Linux Kernel Flaw in KEV; Azure and Totolink Routers Vulnerable
Linux kernel flaw added to KEV catalog; critical Microsoft Azure and Totolink router vulnerabilities disclosed.
The Linux kernel's handling of zero-length TLS records has been fixed, addressing CVE-2025-39682. This vulnerability could allow for improper processing of records during secure communication, potentially leading to instability or other security issues. The fix ensures that each recvmsg() call correctly processes either contiguous data records or a single non-data record, preventing errors in TLS communication. This issue has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, highlighting its active exploitation. CISA Alerts, Cyber Security News, The Hacker News, and Vypr Intelligence all reported on this critical development.
Multiple critical vulnerabilities have been disclosed across Microsoft products, with a significant focus on Azure services. CVE-2026-85889, a critical flaw in Azure AI Foundry, allows for privilege escalation due to missing authentication for critical functions. Similarly, CVE-2026-62874 in Azure Billing and CVE-2026-83944 in Azure Logic Apps also permit privilege escalation through insufficient data authenticity verification and improper access control, respectively. Another Azure Logic Apps vulnerability, CVE-2026-70200, involves path traversal, enabling privilege escalation. Additionally, CVE-2026-69843 in Microsoft Fabric allows for authentication bypass by spoofing, leading to privilege escalation. These flaws, many with CVSS scores of 10.0, pose a severe risk to organizations utilizing these Microsoft cloud services. Cyber Security News and The Hacker News highlighted the Azure AI Foundry vulnerability.
Several critical vulnerabilities have been identified in Totolink routers, specifically affecting the A3002MU model. CVE-2026-93741 and CVE-2026-93740, found in the formWlWds and formWlEncrypt functions respectively, are buffer overflow vulnerabilities resulting from the manipulation of the submit-url argument. Another critical flaw, CVE-2026-93742, in the formWsc function, allows for command injection via manipulation of the localPin argument. CVE-2026-93739, in the formWlAc function, also involves a buffer overflow due to submit-url manipulation. Finally, CVE-2026-93738, affecting the formSchedule function, presents a buffer overflow vulnerability through manipulation of the webpage argument. These vulnerabilities collectively expose Totolink A3002MU devices to significant risks, including remote code execution and denial of service.
IBM MQ Appliance and its Common Licensing Agent are affected by critical vulnerabilities. CVE-2026-10747, a heap buffer overflow in IBM MQ Appliance's protocol message processing before authentication, could allow for denial of service or arbitrary code execution. Separately, CVE-2025-15399 in the IBM Common Licensing Agent is a cross-site request forgery (CSRF) vulnerability that could enable attackers to perform unauthorized actions. These vulnerabilities underscore the need for prompt patching and security reviews for IBM products.
WordPress plugins and themes are facing multiple critical vulnerabilities. The Migratico Lite plugin, up to version 2.6.8, suffers from an unauthenticated remote code execution (RCE) flaw (CVE-2026-62104). The Botiga Pro plugin, prior to version 1.6.5, has a REST route vulnerability (CVE-2026-86591) that allows unauthenticated users to update arbitrary WordPress options, potentially leading to privilege escalation. Furthermore, the Gravity Forms plugin, in all versions up to 3.1.0.4, is vulnerable to arbitrary file uploads (CVE-2026-84434) due to issues in its file persistence mechanism. These issues highlight ongoing security risks within the WordPress ecosystem.
Other notable vulnerabilities include CVE-2026-92808, a server-side request forgery (SSRF) in Altium Enterprise Server's UnifiedLogin service, allowing unauthenticated attackers to make the server issue outbound HTTP requests. Oracle Hyperion Financial Management (component: Security) has a critical vulnerability (CVE-2026-87230) that allows unauthenticated network attackers to exploit easily. Chef Automate's API gateway and identity validation path have a vulnerability (CVE-2026-80462) that could allow unauthenticated actors to gain elevated access. Lastly, OpenPanel js-runtime contains a sandbox escape vulnerability (CVE-2026-93985) in its JavaScript webhook template validator.