Developing Story ●

Status: In progress. This post was last updated on October 23rd 2026 at 11:15 UTC. We will update it as new information becomes available.

PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell by researchers. Every supported PHP installation should be updated immediately. According to PHP, both flaws can allow unauthenticated remote code execution, and the PHP security team rates both at CVSS v4.0 9.2. The fixed releases, published on October 21, 2026, are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have reached end of life and no longer receive official updates, although PHP’s security team has published minimal source backports for PHP 7.4, 8.0 and 8.1. Exploitation attempts have already started: Amazon reports attempts against its honeypots since October 17, four days before disclosure, and public proofs of concept are circulating. Neither CVE is listed in CISA’s KEV catalog as of October 22, 2026. A previous critical PHP flaw, CVE-2024-4577, drew exploit attempts within a day; this time they came before the fix.

Updating the supported branches is the easy part. The harder part is finding every PHP installation in your network, including the ones you can’t see from the outside and the ones the PHP project no longer updates. CERT-EU and Germany’s BSI have issued advisories for both vulnerabilities [1][2].

Scan for PHP2Shell now, no cost, 14 days →

What PHP2Shell Means for End-of-Life PHP

PHP currently supports four branches: 8.2 and 8.3 receive security fixes only, while 8.4 and 8.5 are in active support. Security support for PHP 8.2 ends on December 31, 2026. Every older branch is end of life: PHP 8.1 since December 31, 2025, PHP 8.0 since November 26, 2023, PHP 7.4 since November 28, 2022, and PHP 5.6 since December 31, 2018. PHP’s advisories list every version below 8.2.35 as affected [3][4]. For end-of-life branches, PHP points to distributions and LTS vendors that provide backported fixes, and its security team has published minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1 for people who build from source. Older branches such as PHP 5.6 get neither. Before you can fix these systems, you have to know where they run.

There is a lot of old PHP on the internet. According to Mallory’s count of Shodan banners on October 20, 2026, around 884,000 internet-facing hosts advertise an end-of-life PHP version, 59% of the roughly 1.5 million hosts that show a version at all. Another 740,000 or so don’t reveal their version. These are banner counts, not confirmed vulnerable systems.

A hidden version banner doesn’t mean there’s no PHP behind it. PHP also runs inside control panels such as cPanel and Plesk, content management systems and vendor software, where it’s updated on someone else’s schedule, or not at all.

A Risk Assessment of PHP2Shell

Information about both vulnerabilities leaked before the planned coordinated disclosure [5]. Amazon, which saw a first attempt on October 17, and watchTowr report exploitation attempts against both vulnerabilities. New Zealand’s NCSC says it is aware of reports of active exploitation. As of October 22, 2026, neither CVE is in CISA’s KEV catalog, and BSI has not confirmed exploitation. The flaws are exploitable in practice, though: PHP’s advisory states that unauthenticated remote code execution was validated over HTTP against mod_php with default input and memory limits.

Attackers have moved quickly on PHP flaws before. When the critical PHP flaw CVE-2024-4577 went public in June 2024, Akamai saw the first exploit attempts against its honeypots within a day.

The Technical Details for CVE-2026-109618 and CVE-2026-109619 in PHP

PHP considers all PHP installations serving web requests at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. Both advisories list use-after-free [CWE-416] among the weaknesses, and the ChangeLog records both under a single fix in PHP’s core (“Avoid state corruption via bailout”).

The two CVEs fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, each shown with its CVSS severity band and EPSS exploitation-probability score

CVE-2026-109618

CVSS 9.2 · Critical EPSS 5.3% (93rd)

RCE via OOM corruption (GHSA-w8hw-w9fx-j79w): when PHP runs out of memory while internal request data is only partially initialized, request cleanup can treat the invalid data as valid.

CVE-2026-109619

CVSS 9.2 · Critical EPSS 5.8% (93rd)

RCE via stale global state (GHSA-6wmf-4rv5-p3rp): internal state owned by one request can survive in a persistent worker after its memory has been freed, and a later request handled by the same worker can use it.

PHP’s advisories have the full technical details [6][7].

Affected Versions and Mitigation for CVE-2026-109618 and CVE-2026-109619 in PHP

Update every supported PHP installation to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you run an end-of-life branch, upgrade to a supported one. Since security support for PHP 8.2 ends on December 31, 2026, PHP 8.4 or 8.5 is the better target. If you can’t upgrade yet, check whether your distribution or LTS vendor provides a backported fix, or build from PHP’s source backports for 7.4, 8.0 and 8.1.

If you can’t update immediately, PHP lists configuration changes that reduce exposure to specific attack paths, for example enforcing memory_limit=-1 against CVE-2026-109618 and setting session.upload_progress.enabled=0 against CVE-2026-109619. PHP is clear that these measures do not make an installation safe and that updating is the only complete fix. CERT-EU additionally recommends isolating internet-facing applications from public networks until the fix is applied. CISA goes further: organizations that cannot update immediately, or that still run PHP 8.1 or older, should take PHP-based systems offline until they are patched or upgraded.

