N-able, Adobe, Microsoft Hit With Critical Flaws
N-able, Adobe Commerce, and Microsoft products are hit with critical vulnerabilities, with several added to CISA's KEV catalog amid record-breaking patch releases.
A critical remote code execution vulnerability in N-able N-central, CVE-2026-86218, has been added to the CISA Known Exploited Vulnerabilities catalog. This pre-authentication flaw allows unauthenticated attackers to execute arbitrary code on affected systems. N-able has released multiple hotfixes to address this issue, with the latest being version 2026.3.1.14. The vulnerability has been actively exploited in the wild, prompting urgent patching by affected organizations. The Hacker News and Infosecurity Magazine provide further details on the exploitation and remediation.
Adobe Commerce is facing a critical vulnerability, CVE-2026-75650, which has also been added to the CISA KEV catalog due to active exploitation. This flaw, an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, can lead to arbitrary code execution. Exploitation has been observed in the wild, with attackers deploying backdoors and web shells. Adobe has released patches, and Tenable offers a FAQ on the vulnerability.
Lantronix EDS5000 devices are affected by CVE-2025-67038, a critical vulnerability allowing unauthenticated attackers to execute shell commands due to improper sanitization of usernames in the HTTP RPC module. CISA has warned that this flaw is being actively exploited, and The Hacker News reported on the exploitation. This vulnerability impacts operational technology environments, highlighting the need for prompt patching.
Microsoft's September Patch Tuesday addresses a staggering 974 CVEs, including several critical vulnerabilities. Among these are CVE-2026-66302, an external control of file name or path vulnerability in Skype for Business, and CVE-2026-78510, a heap-based buffer overflow in Microsoft Office Word, both allowing remote code execution. Other critical flaws include CVE-2026-78445 in Windows Services for NFS ONCRPC XDR Driver and CVE-2026-77493 in the Microsoft Graphics Component, also leading to remote code execution. The Register Security provides an overview of the extensive patch release.
SAP has released patches for critical vulnerabilities, including CVE-2026-44756, a memory safety issue in the Extended Passport Protocol (EPP) processing library. This vulnerability could allow unauthenticated attackers to execute arbitrary code by sending crafted network requests. Infosecurity Magazine and SecurityWeek detail the severity and impact of this flaw.
Android x86 users should be aware of multiple critical vulnerabilities disclosed, including CVE-2026-49921 and CVE-2026-58822. CVE-2026-49921 is a heap buffer overflow that could lead to remote code execution, while CVE-2026-58822 is a memory safety issue due to improper casting, also enabling remote code execution. User interaction is not required for exploitation, making these particularly dangerous. Vypr Intelligence covers these vulnerabilities.