CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 21 September 2026 (catalogVersion 2026.09.21; FCEB due 24 September 2026; forensic triage required under BOD 26-04). Zyxel’s security advisory (16 June 2026) documents a stack-based buffer overflow (CWE-121) in the CGI program of GS1900 series switch firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands. NVD (Zyxel as CVSS source) scores CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVD description cites GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0. Vendor patch table maps each GS1900 SKU from 2.90(.*).1)C0 and earlier to fixed 2.90(.*).2)C0 builds (e.g. GS1900-48HPv2 → 2.90(ABTQ.2)C0; GS1900-8 → 2.90(AAHH.2)C0). Known ransomware campaign use: Unknown per CISA. Australia relevance: GS1900 is a common SMB/managed-access switch line — patch LAN-management exposure.
BleepingComputer (Sergiu Gatlan; coverage of weekend disclosure) reports security researcher Abdelhamid Naceri (MSNightmare / Nightmare Eclipse) released BigDiskBuster, a local proof-of-concept that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates while it runs. The tool watches Defender Platform/Definition Updates directories on the C: volume and starves the installer by creating a hidden delete-on-close temp file sized to remaining free space, with worker threads reclaiming capacity if files change; it may also open MRT.exe with restrictive sharing to interfere with staging. Distinct from desk cards ms-defender-shieldcrash-20260909 / CVE-2026-69414 (ShieldCrash SYSTEM file-read after ShieldBreak). No CVE assigned in the BleepingComputer write-up; Microsoft initially had not commented. PoC: github.com/MSNightmare/BigDiskBuster. Correction (24 Oct 2026): BleepingComputer's article, updated 26 September, carries a Microsoft statement that Microsoft Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity; Microsoft did not say a CVE had been assigned and told customers to keep Defender security intelligence and platform updates current. (source: BleepingComputer) Correction (25 Oct 2026): the card date has moved from 21 to 20 September 2026 (Perth time), the date the BigDiskBuster proof-of-concept repository (github.com/MSNightmare/BigDiskBuster) was created on GitHub: 20 September, 07:31 Perth time (AWST), which was 19 September, 23:31 UTC, per the repository creation timestamp in the GitHub API. BleepingComputer's report is dated 22 September (05:55 US Eastern, 17:55 Perth). A Cyber Security News link dated 21 September has been removed because we can no longer read that site, so its date could not be checked. (source: GitHub)
BleepingComputer — New Windows Defender zero-day blocks antivirus updates (BigDiskBuster)
D-Link Security Announcement SAP10516 (published 18 September 2026; last updated 21 September 2026) confirms it is investigating two critical flaws reported against DIR-822A firmware A_101. CVE-2026-86296 is a stack-based buffer overflow in udhcpcd (strcpy in udhcpcd/serverpacket.c): network-reachable, no authentication, no user interaction; CNA/VulDB publish CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 10.0; a public proof-of-concept is reported. Companion CVE-2026-86510 is an out-of-bounds write in L2TP Control Message Parser tunnel_set_params (CVSS 3.1 9.9 / CVSS 4.0 9.4 per vendor write-up); low privileges, no user interaction. Both statuses: Under Investigation — D-Link has not yet confirmed full hardware-revision scope or a remediation build. Primary: D-Link SAP10516; CVE metadata: CVE.report / VulDB; wire: Cyber Security News 22 Sep 2026.
CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on 18 September 2026, citing active exploitation. CVE-2025-39682 (NVD CVSS 3.1 9.8 Critical): improper check in the TLS receive path — zero-length records on rx_list can bypass intended recvmsg() record-type handling. CVE-2026-53266 (NVD 8.8 High): out-of-bounds write in ebtables SNAT ARP rewrite path. CVE-2025-39964 (NVD 7.8 High): AF_ALG race allowing concurrent writes to the same crypto socket, leaving inconsistent socket state (CWE-362). UPDATE 25 September 2026 — IDNsec / Muhammad Alifa Ramdhan (STAR Labs; kernelCTF US$113,337): retrospective shows CVE-2025-39964 can escalate a local user to root and escape a Docker container via scatterlist/usercopy oracle → core_pattern overwrite; Cybersecurity News amplify same day. Upstream fix adds exclusive write ownership on af_alg_sendmsg; CSN cites fixed stables including Linux 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, 6.16.10 (confirm via distro advisories). CISA BOD 26-04 FCEB due 21 September 2026; ransomware use Unknown; forensic triage required. Distinct from DirtyAH6/PPPoEject/TUNderflow/DiagSpill local-root quartet. Primary: CISA KEV; research: IDNsec; CVSS from NVD.
