Security Digest: September 10, 2026 - 33 Critical Vulnerabilities

Today’s digest is dominated by three actively exploited zero-days and a cluster of high-impact RCE, auth-bypass, and file-disclosure bugs across browsers, network appliances, developer tooling, and cloud-adjacent platforms. Patch exposed internet-facing systems first, then move immediately to browser, Git, Node.js, and Windows desktop runtime updates.

· 30 min read

Executive Summary

Today’s digest is dominated by three actively exploited zero-days and a cluster of high-impact RCE, auth-bypass, and file-disclosure bugs across browsers, network appliances, developer tooling, and cloud-adjacent platforms. Patch exposed internet-facing systems first, then move immediately to browser, Git, Node.js, and Windows desktop runtime updates.

The most urgent items are CVE-2026-87491 in Chromium V8, CVE-2025-25249 in Fortinet products, and CVE-2026-19490 in Citrix NetScaler, all listed as actively exploited. If you manage any of those stacks, treat this as a same-day emergency and verify remediation now.

Critical Vulnerabilities

  • CVE-2026-87491: Chromium V8 out-of-bounds write
    Impact: Remote code execution from a crafted web page inside the browser sandbox.
    Affected Systems: Google Chromium V8; browsers based on Chromium, including Chrome, Edge, and Opera.
    Immediate Action: Force-update all Chromium-based browsers across endpoints and managed fleets today.
    Mitigation: Apply the latest vendor browser release and restart browsers to ensure the patched V8 engine is loaded.
  • CVE-2025-25249: Fortinet heap overflow
    Impact: Unauthorized code execution or command execution via crafted packets.
    Affected Systems: FortiOS, FortiSwitchManager, FortiSASE.
    Immediate Action: Patch all Fortinet appliances immediately and restrict management exposure.
    Mitigation: Install Fortinet’s fixed releases; if patching is delayed, isolate the devices from untrusted networks and monitor for exploitation.
  • CVE-2026-19490: Citrix NetScaler authentication bypass
    Impact: Unauthenticated attackers may bypass login on AAA virtual servers or Gateway deployments.
    Affected Systems: Citrix NetScaler ADC and NetScaler Gateway configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy).
    Immediate Action: Patch NetScaler now and review any exposed gateway or VPN instances.
    Mitigation: Apply Citrix’s fixed build and verify that internet-facing gateway services are not left on vulnerable versions.
  • CVE-2026-85061: maplibre-gl zero-click XSS
    Impact: Attacker-controlled HTML can survive sanitization and execute when inserted into the page.
    Affected Systems: npm maplibre-gl.
    Immediate Action: Upgrade to 6.4.1 or later now.
    Mitigation: If you cannot upgrade immediately, stop rendering untrusted attribution strings and sanitize attributes before passing them to MapLibre.
  • CVE-2026-58822: Memory safety issue in ftsmooth.c
    Impact: Remote code execution without user interaction.
    Affected Systems: Affected package/component not specified in the advisory data provided.
    Immediate Action: Identify any products bundling the affected component and apply vendor updates as soon as they are available.
    Mitigation: Remove exposure to untrusted input paths until patched builds are deployed.
  • CVE-2026-49921: Heap buffer overflow
    Impact: Remote code execution without additional privileges.
    Affected Systems: Affected package/component not specified in the advisory data provided.
    Immediate Action: Check vendor advisories for the affected library or product and patch immediately.
    Mitigation: Treat any network- or file-parsing path using the component as unsafe until updated.
  • CVE-2026-78676: GitPython config round-trip injection
    Impact: A malicious config file can be rewritten into a live Git directive, enabling code execution via core.hooksPath.
    Affected Systems: pip GitPython.
    Immediate Action: Upgrade GitPython everywhere it is used in read-write mode, especially CI and repo automation.
    Mitigation: Avoid opening attacker-influenced repositories read-write; block or sanitize config files before any write operation.
  • CVE-2026-62815: Microsoft QUIC use-after-free
    Impact: Unauthenticated remote code execution over the network.
    Affected Systems: NuGet Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel.
    Immediate Action: Update affected Microsoft QUIC packages and restart services using them.
    Mitigation: Patch the runtime and limit direct exposure of QUIC-enabled services until updated.
  • CVE-2026-75604: Next.js Windows-hosted RCE
    Impact: Remote code execution on Windows-hosted apps using Pages/App router without Cache Component.
    Affected Systems: npm next deployments on Windows filesystem hosts.
    Immediate Action: Upgrade immediately if any production or staging server runs Next.js on Windows.
    Mitigation: There is no reliable workaround beyond upgrading.
  • CVE-2026-69439: .NET / Visual Studio heap overflow
    Impact: Privilege escalation over the network.
    Affected Systems: .NET and Visual Studio components (specific package not listed in the provided data).
    Immediate Action: Apply Microsoft updates and verify Visual Studio/.NET runtime versions.
    Mitigation: Restart affected systems after patching.
  • CVE-2026-71328: Visual Studio heap overflow
    Impact: Remote code execution over the network.
    Affected Systems: Visual Studio components (specific package not listed in the provided data).
    Immediate Action: Update Visual Studio installations immediately.
    Mitigation: Reboot or restart developer tooling to load patched binaries.
  • CVE-2026-69522: Visual Studio heap overflow
    Impact: Remote code execution over the network.
    Affected Systems: Visual Studio components (specific package not listed in the provided data).
    Immediate Action: Patch all impacted Visual Studio instances now.
    Mitigation: Remove exposure to untrusted network traffic until patched.
  • CVE-2026-59185: identrail GitHub App installation hijack
    Impact: One tenant can link another tenant’s GitHub App installation and read private repositories.
    Affected Systems: go github.com/identrail/identrail.
    Immediate Action: Disable or restrict the GitHub connect flow until a fixed build is deployed.
    Mitigation: Upgrade and re-validate workspace-to-installation binding on completion.
