PHP ships emergency release for two critical flaws (CVSS 9.2)
PHP will publish an out-of-cycle security release at 14:00 UTC on Oct 21 for two flaws it rates CVSS 9.2. Only branches 8.2–8.5 get the fix. Prepare to patch.
Stories tagged: #rce
FortiSIEM CVE-2026-106173: unauth RCE, PoC public, patch now
Fortinet patched a 9.4 path-traversal RCE in FortiSIEM 7.5.0 reachable unauthenticated over gRPC port 27918. Horizon3.ai has released a working PoC. Upgrade to 7.5.1.
Plex2Shell chain exploited within a day of public PoC
Four Plex Media Server bugs (CVE-2026-96652 to -96656) chain to unauthenticated RCE. A honeypot saw in-the-wild exploitation the day after the PoC dropped. Fixes shipped September 1.
Ghostscript RCE via crafted PDF patched (CVE-2026-39919)
CVE-2026-39919, a heap buffer overflow in Ghostscript's JPEG 2000 adapter, lets a crafted PDF trigger RCE. Fixed in 10.08.0; Wordfence demoed unauth RCE on WordPress, no in-the-wild abuse yet.
Bricksforge WordPress plugin RCE exploited within days (CVE-2026-85097)
CVE-2026-85097, an unauthenticated arbitrary file upload in the Bricksforge plugin, is under active exploitation. Patch to 3.1.8.10. Patchstack saw attacks from October 7.
GitLab patches CVSS 10.0 unauthenticated RCE in CI/CD regex compiler (CVE-2026-97229)
CVE-2026-97229 lets an unauthenticated user run arbitrary code on a GitLab server via a crafted CI/CD regular expression. Fixes are in 19.4.2, 19.3.4, and 19.2.8.
AhsayCBS unauth RCE (CVE-2026-105134) exploited, no patch yet
Attackers chain two AhsayCBS flaws into unauthenticated SYSTEM RCE and drop XMRig miners. Huntress confirms active exploitation; every version through 10.3.4 is affected and no fix exists.
Fortra patches critical BoKS flaws: unauth RCE and AD bypass
Fortra fixed eight BoKS Core PAM flaws, three critical: an unauth stack overflow (CVE-2026-12627, 9.8), a crlserver command injection to root, and predictable AD passwords. Fixed in 8.1.0.24/9.0.0.7.
GitLab patches 9.9 RCE in self-hosted AI Gateway (CVE-2026-90970)
CVE-2026-90970, a CVSS 9.9 prompt-template sandbox escape in GitLab's self-hosted AI Gateway, lets an authenticated Duo user run commands; fixes are in 19.2.4, 19.3.2, and 19.4.1.
Kiteworks patches max-severity RCE in Email Protection Gateway
CVE-2026-54154, scored 10.0, chains path traversal, code injection and missing auth into unauthenticated root RCE on Kiteworks Email Protection Gateway before 9.4.1.
Zammad zero-days (CVE-2026-102489/102490) chained to root; patch now
DIVD says two Zammad zero-days were chained for unauthenticated root RCE — and that its own network was breached by an autonomous AI agent. Fix is in version 7.
Cisco patches exploited SD-WAN Manager auth bypass (CVE-2026-76504)
Cisco fixed CVE-2026-76504 (CVSS 9.8), an unauthenticated API auth bypass in Catalyst SD-WAN Manager already exploited in the wild. CISA added it to KEV the same day.
CISA flags pre-auth root RCE in MikroTik RouterOS (CVE-2026-84411)
CISA warns of CVE-2026-84411, a CVSS 9.8 pre-auth integer underflow in RouterOS web management that yields root code execution. Fixed in 7.24 and 7.23.7 LTS; no known exploitation yet.
TeamViewer patches CVE-2026-92370 access-control bypass (CVSS 8.8)
TeamViewer's 15.82 release fixes five high-severity flaws, led by CVE-2026-92370 (CVSS 8.8), a session access-control bypass that can lead to code execution. No exploitation reported yet.
