Security Digest: September 17, 2026 - 52 Critical Vulnerabilities

Today’s alert is dominated by active exploitation and several high-risk remote code execution paths in widely deployed infrastructure and developer tools. The immediate priority is to patch internet-facing Cisco systems, then move through exposed GitLab MCP, SQL Server, and LMDeploy deployments before attackers turn these bugs into footholds.

· 29 min read

Executive Summary

Today’s alert is dominated by active exploitation and several high-risk remote code execution paths in widely deployed infrastructure and developer tools. The immediate priority is to patch internet-facing Cisco systems, then move through exposed GitLab MCP, SQL Server, and LMDeploy deployments before attackers turn these bugs into footholds.

What you need to do now: patch the KEV-listed Cisco flaws first, then remediate any affected GitLab MCP, SQL Server, LMDeploy, and authentication components. If you cannot patch immediately, isolate the service, restrict network access, and disable risky features such as unauthenticated transports, dynamic API URL overrides, and default SSE/HTTP listeners.

Critical Vulnerabilities

  • CVE-2026-76460: Cisco ISE web management bypass
    • Impact: Unauthenticated remote attackers can bypass the web management interface and gain unauthorized access.
    • Affected Systems: Cisco Identity Services Engine (ISE) and ISE-PIC.
    • Immediate Action: Treat as emergency. Patch or isolate ISE/Ise-PIC from untrusted networks immediately.
    • Mitigation: Apply Cisco’s fix as soon as available; until then, restrict access to management interfaces to trusted admin networks only.
  • CVE-2026-76461: Cisco Secure Email Gateway command execution
    • Impact: Remote unauthenticated attackers can execute commands as root on the appliance.
    • Affected Systems: Cisco Secure Email Gateway (AsyncOS).
    • Immediate Action: Patch now and verify whether the gateway is exposed to the internet.
    • Mitigation: Apply vendor updates; if patching is delayed, remove public exposure and restrict inbound access to mail flow only.
  • CVE-2026-87886: Acronis plugin privilege escalation
    • Impact: Privilege escalation in backup integrations can lead to full host compromise.
    • Affected Systems: Acronis Backup plugin for cPanel & WHM and Plesk extension.
    • Immediate Action: Update or disable the plugin on all management hosts.
    • Mitigation: Apply the vendor fix; review any accounts that could reach the backup plugin interface.
  • CVE-2025-59953: LMDeploy RPC deserialization RCE
    • Impact: Remote code execution through malicious pickle payloads sent to the RPC server.
    • Affected Systems: pip lmdeploy before 0.10.2.
    • Immediate Action: Upgrade immediately and ensure the RPC service is not bound to a network-reachable interface.
    • Mitigation: Move to 0.10.2 or later; keep the service on localhost and add authentication if RPC must remain enabled.
  • CVE-2026-61560: GitLab MCP unauthenticated file read and token theft
    • Impact: Attackers can steal GitLab PATs and take over the connected GitLab account.
    • Affected Systems: npm @zereight/mcp-gitlab in default SSE Docker deployments.
    • Immediate Action: Disable SSE mode or block network access to the MCP port immediately.
    • Mitigation: Upgrade when a fix is available; until then, do not expose the service beyond trusted localhost use.
  • CVE-2026-61559: GitLab MCP SSRF via X-GitLab-API-URL
    • Impact: Victim GitLab tokens can be forwarded to attacker-controlled hosts.
    • Affected Systems: npm @zereight/mcp-gitlab with ENABLE_DYNAMIC_API_URL=true.
    • Immediate Action: Turn off dynamic API URL handling now.
    • Mitigation: Enforce a strict allowlist of trusted GitLab hostnames or disable the feature entirely.
  • CVE-2026-61568: GitLab MCP DNS rebinding to local listener
    • Impact: Malicious web pages can reach local MCP listeners and invoke tools through browser requests.
    • Affected Systems: npm @zereight/mcp-gitlab.
    • Immediate Action: Enforce Host/Origin checks before any browser-accessible deployment.
    • Mitigation: Enable DNS rebinding protection and reject unexpected Host/Origin headers.
  • CVE-2026-67631: SQL Server heap overflow
    • Impact: Unauthorized remote code execution over the network.
    • Affected Systems: Microsoft SQL Server 2017/2019/2022/2025.
    • Immediate Action: Patch all SQL Server instances now.
    • Mitigation: Apply Microsoft’s security update and restrict direct network exposure where possible.
  • CVE-2026-67643: SQL Server heap overflow variant
    • Impact: Unauthorized remote code execution over the network.
    • Affected Systems: Microsoft SQL Server 2022/2025.
    • Immediate Action: Prioritize any 2022/2025 deployments.
    • Mitigation: Apply the vendor patch immediately.
  • CVE-2026-63472: Vendure external-auth account takeover