Linux distributions sometimes backport fixes to their own PHP packages without changing the version number. PHP says distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. Debian, Red Hat and Ubuntu have already published fixed packages, including for branches PHP no longer supports, such as PHP 7.4 and 8.0 on Red Hat Enterprise Linux 8 and 9 [8][9][10][11]. For PHP bundled with control panels, content management systems or appliances, check with the respective vendor. The Dutch NCSC keeps a list of products that include PHP and may be affected, which it is still expanding. Several vendors have already responded: cPanel has fixed its PHP packages, including backports for PHP 7.4, 8.0 and 8.1, and Plesk has published fixed PHP builds and an update for its own management interface. Palo Alto Networks lists all PAN-OS and Panorama versions as affected and has not released fixed versions yet; until then, it advises restricting access to the management interface to trusted internal IP addresses. Web applications such as WordPress, Drupal and Nextcloud run on the PHP installed beneath them, so updating that PHP fixes them.

PHP branch	Status	Fixed version	Notes
8.5	Active support until December 31, 2027	8.5.12
8.4	Active support until December 31, 2026	8.4.27
8.3	Security fixes only until December 31, 2027	8.3.36
8.2	Security fixes only until December 31, 2026	8.2.35	Upgrade to 8.4 or 8.5 recommended
8.1 and older	End of life	No official release	Listed as affected. Minimal source backports for 7.4, 8.0 and 8.1; check your distribution or LTS vendor for backported packages

How to Find Vulnerable PHP Installations With Greenbone

1. Run an authenticated remote scan, i.e. with credentials stored for the target. An unauthenticated scan reads remote information such as banners, which do not always allow conclusions about the version. Important for unauthenticated scans: set the QoD (Quality of Detection) to 0 in the results filter so that all vulnerabilities found are displayed.
2. For Linux systems, use the “Full and fast” scan config unchanged. It covers PHP2Shell there completely, and no additional scan config is needed.
3. For Windows systems, enable portable app detection before scanning.
   • Clone the “Full and fast” scan config and search for “Options for Local Security Checks” in the search bar.
   • Set “Enable Detection of Portable Apps on Windows” to “yes” and save.
4. Make sure the feed is current. A manual feed update gets you the PHP2Shell checks immediately, otherwise they arrive with the nightly update.

The checks for CVE-2026-109618 and CVE-2026-109619 work in unauthenticated and authenticated scans, but the two see different things. An unauthenticated scan only sees what a server chooses to reveal. If a host hides its PHP version, the scan can’t tell which version it runs, and the result is only as reliable as the version information the server sends. An authenticated scan logs in and looks at the installed software, so it finds PHP on every host you scan with credentials, whether or not it advertises a version. For a deeper search on Windows hosts, enable portable app detection before scanning: edit your scan config (for example a copy of Full and fast), scroll down to Network Vulnerability Test Preferences, find Options for Local Security Checks, set Enable Detection of Portable Apps on Windows to yes, and save. Authenticated scans take longer and put more load on the scanned systems, so plan the scope and timing of the scan accordingly.

Summary

CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. PHP has fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while end-of-life branches depend on backports. Exploitation attempts began before the fixes were published, and public proofs of concept are circulating. Defenders should update now and make sure to catch every PHP installation: end-of-life versions, hosts that hide their version, and PHP bundled with other software.

Updates

1. October 21, 2026: First published.
2. October 22, 2026: Added exploitation attempts reported by Amazon and watchTowr, public proofs of concept, fixed packages from Debian, Red Hat and Ubuntu, vendor responses from cPanel, Plesk and Palo Alto Networks, and CISA’s guidance for unsupported PHP versions. Greenbone’s feed now includes package-level checks for ten Linux distributions.
3. October 23, 2026: Added a step-by-step guide to detecting PHP2Shell with Greenbone and the EPSS values. Removed the mention of agent-based scans.

 

CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th pctl) is a critical-severity arbitrary file access vulnerability [CWE-552] affecting Atlassian Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. All unpatched versions of the affected products are vulnerable. The file access vulnerability can be further leveraged for admin account takeover under certain conditions when Crowd SSO is in use. CVE-2026-21589 is considered actively exploited [1][2][3][4], but has not been added to CISA’s KEV list as of October 13th, 2026.

A detailed technical analysis of the full attack chain, including Jira admin account takeover, is available. Proof-of-concept (PoC) exploits for the unauthorized file read [5][6][7][8] and full account-takeover chain [9] are also publicly available. Multiple national CERT agencies have issued alerts for the flaw [10][11][12][13][14][15][16][17][18][19][20].