  • CVE-2026-78675: GitPython submodule include-based file disclosure
    Impact: A malicious .gitmodules file can cause local file content disclosure through include resolution.
    Affected Systems: pip GitPython.
    Immediate Action: Treat untrusted repositories as hostile and upgrade GitPython in tooling that reads submodules.
    Mitigation: Disable include merging for submodule parsing and avoid parsing attacker-controlled repos read-only without a fix.
  • CVE-2026-59179: OpenHop path traversal
    Impact: Read or delete arbitrary YAML files reachable by the process.
    Affected Systems: npm @openhop/server.
    Immediate Action: Restrict access to the service immediately and deploy the fixed path validation.
    Mitigation: Validate flow IDs server-side and block traversal sequences before any filesystem access.
  • CVE-2026-84370: SVGO removeScripts bypass
    Impact: Sanitized SVGs can still carry executable links and trigger XSS.
    Affected Systems: npm svgo.
    Immediate Action: Upgrade to the patched release line in use; do not rely on removeScripts alone for hostile SVG.
    Mitigation: Use a dedicated SVG sanitizer and avoid serving user-controlled SVGs in same-origin contexts.
  • CVE-2026-81525: MongoDB PHP library name confusion
    Impact: Untrusted database or collection names may target the wrong database or collection.
    Affected Systems: composer mongodb/mongodb.
    Immediate Action: Upgrade to 1.21.4 or 2.4.1.
    Mitigation: Validate database and collection names before passing them into APIs.
  • CVE-2026-84381: HTTPX2 wss over SOCKS5 sent in plaintext
    Impact: Secrets and WebSocket traffic can be read or modified by a SOCKS proxy path.
    Affected Systems: pip httpcore2, pip httpx2.
    Immediate Action: Upgrade to 2.10.0 or later immediately.
    Mitigation: Do not route wss:// connections through SOCKS5 until patched.
  • CVE-2026-49932: PduParser out-of-bounds read
    Impact: Local privilege escalation.
    Affected Systems: Affected package/component not specified in the provided data.
    Immediate Action: Check vendor updates and patch any product embedding the parser.
    Mitigation: Limit local parsing of untrusted content until fixed.
  • CVE-2026-59172: Joker linter code execution
    Impact: Running joker --lint on an untrusted repo can execute repository-supplied code.
    Affected Systems: go github.com/candid82/joker.
    Immediate Action: Stop auto-linting untrusted repositories and upgrade to 1.8.2.
    Mitigation: Disable project-local .jokerd/linter.* execution.
  • CVE-2026-59176: functype-mcp-server package-alias RCE
    Impact: An MCP tool can install attacker-controlled packages and execute them at import time.
    Affected Systems: npm functype-mcp-server.
    Immediate Action: Disable the tool or isolate the MCP server until patched.
    Mitigation: Validate version input, block alias specifiers, and use --ignore-scripts on installs.
  • CVE-2026-50646: WPF XAML parsing RCE
    Impact: Crafted XAML can execute code in the current user context.
    Affected Systems: Windows desktop runtimes for .NET 8, .NET 9, and .NET 10, including Microsoft.WindowsDesktop.App.Runtime.win-x64, win-x86, and win-arm64.
    Immediate Action: Update to the patched runtime versions immediately and restart affected applications.
    Mitigation: Rebuild and redeploy self-contained apps targeting vulnerable runtimes.
  • CVE-2026-84382: HTTPX2 decompression memory amplification
    Impact: A small compressed response can trigger large transient allocations and crash memory-constrained services.
    Affected Systems: pip httpx2.
    Immediate Action: Upgrade to 2.12.0 or later.
    Mitigation: Add response size limits and avoid fetching untrusted compressed content until patched.
  • CVE-2026-80205: NLTK regex ReDoS
    Impact: Untrusted regex input can pin CPU and deny service.
    Affected Systems: pip nltk.
    Immediate Action: Upgrade to the patched release and stop exposing findall() to user input.
    Mitigation: Enforce regex timeouts or pre-validate patterns.
  • CVE-2026-78677: GitPython clone path escape via separate-git-dir
    Impact: Clone metadata can be written outside the intended destination directory.
    Affected Systems: pip GitPython.
    Immediate Action: Update GitPython and audit any code that forwards clone options from untrusted sources.
    Mitigation: Reject separate_git_dir inputs and keep allow_unsafe_options disabled.
  • CVE-2026-59158: nuxt-ollama API key exposure
    Impact: Cloud Ollama API keys are exposed to any browser client that fetches the page.
    Affected Systems: npm nuxt-ollama.
    Immediate Action: Remove public exposure of the module configuration and rotate any leaked keys.
    Mitigation: Move secrets to private runtime config only.
  • CVE-2026-82333: multer multipart array-index DoS
    Impact: One crafted multipart request can consume CPU and stall the process.
    Affected Systems: npm multer.
    Immediate Action: Upgrade to 2.3.0 and set limits.fieldArrayIndexLimit appropriately.
    Mitigation: Reject oversized or suspicious multipart field names at the edge.
  • CVE-2026-84375: js-yaml merge-key CPU exhaustion
    Impact: A relatively small YAML document can cause prolonged CPU usage despite merge-key limits.
    Affected Systems: npm js-yaml.
    Immediate Action: Upgrade to the patched version and avoid parsing hostile YAML with merge support enabled.
    Mitigation: Pre-filter untrusted YAML and cap parser workload.
  • CVE-2026-77037: multer diskStorage file-descriptor leak
    Impact: Repeated aborted uploads can exhaust file descriptors and disk resources.
    Affected Systems: npm multer.
    Immediate Action: Upgrade to 2.3.0 immediately.
    Mitigation: Rate-limit uploads and monitor open file descriptors on upload workers.
  • CVE-2026-77078: multer uncaught RangeError crash
    Impact: A single multipart request can crash the Node.js process.
    Affected Systems: npm multer.
    Immediate Action: Upgrade to 2.3.0 and restart affected services.
    Mitigation: Put a reverse proxy or WAF in front of upload endpoints until patched.
  • CVE-2026-84374: Laravel Excel arbitrary file overwrite
    Impact: User-controlled export paths can overwrite existing writable files, potentially leading to code execution.
    Affected Systems: composer maatwebsite/excel.
    Immediate Action: Upgrade to 3.1.70 or later now.
    Mitigation: Never pass user input directly into export paths; derive filenames server-side.

