MikroTik KEV Additions, Microsoft Patch Tuesday Criticals

Two critical vulnerabilities in MikroTik RouterOS have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-86060, a critical flaw with a CVSS score of 9.8, allows privilege escalation by manipulating usernames that begin with a prohibited character, enabling attackers to alter the trusted RouterOS policy mask. This vulnerability has been actively exploited in the wild, as noted by Vypr Intelligence and GovInfoSecurity. Another high-severity vulnerability, CVE-2026-67277 (CVSS 8.2), allows unauthenticated clients to initiate an IPv4 UDP test by exploiting a state where a primary session has not yet completed authentication, as detailed by SecurityWeek. Both vulnerabilities are critical for organizations using MikroTik devices due to the potential for complete system compromise.

Microsoft's September Patch Tuesday addresses a significant number of vulnerabilities, including two critical flaws in its Windows Server DHCP and Graphics Component. CVE-2026-69845, a critical OS command injection vulnerability in Windows Server DHCP, carries a CVSS score of 9.8 and has been exploited in the wild, according to Vypr Intelligence. This flaw allows an unauthenticated remote attacker to execute code over a network. Similarly, CVE-2026-77493, a critical double-free vulnerability in the Microsoft Graphics Component, also allows for remote code execution. These vulnerabilities were highlighted by Cisco Talos Intelligence and Rapid7.

Several critical vulnerabilities have been disclosed across various vendors, including Plesk, Dell, and Apache. Plesk is affected by CVE-2026-68488 and CVE-2026-68487, both critical flaws allowing for local privilege escalation and arbitrary file writes, respectively. These vulnerabilities could enable an authenticated attacker to gain root access or overwrite critical system files. Dell's ThinOS and SCG Appliance are impacted by critical OS command injection (CVE-2026-81467) and insufficient data authenticity verification (CVE-2026-80172) vulnerabilities, respectively, as reported by Cyber Security News. Additionally, Apache Nutch has a critical vulnerability (CVE-2026-41871) due to improper handling of external input, potentially leading to unsafe reflection and code execution.

Critical vulnerabilities affecting embedded systems and development platforms have also been reported. Tenda devices are vulnerable to CVE-2026-86152, a critical OS command injection flaw in their CP3 model, which could allow attackers to execute arbitrary commands. Forgejo, a code hosting platform, has a critical remote code execution vulnerability (CVE-2026-89094) due to mishandling template expansion. Flowiseai's /api/v1/prediction/<flowId> endpoint is susceptible to CVE-2026-52098, a critical arbitrary code execution vulnerability. These disclosures highlight the ongoing risks associated with insecure configurations and code handling in various software and hardware products.