331 vulnerabilities across 15 products scored HIGH or above on September 08, 2026.

  • 🔴 CRITICAL: 4
  • 🟠 HIGH: 327

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin.
  • [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin.

🔴 [CRITICAL] adobe/adobe_experience_manager_as_a_cloud_service

1 CVE | CVSS 3.1: 9.9 | AAS 13.1

  • cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service:*:*:*:*:*:*:*:*

Adobe Experience Manager as a Cloud Service is affected by one critical vulnerability (CVE-2026-19232, CVSS 9.9) involving incorrect authorization that allows a low-privileged attacker to execute arbitrary code in the context of another user, potentially taking over accounts or sessions without any user interaction. Organizations running Adobe Experience Manager should treat this as a high-priority issue given the critical severity rating and the low barrier to exploitation.

Security teams should review Adobe’s advisory at helpx.adobe.com/security/products/experience-manager/apsb26-98.html and apply the latest patches or updates immediately to mitigate this risk.

Vendor Advisory

🔴 [CRITICAL] adobe/commerce

6 CVEs | CVSS 3.1: 9.3 | AAS 12.7

  • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* (< 2.4.4)
  • cpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:* (< 1.3.3)
  • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* (<= 2.4.6)

Adobe Commerce is affected by six vulnerabilities, including at least one rated critical at CVSS 9.3, spanning stored cross-site scripting flaws that allow attackers to inject malicious scripts into form fields and potentially hijack user sessions or gain elevated access. These issues are particularly concerning for any organization running Adobe Commerce or Magento storefronts, as exploitation can occur when victims simply browse to a page containing a compromised field.

Administrators should consult Adobe’s advisory at helpx.adobe.com/security/products/magento/apsb26-138.html and apply all available patches without delay to address the full set of vulnerabilities.

Vendor Advisory

🔴 [CRITICAL] adobe/magento

1 CVE | CVSS 3.1: 9.3 | AAS 12.2

  • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* (<= 2.4.6)
  • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* (< 2.4.4)
  • cpe:2.3:a:adobe:commerce_b2b:*:*:*:*:*:*:*:* (< 1.3.3)

Adobe Magento Open Source is affected by one critical stored cross-site scripting vulnerability (CVE-2026-76200, CVSS 9.3) that allows attackers to inject malicious scripts into form fields, potentially executing JavaScript in victims’ browsers to hijack sessions or escalate access. Any organization running Magento Open Source storefronts should prioritize this fix, as exploitation requires only that a user browse to a page containing the compromised field.

Administrators should review Adobe’s advisory at helpx.adobe.com/security/products/magento/apsb26-138.html and apply the latest patches immediately.

Vendor Advisory

🔴 [CRITICAL] adobe/coldfusion_2025

5 CVEs | CVSS 3.1: 9.9 | AAS 12.1

  • cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:*

Adobe ColdFusion 2025 is affected by five vulnerabilities, including multiple critical issues with the highest rated at CVSS 9.9. The most severe is an eval injection flaw that allows a low-privileged attacker to execute arbitrary code without any user interaction, with scope change indicating potential impact beyond the vulnerable component. Organizations running ColdFusion should treat this as an urgent priority given the ease of exploitation and the severity of the code execution risk.

Security teams should immediately review Adobe’s advisory at helpx.adobe.com/security/products/coldfusion/apsb26-119.html and apply all available updates.

Vendor Advisory

🟠 [HIGH] microsoft/windows

255 CVEs | CVSS 3.1: 9.8 | AAS 11.6

  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.10240.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.14393.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.17763.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.19043.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.19045.0)

Microsoft Windows is affected by 255 vulnerabilities in this release cycle, including multiple critical issues with the highest rated at CVSS 9.8. The most severe involves an out-of-bounds write in the Windows Imaging Component that allows an unauthorized attacker to execute code remotely over a network, and the breadth of this update spans numerous Windows components and attack surfaces.

All organizations running Windows should prioritize deploying the September 2026 Patch Tuesday updates immediately and review the Microsoft Security Response Center update guide for the full list of affected components and configurations.

Vendor Advisory

🟠 [HIGH] microsoft/visual_studio_code

6 CVEs | CVSS 3.1: 9.6 | AAS 11.5

  • cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*

Microsoft Visual Studio Code is affected by six vulnerabilities, including multiple high-severity issues with the highest rated at CVSS 9.6. The lead vulnerability involves an incomplete comparison flaw that allows an unauthorized attacker to bypass security features over a network, and development teams should be aware that VS Code is widely deployed across engineering environments where a compromise could have significant downstream impact.

Organizations should ensure Visual Studio Code is updated to the latest version across all developer workstations and review Microsoft’s advisory at msrc.microsoft.com/update-guide for full details on all six issues.

Vendor Advisory

🟠 [HIGH] google/android_xr

1 CVE | CVSS 4.0: 10.0 | AAS 11.2

  • cpe:2.3:a:google:android_xr:*:*:*:*:*:*:*:*

Google Android XR is affected by one critical vulnerability (CVE-2026-28659, CVSS 10.0) in the MicroXR Blobstore component, where a missing permission check allows an attacker to access other applications’ files and escalate privileges locally without any user interaction or additional execution privileges. Organizations deploying Android XR devices should treat this as a top-priority issue given the maximum severity rating and the trivial exploitation requirements.

Security teams should review Google’s Android XR security bulletin at source.android.com/docs/security/bulletin/xr/2026/2026-09-01 and apply the September 2026 patches as soon as they are available for their devices.