    • Impact: Attackers can bind an unverified external login to a victim account.
    • Affected Systems: npm @vendure/core deployments using external/social auth.
    • Immediate Action: Upgrade and review all custom authentication strategies.
    • Mitigation: Move to 3.7.0 and ensure only provider-verified emails can link to existing accounts.
  • CVE-2026-75513: Marten SQL injection via dictionary keys
    • Impact: SQL injection can bypass tenant boundaries and expose or alter data.
    • Affected Systems: NuGet Marten.
    • Immediate Action: Patch immediately and review any code that filters on attacker-controlled dictionary keys.
    • Mitigation: Upgrade to the fixed release; avoid passing untrusted values into the affected LINQ paths.
  • CVE-2026-61594: djust WebSocket auth bypass
    • Impact: WebSocket transport can bypass standard Django authorization and expose admin actions.
    • Affected Systems: pip djust.
    • Immediate Action: Upgrade to the patched release and audit any WebSocket-mounted views.
    • Mitigation: Use djust-native auth gates; do not rely on HTTP-only Django mixins.
  • CVE-2026-67636: SQL Server out-of-bounds read
    • Impact: Remote attackers can trigger code execution over the network.
    • Affected Systems: Microsoft SQL Server 2019/2022/2025.
    • Immediate Action: Patch all affected SQL Server builds.
    • Mitigation: Apply Microsoft’s update and reduce external exposure.
  • CVE-2026-67378: SQL Server untrusted pointer dereference
    • Impact: Remote code execution over the network.
    • Affected Systems: Microsoft SQL Server 2019/2022/2025.
    • Immediate Action: Patch immediately.
    • Mitigation: Install the vendor fix without delay.
  • CVE-2026-85731: oras-go tar-slip path traversal
    • Impact: Remote attackers can overwrite files outside the intended extraction directory.
    • Affected Systems: Go oras.land/oras-go/v2 up to v2.6.1.
    • Immediate Action: Stop pulling untrusted OCI artifacts into file stores until updated.
    • Mitigation: Upgrade to a patched version and re-check any code that unpacks layers automatically.
  • CVE-2026-65608: Grav Flex arbitrary command execution
    • Impact: Authenticated users with limited Flex permissions can run shell commands on the server.
    • Affected Systems: Composer getgrav/grav with Flex directories.
    • Immediate Action: Patch and review any blueprint fields using data-*@: directives.
    • Mitigation: Upgrade to the fixed release; remove or restrict dangerous dynamic field handlers.
  • CVE-2026-63506: TinaCMS auth bypass via clientID confusion
    • Impact: Attackers can authorize themselves against a victim site using their own TinaCloud app.
    • Affected Systems: npm @tinacms/auth, next-tinacms-azure.
    • Immediate Action: Patch and verify no request-driven client IDs are used for auth decisions.
    • Mitigation: Bind auth checks to the site’s configured app ID, not user input.
  • CVE-2026-63459: Vendure dashboard stored XSS
    • Impact: Admin-facing description fields can execute attacker JavaScript in another admin’s browser.
    • Affected Systems: npm @vendure/dashboard.
    • Immediate Action: Sanitize or remove rich HTML from descriptions immediately.
    • Mitigation: Upgrade and replace live innerHTML parsing with inert parsing or a sanitizer.
  • CVE-2026-69205: Ember HTTP request smuggling
    • Impact: Attackers can desynchronize proxies and backend parsing to bypass controls or poison caches.
    • Affected Systems: http4s Ember HTTP/1.1 components.
    • Immediate Action: Patch and review any Ember origin behind a proxy.
    • Mitigation: Upgrade and ensure intermediaries normalize transfer encoding.
  • CVE-2026-73247: Kestra SSRF via Pebble http()
    • Impact: Unauthenticated attackers can reach internal services and cloud metadata endpoints.
    • Affected Systems: Kestra OSS core.
    • Immediate Action: Restrict Flow import and execution endpoints now.
    • Mitigation: Upgrade and block internal IPs, localhost, and metadata addresses.
  • CVE-2026-76825: RestrictedPython sandbox escape
    • Impact: Exposed string.Formatter can break out of the sandbox.
    • Affected Systems: pip RestrictedPython.
    • Immediate Action: Remove string / string.Formatter from restricted globals.
    • Mitigation: Upgrade and keep the standard library formatter out of untrusted code.
  • CVE-2026-86039: libp2p peer-record address hijack
    • Impact: Attackers can poison certified addresses for third-party peers.
    • Affected Systems: npm @libp2p/peer-store.
    • Immediate Action: Patch and validate any code that consumes certified peer records.
    • Mitigation: Upgrade and verify signer peer ID matches the payload peer ID.
  • CVE-2026-63127: rmcp OAuth token theft via resource metadata
    • Impact: OAuth access tokens can be redirected to a malicious MCP server.
    • Affected Systems: Rust rmcp.
