What you need to know today.
SolarWinds RCE added to KEV; Progress MarkLogic, Joomla extensions, and Linksys routers face critical flaws.
A critical pre-authentication remote code execution vulnerability in SolarWinds Web Help Desk has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-26399, this flaw allows unauthenticated attackers to execute arbitrary commands on the host machine by exploiting a deserialization vulnerability in the AjaxProxy component. The vulnerability has been linked to a ransomware attack on the Adriatic Port and was also highlighted by watchTowr Labs and Check Point Research. Immediate patching or mitigation is strongly advised.
Multiple critical vulnerabilities have been disclosed in Progress MarkLogic Server, with several allowing for remote code execution and privilege escalation. CVE-2026-85955, CVE-2026-85948, and CVE-2026-85947 are among the flaws, affecting versions prior to 12.1.0 for 12.x and 11.3.7 for 11.x. These issues stem from improper handling of XQuery evaluation functions and authorization flaws in forest-management operations, potentially enabling attackers with query-execution or manage-user privileges to execute arbitrary code or escalate privileges. Vypr Intelligence reported on these findings, emphasizing the critical nature of the RCE capabilities.
A significant number of critical vulnerabilities have been identified across various Joomla extensions, including Fabrikar and miniOrange. CVE-2026-76604, CVE-2026-76605, CVE-2026-76606, and CVE-2026-76607 in Fabrikar's components allow for unauthenticated remote code execution and path traversal due to missing access control checks and improper handling of image and download elements. Additionally, CVE-2026-77995 in miniOrange's OAuth Client and related SSO plugins enables arbitrary account takeover. Vypr Intelligence detailed these widespread issues affecting Joomla sites.
Several critical command injection and buffer overflow vulnerabilities have been disclosed in Linksys E1700 firmware version 1.0.0.4.003. Tracked as CVE-2026-108892, CVE-2026-108896, CVE-2026-108895, CVE-2026-108894, and CVE-2026-108893, these flaws impact various components including MAC filtering, IPv6 configuration, DMZ settings, static routes, and VLAN configuration. Exploitation of these vulnerabilities could lead to operating system command injection or stack-based buffer overflows, allowing attackers to compromise the affected devices.
Critical vulnerabilities have been found in TRENDnet routers, specifically the TEW-821DAP and TEW-751DR models. CVE-2026-77946 in the TEW-821DAP's NTP Timezone Configuration Handler allows for command injection via manipulation of the uci_safe_get function. Similarly, CVE-2026-108804 affects the TEW-751DR, TEW-752DRU, and TEW733GR models, enabling command injection through the pigwidgeon.cgi component. Vypr Intelligence reported on these command injection flaws.
A critical remote code execution vulnerability exists in the 3D Product Configurator for WooCommerce WordPress plugin, tracked as CVE-2026-103889. Versions up to and including 2.16.2 are affected due to missing authentication and nonce checks in the 'xpv_image' parameter, allowing unauthenticated attackers to execute arbitrary code on the server. Additionally, a stack-based buffer overflow vulnerability in the lwIP SMTP client (CVE-2026-15340) could lead to denial of service or code execution, as noted in a CISA ICS Advisory.