SolarWinds Trust Center advisory CVE-2026-28324 documents an unauthenticated remote code execution vulnerability in Observability Self-Hosted due to insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected. CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected: Observability Self-Hosted 2026.2.2 and below. Fixed: 2026.2.3. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. Same patch train also addresses sibling CVE-2026-28325 (separate desk card). Distinct from Access Rights Manager CVE-2026-28326 (already on desk). Primary: SolarWinds Trust Center; wire: SecurityWeek 24 Sep 2026.
SolarWinds Trust Center — CVE-2026-28324 Observability Self-Hosted
Ridge Security (public write-up 23 September 2026; SecurityWeek In Other News 25 Sep) and TDengine security advisories document CVE-2026-42542 (TD-SEC-2026-001; GHSA-vg95-j2hf-hvjx; vendor published 4 June 2026; reporter Yan @ Ridge Security): an integer underflow in uvConnMayGetUserInfo() (transSvr.c) on the pre-authentication RPC path lets an unauthenticated remote attacker crash taosd with one crafted packet to the default TCP 6030 listener (CWE-191). Confirmed impact is denial of service (heap overflow / SIGSEGV); Ridge does not claim RCE and reports no in-the-wild exploitation telemetry. CVSS 7.5 HIGH. Affected: TDengine >= 3.4.0.0 through 3.4.1.5; fixed in 3.4.1.6. Relevant to industrial telemetry, energy/utilities, IoT and OT monitoring stacks that embed TDengine. Primary: Ridge Security blog + TDengine security advisories / GHSA.
Ridge Security — TDengine CVE-2026-42542 one-packet DoS (23 Sep 2026)
CVE-2026-96512 (Red Hat CNA; published 23 September 2026; oss-security disclosure 24 Sep) is a high-severity incorrect-authorization flaw in Sudo: when sudoers uses NOTBEFORE/NOTAFTER timestamps that omit a trailing Z, parse_gentime() calls mktime() which re-reads the caller’s TZ. A local user who already has such a time-bound sudoers rule can set an extreme POSIX TZ offset (e.g. TZ=XXX24) and shift the authorization window by ~25 hours, keeping an expired rule valid or unlocking a future rule early. Authentication/PAM is not bypassed. Affected: Sudo 1.8.20 through 1.9.17p2 (and main before the fix). Reporter Ermenson Junior (28 Aug); Todd Miller fixed in main 29 Aug (commit 1820a349); no upstream 1.9.18 release yet at disclosure. Red Hat rates Important; ships RHSA-2026:71609. Workaround: append Z (UTC) to all NOTBEFORE/NOTAFTER timestamps. Primary: Red Hat CVE; secondary: oss-security; wire: Cyber Security News 25 Sep.
Red Hat — CVE-2026-96512 (sudo TZ / NOTBEFORE|NOTAFTER)
Australian research firm elttam (blog dated 23 September 2026) discloses a remote pre-authentication format-string vulnerability (CWE-134; CVE-pending) in tac_plus, the long-lived open-source TACACS+ daemon descended from Cisco's 1990s Developer's Kit. On an error path, attacker-controlled session.port is passed as the format string to report()/logging helpers, yielding code execution as the daemon user (root by default) after the shared secret is known. A separate pre-auth truncated-AUTHEN/START error-reply oracle lets an attacker offline-crack weak PSKs (wordlist demo), and a client-laundering path can place a format-string payload via an oversized username on a TACACS-speaking network device without knowing the key. Affected: Cisco original kit lineage, every Shrubbery release through F4.0.4.31 (Feb 2026), and the archived Facebook/Meta fork (F4.0.4.28-7fb — will not be fixed). Shrubbery published F4.0.4.32 on 21 September 2026 fixing both sinks (changelog: single-line CWE-134 note). Cisco confirmed no Cisco product affected. Disclosure took ~90 days (Meta out-of-scope for archived fork; Shrubbery reply from spam queue). No CVSS assigned yet (CVE-pending). Primary: elttam; vendor download: shrubbery.net/tac_plus.