A Risk Assessment of CVE-2026-21589 in Atlassian Data Center Products

Atlassian Data Center products are self-hosted enterprise platforms used for project tracking, documentation, build automation, identity management, code review, and more. That makes CVE-2026-21589 a high risk across a broad set of business-critical workflows. Furthermore, Atlassian products have historically been leveraged by ransomware gangs and Advanced Persistent Threat (APT) groups. Atlassian products are listed 13 times on CISA’s KEV list; 8 instances have been flagged for ransomware activity.

CVE-2026-21589 allows unauthenticated attackers to access files within the web application root directory, and when Crowd SSO is in use, attackers may also be able to create accounts and assign administrative privileges. The full attack chain can result in unauthorized admin access. The vulnerability’s actively exploited status and the availability of detailed technical information and PoC exploits further increase the risk.

Technical Details for CVE-2026-21589 in Atlassian Data Center Products

CVSS 9.3 · CriticalEPSS 1.8% (78th)Actively exploitedPublic PoC

CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th pctl) allows unauthenticated attackers to access files [CWE-552] within the web application root directory if the exact file name and path are already known. Exploitation requires prior knowledge of the exact target file name and path. CVE-2026-21589 does not allow attackers to enumerate or list directory contents. When Crowd SSO is in use and has sufficient permissions to create users and modify group memberships, attackers can create accounts and achieve admin takeover.

The vulnerability originates in the shared Atlassian Web Resource Plugin, specifically its handling of resource paths in the atlassian-plugins-webresource library. The Router.unescapeSlashes() function converts double-colon (::) sequences into forward slashes (/), allowing attackers to construct directory traversal payloads that bypass path restrictions. By submitting malicious HTTP requests to web resource endpoints, an unauthenticated attacker can exploit the resource-serving functionality to read otherwise inaccessible files within the application’s webroot directory tree. This includes sensitive configuration files under the WEB-INF directory.

Jira installations integrated with Atlassian Crowd may expose the WEB-INF/classes/crowd.properties configuration file, which contains the Crowd application name, plaintext application password, and Crowd server URL. If an attacker can obtain these credentials and has access to the Crowd server, they can authenticate to its REST API, enumerate existing users, create new accounts, and modify group memberships.

watchTowr Labs researchers created a new Crowd user and added it to the jira-administrators group, achieving Jira administrator privileges. This exploitation scenario depends on Crowd integration, exposed credentials, and network accessibility to the Crowd service. Highly restrictive Crowd IP allowlists can limit exploitability.

Affected Products and Mitigation for CVE-2026-21589 in Atlassian Data Center Products

CVE-2026-21589 affects Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. All versions prior to the fixed versions are affected. Users should urgently update affected instances within their IT environment, giving priority to those that are internet-accessible.

Atlassian has provided web application firewall (WAF) rules to mitigate the vulnerability across all affected products, along with Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd. For Bitbucket, Atlassian has provided a rule that can be added to urlrewrite.xml. The vendor-provided workarounds are temporary mitigations only.

The fixed versions are shown below:

Product	Fixed versions
Jira Service Management Data Center	5.12.40 10.3.26 11.3.12
Jira Software Data Center	9.12.40 10.3.26 11.3.12
Confluence Data Center	9.2.26 10.2.19
Bitbucket Data Center	9.4.26 10.2.8 10.5.1
Bamboo Data Center	10.2.24 12.1.12
Crowd Data Center	6.3.7 7.0.3 7.1.7 7.2.4
Crucible	4.9.15
Fisheye	4.9.15

Summary

CVE-2026-21589 is a critical-severity, actively exploited, unauthenticated arbitrary file read vulnerability affecting all unpatched versions across multiple Atlassian Data Center products. The flaw allows access to specific files in the web application root directory when an attacker already knows the exact file path and name. Attackers may also leverage CVE-2026-21589 to gain administrator privileges when Crowd SSO is in use. Users should immediately restrict access to internet-facing instances and urgently update to a patched version.

 

Widespread, unchecked accumulation of security debt in enterprise IT is emerging at an accelerated pace. While the numbers are staggering, defenders need to realize that regular scanning, orderly prioritization, and timely patching are still the most fundamental way to prevent attackers from exploiting software flaws for impact. For prudent defenders applying well-orchestrated security programs, vulnerability management is still sustainable. On the other hand, some will need to improve their VM maturity to prevent an unmitigated exposure from turning catastrophic.

Here is a summary of high-risk issues for enterprise IT that emerged in September 2026.

CVE-2026-86218: Another Actively Exploited Unauthenticated RCE Flaw in N-able N-central

CVSS 9.8 · CriticalEPSS 12.9% (96th)Actively exploitedIn CISA KEVPublic PoC

CVE-2026-86218 (CVSS 9.8, EPSS ≥ 96th pctl) is a critical unauthenticated remote code execution (RCE) flaw in N-able N-central before version 2026.3.1.14. The root cause is improper neutralization of directives in statically saved code [CWE-96]. CVE-2026-86218 has been added to CISA’s KEV list. A detailed technical analysis [1], Metasploit module [2], and at least one additional proof-of-concept exploit [3] are available, further increasing the risk of ongoing attacks.

