector is still under investigation, its presence in the kernel signifies a significant risk to systems running Linux. Patches and mitigations are being developed, but users are advised to monitor for updates. The Hacker News reported on a related PoC release, highlighting the active interest in exploiting this vulnerability.
Microsoft's September Patch Tuesday addresses a significant number of vulnerabilities, including critical flaws in Azure Active Directory B2C (CVE-2026-83711) and Azure AI Language (CVE-2026-70352). These vulnerabilities allow for privilege escalation over a network, posing a substantial risk to organizations utilizing these Microsoft cloud services. As detailed by Cisco Talos Intelligence, these flaws are critical and require immediate attention.
Several critical vulnerabilities have been disclosed across various Tenda device models, including CVE-2026-86152 and CVE-2026-86165. These flaws, ranging from OS command injection to buffer overflows, could allow unauthenticated attackers to gain control of affected devices. Vypr Intelligence noted that multiple Tenda devices are affected, emphasizing the widespread risk to users of these products.
Advantech devices, specifically models within the WISE-6610 series, are impacted by multiple critical vulnerabilities, including CVE-2026-79697 and CVE-2026-79698. These flaws could lead to significant security breaches, potentially allowing attackers to compromise these industrial IoT devices. The scope of affected models highlights a broad risk for organizations relying on Advantech's WISE-6610 series.
Critical vulnerabilities have been found in ASUS Control Center (CVE-2026-75754), allowing unauthorized users to obtain encryption keys and gain local service control. This flaw poses a significant risk to organizations using ASUS Control Center for managing their ASUS devices, potentially leading to widespread compromise. Cyber Security News highlighted the severity of this issue, noting the potential for full administrative control.
Multiple WordPress plugins are affected by critical vulnerabilities. The MemberDash plugin (CVE-2026-16310) suffers from an Insecure Direct Object Reference, while the ComboBlocks plugin (CVE-2024-11080) has an Unauthenticated Hook Injection vulnerability. Additionally, the Mstore Api plugin (CVE-2026-13447) has an Authentication Bypass via JWT Forgery. These flaws could allow unauthenticated attackers to compromise WordPress sites, leading to data breaches or further system compromise.
Hitachi Cosminexus Component Container is affected by several critical vulnerabilities, including Command Argument Injection (CVE-2026-71377), OS command injection (CVE-2026-71376), and Deserialization of untrusted data (CVE-2026-71374). These flaws, present in multiple versions of the software, could allow attackers to execute arbitrary commands on affected systems, leading to significant compromise.
Miniorange.com Joomla extensions are vulnerable to critical security flaws, including Unauthenticated Authentication Bypass (CVE-2026-77998) and Arbitrary Account Takeover (CVE-2026-77995). These vulnerabilities affect various SSO and OAuth plugins, potentially allowing attackers to gain unauthorized access to Joomla sites and user accounts.
IBM Operational Decision Manager (CVE-2026-18658) is vulnerable to SQL injection, enabling unauthenticated attackers to execute arbitrary SQL statements and potentially compromise the underlying database. This critical flaw poses a significant risk to organizations using this IBM product, as it could lead to data exfiltration or manipulation.
Linksys RE7000 routers are affected by a critical vulnerability (CVE-2026-86299) in the PingTest Handler component. This flaw could allow attackers to compromise the router's functionality, potentially leading to network disruption or unauthorized access.
EDGE22 Studios Ltd. GP Premium (CVE-2026-66627) has an unrestricted file upload vulnerability that could allow for Remote Code Inclusion. This critical flaw poses a risk to websites using this plugin, potentially enabling attackers to execute arbitrary code on the server.
NetStaX EtherNet/IP Stack (CVE-2026-78012) has a vulnerability that could lead to memory corruption and denial-of-service conditions due to improper handling of large explicit-message requests. This critical flaw could impact industrial control systems relying on this stack.