BerriAI LiteLLM GitHub security advisory GHSA-7hp6-4w63-5g45 (published 30 September 2026; Critical CVSS 3.1 9.9; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) — authenticated internal_user can escalate to proxy_admin and execute arbitrary commands. Root cause: one encryption key seals secrets at rest and mints session tokens. Attacker requests a new API key with crafted metadata containing a forged admin credential as the “secret”; proxy encrypts and returns it; presenting that value as a bearer token decrypts to a trusted admin identity, including MCP stdio command execution. Default-config exploitable on versions later than 1.91.0; 1.87.0–1.90.x only if EXPERIMENTAL_UI_LOGIN=true. Patched: 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 (per advisory ranges). Interim: EXPERIMENTAL_UI_LOGIN=false (disables vulnerable path; breaks CLI SSO / Claude Code gateway login). Credit: Hoa X. Nguyen (OPSWAT Unit 515). Category tech (AI gateway stack). Distinct from desk litellm-default-sk1234-20260909 (default master key exposure). Primary: GitHub advisory.
Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuU (first published 30 September 2026 13:00 GMT) covers CVE-2026-76504 (CVSS 3.1 9.8 Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Cisco Catalyst SD-WAN Manager API session-based authentication. Improper URI encoding lets an unauthenticated remote attacker bypass an authentication rule and access the API as the admin user (default netadmin). Affects Catalyst SD-WAN Manager regardless of configuration. Cisco PSIRT became aware of active exploitation in September 2026 (found via TAC case); no public victim count or actor named. Fixed trains: earlier than 20.9 → migrate; 20.9.10.1; 20.12.8.2; 20.15.6.1; 20.18.4.1; 26.1.2.1; 26.2.1. Cisco SD-WAN Cloud (Cisco Managed) already remediated in 20.15.605 (no customer action). No workaround; until patched restrict Manager from untrusted/internet networks and follow Catalyst SD-WAN Hardening Guide. Hunt j_security_check (incl. URI-encoded variants such as /%6a_security_check) in serviceproxy-access.log and vmanage-server.log, especially viptela-reserved- users. Distinct from older desk cisco-sd-wan-2026 (CVE-2026-20127/20128/20122 joint advisory) and May/June SD-WAN zero-days. Primary: Cisco; wire: The Hacker News / BleepingComputer 30 Sep. UPDATE 1 Oct 2026: CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog (The Hacker News 1 Oct), citing hex-encoding/URI handling that grants unauthenticated admin API access; CISA KEV federal remediation due 3 Oct 2026 for FCEB. Wire: THN KEV item 1 Oct.
CVE-2026-50610 (CVE.org record updated 17 September 2026; Intrinsec public write-up 29 September 2026) is a local privilege-escalation flaw in the Acer System Monitoring component shipped with NitroSense and PredatorSense. Insufficient access control on a privileged Windows service (AcerSysHardwareService / systemmonitoring_hardware_service_ named pipe writable by Authenticated Users) lets an authenticated local user trigger unauthorized registry modifications as SYSTEM (CWE-284). Intrinsec’s research chain writes a utilman debugger value and obtains NT AUTHORITY\SYSTEM from the login-screen accessibility path. CVE.org CVSS 4.0 7.4 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U); product status lists affected through 1.0.19.2. Intrinsec notes tested AcerSysHardwareService.exe builds 1.0.1018.13 / 1.0.1019.0 (NitroSense 5.1.361 engine). Vendor remediation pointer: Acer Community KB article 19877 (apply Acer advisory update or disable/uninstall the affected service). No wild exploitation stated. Primary: CVE.org; research: Intrinsec 29 Sep; Talkback resurfaced ~2 Oct.
CVE.org — CVE-2026-50610 Acer System Monitoring improper access control / LPE
CISA ICS advisory ICSA-26-272-06 (29 September 2026) assigns CVE-2026-84411 (CVSS 3.1 9.8 / CVSS 4.0 9.3 Critical) to MikroTik RouterOS web management: an integer underflow (CWE-191) in HTTP request body handling reachable before authentication lets an unauthenticated network attacker achieve arbitrary code execution as root or denial of service with a single crafted request. Affected: RouterOS <7.24. CISA remediation text: MikroTik recommends update to RouterOS 7.24 or later (download mikrotik.com/download). CISA: no known public exploitation specifically targeting this CVE at publication. Distinct from desk mikrotik-routeros-20260905 (CERT.PL MikroTrick SSH chain CVE-2026-67279/86060 and related Sep disclosures). Until patched: keep web management off the internet; firewall-isolate management planes; prefer VPN for remote admin. Primary: CISA ICSA-26-272-06; wire: BleepingComputer 30 Sep (RSS/homepage 403 from desk egress — opened via search/WebFetch).