N-central vulnerabilities also appeared on CISA’s KEV list twice last month, and were alerted twice on the Greenbone blog in 2025 [4][5]. Risk is elevated because N-central is a remote administration platform used by internal IT teams and in Managed Service Provider (MSP) environments. Compromise of an N-central server creates a threat across managed customer environments.

The vendor has published fixes for CVE-2026-86218 via 2026.3 HF4 build 2026.3.1.14. Users should verify their installed patch level, since 2026.3 HF3 was issued only days before in response to CVE-2026-86206 and CVE-2026-86207. CVE-2026-86206 is considered to be exploited in the wild. Previdian reports exploitation of CVE-2026-86207 against its sensors, and a detailed technical analysis is available. The OPENVAS ENTERPRISE FEED includes a remote banner check for CVE-2026-86218, and a separate remote banner check and active check covering CVE-2026-86206 and CVE-2026-86207.

Living on the Edge: Emerging Risk to Perimeter Network Devices

According to the latest Verizon DBIR 2026 report, exploiting publicly exposed software vulnerabilities is now the most common vector for initial access globally. Greenbone’s OPENVAS SCAN excels at detecting perimeter vulnerabilities, via both network-based scans and host-based authenticated scans. Greenbone’s detection is industry-leading when paired with the OPENVAS ENTERPRISE FEED. Here are some of the most critical emerging threats to perimeter devices in September 2026.

Three Citrix NetScaler ADC and Gateway Flaws Actively Exploited

Three CVEs affecting Citrix NetScaler ADC and NetScaler Gateway were added to CISA’s KEV list in September [1][2][3]. CVE-2026-88771 (CVSS 9.8) and CVE-2026-88772 (CVSS 8.1) were published in late September; CVE-2026-19490 (CVSS 9.8) is from August 2026. Several detailed technical write-ups addressing one or more of the CVEs [4][5][6][7][8], as well as PoC exploits [9][10][11] are publicly available.

The three Citrix NetScaler ADC and Gateway CVEs added to CISA’s KEV list in September, each shown with its CVSS severity band and EPSS exploitation-probability score

CVE-2026-88771

CVSS 9.8 · Critical EPSS 1.1% (63rd)

An improper input validation flaw [CWE-20] allows unauthenticated, arbitrary RCE. All NetScaler ADC and NetScaler Gateway deployments are vulnerable in the default configuration.

CVE-2026-19490

CVSS 9.8 · Critical EPSS 8.0% (95th)

An authentication bypass using an alternate path [CWE-288] allows a remote, unauthenticated attacker to target appliances. Exploitability requires the appliance to be configured as a Gateway or AAA virtual server, and for certain later affected builds, a SAML action must also be configured. The practical impact depends on configuration: an attacker may be able to trigger DoS conditions or, on a vulnerable Gateway, potentially obtain an anonymous authenticated VPN session with access to an organization’s internal network.

CVE-2026-88772

CVSS 8.1 · High EPSS 1.3% (69th)

A memory overflow flaw [CWE-119] that allows RCE or triggering denial of service (DoS) conditions. Exploitability depends on DTLS being enabled, which is enabled by default on VPN vServer deployments.

Affected versions are shown below:

CVE	Affected versions	Fixed versions
CVE-2026-88771	– NetScaler ADC and Gateway 14.1 before 14.1-73.37 – NetScaler ADC and Gateway 13.1 before 13.1-64.23 – NetScaler ADC FIPS before 14.1-73.37 – NetScaler ADC FIPS and NDcPP before 13.1-37.279	– NetScaler ADC and Gateway 14.1-73.37 and later – NetScaler ADC and Gateway 13.1-64.23 and later – NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later – NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later
CVE-2026-19490	– NetScaler ADC and Gateway 14.1 before 14.1-73.32 – NetScaler ADC and Gateway 13.1 before 13.1-63.21 – NetScaler ADC FIPS before 14.1-73.32 – NetScaler ADC FIPS and NDcPP before 13.1-37.277	– NetScaler ADC and Gateway 14.1-73.32 and later – NetScaler ADC and Gateway 13.1-63.21 and later – NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS and later – NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.277 and later
CVE-2026-88772	– NetScaler ADC and Gateway 14.1 before 14.1-73.37 – NetScaler ADC and Gateway 13.1 before 13.1-64.23 – NetScaler ADC FIPS before 14.1-73.37 – NetScaler ADC FIPS and NDcPP before 13.1-37.279	– NetScaler ADC and Gateway 14.1-73.37 and later – NetScaler ADC and Gateway 13.1-64.23 and later – NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later – NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later

No workarounds have been provided by the vendor. Affected users should update systems to the most relevant fixed build as described above. Immediately after the flaws were disclosed, the OPENVAS ENTERPRISE FEED added a remote banner version check for CVE-2026-88771 and CVE-2026-88772, and a separate remote banner check and active check for CVE-2026-19490.

