Red Hat Product Security (public_date 17 September 2026) documents CVE-2026-92925 in Redis community: the cluster bus packet parser for PING/PONG/MEET fails to validate null-termination on string-carrying extensions (CWE-125), enabling a remote attacker on an adjacent network to craft a malicious packet and trigger an out-of-bounds read — sensitive-info disclosure or remote DoS. Red Hat CVSS 3.1 base 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H); threat severity Important; CISA SSVC notes exploitation none. Upstream fix referenced via redis/redis PR #15263 / commit 37894fae and release tag 8.10.0. Red Hat CVE page lists mixed product package states (Affected / Will not fix / Not affected) — check RH advisory for your workload. No in-the-wild claim in RH/NVD snippets this pass. Primary: Red Hat CVE; secondary: upstream 8.10.0 release / NVD.
Red Hat — CVE-2026-92925 Redis cluster bus OOB read (17 Sep 2026)
Microsoft Security Update Guide (September 2026 release; MSRC releaseDate 17 September 2026 PDT) published two exclusively-hosted Azure AI Foundry elevation-of-privilege CVEs for transparency. CVE-2026-85889 (Critical, Microsoft CVSS 3.1 base 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-306): missing authentication for a critical function allows an unauthenticated network attacker to elevate privileges. CVE-2026-85917 (Critical impact class / High base 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; CWE-918): SSRF allowing unauthenticated privilege elevation. Microsoft states both are already fully mitigated in the hosted service — no customer patch action; CVEs are for cloud transparency (aka.ms/MSRC-Cloud-CVEs). MSRC: publicly disclosed No; exploited No. NVD received records 17 September 2026. Primary: MSRC CVE-2026-85889; companion: MSRC CVE-2026-85917; NVD indexes both.
Microsoft Security Update Guide (September 2026; MSRC releaseDate 17 September 2026 PDT) lists CVE-2026-85887, an M365 Copilot information-disclosure vulnerability: incorrect permission assignment for a critical resource (CWE-732) lets an authorized (low-privilege) attacker disclose information over the network. Microsoft CVSS 3.1 base 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); MSRC severity Critical / impact Information Disclosure. Exclusively hosted service: Microsoft states the issue is already fully mitigated — no customer patch steps; CVE published for cloud transparency. MSRC: publicly disclosed No; exploited No. NVD received 18 September 2026 00:17 UTC. Distinct from Azure AI Foundry CVE-2026-85889/85917. Primary: MSRC; secondary: NVD.
MSRC — CVE-2026-85887 M365 Copilot information disclosure (17 Sep 2026)
CVE-2026-92838 (published ~17 September 2026 per Tenable) is a DLL hijacking issue in the GeoVision GV-Remote E-Map desktop application: one or more DLLs are loaded from an unsafe search path. A local attacker with write access to a directory searched before the legitimate library location can plant a malicious DLL and achieve code execution as the GV-Remote E-Map process. Tenable CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor cyber-security portal (geovision.com.tw/cyber_security.php) hosts GeoVision advisories; this CVE id was not visible as a labelled row on that index during the 18 September 2026 07:00 Perth desk pass — treat Tenable/CVE record as primary until a matching PDF advisory is linked. No public in-the-wild exploitation claim on the Tenable snippet reviewed. Relevance: physical-security / VMS operators running GeoVision Windows clients.
CVE-2026-81546 (published ~17 September 2026 per Tenable/NVD indexing) covers a stack-based buffer overflow in the Affinity by Canva application before the 3.3.0 September 2026 release: inadequate bounds checking when parsing Affinity document files. A crafted Affinity document opened by a user can lead to arbitrary code execution. Tenable lists CVSS 3.1 base score 7.7 (High). Australia relevance: Affinity is Canva’s creative suite (Canva is Australian-headquartered). Patch: upgrade Affinity by Canva to 3.3.0 or later. No public exploitation claim on the Tenable/NVD snippets reviewed this pass. Primary: CVE/NVD/Tenable record; treat vendor release notes as authoritative for build numbers when published.
Tenable — CVE-2026-81546 Affinity by Canva (indexed 17 Sep 2026)
Doyensec research post (17 September 2026) shows Open vSwitch’s kernel datapath can strip SKBFL_SHARED_FRAG from a still-forwarded packet, re-opening the Fragnesia Dirty COW-class primitive: an unprivileged user can cause in-place ESP decrypt over page-cache pages they may only read, writing attacker-chosen bytes into root-owned file page cache. Tracked as CVE-2026-90049, CVE-2026-89487 and CVE-2026-80977; reported to the Linux kernel security team and coordinated with OVS maintainers. Builds on prior Dirty Frag / Fragnesia work (including CVE-2026-43284 and CVE-2026-43500). Impact surface: virtualisation/container stacks using OVS (OpenStack Neutron, oVirt, Antrea/OVN-Kubernetes, libvirt bridges, etc.). Primary: Doyensec blog; await distro/kernel OVS package advisories for fixed revisions.
