What you need to know today.

CISA has added a critical vulnerability in Collabora Online's CODE Server to its Known Exploited Vulnerabilities catalog. The flaw, CVE-2026-110447, affects Collabora Online Built-in CODE Server before version 26.4.303 and allows for remote code execution. Reports indicate this vulnerability was actively exploited in September and October 2026, potentially allowing attackers to backdoor Nextcloud servers. This is a separate issue from CVE-2025-66208. Mitigation requires updating to a patched version.

Hewlett Packard Enterprise (HPE) has issued warnings regarding multiple critical vulnerabilities across its Aruba networking products. Specifically, AOS-10 is affected by buffer overflow vulnerabilities (CVE-2026-79847, CVE-2026-79851) and authentication bypass flaws (CVE-2026-79844), which could lead to unauthenticated remote code execution and arbitrary command execution. Additionally, AOS-8 faces vulnerabilities including authentication bypass (CVE-2026-79850), SQL injection (CVE-2026-79849, CVE-2026-79848), and command injection (CVE-2026-79846), all potentially allowing unauthenticated attackers to compromise the underlying host. These flaws could grant privileged access and enable arbitrary code execution.

Microsoft has disclosed six critical vulnerabilities affecting Azure and Exchange services. Among these, CVE-2026-97785 and CVE-2026-83938 stand out, both carrying a CVSS score of 10.0. CVE-2026-97785, an improper authentication flaw in AAD App Proxy, and CVE-2026-83938, a missing authentication vulnerability in Azure Kubernetes Configuration Service, could both be exploited over a network to elevate privileges. The full impact and specific attack vectors for all six vulnerabilities require further investigation, but their critical nature warrants immediate attention and patching.

A significant batch of 25 vulnerabilities has been disclosed for WordPress plugins, including several critical flaws. Notably, CVE-2026-115214, affecting the Datawiza Proxy Auth Plugin, allows unauthenticated attackers to bypass security controls by trusting specific HTTP headers. Multiple plugins are also susceptible to deserialization vulnerabilities, such as CVE-2026-94075 and CVE-2026-114196 in Tribulant Software Newsletters and Paytium Paytium respectively, leading to object injection. Additionally, CVE-2026-110956 in asVereinbase and CVE-2026-115806 in Prime Mover Backup and Migration allow for unauthenticated access or arbitrary code execution due to improper authentication and PHP object injection, respectively.

Fortinet has addressed a critical authentication bypass vulnerability in its FortiSandbox product line. CVE-2026-107656 affects multiple versions of FortiSandbox, including 5.0.x, 4.4.x, and all versions of 4.2, as well as PaaS versions. This flaw allows unauthenticated remote attackers to bypass security controls via an alternate path or channel, potentially leading to unauthorized access and further compromise. Patches are available for affected versions.

WolfVision has identified two critical vulnerabilities in its vSolution Matrix file sharing feature and WolfProt interface. CVE-2026-59107 involves a shared cryptographic trust configuration that, if an attacker obtains the private key, could allow SSH authentication to affected devices. CVE-2026-59106, stemming from insufficient neutralization of user-controlled input, could permit unauthenticated attackers to execute arbitrary operations over the network.

Oray's Pugongying X5 Pro 7.6.1 contains a critical CRLF injection vulnerability in its Ser2net component. CVE-2026-116231 arises from manipulation of the 'regmsg' argument, allowing an attacker to inject control characters and potentially disrupt services or execute commands.

Mautic's campaign import feature is vulnerable to unrestricted file upload. CVE-2026-115188 allows attackers to upload malicious files that are then copied to a publicly accessible media directory without proper validation, potentially leading to remote code execution.