Zoho ManageEngine Applications Manager advisory for CVE-2026-86708 (Critical; fixed 08 September 2026): the installer included a Google Cloud service-account private key with broader-than-required permissions used for push notifications. An unauthenticated attacker who obtained the public installer could extract and misuse the key to impersonate the service account and access or modify associated cloud resources (application data, project configuration, storage, messaging, or other GCP services beyond push). Affected: version 182200 and below. Fixed: 182300 and above; also 181104–181109 and 182001–182009 trains per vendor. Fix replaces the key with a new encrypted key scoped to push-notification permissions — upgrade via service pack. CVE.report / CNA CVSS 3.1 10.0 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). WA SOC advisory 20260924001 (24 Sep 2026) groups this with two other ManageEngine criticals and states no exploitation observed on WA Government networks at time of writing. Primary: ManageEngine Applications Manager security-updates page; AU: WASOC 20260924001.
Zoho ManageEngine OpManager MSP advisory for CVE-2026-19599: Remote Code Execution in the Notification Profile module, exploitable by a customer administrator user on the MSP Central installed server via broken access control on an API that runs commands as part of profile functionality. Vendor severity High on the advisory page; CVE.report / CNA CVSS 3.1 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected trains (vendor): OpManager MSP 128166–128709 (fix 128711, 14 Aug 2026); 128718–129001 (fix 129125, 13 Aug 2026); 129100–129108 and 129117–129122 (fixed 14 Aug 2026). WASOC 20260924001 (24 Sep 2026) summarises as versions 12.8.709 and below / CVSS 9.9 Critical and reports no exploitation on WA Government networks at time of writing. Fix enforces strict access control so only MSP Central Server administrators can use the sensitive APIs. Primary: ManageEngine OpManager MSP advisory; AU: WASOC 20260924001.
Apache Tomcat security pages (Fixed in 11.0.26 dated 15 September 2026; issues made public 23 September 2026) document twelve vulnerabilities across WebSocket, HTTP/2, AJP, CLIENT_CERT/OCSP, and TLS CRL handling. Highest ADP CVSS 3.1 scores on CVE.report: CVE-2026-76183 Important — WebSocket endpoint security-constraint bypass via request paths parsed as endpoint templates (9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; affects 11.0.0-M1–11.0.25); CVE-2026-86248 Moderate (Apache) / 9.8 ADP — CLIENT_CERT soft-fail OCSP incomplete fix under FFM (11.0.0-M14–11.0.25); CVE-2026-86350 Important — HTTP/2 request-header mix-up regression from CVE-2026-41293 fix (9.1; 11.0.22–11.0.25). Other public CVEs in the same train: CVE-2026-87022 WebSocket per-message-deflate smuggling (7.5); CVE-2026-78383 AJP DoS missing body (7.5); CVE-2026-77791 WebSocket close busy-wait DoS (7.5); CVE-2026-79677 async WebSocket write timeout DoS (7.5); CVE-2026-77762 HTTP/2 trailer injection race (8.1); CVE-2026-78437 HTTP/2 malformed-request DoS (7.3); CVE-2026-75973 Jakarta Authentication cross-context realm mix-up (7.3); CVE-2026-73581 OpenSSL/OpenSSL-FFM CRL ignore with keystore (6.5); CVE-2026-77756 Transfer-Encoding on HTTP/1.0 behind reverse proxy (3.7). Same CVE set fixed in Tomcat 10.1.60 and 9.0.122. Apache does not ship per-CVE binary patches — upgrade to a release that contains the fixes. No in-the-wild claim on the vendor pages reviewed this pass. Primary: Apache Tomcat 11 security page (Fixed in 11.0.26); wire: Cyber Security News 24 Sep 2026.
CERT/CC VU#369093 (revised 23 September 2026) and NVD document two MLflow flavor flaws that let crafted MLmodel artifacts reach pickle deserialization even when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. CVE-2026-96804: statsmodels flavor omits the control in _load_model() (NVD: versions 2.1.0–3.14.0; CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N). CVE-2026-96775: dspy flavor applies the control only when model_path ends in .pkl, so a non-.pkl path bypasses it (NVD: dspy >=2.0; CVSS 3.1 8.8 AV:N/AC:L/PR:N/UI:R). Attack path needs write/supply influence over models a victim loads. CERT: statsmodels patched in MLflow >=3.15.0; MLflow not coordinated for a full statement — until a further dspy fix, avoid loading models via the dspy flavor if pickle must stay blocked. Reporter: Prasanna Dabi. Primary: CERT VU#369093; NVD records.
