AWS Security Bulletin 2026-115-AWS (Publication 22 September 2026 10:00 AM PDT) documents CVE-2026-94384: missing authorization in Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) sfExecuteAWSService before 5.26. Any IAM principal with lambda:InvokeFunction on the function can escalate and call AWS APIs allowed by the function's privileged execution role even when their own IAM policy denies those actions — the Lambda becomes a privileged parameter-dispatch proxy. Amazon CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); CVSS 4.0 6.4 Medium. Affected SAR app versions 5.15 through <5.26 (CSN also cites through 5.24.16). Remediation: upgrade to 5.26 or later; after setup delete or disable sfExecuteAWSService, or restrict InvokeFunction to the intended CTI Adapter IAM user only. Credit: Chang Li (Xidian University) via CVD. Primary: AWS bulletin 2026-115-AWS; metadata: CVE.report; wire: Cyber Security News 23 Sep 2026.
cPanel support advisory (22 September 2026) documents CVE-2026-87899: an authenticated cPanel account holder can escalate through CalDAV/CardDAV functionality to code execution as root and full server control. Affects cPanel/WHM v120 or later; patched in 11.134.0.57+, 11.136.0.41+, 11.138.0.8+, and WP Squared 11.138.1.11+. Same-day related advisories (not separate desk cards): CVE-2026-87900 (WP Toolkit ≤6.11.2-10794 — authenticated cPanel user can modify other accounts' databases; fix WP Toolkit 6.11.3+) and CVE-2026-68490 (CalDAV/CardDAV — local user can read other accounts' calendar/contacts; same cPanel/WHM patched trains; no root). Vendor advisories do not publish CVSS and do not state exploitation. Credited to Ali Mustafa (rz1027). Primary: cPanel support CVE-2026-87899; secondary: The Hacker News 23 Sep 2026. UPDATE (24 Oct 2026): The CVE record (HackerOne as CNA) scores CVE-2026-87899 at 9.4 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). (source: CVE record CVE-2026-87899)
Vercel GitHub advisory GHSA-vcvr-r3jv-pc5j (published 22 September 2026; CVE-2026-94545) documents remote code execution in the Node.js ImageResponse implementation from next/og when apps pass attacker-controlled values into SVG content, attributes, or styles during Open Graph / social-preview image generation (upstream Satori path). Vercel rates Critical with CVSS 4.0 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Affected: Next.js >=16.2.0 <16.3.6 on the Node.js runtime (default). Not affected per advisory/industry coverage: Edge ImageResponse and Next.js 15. Patched: 16.3.6 (22 Sep). Inventory routes importing ImageResponse from next/og that echo request/URL input into SVG; prefer not placing untrusted input in SVG title/attrs/styles until patched. No in-the-wild exploitation claimed in the 22–23 Sep Vercel/THN materials. Primary: GHSA-vcvr-r3jv-pc5j; wire: The Hacker News 23 Sep 2026.
UPDATE 23–24 Sep 2026: BleepingComputer reports threat actors moved from probing to exploiting CVE-2026-87902 to write files that execute shell commands when accessed. Patchstack saw first malicious requests at 17:44 UTC on 22 September 2026 (under five hours after WordPress 7.1.2 shipped), then ~10× traffic increase delivering payloads. Flaw: unauthenticated get_page_template() path traversal to include a chosen readable local .php outside active theme dirs; RCE needs theme top-level page-* dir plus a readable include target (e.g. pearcmd.php with register_argc_argv). WordPress/GHSA rate Critical (~9.2 CVSS 4.0 UI; NVD/CISA secondary CVSS 3.1 8.1 High). Official PHP Docker image and default cPanel on PHP <8.5 called out. Fix: 7.1.2 with backports through eligible branches to 4.7 (pre-4.6 unfixed). Distinct from click2shell/comment2shell (7.1.1). UPDATE 25 Sep 2026: CISA added CVE-2026-87902 to KEV (dateAdded 2026-09-25). Primary: WordPress 7.1.2 + GHSA; exploitation wire: BleepingComputer 23 Sep 2026; KEV: CISA.