🚨 ACTIVELY EXPLOITED

  • CVE-2026-87491 — Chromium V8 zero-day affecting Chrome, Edge, Opera, and other Chromium browsers.
  • CVE-2025-25249 — Fortinet heap overflow affecting FortiOS, FortiSwitchManager, and FortiSASE.
  • CVE-2026-19490 — Citrix NetScaler authentication bypass on AAA virtual server and Gateway deployments.

Previously Alerted

What to Do Now

  1. Patch the actively exploited items first: Chromium browsers, Fortinet, and Citrix NetScaler. These are the highest-risk exposures today.
  2. Update developer and web stacks: GitPython, Next.js, HTTPX2/httpcore2, SVGO, multer, js-yaml, NLTK, and any affected Node/Python packages in CI and production.
  3. Check Windows desktop runtime deployments: Microsoft .NET/WPF and Visual Studio environments should be updated and restarted.
  4. Audit internet-facing appliances and gateways: NetScaler, Fortinet, QUIC-enabled services, and any host-network add-ons or proxy-facing services.
  5. Rotate secrets where exposure is plausible: especially browser-exposed keys, API keys in SSR output, and credentials handled by vulnerable tooling.
  6. Verify versions, not just package presence: confirm patched build numbers in deployed hosts, containers, and developer workstations.

Verification Steps

  • Run inventory checks for browser versions, NetScaler/Fortinet firmware, and Microsoft runtime/package versions.
  • Search codebases and dependency manifests for vulnerable packages listed above.
  • Review logs for unusual requests to gateway, upload, and parsing endpoints.
  • Confirm patched versions after restart; many fixes do not take effect until services reload.

Monitoring Recommendations

  • Watch for exploit patterns against browser-delivered HTML, multipart upload endpoints, YAML parsers, and Git automation jobs.
  • Alert on unexpected hook execution, config rewrites, or repository metadata appearing outside intended clone paths.
  • Increase monitoring on VPN, gateway, and reverse-proxy layers for unauthenticated access attempts.
  • Track package updates and redeploy any container images built before today’s patches.

Related Resources

  • Internal blog post on emergency patch prioritization: to be published
  • Internal guidance on browser and gateway zero-day response: to be published
  • Official vendor advisories: Google Chromium security bulletin, Fortinet PSIRT, Citrix security advisory, Microsoft security update guide, GitPython advisory notes, Next.js release notes, HTTPX2/httpcore2 release notes, SVGO releases, multer release notes, and the .NET security bulletin.

Keep reading