Two New SonicWall SMA1000 Flaws Added to CISA’s KEV List

SonicWall has confirmed that two new SMA1000 vulnerabilities, described below, are being actively exploited in the wild [1][2].

The two SonicWall SMA1000 CVEs added to CISA’s KEV list, each shown with its CVSS severity band and EPSS exploitation-probability score

CVE-2026-83548

CVSS 10 · Critical EPSS 8.8% (95th)

A pre-authentication SSRF flaw [CWE-918] in the Appliance Work Place interface caused by an unintended alternate access path. A remote, unauthenticated attacker could gain unauthorized access to sensitive functionality and perform unauthorized operations.

CVE-2026-83549

CVSS 7.8 · High EPSS 10.8% (96th)

An OS command injection flaw [CWE-78] in the Appliance Management Console (AMC) allows a remote authenticated attacker with admin credentials to execute arbitrary OS commands on an affected device.

Exploitation of the two flaws can be chained to achieve unauthenticated RCE on affected appliances. A Metasploit module covering the exploit chain is available. SonicWall released a combined security update in SNWLID-2026-0016. Within hours of their disclosure, the OPENVAS ENTERPRISE FEED added a remote banner check that covers both CVEs.

Products	Affected versions	Fixed versions
SonicWall SMA1000 (6210, 7210, 8200v)	– 12.4.3-03453 and earlier – 12.5.0-02835 and earlier	– 12.4.3-03526 – 12.5.0-02952

CVE-2025-25249: Fortinet FortiOS Actively Exploited

CVSS 9.8 · CriticalEPSS 3.9% (90th)Actively exploitedIn CISA KEV

CVE-2025-25249 (CVSS 9.8, EPSS ≥ 90th pctl), published in January 2026, is a heap-based buffer overflow [CWE-122] in Fortinet’s cw_acd daemon. cw_acd is Fortinet’s CAPWAP (Control and Provisioning of Wireless Access Points) Access Controller daemon. The vulnerable path is reachable over the network, and exploitation allows unauthenticated arbitrary RCE on affected FortiOS, FortiSwitchManager, and FortiSASE devices. On FortiOS, the interface setting set allowaccess fabric enables the Security Fabric Connection service, which includes FortiTelemetry and the CAPWAP endpoint.

CVE-2025-25249 has been exploited in the wild since July 2026, and CISA added the flaw to its KEV catalog in September. The vulnerability has been used to deploy PivotC2, a novel Node.js malware strain against at least 178 confirmed victims.

Product	Affected versions	Fixed versions
FortiOS	– 7.6.0 through 7.6.3 – 7.4.0 through 7.4.8 – 7.2.0 through 7.2.11 – 7.0.0 through 7.0.17 – 6.4 all versions	– 7.6.4 – 7.4.9 – 7.2.12 – 7.0.18
FortiSwitchManager	– 7.2.0 through 7.2.6 – 7.0.0 through 7.0.5	– 7.2.7 – 7.0.6
FortiSASE	– 25.2.b – 25.1.a.2	– 25.2.c – 25.1.b

Fortinet advises that the issue can be mitigated by removing fabric access for each interface or by disallowing access to the CAPWAP daemon. Users should verify their exposure and either apply the workaround or upgrade affected devices to the latest fixed versions. Devices using FortiOS version 6.4 must migrate to a fixed release train.

Immediately after disclosure, Greenbone’s OPENVAS ENTERPRISE FEED added package-level detection for CVE-2025-25249 in FortiOS. The ENTERPRISE FEED also includes regular detection for emerging vulnerabilities affecting Fortinet products.

CVE-2026-94127: Actively Exploited F5 BIG-IP APM OAuth Flaw Allows Unauthenticated RCE

CVSS 9.8 · CriticalEPSS 2.2% (82nd)Actively exploitedIn CISA KEV

CVE-2026-94127 (CVSS 9.8, EPSS ≥ 82nd pctl) is a critical heap-based buffer overflow [CWE-122] affecting F5 BIG-IP APM. The flaw allows unauthenticated RCE and full-system compromise on affected devices. Exploitability depends on APM access policy and an OAuth profile being configured on the same virtual server. Deployments using APM only as an OAuth Client or Resource Server are not affected.

The attack chain involves providing an oversized Authorization: Bearer header to an OAuth endpoint such as /f5-oauth2/v1/userinfo. F5 has confirmed active exploitation in the wild, and the flaw has been added to CISA’s KEV list. Also, watchTowr Labs has published a technical write-up with exploit details.

