CISA adds WordPress Core race condition RCE to Known Exploited Vulnerabilities catalog

Why it matters.Data analytics pipelines rely on database drivers to ingest telemetry and query distributed analytical warehouses. When client drivers execute unverified classes during connection initialization, attackers can bridge SQL interfaces to achieve process execution. Engineering teams maintaining data pipelines should upgrade driver packages to version 2.3.0 without delay. Security engineers must enforce static connection configurations to ensure external users cannot inject connection parameters.

• Vulnerability mechanics: Tracked as CVE-2026-119084, an unsafe class loading flaw allows arbitrary class instantiation when the driver processes connection URL parameters or credentials profiles.
• Exploitation risk: Applications that construct database connection strings from untrusted inputs permit remote attackers to execute arbitrary code within the host JVM environment.
• Remediation release: AWS released Amazon Redshift JDBC Driver version 2.3.0 across official distribution mirrors, advising software builders to replace vulnerable client dependencies.

Why it matters.Access governance engines and enterprise compute managers control access to internal corporate networks and server clusters. When vendors enter extended advisory freezes, unpatched vulnerabilities linger in corporate environments throughout fourth-quarter holiday operational moratoriums. Network architects should install all released maintenance updates across identity nodes before year-end change freezes commence. Infrastructure operations teams must monitor perimeter telemetry closely while routine vendor advisory disclosures remain paused.

• Impacted platforms: The maintenance bundle resolves identified vulnerabilities across Cisco Identity Services Engine, UCS Central Software, and Unified Communications Manager deployments.
• Cadence freeze: Cisco announced that this batch represents its final routine security advisory publication for calendar year 2026, suspending scheduled updates until January 20, 2027.
• Operational guidance: Enterprise administrators must apply the published maintenance patches across affected access control servers and compute fabric managers to resolve open vulnerabilities.

Why it matters.Rendering engines run behind consumer browsers, internal web views, and mobile application wrappers. When memory corruption vulnerabilities affect core browser components, user interaction with unvetted links can compromise client devices. Systems engineers managing enterprise fleets should enforce automated patch updates across mobile devices and workstations. Mobile application developers should verify that embedded web view components inherit current system WebKit runtime libraries.

• Vulnerability mechanics: Tracked as CVE-2026-112637, improper memory handling in WebKit canvas and JavaScript bindings allows malicious web content to induce memory corruption.
• Exploitation impact: Threat actors can exploit the defect by inducing browser sessions to process crafted web pages, triggering arbitrary code execution inside application sandboxes.
• Platform coverage: Apple deployed patched memory management routines across iOS 27.2, iPadOS 27.2, macOS Tahoe, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2.