    • Immediate Action: Patch any MCP clients using OAuth resource discovery.
    • Mitigation: Validate the resource field against the expected server URL.
  • CVE-2026-61593: djust SSE CSRF
    • Impact: Cross-origin pages can drive victim-authenticated SSE sessions and trigger state-changing handlers.
    • Affected Systems: pip djust.
    • Immediate Action: Disable SSE transport or upgrade immediately.
    • Mitigation: Enforce Origin checks and require JSON POST bodies.
  • CVE-2026-61591: djust snapshot state injection
    • Impact: Attackers can tamper with unsigned state snapshots and inject arbitrary view state.
    • Affected Systems: pip djust.
    • Immediate Action: Upgrade and disable state snapshots if you cannot patch right away.
    • Mitigation: Sign snapshots and reject forged reconnect state.
  • CVE-2026-56668: ZITADEL token exchange abuse
    • Impact: Low-privilege tokens can be exchanged for elevated tokens at other applications.
    • Affected Systems: GitHub zitadel/zitadel.
    • Immediate Action: Upgrade and disable token exchange if possible.
    • Mitigation: Enforce strict audience and scope checks.
  • CVE-2026-69088: Grav static method call bypass
    • Impact: Page editors can invoke arbitrary public static methods and read or write files.
    • Affected Systems: Composer getgrav/grav.
    • Immediate Action: Audit all pages using data-*@: directives and patch immediately.
    • Mitigation: Extend the dynamic-call safety checks to cover qualified static calls.
  • CVE-2026-63671: @nuxtjs/mdc XSS bypass
    • Impact: Sanitizer bypass can execute scripts through SVG and iframe vectors.
    • Affected Systems: npm @nuxtjs/mdc.
    • Immediate Action: Treat rendered markdown as untrusted until patched.
    • Mitigation: Upgrade and block xlink:href and dangerous data: iframe sources.
  • CVE-2026-61595: djust tenant isolation failure
    • Impact: WebSocket/SSE paths can disclose all tenant rows.
    • Affected Systems: pip djust.
    • Immediate Action: Upgrade immediately; there is no reliable workaround on the live path.
    • Mitigation: Move tenant state to context-local storage and fail closed.
  • CVE-2026-75831: Grav audio/video XSS
    • Impact: Crafted media fragments can inject script into rendered pages.
    • Affected Systems: Composer getgrav/grav.
    • Immediate Action: Remove or sanitize user-supplied media fragments.
    • Mitigation: Escape the generated <source> HTML and encode fragments.
  • CVE-2026-85721: async-http-client decompression bomb
    • Impact: A small compressed response can exhaust client memory.
    • Affected Systems: Maven org.asynchttpclient:async-http-client.
    • Immediate Action: Disable automatic decompression or upgrade.
    • Mitigation: Cap decompressed output and move to a fixed release.
  • CVE-2026-69203: Ember HTTP/2 stream exhaustion
    • Impact: A single connection can create unbounded concurrent streams and exhaust heap.
    • Affected Systems: http4s Ember HTTP/2 servers and clients.
    • Immediate Action: Disable HTTP/2 if you can.
    • Mitigation: Upgrade and enforce stream limits.
  • CVE-2026-69213: Ember HTTP/2 write queue OOM
    • Impact: A stalled write side can accumulate unlimited outbound frames.
    • Affected Systems: http4s Ember HTTP/2 components.
    • Immediate Action: Turn off HTTP/2 where possible.
    • Mitigation: Apply the vendor fix and monitor queue growth.
  • CVE-2026-61554: emp3r0r pre-auth HTTP polling abuse
    • Impact: Unauthenticated attackers can create polling sessions and drive C2 processing.
    • Affected Systems: Go github.com/jm33-m0/emp3r0r/core.
    • Immediate Action: Restrict the C2 HTTP polling endpoint immediately.
    • Mitigation: Require authentication before session creation.
  • CVE-2026-69202: Ember HTTP/2 unbounded inbound buffering
    • Impact: A hostile peer can stream data faster than the application drains it and exhaust memory.
    • Affected Systems: http4s Ember HTTP/2 components.
    • Immediate Action: Disable HTTP/2 or add strict body limits.
    • Mitigation: Upgrade and enforce entity limits.
  • CVE-2026-69208: DigestAuth nonce leak
    • Impact: Fresh nonces are evicted incorrectly, allowing gradual heap exhaustion.
    • Affected Systems: http4s Ember server DigestAuth middleware.
    • Immediate Action: Rate-limit and restart until patched.
    • Mitigation: Upgrade to the fixed release.
  • CVE-2026-88975: Ember HTTP/2 frame-size memory blowup
    • Impact: A single oversized frame can consume up to 16 MiB per connection.
    • Affected Systems: http4s Ember HTTP/2 components.
    • Immediate Action: Leave HTTP/2 off or terminate it upstream.
    • Mitigation: Patch and enforce frame-size handling.
  • CVE-2026-69218: Ember HTTP/2 header block exhaustion
    • Impact: Incomplete header blocks can grow without bound and exhaust memory.