F5 provides an official iRule-based workaround for customers with a support agreement. Other temporary mitigation controls include restricting access to OAuth endpoints using IP allow-listing or web application firewall (WAF) rules and disabling the OAuth Authorization Server if it is not in use. The OPENVAS ENTERPRISE FEED includes package detection for CVE-2026-94127 in F5 BIG-IP APM and regular detection for vulnerabilities affecting F5 products. The affected versions and corresponding hotfix patches are shown below:

Affected versions	Patched hotfixes
17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG	17.1.0 Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG	17.5.0 Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG	21.1.0 Hotfix-BIGIP-21.1.0.2.0.30.22-ENG

Critical Flaws Affecting Check Point Security Products Include Two Actively Exploited

Check Point reported active exploitation of two critical flaws: CVE-2026-85102 (CVSS 9.8, EPSS ≥ 94th pctl) affecting VPN certificate handling on Check Point Quantum Security Gateway and Spark Firewall, and CVE-2026-93616 (CVSS 9.8, EPSS ≥ 97th pctl) in the Check Point management web service. Both were added to CISA’s KEV catalog [1][2]. Two additional critical issues were disclosed in September: CVE-2026-85103 (CVSS 9.8, EPSS ≥ 89th pctl) and CVE-2026-91843 (CVSS 9.8, EPSS ≥ 42nd pctl), which affect VPN and management-plane components.

Attacks against Spark customers from anonymized IPs were observed globally. Check Point also said post-exploitation activity included internal port and service scans. Although Security Management and Log Server is not explicitly an edge networking service, Censys found 3,836 publicly accessible instances globally.

The four critical Check Point CVEs described in this section, each shown with its CVSS severity band and EPSS exploitation-probability score

CVE-2026-85102

CVSS 9.8 · Critical EPSS 7.5% (94th)

Improper certificate trust [CWE-295] during VPN negotiation in Check Point Quantum Security Gateway allows an unauthenticated remote attacker to execute arbitrary code on the Gateway. A full list of affected products and versions is available from the vendor’s sk1000117 advisory.

CVE-2026-93616

CVSS 9.8 · Critical EPSS 19.7% (97th)

A directory traversal flaw [CWE-22] allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. A full list of affected products and versions is available from the vendor’s sk1000171 advisory.

CVE-2026-85103

CVSS 9.8 · Critical EPSS 3.7% (89th)

A heap-based buffer overflow [CWE-122] in VPN certificate ASN.1 decoding allows an unauthenticated, remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems. A full list of affected products and versions is available from the vendor’s sk1000118 advisory.

CVE-2026-91843

CVSS 9.8 · Critical EPSS 0.5% (42nd)

A stack overflow [CWE-121] during the login process allows an unauthenticated, remote attacker to run arbitrary code with root privileges. A full list of affected products and versions is available from the vendor’s sk1000155 advisory.

The OPENVAS ENTERPRISE FEED includes a remote banner check that covers CVE-2026-85102 and CVE-2026-85103, and separate remote banner checks for CVE-2026-93616 [3] and CVE-2026-91843 [4]. Organizations using affected Check Point products should prioritize remediation for internet-exposed VPN and management systems, with the highest priority on the two actively exploited vulnerabilities.

Adobe Commerce/Magento: Two Actively Exploited CVEs Allow Remote PHP Code Execution and Customer Account Takeover

Adobe disclosed two critical-severity issues in Adobe Commerce and Magento Open Source. CVE-2026-75650 (CVSS 10, EPSS ≥ 90th pctl), dubbed “StyleSmuggler”, is a template-engine flaw [CWE-1336] that can enable unauthenticated arbitrary RCE. The second critical flaw, CVE-2026-71362 (CVSS 9.1, EPSS = 100th pctl), is an incorrect authorization flaw [CWE-863] that allows privilege escalation. Adobe reports that CVE-2026-75650 is being exploited in the wild. Both CVEs have been added to CISA’s KEV list [1][2] and are flagged for forensic triage.

Sansec reported that exploitation of StyleSmuggler starts with an unauthenticated request to Magento’s GraphQL endpoint. A specially crafted HTTP request allows an attacker to smuggle malicious PHP via HTTP headers and parameters into the template-processing chain. The malicious PHP is later executed during automated email rendering. Sansec also reported that CVE-2026-71362 lets attackers switch a customer session to another customer account, providing access to private customer data.

The OPENVAS ENTERPRISE FEED includes separate remote banner checks for CVE-2026-75650 [3] and CVE-2026-71362 [4] in Adobe Commerce and Magento Open Source. CVE-2026-71362 was addressed through Adobe’s APSB26-138 security update. For CVE-2026-75650 (StyleSmuggler), Adobe subsequently released the VULN-39341 hotfix. Both updates must be applied according to the affected release train. Adobe also recommends that users rotate exposed encryption keys, OAuth client secrets, tokens for integrated third-party extensions, payment credentials, and other privileged credentials.