Mozilla MFSA 2026-97 (announced 29 September 2026) — Security Vulnerabilities fixed in Firefox 157. Large advisory set (Mozilla now issues per-bug CVEs): high-impact items include sandbox escapes and use-after-free across DOM/Content Processes, Graphics/WebGPU, WebAssembly, Widget, and related components (examples: CVE-2026-100758, 100760, 100762, 100770, 100775, 100778, 100781, 100786, 100787). SecurityWeek 30 Sep roundup cites ~76 issues with ~38 high-severity in Firefox 157, with many also fixed in Firefox ESR 153.4 / 140.17 / 115.42 (MFSA 2026-99 / 2026-100 trains). No in-the-wild exploitation stated in the MFSA. Chrome 154.0.8037.92/.93 companion already on desk as chrome-154-20260922. Primary: Mozilla MFSA 2026-97; wire: SecurityWeek 30 Sep.
WatchGuard PSIRT (published 29–30 September 2026; SecurityWeek 30 Sep) released a Fireware OS security train fixing 15 issues. Critical: CVE-2026-86131 (CVSS v4 9.2) — code injection in BOVPN over TLS client configuration handling lets an attacker who controls the remote VPN server execute commands as root on the connecting Firebox. Fixed in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21 (T15/T35). The same trains also address high-severity pre-auth RCE/DoS (including fingerd stack overflow CVE-2026-81433, spamd overflow CVE-2026-18145, iked underflows, samld deserialization), SSLVPN SAML auth bypass CVE-2026-86101, WebUI path traversal CVE-2026-13224, wgagent DoS, and related. Distinct from desk watchguard-ap-api-20260928 (AP firmware) and the August iked/Dimension cluster (watchguard-fireware-iked-20260827). Vendor: not aware of in-the-wild exploitation of 86131. Primary: WatchGuard PSIRT / CVE.report; wire: SecurityWeek 30 Sep.
TeamViewer security bulletin TV-2026-1010 (29 September 2026; Important; CVSS up to 8.8 High) patches five flaws in TeamViewer Full Client, Host and related services across TeamViewer Remote / Tensor / ONE. Highest: CVE-2026-92370 (CVSS 3.1 8.8) — improper access control lets a remote attacker on the session path bypass user-configured permission settings during session establishment and perform denied actions that may lead to remote code execution (Windows/Linux/macOS). Also: CVE-2026-19743 (7.8) local IPC path validation → arbitrary file write as SYSTEM/root (Win/Linux/macOS); CVE-2026-92368 (7.8) heap overflow in .tvs session-recording playback (Linux/macOS); CVE-2026-92369 (7.3) Windows installer rollback TOCTOU → SYSTEM; CVE-2026-92371 (7.0) Linux Cloud Session Recording path race. Fixed in TeamViewer Clients 15.82 and supported maintenance/legacy trains. Vendor: no public exploit code or in-the-wild exploitation known. Primary: TeamViewer TV-2026-1010; wire: BleepingComputer 30 Sep.
Apache MINA SSHD maintainers (oss-security, 29 September 2026; CVE records published 30 Sep) disclose critical flaws in the optional sshd-ldap component plus related SFTP memory issues, fixed in 2.20.0 and 3.0.0-M6. CVE-2026-94053 (CVSS 3.1 9.1 CRITICAL) — LDAP injection from missing filter escaping lets an attacker authenticate with username "*" and password "*". CVE-2026-94052 (CVSS 3.1 9.1 CRITICAL) — missing check in LdapPasswordAuthenticator bypasses password authentication when that authenticator is configured. Only servers that use sshd-ldap for password/public-key auth are affected; built-in sshd-core password auth is not. Also: CVE-2026-94029 (CVSS 3.1 6.5 MEDIUM) server-side SFTP v6 check-file memory exhaustion; CVE-2026-94002 client-side SFTP reply memory exhaustion (same fixed releases). Credit: Dilrevx, Ho1aAs. Primary: Apache oss-security 29 Sep; wire: CVE.report 30 Sep.
OpenSSL Security Advisory (29 September 2026) patches 14 vulnerabilities. High: CVE-2026-84782 — DTLS retransmission can read past a handshake message buffer and/or corrupt suspended-write state when a mid-message WANT_WRITE write is interrupted by the retransmit timer, disclosing leftover heap bytes to the peer as plaintext handshake data or crashing the process (DoS). Affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2. Moderate: CVE-2026-84783 — use-after-free in X.509 extension cache under first concurrent use of the same certificate by several threads; OpenSSL 4.0 only (multi-threaded TLS client, or server that requests client certs). Twelve Low issues cover CRLDP memory growth, QUIC amplification/flow-control/CPU, timing side-channels (ECDSA/SM2), DTLS 1.2 tear-down, CMP NULL deref, and related. OpenSSL rates severity High/Moderate/Low; no numeric CVSS in the vendor advisory (desk does not invent scores). Distinct from wolfSSL 5.9.4 (wolfssl-5-9-4-20260928); SecurityWeek 30 Sep roundup covers both libraries. Primary: OpenSSL secadv 20260929; wire: SecurityWeek 30 Sep.