NVD/MSRC (published 23 September 2026) lists CVE-2026-70125 as a Microsoft Outlook Remote Code Execution vulnerability. Microsoft CVSS 3.1 base 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected product lines named in the NVD record: Microsoft 365 Apps for Enterprise; Microsoft Office LTSC 2021; Microsoft Office LTSC 2024 (version ranges point to Office security releases via aka.ms/OfficeSecurityReleases). No public exploitation claim in the NVD “Received” record reviewed this pass. Apply current Office/Outlook security updates from the MSRC update guide; do not invent build numbers beyond the vendor release channel.
Adobe Experience Manager Forms JEE APSB26-151 (CVE records published 22 September 2026, 18:56 UTC; 23 September, 2:56 am Perth) patches six vulnerabilities. Adobe's CVE records score them as follows (CVSS 3.1): CVE-2026-75745 (incorrect authorization → arbitrary code execution) 10.0 Critical; CVE-2026-82000 (SSRF → privilege escalation) 9.6 Critical; CVE-2026-81995 (improper input validation → arbitrary code execution) 9.1 Critical; CVE-2026-81999 (SSRF → privilege escalation) 8.7 High; CVE-2026-75744 (stored cross-site scripting) 8.1 High; and CVE-2026-75743 (CSRF → security feature bypass) 7.1 High. Affected: AEM 6.5 Forms JEE 6.5.25 and AEM 6.5 LTS Forms JEE SP2. Fixes: a hotfix for 6.5.25; 6.5 LTS SP3. Companion to Connect APSB26-150 same day. Primary: Adobe APSB26-151 helpx; scores: Adobe's CVE records (CVE.org). Correction (24 Oct 2026): Adobe's CVE record scores CVE-2026-75745 at 10.0 (CVSS 3.1; no privileges or user interaction needed), so it, not CVE-2026-82000 (9.6), is the highest-rated flaw in APSB26-151. (source: CVE record CVE-2026-75745 (Adobe)) Correction (25 Oct 2026): an earlier correction on this card gave severity ratings and scores from Adobe's bulletin that we could not verify; the card now gives only the scores in Adobe's CVE records, and a wire credit we could not verify has been removed. (source: CVE.org) Correction (25 Oct 2026): the card date has moved from 22 to 23 September 2026, the Perth date of the publication of Adobe's CVE records (22 September, 18:56 UTC; 23 September, 2:56 am Perth). (source: CVE.org) Correction (26 Oct 2026): an earlier update today restored severity ratings from Adobe's APSB26-151 bulletin; this desk's plain request for the bulletin was redirected (HTTP 301) rather than answered, so that update has been withdrawn and the card again gives only the scores in Adobe's CVE records. The hotfix name, Adobe's priority rating and its statement on in-the-wild exploitation, which came from the bulletin, have also been removed. (source: CVE.org)
Adobe APSB26-151 — AEM Forms JEE security update (22 Sep 2026 US time)
Hewlett Packard Enterprise advisory HPESBNW05137 (rev.1, 22 September 2026) covers multiple flaws in HPE Networking Analytics and Location Engine (ALE) ≤ 5.0.0.0, fixed in ALE 5.1.0.0. Lead criticals: CVE-2026-76708 (CVSS 9.8) — default hard-coded credentials on administrative/system accounts enabling unauthenticated remote login to the ALE management interface and underlying OS (CWE-798); CVE-2026-76709 (CVSS 9.8) — unauthenticated remote arbitrary file write with elevated privileges via an internal administrative component. Additional highs include info disclosure, data injection, auth’d root filesystem/command execution, MitM RCE, and API password-hash disclosure (CVE-2026-76710 through CVE-2026-76717). HPE stated no known public exploit code or active exploitation at advisory time. Primary: HPE HPESBNW05137; secondary: CVE.report / Tenable CVE pages; wire: Cyber Security News 25 Sep.
