Cisco, WSO2 Flaws Hit KEV; Multiple Critical RCEs Disclosed

Cisco Identity Services Engine (ISE) is facing a critical authentication bypass vulnerability, CVE-2026-76460, which has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This flaw allows unauthenticated, remote attackers to bypass authentication by exploiting an API endpoint with insufficient controls. The vulnerability has been observed to be actively exploited, prompting an emergency patch from Cisco. As The Register Security reported, this is a perfect CVSS 10.0 vulnerability, highlighting the severe risk it poses.

A critical vulnerability in WSO2 products, CVE-2026-5430, has also been added to the CISA KEV catalog due to active exploitation. This flaw affects the JWT authentication mechanism, allowing attackers to forge tokens signed with unsupported algorithms, leading to authentication bypass and potentially full administrative access. Cyber Security News and The Hacker News both report on the active exploitation and the severity of this issue, which allows attackers to gain administrative privileges.

GitLab has released patches for multiple vulnerabilities, including two critical remote code execution (RCE) flaws, CVE-2026-89078 and CVE-2026-93577. These vulnerabilities, affecting GitLab CE/EE versions prior to 19.2.7, 19.3.3, and 19.4.1, could allow authenticated users to execute arbitrary code under certain conditions. Cyber Security News and Vypr Intelligence detail these critical RCEs, emphasizing the need for prompt patching.

A series of critical vulnerabilities have been disclosed in IBM Concert versions 1.0.0 through 3.0.0. These include memory corruption and application crash possibilities due to use-after-free (CVE-2026-6928), arbitrary code execution via buffer overflow (CVE-2026-6730), and unauthenticated command execution through specially crafted input (CVE-2026-6721). Vypr Intelligence reports on these 15 disclosed vulnerabilities, highlighting the critical nature of the code execution flaws.

Lantronix devices, including SLC8000, SLC9000, EMG8500/EMG7500, and SLB882/SLCx-03/SLCx-02, are affected by multiple critical vulnerabilities. These include an authentication bypass in the web management interface (CVE-2026-80155) and command injection flaws allowing arbitrary code execution for authenticated attackers (CVE-2026-80144, CVE-2026-80143). These vulnerabilities pose a significant risk to the security of the affected industrial and network management devices.

Microsoft Azure AI Foundry has a critical vulnerability, CVE-2026-85889, that allows unauthorized privilege escalation over a network. This flaw, with a CVSS score of 10.0, was patched by Microsoft and detailed by The Hacker News and Cyber Security News. The vulnerability underscores the importance of securing cloud-based AI platforms.

Wgetnz HFS2 versions prior to 2.4.0 contain critical vulnerabilities including unauthenticated arbitrary file access (CVE-2026-97360) and remote code execution via template injection in the multipart upload handler (CVE-2026-97359). These flaws allow unauthenticated attackers to read, write, delete files, or execute arbitrary code by embedding malicious syntax in filenames.

MindsDB Minds Platform version 26.1.0 and earlier is vulnerable to unauthenticated remote code execution (CVE-2026-73678). Attackers can exploit a flaw in the POST /api/v1/prompts endpoint to execute arbitrary OS commands without authentication.

Cisco ISE and Cisco ISE-PIC have a vulnerability, CVE-2026-20147, that allows authenticated, remote attackers to execute arbitrary commands on the underlying operating system. Exploitation requires valid user credentials, but the severity is high due to the potential for OS-level compromise.

Honeywell PD45 Industrial Printer, version F10.19.010040, has a critical unauthenticated arbitrary file upload vulnerability (CVE-2026-13249) in its web management interface, allowing attackers to upload malicious files without authentication.

Delta Electronics DIAEnergie before version 1.11.00.022 contains an improper authentication vulnerability (CVE-2026-78308) that allows for authentication bypass.

WordPress plugin "Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code" versions up to 4.8.6 are affected by a privilege escalation vulnerability (CVE-2026-14281) due to missing permission enforcement.

Gigatech PDV5701 version 1.0.31_240305_112640 has a missing authentication vulnerability in its WebSocket Service component, affecting the /index.html file (CVE-2026-94493).

Moodle Socialwall plugin versions v.3.0 through v.3.3 contain an SQL injection vulnerability (CVE-2025-63564) that allows arbitrary code execution via crafted HTTP requests.