Bishop Fox advisory (29 September 2026) details two vulnerabilities in Zilliz Attu 2.6.5 — the GUI admin tool for the Milvus vector database used in AI/ML stacks. Missing authentication (Bishop Fox: Critical) in the Playground feature lets unauthenticated attackers proxy arbitrary HTTP/HTTPS requests through an exposed Attu instance. Insecure input validation (Bishop Fox: High) bypasses private-IP blocking (DNS resolve vs host-header split), enabling requests to internal addresses and cloud metadata endpoints. Combined in a typical Milvus+Attu Amazon EKS deployment, Bishop Fox demonstrated administrative access to the Kubernetes namespace hosting Attu (and possible wider cloud impact depending on service-account permissions). No CVE identifiers assigned in the advisory. Vendor: Attu 2.6.x is no longer maintained and will not receive a 2.6.5 patch; upgrade to Attu 3.0.0 (released 3 Sep 2026; substantial rewrite). Bishop Fox could not reproduce either issue on 3.0.0. If upgrade is delayed: restrict network access, put Attu behind an authenticating reverse proxy, and tightly scope the Attu pod’s Kubernetes service-account permissions. Desk does not reproduce the chain. Primary: Bishop Fox 29 Sep; vendor path: Attu 3.0.0 release.
IBM's security bulletin for DataPower Gateway, first published on 28 September 2026, fixes 36 CVEs; the CVE records went public on 8 October 2026. DataPower is a security and integration gateway often placed at the network edge in front of APIs, web services and mainframe systems. Flaws rated CVSS 9.8 include CVE-2026-16340 (out-of-bounds write in the RFC 2047 encoded-word parser allowing a remote attacker to run code), CVE-2026-15762 (out-of-bounds write allowing remote code execution), CVE-2026-14269 (heap-based buffer overflow letting an unauthenticated remote attacker run code), CVE-2026-14502 (a remote attacker can gain administrative access because empty passwords are not rejected during LDAP authentication) and buffer overflows CVE-2026-14991 and CVE-2026-14992 (IBM's text for CVE-2026-14991 describes a local user). Affected: 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6CD 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. IBM lists no workarounds, flags known issue DT499224, and reports no exploitation. Primary: IBM.
IBM — Security Bulletin: IBM DataPower Gateway multiple vulnerabilities (28 Sep 2026; CVE records published 8 Oct 2026)
vulnerabilitiesnetworkidentity
Vulnerabilities
Mon 28 Sep
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (GHSA-J6WC ALONE; CHAIN USES ADDITIONAL HIGH GHSAS FOR EARLIER FOOTHOLD)
AVAttack Vector
Network
ACAttack Complexity
Low
ATAttack Requirements
None
PRPrivileges Required
High
UIUser Interaction
None
VCVulnerable System Confidentiality
High
VIVulnerable System Integrity
High
VAVulnerable System Availability
High
SCSubsequent System Confidentiality
High
SISubsequent System Integrity
High
SASubsequent System Availability
H (GHSA-J6WC ALONE; CHAIN USES ADDITIONAL HIGH GHSAS FOR EARLIER FOOTHOLD)
ControlPlane (28 September 2026), with the OpenBao community, describes a full exploit chain from unauthenticated access to remote code execution in OpenBao (and notes the same class of issues affect HashiCorp Vault / IBM remediation still pending at publication). The chain combines multiple independently reported issues patched in OpenBao v2.6.3 and v2.7.0 (shipped 23 Sep 2026), including GHSA-j6wc-jpvg-xfxq — Critical CVSSv4 9.4 remote code execution via Raft snapshot restore / plugin-catalog replacement (Raft storage backend; privileged snapshot endpoints; original to HashiCorp Vault) — plus High issues GHSA-x8fg-h69x-p28f (PKI ACME validation bypass, 8.2), GHSA-mjch-vcw3-hhmf (cross-namespace policy access, 7.7), and GHSA-fg5x-7whg-6c28 (ACL deny bypass via non-canonical URLs, 7.6). ControlPlane: second-ever remote code execution vulnerability class in Vault/OpenBao; fork-coordination gaps can leave customers exposed. Operators not using Raft storage are not affected by the snapshot RCE path per GHSA-j6wc. Desk does not reproduce the chain. Primary advisory: OpenBao GHSA-j6wc; narrative: ControlPlane 28 Sep.
