9 vulnerabilities across 6 products scored HIGH or above on September 07, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 8

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin.
  • [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin.

🔴 [CRITICAL] adobe/adobe_commerce

1 CVE | CVSS 3.1: 10.0 | AAS 14.1

  • cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*

Adobe Commerce — Critical Remote Code Execution

Adobe Commerce is affected by a critical template injection vulnerability (CVE-2026-75650, CVSS 10.0) that allows an attacker to execute arbitrary code without any user interaction. The scope-changed rating means compromise of the Commerce application can impact other components in the environment. This is a maximum-severity issue and any organization running Adobe Commerce should treat patching as an emergency priority.

All Adobe Commerce deployments should apply the vendor’s security update immediately. Refer to Adobe’s advisory at helpx.adobe.com/security/products/magento/apsb26-146.html for affected versions and patching instructions. Given the unauthenticated, no-interaction attack vector, organizations unable to patch immediately should consider taking affected storefronts offline or placing them behind a web application firewall with strict template injection rules until the update is applied.

Vendor Advisory

🟠 [HIGH] jetbrains/youtrack

2 CVEs | CVSS 3.1: 9.8 | AAS 11.8

  • cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* (>= 2026.1, < 2026.1.14042)
  • cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* (< 2026.2.18634)

JetBrains YouTrack — Critical Authentication Bypass

JetBrains YouTrack is affected by 2 vulnerabilities, including at least one critical authentication flaw (CVSS 9.8) in the YouTrack Helpdesk module that allows an unauthenticated attacker to take over accounts by supplying a self-asserted email address. Organizations using YouTrack for project tracking or helpdesk operations should treat this as a high-priority issue, as exploitation requires no credentials or user interaction.

Administrators should update to YouTrack 2025.3.161254 or 2026.1.14042 or later immediately. Refer to the JetBrains security advisory at www.jetbrains.com/privacy-security/issues-fixed/ for full details on both CVEs and affected versions. Until patched, consider restricting external access to YouTrack Helpdesk portals.

Vendor Advisory

🟠 [HIGH] librenms/librenms

2 CVEs | CVSS 4.0: 9.2 | AAS 10.7

  • cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*

LibreNMS — Critical API Authentication Bypass

LibreNMS prior to version 26.8.0 is affected by 2 vulnerabilities, including at least one critical authentication bypass (CVSS 9.2) in the REST API. An unauthenticated attacker can exploit MySQL type coercion by sending small integer values in place of API tokens, bypassing authentication entirely and gaining access to protected endpoints including device credentials and administrative functions that enable remote code execution through alert templates.

Any organization running LibreNMS for network monitoring should update to version 26.8.0 or later immediately. Refer to the vendor advisory at github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg for full details. Until patched, restrict network-level access to the LibreNMS API to trusted management hosts only.

Vendor Advisory

🟠 [HIGH] red_hat/red_hat_enterprise_linux_10

1 CVE | CVSS 3.1: 9.8 | AAS 9.9

  • cpe:2.3:a:redhat:enterprise_linux:*:*:*:*:*:*:*:*

Red Hat Enterprise Linux 10 (FreeIPA) — Critical Unauthenticated Privilege Escalation

Red Hat Enterprise Linux 10 is affected by a critical vulnerability (CVE-2026-76578, CVSS 9.8) in FreeIPA where the self-managed OTP token access control does not require authentication and fails to restrict which attributes can be added alongside token entries. A remote, unauthenticated attacker can exploit this flaw via LDAP to create an arbitrary Kerberos principal and add it to the administrators group, resulting in full domain compromise.

Organizations using FreeIPA for identity management on RHEL 10 should review the vendor advisory at access.redhat.com/security/cve/CVE-2026-76578 and apply patches as soon as they are available. Until a fix is in place, consider restricting network access to the LDAP service to trusted hosts and auditing the administrators group for unexpected principals.

Vendor Advisory

🟠 [HIGH] red_hat/red_hat_directory_server_11

2 CVEs | CVSS 3.1: 9.8 | AAS 9.9

  • cpe:2.3:a:redhat:directory_server:*:*:*:*:*:*:*:*

Red Hat Directory Server 11 — Critical SASL Authentication Bypass

Red Hat Directory Server 11 (389 Directory Server) is affected by 2 vulnerabilities, including at least one critical authentication bypass (CVE-2026-18922, CVSS 9.8) where a stale identity from a failed SASL PLAIN bind can carry over to a subsequent successful anonymous bind on the same connection. An attacker can exploit this by first attempting a PLAIN bind as Directory Manager with an incorrect password, then completing a SASL ANONYMOUS bind, causing the server to grant full Directory Manager privileges to the unauthenticated session.

Organizations running Red Hat Directory Server 11 or 389 Directory Server should review the vendor advisories at access.redhat.com/security/cve/CVE-2026-18922 and apply available patches as a priority. Until patched, consider disabling SASL ANONYMOUS authentication if not required and restricting direct LDAP access to trusted networks only.

Vendor Advisory

🟠 [HIGH] openvpn/openvpn

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*

OpenVPN — High-Severity Unauthenticated Denial of Service

OpenVPN through versions 2.6.22 and 2.7.6 is affected by a high-severity vulnerability (CVE-2026-84732, CVSS 8.7) where a remote unauthenticated attacker can craft ACK packet ID retransmissions that trigger a timeout integer overflow, causing a denial of service. This can disrupt VPN connectivity without requiring any credentials or prior access, making it a significant risk for any internet-facing OpenVPN deployment.

Organizations running affected versions should update to patched releases as soon as they are available. Refer to the vendor advisory at community.openvpn.net/Security%20Announcements/CVE-2026-84732 for remediation guidance. In the interim, network-level rate limiting or filtering on OpenVPN listener ports may help reduce exposure.

Vendor Advisory