CVE-2026-28326: Hard-Coded Key Allows Unauthenticated RCE in SolarWinds Access Rights Manager

CVSS 8.8 · HighEPSS 0.7% (51st)

CVE-2026-28326 (CVSS 8.8) is an unauthenticated RCE flaw in SolarWinds Access Rights Manager prior to version 2026.2.1. The root cause is a hard-coded static key [CWE-321], and exploitation allows total device compromise. Some technical details are available, which could support exploit development. ARM’s gRPC service on TCP port 55555 does not properly handle a missing client certificate during TLS authentication, but instead redirects to a fallback authentication mechanism. The fallback path accepts an HMAC token generated with a hard-coded secret, allowing an attacker to authenticate without a client certificate.

Access Rights Manager (ARM) is used to provision, deprovision, manage, and audit user access rights to systems, data, and files in corporate networks, including Microsoft Active Directory, Exchange, and SharePoint. The product’s central role in access-rights administration makes patching CVE-2026-28326 critical, especially where ARM is reachable via untrusted IP addresses.

The OPENVAS ENTERPRISE FEED includes a remote banner check for CVE-2026-28326 in SolarWinds ARM. CVE-2026-28326 affects Access Rights Manager 2026.2 and all previous versions. For deployments that cannot be updated immediately, SolarWinds strongly recommends not exposing ARM on the public internet and restricting access to trusted IPs. For full mitigation, users should upgrade to the fixed version 2026.2.1 as soon as possible.

Ivanti Patches Six Critical Flaws in Neurons ITSM

Ivanti disclosed eight new CVEs in Neurons for ITSM prior to version 2026.2; all allow RCE on the server. Six are rated critical severity. Two can be exploited without authentication, while the remaining require authenticated access. The CVEs include improper deserialization [CWE-502] and missing authorization [CWE-862] flaws. While there is no evidence of exploitation in the wild yet, Ivanti products are a popular target in cyberattacks, including ransomware attacks.

Ivanti Neurons for ITSM is used by administrators and IT staff to manage service requests, incidents, problems, and changes. Exploitation allows attackers to manipulate service-desk data, credentials, and integrations, and potentially pivot further into an organization’s IT network.

The affected versions and fixes are shown below:

Deployment	Affected versions	Fix status
Ivanti ITSM On-premises	2025.2 2025.3 2025.4 2026.1	Apply the September 2026 Security Patch for the applicable branch
Ivanti ITSM On-premises (released September 21, 2026)	2026.2	Not affected

Ivanti’s security advisories [1][2] indicate that cloud customers are already protected, but on-premises administrators must apply the relevant patch for mitigation. Immediately after the disclosure, the OPENVAS ENTERPRISE FEED added a remote banner check covering all aforementioned CVEs in Ivanti Neurons for ITSM.

Summary

In September, critical flaws in enterprise IT products emerged at an accelerated pace. Critical flaws in N-able N-central, Citrix NetScaler, SonicWall, Fortinet, F5, Check Point, Adobe Commerce, and Ivanti Neurons ITSM illustrate persistent high-risk exposure to internet-facing systems. While the numbers are staggering, defenders need to remain vigilant. Regular scanning, orderly prioritization, and timely patching are still the most fundamental way to prevent attackers from exploiting software flaws for impact.

 

Greenbone is pleased to announce CoreWin as a new distribution partner. As a Ukraine-based value-added software distributor, CoreWin is well-positioned to make OPENVAS available in Ukraine, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Moldova, and Uzbekistan.

Why Our CoreWin Partnership Matters

Organizations across these regions, in both the public and private sectors, depend on reliable cyber security infrastructure to keep critical systems running under demanding conditions. Vulnerability management plays a central role in that resilience. By continuously identifying and prioritizing security gaps, organizations can reduce risk before attackers can exploit it. Greenbone’s OPENVAS line of security products also supports the compliance requirements that are increasingly expected of organizations of all sizes, across all sectors. That’s exactly where Greenbone + CoreWin comes in.

CoreWin Brings Regional Expertise to the Table

CoreWin brings deep regional expertise through a network of 500+ resellers. Our new partner delivers high-quality software, professional technical support, and hands-on assistance to government agencies and businesses alike, making OPENVAS more accessible to organizations across these markets.

About the OPENVAS Product Line

Built on an open-source foundation and developed in Europe with full GDPR compliance, OPENVAS products are ideal for organizations seeking both transparency into the IT products they use and sovereign control over their sensitive security data.

For organizations operating enterprise IT environments, visibility is a critical factor for resilient security. After all, you can’t remediate security issues that are left undetected. OPENVAS SCAN, paired with the OPENVAS ENTERPRISE FEED, is built for high-visibility across distributed networks, remote sites, and air-gapped deployments in highly isolated locations.