Vendor Advisory

🟠 [HIGH] connectwise/screenconnect

1 CVE | CVSS 3.1: 9.9 | AAS 11.1

  • cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*

ConnectWise ScreenConnect is affected by one critical vulnerability (CVE-2026-84869, CVSS 9.9) in the client component that allows files to be transferred and executed through an active remote session without authorization or host confirmation. Given ScreenConnect’s widespread use as a remote access tool across managed service providers and enterprise environments, this flaw is particularly dangerous as it could enable unauthorized code execution on endpoints during active sessions.

Organizations using ScreenConnect should immediately review ConnectWise’s advisory at github.com/ConnectWise-Advisories/Disclosures and update all client installations, noting that while servers are not impacted, every managed endpoint running the client is potentially at risk.

Vendor Advisory

🟠 [HIGH] adobe/campaign

1 CVE | CVSS 3.1: 10.0 | AAS 10.8

  • cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:* (< 7.4.4)

Adobe Campaign Classic is affected by one critical OS command injection vulnerability (CVE-2026-82004, CVSS 10.0) that allows an attacker to execute arbitrary code without any user interaction, with scope change indicating the potential to impact systems beyond the vulnerable component. The maximum possible severity rating and the lack of required user interaction make this an especially urgent issue for any organization running Adobe Campaign Classic for marketing automation.

Security teams should immediately apply patches per Adobe’s advisory at helpx.adobe.com/security/products/campaign/apsb26-142.html and audit Campaign Classic instances for any signs of compromise given the exploitable nature of this vulnerability.

Vendor Advisory

🟠 [HIGH] deepseek/deepseek_harness

1 CVE | CVSS 4.0: 9.4 | AAS 10.8

  • cpe:2.3:a:deepseek:deepseek_harness:*:*:*:*:*:*:*:*

DeepSeek Harness before version 0.1.2-alpha.1 is affected by one critical authentication bypass vulnerability (CVE-2026-82533, CVSS 9.4) in its local HTTP control-plane API, where an attacker can spoof the Host header to bypass authentication and gain full agent control, including the ability to execute privileged commands with unrestricted permissions. Any organization or developer running DeepSeek Harness for AI agent orchestration should treat this as an urgent issue, as exploitation allows complete takeover of agent sessions and policy escalation.

Users should immediately update to version 0.1.2-alpha.1 or later and review the fix commit at github.com/deepseek-ai/deepseek-harness for details on the remediation.

Vendor Advisory

🟠 [HIGH] microsoft/365_apps

45 CVEs | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
  • cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*
  • cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x64:*
  • cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x86:*

Microsoft 365 Apps is affected by 45 vulnerabilities, including multiple critical issues with the highest rated at CVSS 9.8. The most severe is a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code remotely over a network, and the large volume of fixes across the Office suite indicates broad attack surface exposure for any organization relying on these productivity applications.

Security teams should prioritize deploying the September 2026 updates for all Microsoft 365 Apps installations immediately and review the Microsoft Security Response Center update guide for the complete list of affected components.

Vendor Advisory

🟠 [HIGH] n8n-io/n8n

3 CVEs | CVSS 4.0: 8.7 | AAS 10.5

  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:*

n8n workflow automation platform is affected by three high-severity vulnerabilities, including multiple sandbox escape flaws with the highest rated at CVSS 8.7. The most critical issue involves the expression compiler sanitizer failing to reject reserved class member names, allowing an attacker to rebind the sanitizer and reach the Function constructor to achieve backend code execution on the n8n server.

Organizations running n8n should update immediately to version 1.123.76, 2.37.7, or 2.38.2 depending on their release track, and review the release notes at github.com/n8n-io/n8n for full details on all three vulnerabilities.

Vendor Advisory

🟠 [HIGH] commvault/commvault_cloud

1 CVE | CVSS 4.0: 9.3 | AAS 10.4

  • cpe:2.3:a:commvault:commvault_cloud:*:*:*:*:*:*:*:*

Commvault Cloud Command Center is affected by one critical authentication bypass vulnerability (CVE-2026-77089, CVSS 9.3) in its API that impacts privilege management, potentially allowing unauthorized access to administrative functions. Given Commvault’s role as a backup and data protection platform, exploitation of this flaw could give attackers access to highly sensitive backup infrastructure and data.

Organizations running Commvault Cloud should immediately update Command Center to the latest maintenance release and review the vendor advisory at documentation.commvault.com/securityadvisories/CV_2026_07_1.html for specific version guidance.

Vendor Advisory

🟠 [HIGH] craftcms/cms

2 CVEs | CVSS 4.0: 8.7 | AAS 10.3

  • cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*

Craft CMS before version 5.10.12 is affected by two high-severity vulnerabilities, including at least one remote code execution flaw rated at CVSS 8.7 that allows authenticated content editors to instantiate arbitrary classes through the element-index endpoint and leverage a PHP gadget chain to execute code on the server. Since exploitation requires only content editor privileges rather than full admin access, any Craft CMS installation with multiple users is at significant risk.

Organizations running Craft CMS should update to version 5.10.12 or later immediately and review the security advisory at github.com/craftcms/cms/security/advisories/GHSA-9wcj-wqqh-cqvg for full technical details.

Vendor Advisory

🟠 [HIGH] hitachi/cosminexus_component_container

2 CVEs | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:hitachi:cosminexus_component_container:*:*:*:*:*:*:*:*

Hitachi Cosminexus Component Container is affected by two critical OS command injection vulnerabilities (CVE-2026-71376 and CVE-2026-71377, max CVSS 9.8) spanning a wide range of product versions from the 09-00 through 11-70 release lines. Command injection at this severity allows attackers to execute arbitrary operating system commands on the host, making this an urgent concern for any organization running Cosminexus application infrastructure.

Administrators should review Hitachi’s advisory at www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-132/index.html to determine whether their specific version is affected and apply the appropriate patched release immediately.

Vendor Advisory