CISA adds WordPress Core TOCTOU race condition flaw to KEV catalog

Why it matters.Secure Shell daemons provide administrative access across infrastructure. When library error conventions mismatch, standard password checks grant access to disabled accounts without credentials. Cloud teams deploying Alpine Linux must upgrade to OpenSSH 10.6p2 and restart daemon processes. Security engineers should mandate public-key authentication and disable password logins across administration endpoints.

• Vulnerability mechanics: Tracked as CVE-2026-123158 with an 8.1 CVSS score, the flaw impacts OpenSSH prior to 10.6p2 built against musl libc without PAM.
• Input size triggers: The musl crypt function returns an asterisk on passwords over 256 bytes, matching locked account markers in shadow files.
• Root access vector: Attackers sending oversized passwords to locked accounts trigger successful string equality checks, securing administrative command shells.
• Honeypot telemetry: Telemetry confirmed active in-the-wild exploitation against Alpine Linux containers within hours of public disclosure.
• Remediation release: OpenSSH released Portable OpenSSH 10.6p2, with distributions advising operators to disable password authentication or restart sshd.

Why it matters.Modern enterprise security architectures rely on device registration services to establish trusted identity perimeters. When authorization checks accept untrusted cryptographic parameters during device enrollment, attackers bypass multi-factor conditional access controls and escalate privileges to global tenant administrators. Cloud security teams should review tenant audit logs for unauthorized device additions. Identity administrators must verify continuous device compliance evaluations across corporate directories.

• Vulnerability mechanics: Tracked as CVE-2026-109469 with a maximum CVSS score of 10.0, the defect involves authorization bypass through user-controlled cryptographic keys.
• Identity elevation: Unauthenticated network actors can leverage user-controlled key parameters during registration handshakes to elevate privileges across enterprise cloud tenants.
• Cloud boundary impact: The flaw circumvents device compliance boundaries and conditional access policies enforcing trusted endpoint enrollment.
• Tenant scope: The vulnerability affects identity registration endpoints managing enterprise devices joined to Microsoft Entra ID.
• Remediation deployment: Microsoft deployed automated cloud-side updates across global Entra ID infrastructure, requiring no manual endpoint firmware modifications.

Why it matters.Graphics rendering engines process untrusted document formats across messaging clients and mobile systems. When memory bounds checks fail during parsing, threat actors deploy spyware payloads without requiring user interaction. Enterprise mobility managers should mandate immediate installation of iOS 27.2 and macOS updates across corporate fleets. Security teams should audit devices for irregular configuration profiles.

• Vulnerability mechanics: Tracked as CVE-2026-86950, an out-of-bounds write flaw in CoreGraphics allows crafted media files to corrupt process memory during rendering.
• Targeted exploitation: Apple acknowledged reports indicating the vulnerability was actively exploited in targeted intrusions against individuals on pre-iOS 27 releases.
• Discovery credit: Researchers within Meta Product Security discovered and reported the memory corruption flaw to Apple.
• Platform coverage: The patch addresses vulnerabilities across iOS, iPadOS, macOS Sequoia, macOS Tahoe, and legacy iOS 18.7.11 branches.
• Remediation releases: Apple released iOS 27.2, iPadOS 27.2, and macOS Sequoia 15.8.1 with reinforced input bounds checking across media libraries.

Why it matters.MicroVM monitors isolate untrusted serverless functions from shared host kernels. When memory discard errors fail to reclaim guest mappings correctly, root access in a sandboxed guest translates into memory corruption on the host hypervisor. Engineers maintaining private serverless platforms must upgrade to Firecracker v1.16.2. Platform operators should migrate snapshot pipelines to userfaultfd backends to ensure memory safety.

• Vulnerability mechanics: Tracked as CVE-2026-122192, the flaw enables root users inside guest VMs to read or alter host Firecracker VMM memory following failed discard operations.
• Trigger conditions: The defect impacts microVMs restored from snapshots using File backends configured with balloon or virtio-mem devices.
• Service isolation: AWS confirmed managed services including AWS Lambda are unaffected, with exposure limited to self-managed Firecracker virtualization stacks.
• Affected versions: The vulnerability impacts open-source Firecracker v0.23.0 through v1.16.1 deployed in custom serverless infrastructure.
• Remediation release: AWS published Firecracker v1.16.2 and v1.17.0, recommending operators switch snapshots to the userfaultfd backend.

Why it matters.Kubernetes network policies establish zero-trust boundaries within shared container clusters. When eBPF connection tracking tables fail to partition traffic state between co-located pods, low-privileged containers establish unauthorized sessions with internal services. DevOps teams running Amazon EKS must upgrade the Amazon VPC CNI add-on to version 1.22.3. Platform architects should restrict raw socket capabilities across container pods.

• Vulnerability mechanics: Tracked as CVE-2026-122266, improper isolation in shared eBPF connection tracking state allows adjacent pods to bypass Kubernetes NetworkPolicy ingress enforcement.
• Conntrack poisoning: Adjacent workloads on co-located worker nodes can craft raw network frames to inject poisoned connection tracking entries into kernel maps.
• Isolation bypass: Untrusted container workloads evade network segmentation policies, routing traffic directly to restricted application pods.
• Affected packages: The defect impacts aws-network-policy-agent versions prior to 1.3.7 and Amazon VPC CNI releases below 1.22.3.
• Remediation updates: AWS published aws-network-policy-agent 1.3.7 and VPC CNI 1.22.3, instructing administrators to upgrade managed add-ons.

Why it matters.Database drivers operate within high-trust application contexts executing data transformations and administrative queries. When connection string parsers execute unvetted class constructors through dynamic reflection, malicious database connection strings compromise underlying application servers. Data platform engineers must update the Redshift JDBC Driver across ingestion pipelines and analytics clusters. Security teams should sanitize connection string inputs supplied through untrusted configuration portals.

• Vulnerability mechanics: Tracked as CVE-2026-119084, the defect allows arbitrary class loading during connection string parameter and credentials profile parsing.
• Client execution: Attackers capable of influencing JDBC connection parameters or configuration profiles can trigger arbitrary code execution in calling client runtimes.
• Supply chain risk: The driver is embedded across enterprise ETL data pipelines, analytics workbenches, and business intelligence connection pools.
• Affected releases: All Amazon Redshift JDBC Driver builds prior to version 2.3.0 are vulnerable to parameter-driven class execution.
• Remediation release: AWS published Redshift JDBC Driver version 2.3.0, disabling dynamic reflection and validating all connection profile parameters.

Why it matters.Unified communications platforms orchestrate telephony, call routing, and enterprise collaboration backbones across corporate environments. When management portals fail to sanitize user input, attackers weaponize administrative sessions to harvest session tokens and compromise telephony gateways. Telecom engineering teams must apply Cisco maintenance updates across all Unified CM deployments. Security administrators should restrict administrative access to isolated management networks.

• Vulnerability mechanics: Tracked as CVE-2026-76419 with a CVSS score of 6.1, improper input validation in the web interface permits cross-site scripting.
• Attack vector: Unauthenticated remote attackers can trick administrative interface users into clicking crafted malicious links during active management sessions.
• Exploitation impact: Successful attacks allow adversaries to execute arbitrary script code within administrative browser sessions or steal sensitive credentials.
• Affected software: The vulnerability affects Cisco Unified Communications Manager and Unified CM Session Management Edition releases 14 and 15.
• Remediation guidance: Cisco published software maintenance fixes tracked under Bug ID CSCwv01048, confirming no operational workarounds exist.