SolarWinds Trust Center advisory CVE-2026-28326 (first published 17 September 2026) documents an unauthenticated remote code execution flaw in Access Rights Manager (ARM) stemming from a hard-coded static key. CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network). Affected: ARM 2026.2 and all previous versions. Fixed: ARM 2026.2.1. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. The Hacker News (19 Sep) also notes earlier July WHD SAML bypass CVE-2026-28323 (9.8; fix WHD 2026.2.1) and Serv-U fixes — those are separate advisories; this card is ARM only. Primary: SolarWinds Trust Center; secondary: THN / ARM 2026.2.1 release notes.
SolarWinds — CVE-2026-28326 ARM unauthenticated RCE (17 Sep 2026)
CrowdSec statement (17 September 2026; informed 16 Sep) confirms a May 2026 leak of its private GitHub repositories (SaaS console, AWS cloud routines, connectors, automations). Public Security Engine repos are out of scope by design. CrowdSec says reports of ~300 repositories are accurate when 130+ intentionally public repos are included, and that the figure reflects code subdivision rather than 300 separate sensitive systems. Company assessment: TanStack npm supply-chain compromise (CVE-2026-45321; TanStack postmortem 11 May 2026 — 84 malicious versions across 42 @tanstack/* packages) is the very likely vector, similar to Mistral AI’s related case; a backdoored component appears to have extracted a CI/CD API key with read access to the private codebase during a short May window. CrowdSec says no client data, login/password, name, organisation, or PII/client logs were leaked; hunting for lateral-movement credentials found none so far; tokens/credentials rotated after confirmation. Thanks Fuites Infos for disclosure. Wire: The Hacker News 19 Sep summarises later CrowdSec reporting (~170 private repos copied 22 May via a former-employee GitHub OAuth token; 83 user emails / investor details in archive) — treat those extras as wire until mirrored on CrowdSec’s primary statement. Primary: CrowdSec; TanStack postmortem for CVE-2026-45321. Updated 19 Sep 2026 (The Hacker News): The Hacker News's report is dated 19 September 2026; details credited to The Hacker News on this card come from that report.
CrowdSec — Source Code Exposure in May 2026 (17 Sep 2026)
WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). Primary: WordPress 7.1.1 release; research: pwn.ai; wire: The Hacker News 18 Sep 2026.
WordPress — 7.1.1 maintenance and security release (17 Sep 2026)
Microsoft Security Update Guide lists CVE-2026-85885 (NVD published 17 September 2026): command injection (CWE-77) in M365 Copilot allowing an authorized (low-privilege) attacker to elevate privileges over the network. Microsoft CVSS 3.1 base 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). NVD cveTags: exclusively-hosted-service — same September 2026 MSRC cloud-transparency release train as desk cards cve-2026-85887 (Copilot info disclosure 7.7) and cve-2026-85889 (Azure AI Foundry). Expect Microsoft’s hosted-service pattern: CVE published for transparency with mitigation already applied in the service (confirm on MSRC for customer action). Distinct CVE from 85887. Primary: MSRC; secondary: NVD.
Red Hat Product Security (public_date 17 September 2026) documents CVE-2026-92925 in Redis community: the cluster bus packet parser for PING/PONG/MEET fails to validate null-termination on string-carrying extensions (CWE-125), enabling a remote attacker on an adjacent network to craft a malicious packet and trigger an out-of-bounds read — sensitive-info disclosure or remote DoS. Red Hat CVSS 3.1 base 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H); threat severity Important; CISA SSVC notes exploitation none. Upstream fix referenced via redis/redis PR #15263 / commit 37894fae and release tag 8.10.0. Red Hat CVE page lists mixed product package states (Affected / Will not fix / Not affected) — check RH advisory for your workload. No in-the-wild claim in RH/NVD snippets this pass. Primary: Red Hat CVE; secondary: upstream 8.10.0 release / NVD.
Red Hat — CVE-2026-92925 Redis cluster bus OOB read (17 Sep 2026)
Microsoft Security Update Guide (September 2026 release; MSRC releaseDate 17 September 2026 PDT) published two exclusively-hosted Azure AI Foundry elevation-of-privilege CVEs for transparency. CVE-2026-85889 (Critical, Microsoft CVSS 3.1 base 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-306): missing authentication for a critical function allows an unauthenticated network attacker to elevate privileges. CVE-2026-85917 (Critical impact class / High base 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; CWE-918): SSRF allowing unauthenticated privilege elevation. Microsoft states both are already fully mitigated in the hosted service — no customer patch action; CVEs are for cloud transparency (aka.ms/MSRC-Cloud-CVEs). MSRC: publicly disclosed No; exploited No. NVD received records 17 September 2026. Primary: MSRC CVE-2026-85889; companion: MSRC CVE-2026-85917; NVD indexes both.
Microsoft Security Update Guide (September 2026; MSRC releaseDate 17 September 2026 PDT) lists CVE-2026-85887, an M365 Copilot information-disclosure vulnerability: incorrect permission assignment for a critical resource (CWE-732) lets an authorized (low-privilege) attacker disclose information over the network. Microsoft CVSS 3.1 base 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); MSRC severity Critical / impact Information Disclosure. Exclusively hosted service: Microsoft states the issue is already fully mitigated — no customer patch steps; CVE published for cloud transparency. MSRC: publicly disclosed No; exploited No. NVD received 18 September 2026 00:17 UTC. Distinct from Azure AI Foundry CVE-2026-85889/85917. Primary: MSRC; secondary: NVD.