    • Affected Systems: http4s Ember HTTP/2 components.
    • Immediate Action: Disable HTTP/2 until upgraded.
    • Mitigation: Apply the fix that caps header-block size.
  • CVE-2026-63128: rmcp session leak DoS
    • Impact: Non-initialize requests can leak sessions permanently and exhaust memory.
    • Affected Systems: Rust rmcp Streamable HTTP server.
    • Immediate Action: Patch and watch for rising session counts.
    • Mitigation: Validate before allocating or add RAII cleanup.
  • CVE-2026-63460: Vendure SQLite regex DoS
    • Impact: A crafted regex can block the Node.js event loop and freeze the storefront.
    • Affected Systems: npm vendure/core on SQLite drivers.
    • Immediate Action: Restrict public product search until patched.
    • Mitigation: Upgrade and add regex length/safety checks.
  • CVE-2026-63126: Wire protobuf decode crash
    • Impact: Malformed protobuf input can trigger unchecked exceptions or traps.
    • Affected Systems: Maven com.squareup.wire:wire-runtime.
    • Immediate Action: Patch and treat decode errors as malformed input, not crashes.
    • Mitigation: Upgrade to the fixed release and cap untrusted message sizes.
  • CVE-2026-85756: SSH.NET SCP remote command execution
    • Impact: Attacker-influenced remote paths can execute as the SSH user on shell-based servers.
    • Affected Systems: NuGet SSH.NET.
    • Immediate Action: Stop passing untrusted remote paths to SCP.
    • Mitigation: Upgrade and use an explicit remote path transformation.
  • CVE-2026-68537: fulgur PDF page explosion
    • Impact: Tiny HTML/CSS payloads can generate thousands of blank pages and exhaust resources.
    • Affected Systems: Rust fulgur.
    • Immediate Action: Limit untrusted HTML/CSS immediately.
    • Mitigation: Upgrade to 0.26.0 or later.
  • CVE-2026-85715: ExifReader HEIC/AVIF heap exhaustion
    • Impact: Crafted image files can crash Node.js with out-of-memory errors.
    • Affected Systems: npm exifreader 4.41.0.
    • Immediate Action: Block untrusted HEIC/AVIF processing until patched.
    • Mitigation: Upgrade and cap extent parsing.
  • CVE-2026-86038: libp2p gossipsub RSA author spoofing
    • Impact: Attackers can forge signed pubsub messages as a victim RSA peer.
    • Affected Systems: npm @libp2p/gossipsub.
    • Immediate Action: Patch and do not trust message.from blindly.
    • Mitigation: Verify the claimed peer ID matches the supplied public key.
  • CVE-2026-68523: fulgur unbounded pagination DoS
    • Impact: Huge CSS heights can force massive page allocation and infinite loops.
    • Affected Systems: Rust fulgur.
    • Immediate Action: Constrain attacker-controlled CSS now.
    • Mitigation: Upgrade to 0.19.0 or later.
  • CVE-2026-86043: Skipper OPA mitigation bypass
    • Impact: Chunked oversized bodies can bypass the published truncated_body defense and reach upstream services.
    • Affected Systems: Go github.com/zalando/skipper.
    • Immediate Action: Do not rely on truncated_body alone for body-based authorization.
    • Mitigation: Update the proxy and treat oversized bodies as truncated regardless of transfer encoding.
  • CVE-2026-61592: djust SSE session hijack
    • Impact: A leaked session_id can let an attacker act as the victim.
    • Affected Systems: pip djust.
    • Immediate Action: Disable SSE transport until patched.
    • Mitigation: Bind sessions to the owning principal and reject cross-principal access.
  • CVE-2026-61590: djust observability endpoint exposure
    • Impact: Remote clients can read live state and invoke handlers if middleware is missing.
    • Affected Systems: pip djust.
    • Immediate Action: Confirm production endpoints are not exposed and upgrade.
    • Mitigation: Enforce localhost checks in the view itself.
  • CVE-2026-61596: djust object-level access bypass
    • Impact: Authenticated users can access objects they should not see via GET, SPA navigation, or embeds.
    • Affected Systems: pip djust.
    • Immediate Action: Patch and review object-scoped views.
    • Mitigation: Route all render paths through a shared permission check.
  • CVE-2026-68904: node-opcua socket leak on reconnect
    • Impact: Reconnection loops can accumulate FIN-WAIT-2 sockets and exhaust resources.
    • Affected Systems: npm node-opcua-transport, node-opcua-client, node-opcua.
    • Immediate Action: Patch and watch for repeated reconnects, especially with clock skew.
    • Mitigation: Replace socket.end() with destroy() in the transport path and fix keepalive handling.
  • CVE-2026-81192: OpenTelemetry.Resources.Host PATH hijack on macOS
    • Impact: A local attacker can execute arbitrary code by hijacking ioreg through PATH.
    • Affected Systems: NuGet OpenTelemetry.Resources.Host on macOS.
    • Immediate Action: Patch macOS hosts and inspect service environments for unsafe PATH entries.
    • Mitigation: Use the fixed release that calls ioreg by absolute path.