Trend Micro Zero Day Initiative advisory ZDI-26-708 / ZDI-CAN-29849 (published 16 September 2026; CVSS 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) documents an unpatched Microsoft Windows privilege-escalation issue in HTTP proxy authentication handling. A low-privileged local attacker who can change the user proxy setting to an attacker-controlled server can coerce NTLM authentication in the machine-account context (commonly via Network Connectivity Status Indicator / WinHTTP connectivity checks running as NETWORK SERVICE). Microsoft acknowledged the report (May 2026), initially indicated a September fix, then on 31 August 2026 said the issue did not meet the Windows security servicing bar; ZDI published as a 0-day on 16 Sep. No CVE assigned. ITRESIT Labs (28 Sep) describes a pentest chain using the coercion into AD CS Web Enrollment relay when EPA/HTTPS are not enforced — that chain is environmental, not part of ZDI’s scored impact. Primary: ZDI-26-708; technical write-up: ITRESIT 28 Sep.
ZDI-26-708 — Microsoft Windows HTTP Proxy Privilege Escalation (0-day, 16 Sep 2026)
oss-security disclosure by Hyunwoo Kim (17 September 2026; embargo lift) and CVE published 16 September 2026: CVE-2026-89775 is a guest-to-host escape in KVM/arm64 when nested virtualization is enabled. Type truncation of the stage-1 walk level can make VNCR pseudo-TLB size computation return 0 (“size unknown”); invalidation treats that as an empty range and skips, leaving a freed host page mapped writable so a malicious guest gets 64-bit R/W without trap/VM-exit. Introduced mainline 7270cc9157f47 (14 May 2025); fixed 8053393680d4 (6 Aug 2026). Red Hat rates Important, CVSS 3.1 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). On hosts with nested virt and world-writable /dev/kvm (e.g. some RHEL configs), also a local root LPE path. Primary: oss-security; Red Hat CVE page; wire: The Hacker News / Cyber Security News 22 Sep 2026.
Veeam KB4852 documents CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows: a low-privileged local user can obtain SYSTEM by abusing elevated session UIDs cached against a client-controlled session UID on the local gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe (UIDs readable from C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log). Vendor CVSS 4.0 score 7.3 High (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). KB4852 says the flaws it lists affect Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds. Fixed starting with Veeam Backup & Replication 13.0.2.29; Veeam's Agent for Windows fix list (KB3108) shows CVE-2026-32996 fixed in Agent build 13.0.3.1220. Arctic Wolf warned of active exploitation after a public proof-of-concept (PoC) exploit was posted on GitHub, as reported by The Hacker News (22 September 2026) — prioritise shared workstations, admin endpoints, and multi-user hosts. Same KB also ships CVE-2026-32997 (Backup Administrator arbitrary file write on Linux Veeam Software Appliance; CVSS 4.0 8.6) fixed in the same 13.0.2.29 build. Primary: Veeam KB4852; Agent fix build: Veeam KB3108; exploitation context: Arctic Wolf via The Hacker News 22 Sep 2026. Correction (24 Oct 2026): KB4852 gives the affected range as Veeam Backup & Replication 13.0.1.2067 and earlier version 13 builds, not Agent builds; the fixed Agent build 13.0.3.1220 is now sourced to Veeam KB3108 because the Arctic Wolf post no longer loads. (source: Veeam KB4852)
Check Point advisory sk1000155 (disclosed 16 September 2026; NVD published same day) documents CVE-2026-91843, a stack overflow (CWE-121) in the unauthenticated login process on Security Management and Log Servers. Check Point CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker without credentials can run arbitrary code as root over the network; Check Point states the vulnerable path runs through the Trusted Clients setting (hosts allowed to connect via SmartConsole). Vendor and CISA SSVC: no indication of in-the-wild exploitation; not in KEV as of mid-September catalog checks. Affected branches by Jumbo Hotfix Take (or older): R82.20 (apply Take 29+), R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below; R81.10/R81/R80.x End of Support (ticket Check Point for fix or upgrade). Standalone, Log Server, and Multi-Domain deployments also vulnerable per vendor confirmation (THN update 18 Sep). Smart-1 Cloud hosted management is not affected (fix already deployed). Remediation: LivePatch per sk1000155; customers with automatic updates (sk175504) already protected. Distinct from desk card checkpoint-vpn-cert-20260910 (VPN CVE-2026-85102/85103). Primary: Check Point sk1000155; secondary: NVD / Censys advisory.
Check Point sk1000155 — CVE-2026-91843 Security Management/Log Server (16 Sep 2026)
CVE-2026-65388 (GHSA-mx96-5vvg-x2mg; Apple/containerization Swift package) covers RegistryClient following the WWW-Authenticate realm without validating host or scheme. A remote attacker who controls a container registry can redirect the client’s token request to an attacker-chosen host and disclose the victim’s registry credentials. GitHub advisory severity Moderate; published on the advisory 30 August 2026; Tenable/NVD indexing lists CVE published ~16 September 2026 with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). GHSA lists affected versions ≤ 0.41.0 and patched versions > 0.41.0; Tenable text says the issue is addressed in containerization 0.41.0 — confirm the exact fixed build against GHSA before closing. No public exploitation claim on the Tenable/GHSA material reviewed this pass. Australia relevance: Apple container tooling / Mac container workflows pulling from untrusted registries.
NLnet Labs advisory dated 16 September 2026 (covered by The Hacker News 17 Sep) assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI; NVD still awaiting analysis per THN). Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption). NLnet Labs reports no known exploitation; CISA exploitation “none” on disclosure day per THN. Primary: NLnet Labs CVE-2026-81642.txt / security advisories; wire: THN 17 Sep 2026.
