SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
Check Point CVE-2026-93616 & 85102: 9.8 Pre-Auth RCEs Exploited
Check Point CVE-2026-93616 and CVE-2026-85102 are two 9.8 pre-auth flaws exploited in the wild and on CISA's KEV list. Patch, then hunt for compromise.
F5 BIG-IP APM CVE-2026-94127: Pre-Auth RCE, Exploited Now
CVE-2026-94127 is an unauthenticated RCE in F5 BIG-IP APM configured as an OAuth authorization server, exploited now. Who is exposed and how to patch.
The gatekeeper was the target: identity appliances got bypassed
This week's exploited flaws were in the access-control layer itself: Cisco ISE (two CVSS 10.0, in CISA KEV) and Kong Gateway's SAML bypass.
HUSKY WooCommerce CVE-2026-92969: Unauth File Inclusion, Patch Now
CVE-2026-92969 is an unauthenticated file inclusion flaw in HUSKY Products Filter for WooCommerce (up to 1.4.4), fixed in 1.4.5. Update now and hunt your logs.
Brevo Hack Injected Malware at the CDN Edge, Evading Site Checks
Attackers abused Brevo (formerly Sendinblue) to inject malware into up to 100,000 sites at the CDN edge, so origin files never changed and checks missed it.
Cisco ISE CVE-2026-76460: Exploited Auth-Bypass Zero-Day, Patch
CVE-2026-76460 is an unauthenticated API auth bypass in Cisco ISE, CVSS 10.0, actively exploited and in CISA KEV. Patch ISE 3.1-3.5 to the fixed build now.
WordPress CVE-2026-93485: Stored XSS in Core, Update to 7.1.1
WordPress 7.1.1 fixes CVE-2026-93485, a stored cross-site scripting flaw in core that an unauthenticated comment can carry. Who is exposed and how to patch.
Cisco ISE CVE-2026-20192: Exploited Access-Control Flaw, Patch Now
Cisco's September 2026 ISE hardening release fixes six flaws, two rated CVSS 10.0. One access-control bug (CVE-2026-20192) is being exploited.
Kong Gateway CVE-2026-14917: SAML Auth Bypass, Check Config
Kong Gateway's SAML plugin (CVE-2026-14917) can accept unsigned responses and impersonate admins when signature validation is off. Audit the flag, then patch.
LiteSpeed Enterprise: Critical Root Flaw, Update to 6.3.7 Now
LiteSpeed Enterprise before 6.3.7 lets a low-privilege hosting account reach root and bypass CageFS, per the vendor advisory. No CVE yet. Update every node now.
BioStar 2 CVE-2026-31278: Active Directory Password Leak, Patch Now
Suprema BioStar 2 exposes its Active Directory bind password in cleartext via an API endpoint (CVE-2026-31278). Patch to 2.9.12 and rotate the account.
JFrog Artifactory CVE-2026-42016: Auth Chain to Admin, Patch Fast
CISA added JFrog Artifactory CVE-2026-42016 and CVE-2026-42018 to KEV. Chained, they turn an unauthenticated request into admin.
GitLab CVE-2026-85706: Unauthenticated File Read, Patch Now
GitLab's critical patch fixes CVE-2026-85706, an unauthenticated CVSS 10 file-read flaw now being scanned for, plus a CVSS 9.9 credential leak.
Omada Controller CVE-2026-84941: SAML XXE File Read, Patch
TP-Link patched CVE-2026-84941, an XXE in Omada Controller's SAML SSO that lets an admin read files off the host. Update to 6.2.14.11 or the 20260711 build.
Keycloak CVE-2026-88770: Device Flow Bypasses Account Lockout
CVE-2026-88770 lets a held Keycloak session mint fresh tokens through the device grant flow while the account is brute-force-locked.
Magento CVE-2026-75650: Exploited RCE, Patching Isn't Enough
CVE-2026-75650 (StyleSmuggler) is a CVSS 10 unauthenticated RCE in Adobe Commerce and Magento, exploited before the fix shipped. Patch, then hunt the backdoor.
The flaws exploited this week mostly already had a fix
Most of this week's actively exploited flaws were n-days, not zero-days: already-patched bugs like Switchvox and Exchange, weaponized weeks after the fix
SAP CVE-2026-44756: Unauthenticated Memory Corruption, Patch Now
SAP CVE-2026-44756 is a CVSS 10.0 unauthenticated memory corruption flaw in Extended Passport (EPP) processing that can crash the SAP kernel or Web Dispatcher.
N-able N-central CVE-2026-86218: CVSS 10 Unauth RCE, Patch Now
N-able shipped its fourth N-central hotfix in five weeks: CVE-2026-86218, a CVSS 10 unauthenticated RCE on the on-prem console. Patch to 2026.3.1.14 and hunt.
Chrome CVE-2026-85046: Exploited V8 Zero-Day, Update Now
CVE-2026-85046 is an actively exploited V8 type confusion zero-day in Chrome. Update to 152.0.7977.82, and patch Edge, Brave, Opera and Electron apps too.
LiteLLM CVE-2026-59822: MCP Auth Bypass, Exploited, Patch Now
CVE-2026-59822 is an actively exploited MCP auth bypass in the LiteLLM gateway. Patch to 1.84.0 and rotate every stored provider and virtual key now.
WHMCS CVE-2026-67399: Stopgap Hook If You Cannot Upgrade Yet
A defense-in-depth WHMCS hook that blocks the payload classes CVE-2026-67399 most likely needs, for installs that cannot reach 8.13.7 or 9.0.8 yet. Not a fix.
WHMCS CVE-2026-67399: Critical Unauthenticated RCE, Patch Now
WHMCS shipped 9.0.8 and 8.13.7 to fix an unauthenticated remote code-execution flaw (CVE-2026-67399) plus a customer-data leak (CVE-2026-67398).
JFrog Artifactory flaw (CVE-2026-82329) lets attackers forge admin tokens with no login, now exploited
Attackers are forging admin tokens via a JFrog Artifactory authentication bypass (CVE-2026-82329, CVSS 9.8). Patch the six fixed builds and rotate tokens now.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.