🚨 ACTIVELY EXPLOITED

  • CVE-2026-76460 — Cisco ISE / ISE-PIC web management bypass. Patch or isolate now.
  • CVE-2026-76461 — Cisco Secure Email Gateway root command execution. Patch or remove internet exposure now.
  • CVE-2026-87886 — Acronis backup plugin privilege escalation. Update or disable immediately.

Previously Alerted

What to Do Now

  1. Patch all KEV-listed Cisco systems first, then move to exposed SQL Server, GitLab MCP, LMDeploy, and authentication products.
  2. Disable or isolate risky network listeners right away: MCP SSE/Streamable HTTP, public RPC servers, unauthenticated polling endpoints, and any service with dynamic header-driven backend URLs.
  3. Verify versions and exposure across your fleet, especially Docker defaults, localhost-bound developer tools, and services that process untrusted files or markdown.
  4. Assume token theft is possible for the GitLab MCP and TinaCMS issues; rotate secrets if those services were reachable.
  5. Review admin-facing content fields for stored XSS and auth-bypass primitives in Vendure, Grav, and djust deployments.

Verification steps: inventory by package name and version, confirm whether the affected feature is enabled, and check whether the service is reachable from anything beyond loopback or a trusted admin subnet. For Docker deployments, assume default ports are exposed unless you explicitly changed them.

Monitoring recommendations: watch for unusual auth failures, repeated reconnect loops, rising session counts, unexpected outbound requests to attacker-controlled hosts, and sudden changes in SQL Server, GitLab, or MCP logs. If you see signs of exploitation, rotate credentials and tokens immediately.

Related Resources

  • Internal follow-up analysis: planned for the September 17, 2026 threat round-up.
  • Official vendor advisories: Cisco, Microsoft, GitLab, Vendure, Grav, ZITADEL, and other upstream security notices referenced in each CVE entry.

Keep reading