Here are some of the highlights of Greenbone’s OPENVAS line of security products:

• Extensive vulnerability coverage: The OPENVAS ENTERPRISE FEED is Greenbone’s most comprehensive library of vulnerability detection tests, with over 200,000 security checks and daily updates. Customers can often detect emerging vulnerabilities within a day of their publication. Its coverage includes business-critical software from vendors including Microsoft, Cisco, VMware, Oracle, Palo Alto Networks, Fortinet, an extensive list of Linux distributions, and a vast array of open-source software.
• Distributed and air-gapped deployment: OPENVAS SCAN is available as turnkey hardware or virtual appliances for standard on-premises use and also supports distributed sensor architectures and air-gapped deployment for isolated networks.
• Vendor support: The OPENVAS ENTERPRISE FEED includes access to our Enterprise Support and Professional Services.

 

Overview of CVE-2026-48842, the unauthenticated SQL injection flaw in Roundcube Webmail, shown with its CVSS severity band and EPSS exploitation-probability score

CVE-2026-48842

CVSS 8.1 · High EPSS 0.8% (54th)

CVE-2026-48842 (CVSS 8.1, EPSS ≥ 54th pctl), published in May 2026, is an unauthenticated SQL injection flaw in Roundcube Webmail. Vulnerable instances warrant prompt attention due to the elevated risk signals. The flaw affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1.

Coalition has reported exploitation attempts against its honeypot, and on September 21st, the Canadian Centre for Cyber Security issued an update warning of the exploited status. However, CVE-2026-48842 has not been added to CISA’s Known Exploited Vulnerabilities (KEV) list.

Roundcube Webmail has a long record of in-the-wild exploitation, particularly in espionage-motivated attacks. CISA’s KEV catalog contains 11 Roundcube vulnerabilities. Previous attack campaigns have exploited SQL injection, Cross-Site Scripting (XSS) and other types of defects in Roundcube to steal credentials and sensitive email content, and establish persistent access to the victim’s servers.

Risk Assessment of CVE-2026-48842 in Roundcube Webmail

CVSS 8.1 · HighEPSS 0.8% (54th)Actively exploited

Roundcube is a PHP-based web application and server that connects to separate IMAP and SMTP mail services. The multilingual user interface is used to access and manage email messages, while the server contains sensitive credentials to an organization’s email system. CVE-2026-48842 is a network-reachable vulnerability, and no credentials or privileges are required for exploitation.

CVE-2026-48842 also warrants prompt attention due to additional elevated risk signals. Coalition has reported exploitation attempts against its honeypot. However, the flaw has not been added to CISA’s Known Exploited Vulnerabilities (KEV) list. Roundcube also has a long record of in-the-wild exploitation, particularly for cyber espionage. Previous Roundcube exploitation campaigns have targeted Ukrainian government organizations [1][2], government and military entities across Eastern Europe, including Albania, Greece, Moldova, and Türkiye [3], European government entities and think tanks [4], and physics and engineering departments at U.S. and Canadian universities [5].

A Technical Assessment of CVE-2026-48842 in Roundcube Webmail

From a technical standpoint, CVE-2026-48842 (CVSS 8.1, EPSS ≥ 54th pctl) is an unauthenticated SQL injection flaw [CWE-89] in the virtuser_query plugin. The root cause is a bypass of backslash character escaping when user-supplied input is processed by the preg_replace() function. Analyzing the fixed GitHub commits [1][2] reveals that the vulnerability is not a general failure to SQL-escape input fields. After sanitizing user-supplied credentials via $dbh->escape(), inputs were subsequently passed to PHP’s preg_replace() function.

$dbh->escape() inserted backslashes to protect SQL metacharacters. However, backslashes have a different contextual impact in the subsequent preg_replace() function, allowing an attacker to bypass the applied SQL statement protections. The fixed code now performs a literal placeholder substitution via the PHP str_replace() function.

Affected Versions and Mitigation

CVE-2026-48842 affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Although the vendor has released security updates for the affected release lines [1][2], users should review recent vulnerability scans of their Roundcube Webmail infrastructure since new critical and high-severity CVEs, such as CVE-2026-75003, have emerged since the patches for CVE-2026-48842 were released. Due to the product’s history of exploitation in the wild, users should upgrade to the most recent fixed versions.

The most recent stable release trains for Roundcube Webmail are:

Release Train	Current Release	Release Date	Support Status
1.7.x	1.7.4	2026-09-06	Current stable release train; fully maintained
1.6.x	1.6.19	2026-09-06	LTS / low-maintenance release train; security and critical fixes only

Summary

CVE-2026-48842 is a high-severity pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin affecting 1.6.x before 1.6.16 and 1.7.x before 1.7.1. Risk is elevated because active exploitation has been observed against honeypot instances and because of the product’s historical abuse in espionage-motivated attacks.