Major Vendors Address Critical Vulnerabilities; Routers Also Impacted
Critical vulnerabilities disclosed in Cisco, Apple, IBM, and Microsoft products; D-Link and Totolink routers also affected.
Cisco is addressing multiple critical vulnerabilities in its Secure Email Gateway and Secure Email and Web Manager products. These flaws, stemming from an internal security review, could allow remote, unauthenticated attackers to execute arbitrary code. The vulnerabilities include CVE-2026-76441 and CVE-2026-20353, which are described as critical and carry a CVSS score of 9.8. While the details of the fixes are not fully disclosed, Cisco's proactive security commitment suggests patches or hardened releases are available. As reported by The Hacker News, these issues highlight the ongoing risks in email security infrastructure.
Apple has released a significant security update addressing numerous vulnerabilities across its operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Among the patched flaws are CVE-2026-84609, a permissions issue in iOS and other platforms fixed with improved path validation, and CVE-2026-65414, an out-of-bounds write vulnerability in various Apple devices, both rated critical with CVSS 9.8. These updates are crucial for users to protect against potential unauthorized access and code execution. Cyber Security News detailed the extensive nature of these patches, emphasizing the importance of timely updates.
Several critical vulnerabilities have been disclosed in IBM products, including Langflow OSS, ContextForge MCP Gateway, and potentially others like Db2 and DataStage. CVE-2026-81204 and CVE-2026-79724 highlight critical code execution and OS command injection risks in Langflow OSS (versions 1.0.0 through 1.11.5) due to code injection and improper neutralization of special elements. Additionally, CVE-2026-78573 points to a critical issue in ContextForge MCP Gateway (versions 1.0.0 through 1.0.7) related to default credentials, allowing administrative access. Vypr Intelligence noted that these disclosures affect multiple IBM product lines, underscoring the need for vigilance.
A series of critical vulnerabilities have been identified in D-Link and Totolink routers, posing significant risks to home and small business networks. For D-Link, CVE-2026-90693 (DIR-878) and CVE-2026-90680 (DIR-823G) involve stack-based buffer overflows and issues in the HNAP1 component, respectively, allowing for remote code execution. Totolink's A3002MU model is affected by CVE-2026-90608 and CVE-2026-90606, which are buffer overflow vulnerabilities in the boa component related to port forwarding and IPv6 setup. These flaws, often exploitable with basic network access, require immediate attention from users of these devices.
Microsoft's September Patch Tuesday addresses a critical privilege escalation vulnerability in Entra ID, identified as CVE-2026-83941. This flaw allows an authorized attacker to elevate their privileges over a network, potentially leading to wider system compromise. Additionally, a heap-based buffer overflow in the Windows USB Mass Storage Class Driver (CVE-2026-68839) could permit unauthorized attackers to execute code remotely. Rapid7 Blog and Cyber Security News provide further details on these and other vulnerabilities fixed in this month's update.
Critical vulnerabilities have been disclosed in Apache's OpenNLP, specifically affecting the RegexNameFinderFactory's email and URL patterns (CVE-2026-82617). These patterns contain ambiguous nested quantifiers, which could lead to denial-of-service conditions or potentially other impacts when processed by applications. While the exact exploitability and impact depend on the specific implementation, the presence of such flaws in a widely used NLP library warrants attention. Vypr Intelligence highlighted this as part of a broader set of vulnerabilities affecting Apache projects.