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability. Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
oss-security (18 September 2026) summarises four long-lived Linux kernel local privilege-escalation bugs nicknamed DirtyAH6 (CVE-2026-80844, xfrm/AH6 routing-header segments_left validation), PPPoEject (CVE-2026-68121, pppoe_sendmsg header pointer after dev_hard_header), TUNderflow (CVE-2026-81000, TUN/TAP oversized headroom underflow; CVSS 3.1 7.8), and DiagSpill (CVE-2026-74469, SCTP transport_count overflow; CVSS 3.1 8.8). First three LPEs generally need unprivileged user namespaces or specific capabilities; DiagSpill does not. Corruption in DirtyAH6 and DiagSpill can be remotely reachable only under very specific circumstances (oss-security). CVE records list stable-tree fixes and unaffected lines such as 5.10.269+/5.15.220+ (DirtyAH6), 5.10.270+/5.15.221+ (TUNderflow), 5.10.265+/5.15.216+ (PPPoEject/DiagSpill) among others — apply your distro’s kernel security updates rather than cherry-picking. No CVSS published yet in the CVE JSON for DirtyAH6 (CVE-2026-80844) at fetch time — do not invent. Primary: oss-security roundup; also MITRE CVE records / kernel stable commits.
Linux Kernel Out-of-Bounds Write Vulnerability. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Linux Kernel Race Condition Vulnerability. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
WordPress 7.1.1 (17 September 2026) fixes an unauthenticated stored XSS in core wpautop() that Patchstack tracks as CVE-2026-93485 (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and industry coverage dubs Comment2Shell. An anonymous visitor submits a comment with a line break inside an allowed HTML attribute; comment sanitisation (wp_kses) accepts it, then display-time reformatting turns the payload into a live event handler. When a logged-in administrator later opens the page, the script runs in their browser session and can upload a malicious plugin (web shell) — server RCE requires that admin session and a theme that renders comments in the vulnerable path (block themes / compatible classic themes). WordPress wording: exploitable “subject to comment approval”; Patchstack notes moderation is not a security control (default first-comment hold can be bypassed). No in-the-wild exploitation claimed; not on CISA KEV. Affected: WordPress 4.7 through 7.1 before the 17 Sep security builds. Fixed: 7.1.1, 7.0.5, 6.9.8, and matching backports through 4.7.36. Distinct from desk card wordpress-click2shell-20260918 (theme-preview forced install in the same 7.1.1 release). Primary: WordPress 7.1.1 release; Patchstack analysis; wire: The Hacker News 22 Sep 2026.
SolarWinds Trust Center advisory CVE-2026-28326 (first published 17 September 2026) documents an unauthenticated remote code execution flaw in Access Rights Manager (ARM) stemming from a hard-coded static key. CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network). Affected: ARM 2026.2 and all previous versions. Fixed: ARM 2026.2.1. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. The Hacker News (19 Sep) also notes earlier July WHD SAML bypass CVE-2026-28323 (9.8; fix WHD 2026.2.1) and Serv-U fixes — those are separate advisories; this card is ARM only. Primary: SolarWinds Trust Center; secondary: THN / ARM 2026.2.1 release notes.
SolarWinds — CVE-2026-28326 ARM unauthenticated RCE (17 Sep 2026)
WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). Primary: WordPress 7.1.1 release; research: pwn.ai; wire: The Hacker News 18 Sep 2026.
WordPress — 7.1.1 maintenance and security release (17 Sep 2026)
Microsoft Security Update Guide lists CVE-2026-85885 (NVD published 17 September 2026): command injection (CWE-77) in M365 Copilot allowing an authorized (low-privilege) attacker to elevate privileges over the network. Microsoft CVSS 3.1 base 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). NVD cveTags: exclusively-hosted-service — same September 2026 MSRC cloud-transparency release train as desk cards cve-2026-85887 (Copilot info disclosure 7.7) and cve-2026-85889 (Azure AI Foundry). Expect Microsoft’s hosted-service pattern: CVE published for transparency with mitigation already applied in the service (confirm on MSRC for customer action). Distinct CVE from 85887. Primary: MSRC; secondary: NVD.