F5 (CVE published 22 September 2026; advisory K000162605) documents CVE-2026-94127: when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server and BIG-IP APM is configured as an OAuth Authorization Server, specific malicious traffic can lead to unauthenticated remote code execution. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization-server profiles) are not affected. Data-plane issue (no control-plane exposure); Appliance mode is also vulnerable. F5 CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 Critical. CISA added CVE-2026-94127 to KEV on 22 September 2026 (due 25 September 2026; forensic triage under BOD 26-04); known ransomware campaign use Unknown. Temporary mitigation: vendor-provided iRule, then install final vendor hotfixes. Distinct from desk cards on BIG-IP APM PoisonedRefresh / in-memory PHP webshell malware (Sophos/ESET). Primary: F5 K000162605; metadata: NVD; KEV confirmation: CISA 22 Sep 2026.
Check Point sk1000171 (approved/created 20 September 2026; last modified 22 September 2026; CVE published 22 Sep) documents CVE-2026-93616: directory traversal plus file upload lets an unauthenticated attacker upload and execute arbitrary scripts on Quantum Security Management / Multi-Domain / Log Server / Multi-Domain Log Server / SmartEvent. Check Point CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-22. Vendor states the vulnerability is exploited in the wild and a handful of customers have been attacked. Smart-1 Cloud already patched; firewall appliances / Spark not affected. LivePatch Take 28/29 does not fix this issue (no LivePatch for this fix). Distinct from desk CVE-2026-91843 (login stack overflow; same Jumbo trains also pick that up). Primary: Check Point sk1000171; metadata: CVE.report; wire: BleepingComputer 22 Sep 2026.
Check Point sk1000171 — CVE-2026-93616 Management Server path traversal (22 Sep 2026)
Arista Security Advisory 0183 (CVE published 22 September 2026) documents CVE-2026-93952 in on-premises VeloCloud Orchestrator (VCO): a remote attacker with network access to the VCO web interface and the public part of an Edge authentication certificate may reach privileged internal functionality and impact the VCO host when certificate-based Edge→VCO authentication is configured. Arista/CNA CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 9.5; Arista states the issue was discovered externally and is known to be actively exploited. Hosted/Dedicated VCO already patched. On-prem trains: 5.2.3.15 and earlier → fix 5.2.3.16+; 6.4.2.7 and earlier → fix 6.4.2.8+; 6.1.3.7 and earlier and 7.0.0.2 and earlier — no fix listed as of 22 Sep 2026 (Arista says supported-train fixes forthcoming). Distinct from July exploited VCO CVE-2026-16812. Primary: Arista SA-0183 URL; metadata: CVE.report; wire: The Hacker News 22 Sep 2026.
Red Hat CVE-2026-75939 (published 21 September 2026): openshift/oc-mirror incorrectly verifies PGP release-image signatures by checking for signature errors before the entire signed body is processed, enabling a verification bypass. A remote attacker who can intercept/manipulate traffic to the signature endpoint can craft a PGP message with a valid Red Hat release key ID but a forged signature so oc-mirror accepts and mirrors a malicious release payload into a disconnected/air-gapped registry. Red Hat CVSS 3.1 7.4 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), CWE-347. Primary: Red Hat CVE page; metadata: CVE.report; wire: Cyber Security News 22 Sep 2026. UPDATE (26 Oct 2026): the CVE record (Red Hat, updated 15 October) now lists erratum RHSA-2026:79039, which fixes the oc-mirror-plugin-rhel9 container for OpenShift Container Platform 4.18. (source: CVE record CVE-2026-75939)
Red Hat — CVE-2026-75939 oc-mirror PGP verification bypass
CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 21 September 2026 (catalogVersion 2026.09.21; FCEB due 24 September 2026; forensic triage required under BOD 26-04). Zyxel’s security advisory (16 June 2026) documents a stack-based buffer overflow (CWE-121) in the CGI program of GS1900 series switch firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands. NVD (Zyxel as CVSS source) scores CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVD description cites GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0. Vendor patch table maps each GS1900 SKU from 2.90(.*).1)C0 and earlier to fixed 2.90(.*).2)C0 builds (e.g. GS1900-48HPv2 → 2.90(ABTQ.2)C0; GS1900-8 → 2.90(AAHH.2)C0). Known ransomware campaign use: Unknown per CISA. Australia relevance: GS1900 is a common SMB/managed-access switch line — patch LAN-management exposure.