MSRC — CVE-2026-85887 M365 Copilot information disclosure (17 Sep 2026)
AIR Security (Or Nevo, Dor Granat, Niv Hoffman; 17 September 2026) discloses Plugin4Shell: a marketplace plugin SHA-pinning bypass affecting the four major AI coding agents — Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Attack path: a trusted plugin/skill repo is compromised (building on prior SkillJacking findings); the agent checks out the pinned commit but does not verify the tree that landed, so checkout can resolve to malicious code while the pin still appears honoured — zero-click RCE on the developer host with the employee’s full reach into enterprise systems. No CVE identifier published in the disclosure. Patches named by AIR: Claude Code 2.1.179 (Anthropic); Codex 0.146.0 (OpenAI). GitHub Copilot: disclosed to Microsoft, no patch shipped at publication — users have no vendor fix yet. Gemini CLI: Google deprecated the CLI and will not patch; AIR advises migrating to Antigravity (no marketplace SHA-pinning surface). Enterprises using Air Marketplace / Air Filter were not affected per the authors. Treat community agent plugins as untrusted code until agents verify checkout integrity.
CVE-2026-92838 (published ~17 September 2026 per Tenable) is a DLL hijacking issue in the GeoVision GV-Remote E-Map desktop application: one or more DLLs are loaded from an unsafe search path. A local attacker with write access to a directory searched before the legitimate library location can plant a malicious DLL and achieve code execution as the GV-Remote E-Map process. Tenable CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor cyber-security portal (geovision.com.tw/cyber_security.php) hosts GeoVision advisories; this CVE id was not visible as a labelled row on that index during the 18 September 2026 07:00 Perth desk pass — treat Tenable/CVE record as primary until a matching PDF advisory is linked. No public in-the-wild exploitation claim on the Tenable snippet reviewed. Relevance: physical-security / VMS operators running GeoVision Windows clients.
SecurityWeek (17 September 2026) reports that CISA has discontinued its Weekly Vulnerability Bulletin — the alphabetical product dump of newly recorded CVEs with severity/CVSS/patch fields but no exploitation context. CISA framed the change as aligning with Binding Operational Directive (BOD) 26-04 (June), which directs US federal agencies to prioritise remediation using real-world risk factors including evidence of exploitation and exposure, not severity scores alone. CISA continues risk-focused output via the Known Exploited Vulnerabilities (KEV) catalog, alerts, and advisories. Practical takeaway for AU SOCs that mirrored the bulletin: shift intake to KEV plus vendor PSIRTs / NVD / ASD-ACSC alerts rather than expecting a CISA weekly CVE dump. Correction (25 Oct 2026): CISA's own notice of 16 September 2026 said it would discontinue the weekly Vulnerability Bulletin on 28 September 2026, so when SecurityWeek reported on 17 September the change had been announced but had not yet taken effect. The notice names the KEV catalog, CISA cybersecurity alerts and advisories, and CVE as the continuing sources. The earlier note that no CISA page could be found has been removed. (source: CISA bulletin notice (GovDelivery))
CBS News (16 September 2026, 7:45 pm US Eastern; 17 September, 7:45 am Perth) reports, citing US officials, that US Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers last month after cyberattacks struck the vessels while they were travelling toward the United States. One was the VL Prosperity, a 1,093-foot Liberian-flagged crude oil tanker; public vessel data cited by CBS shows it left Egypt's Sidi Kerir oil terminal on 1 August for Galveston, and US officials say it slowed near the Strait of Gibraltar around the time of the attack. Iran's Mehr News Agency reported on 20 August that the ship was attacked on 7 August in the Strait of Gibraltar and, citing an unnamed crew member, alleged hackers breached the engine room, reducing engine cooling flow, increasing engine speed and interfering with fuel systems; Iranian state media also claimed access to its propulsion, navigation and cargo systems and a 30-hour communications outage. The Coast Guard has not publicly attributed the attacks to Iran. On 21 August, the day after Mehr's report, Coast Guard cyber personnel, law enforcement officers, a vessel inspector and FBI Cyber Action Team operators boarded the ship for four days. Rear Adm. Amy Grable, commander of US Coast Guard Cyber Command, told CBS investigators found malicious cyber activity on the vessel's IT and other onboard systems but no evidence the ship had become unsafe to navigate; the boarding was one of roughly 40 to 50 Coast Guard Cyber Protection Team missions in the past year. The US is investigating whether the two attacks are connected and whether Iran or another foreign adversary was behind them. OT/maritime relevance for AU shippers and ports. Primary: CBS News. Correction (26 Oct 2026): the card now rests on CBS News's own report rather than SecurityWeek's summary of it, and a Wall Street Journal detail on when the second ship was boarded, which no source readable to this desk supports, has been removed. (source: CBS News)
CBS News — Coast Guard and FBI boarded two energy tankers after cyberattacks (16 Sep 2026 US Eastern; 17 Sep Perth)
CVE-2026-81546 (published ~17 September 2026 per Tenable/NVD indexing) covers a stack-based buffer overflow in the Affinity by Canva application before the 3.3.0 September 2026 release: inadequate bounds checking when parsing Affinity document files. A crafted Affinity document opened by a user can lead to arbitrary code execution. Tenable lists CVSS 3.1 base score 7.7 (High). Australia relevance: Affinity is Canva’s creative suite (Canva is Australian-headquartered). Patch: upgrade Affinity by Canva to 3.3.0 or later. No public exploitation claim on the Tenable/NVD snippets reviewed this pass. Primary: CVE/NVD/Tenable record; treat vendor release notes as authoritative for build numbers when published.
Tenable — CVE-2026-81546 Affinity by Canva (indexed 17 Sep 2026)