WatchGuard patches critical Fireware OS RCE (CVE-2026-86131)
WatchGuard fixed CVE-2026-86131 (CVSS 9.2), a code-injection flaw letting a malicious BOVPN-over-TLS server run root commands on a connecting Firebox, plus 13 more high-severity Fireware OS bugs.
Citrix patches exploited NetScaler zero-days (CVE-2026-88771, CVSS 9.5)
Citrix patched eight NetScaler ADC/Gateway flaws, two exploited as zero-days. CVE-2026-88771 hits default configs; a public PoC exists and web shells are being dropped.
ServiceNow CVE-2026-6875: pre-auth sandbox escape RCE now exploited
ServiceNow's July 13 patch closes CVE-2026-6875 — a pre-auth sandbox escape in the AI Platform that yields unauthenticated RCE. Defused observed in-the-wild exploitation five days later.
Two more Joomla extensions hit CISA KEV: iCagenda and Balbooa Forms
CISA added CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) to KEV on July 10. Both unauth file-upload to RCE. Patches: iCagenda 4.0.8/3.9.15, Balbooa Forms 2.4.1.
Two Joomla page-builder RCEs hit CISA KEV, remediation due today
CISA added CVE-2026-48908 (JoomShaper SP Page Builder) and CVE-2026-56290 (Page Builder CK) to KEV on July 7. Both CVSS 10.0, unauth file-upload to RCE. FCEB deadline: July 10.
Progress LoadMaster CVE-2026-8037: pre-auth root RCE, PoC-ready diff
Progress patches an unauth pre-auth command-injection RCE in Kemp LoadMaster. CVSS 9.8. GA 7.2.63.2 and LTSF 7.2.54.18 ship the fix; watchTowr posted the full chain on June 29.
Splunk Enterprise CVE-2026-20253: KEV-listed unauthenticated RCE via PostgreSQL sidecar
CVE-2026-20253 is a CVSS 9.8 missing-authentication flaw in Splunk Enterprise 10. CISA added it to KEV on June 18 with a three-day patch deadline. WatchTowr published a working RCE exploit.
Fortinet patches unauth command injection in FortiSandbox (CVE-2026-25089)
Crafted HTTP requests against the FortiSandbox web UI yield OS command execution. CVSS 9.1. No active exploitation reported. Fixed in 5.0.6 and 4.4.9.
Langflow CVE-2026-5027 exploited; fix shipped but unlabelled
VulnCheck added CVE-2026-5027 to its KEV on June 8 after detecting in-the-wild exploitation. Path traversal in /api/v2/files yields unauth RCE; ~7,000 instances are publicly exposed.
Everest Forms Pro CVE-2026-3300 exploited since April 13 to plant rogue admins
Wordfence's firewall blocked 29,300+ exploit attempts against a CVSS 9.8 PHP-eval RCE in Everest Forms Pro. Sites pre-1.9.13 should hunt for the rogue admin diksimarina.
Veeam patches critical RCE in Backup & Replication (CVE-2026-44963)
An authenticated domain user can run code on a domain-joined VBR backup server. CVSS 9.4. Fixed in 12.3.2.4854; v13 is not affected.
Marimo CVE-2026-39987 RCE chains into LLM-driven post-exploit
Sysdig documents an LLM agent driving post-exploitation after a CVE-2026-39987 Marimo notebook compromise: cloud creds and SSH key pulled in under three minutes.
CISA flags Langflow CVE-2025-34291: CORS chain yields RCE
CISA added CVE-2025-34291 to the KEV catalog on May 21. An overly permissive CORS plus a misconfigured refresh-token cookie chain to account takeover and code execution in Langflow ≤ 1.6.9.
LiteSpeed cPanel plugin RCE (CVE-2026-48172, CVSS 10.0) actively exploited — any cPanel user can run code as root
A privilege-escalation flaw in the LiteSpeed User-End cPanel plugin lets any cPanel account execute arbitrary scripts as root. Mass scanning began within 72 hours of disclosure.