CISA adds GPUStack improper authentication flaw to KEV catalog

Why it matters.Secure Email Gateway appliances filter inbound and outbound email traffic for enterprise communications. When incoming email parsing triggers root remote code execution, unauthenticated attackers compromise corporate email infrastructure and pivot into enterprise networks. Infrastructure teams must apply Cisco AsyncOS maintenance releases immediately. Security operations engineers should inspect mail logs for unauthorized command patterns.

• Vulnerability mechanics: Tracked as CVE-2026-76461 with a 9.8 CVSS score, the defect stems from improper input validation during email message parsing in AsyncOS.
• Attack vector: Remote unauthenticated attackers send crafted email messages containing malicious database commands directly through targeted appliances.
• Root execution: The injected SQL commands execute with root privileges on the underlying operating system without requiring administrative authentication.
• Exploitation detection: Administrators can audit text mail logs for suspicious COPY TO PROGRAM entries to detect active exploitation attempts.
• Remediation releases: Cisco released AsyncOS maintenance builds 15.5.5-014, 16.0.4-302, and 16.5.0-780, confirming no workarounds exist.

Why it matters.Enterprise security perimeters rely on firewall SSL-VPN portals to shield corporate internal networks from unauthorized access. When alternate credential paths bypass SAML authentication checks, external attackers compromise private cloud resources and pivot into enterprise databases. Network security engineers must apply SonicOS maintenance firmware releases immediately. IT administrators should verify that WAN management interfaces remain restricted to trusted administrative IP addresses.

• Vulnerability mechanics: Tracked as CVE-2026-19868 with a 7.5 CVSS score, the defect allows attackers to bypass security assertion markup language authentication.
• Trigger conditions: The vulnerability occurs when administrators configure the SonicOS SSL-VPN gateway service with external SAML authentication enabled.
• Multi-factor evasion: Authenticated network callers using alternate credential paths skip secondary identity challenges to access internal network assets directly.
• Federal directive: The Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04.
• Remediation releases: SonicWall published maintenance firmware hotfixes across affected appliance lines, advising operators to restrict public management access until completing patch deployment.

Why it matters.IBM Aspera Faspex transfers large data packages and media archives across corporate hybrid cloud topologies. When authenticated users elevate privileges to platform administrators, attackers exfiltrate proprietary enterprise datasets and manipulate package delivery workflows. Infrastructure engineering leads should upgrade Aspera Faspex servers to version 5.0.20 or later. Security teams should audit user role assignments across transfer clusters.

• Vulnerability mechanics: Tracked as CVE-2026-123218 with an 8.8 CVSS score, an incorrect authorization defect allows authenticated users to bypass permission boundaries.
• Exploitation impact: Authenticated attackers send crafted API payloads to escalate privileges to full administrative control across the file exchange platform.
• Affected deployments: The defect impacts IBM Aspera Faspex versions 5.0.0 through 5.0.19 running across enterprise data transfer environments.
• Federal directive: CISA mandated that Federal Civilian Executive Branch agencies remediate the flaw under Binding Operational Directive 26-04.
• Remediation update: IBM released maintenance updates addressing the authorization check, urging administrators to upgrade past version 5.0.19.

Why it matters.Kubernetes worker nodes run shared container workloads across cloud environments. When external TCP handshakes corrupt kernel socket structures, attackers crash worker nodes or escape container boundaries to gain host root privileges. Cloud platform teams must upgrade GKE node images immediately. Infrastructure operators should audit VPC firewalls to block public ingress to node IP ranges.

• Vulnerability mechanics: Tracked as CVE-2026-98432 with an 8.1 CVSS score, the defect involves a race condition in the IPv4 TCP stack receive socket function.
• Trigger conditions: Remote network attackers send crafted IPv4 TCP packets containing custom IP options to open network listeners on Kubernetes worker nodes.
• Impact scope: The memory corruption triggers kernel crashes or node-level privilege escalation, impacting GKE Standard and Autopilot clusters.
• Cloud mitigations: Google Cloud began rolling out patched node images and recommended restricting external TCP access via VPC firewall rules.
• Customer action: Cluster administrators must upgrade GKE node pools and block untrusted public traffic to node TCP listeners.

Why it matters.AWS ParallelCluster deploys high-performance computing clusters for scientific simulation and engineering research. When log extraction commands permit arbitrary file writes, compromised S3 buckets allow attackers to overwrite local scripts and binaries on administrator workstations. DevOps engineers running ParallelCluster should update the CLI package to version 3.16.0 immediately. Cloud teams should audit write permissions on cluster log export buckets.

• Vulnerability mechanics: Tracked as CVE-2026-124033 with a 7.5 CVSS score, the flaw resides in the log export routines of the CLI.
• Affected commands: The defect affects the export-cluster-logs and export-image-logs subcommands in aws-parallelcluster versions 3.0.0 through 3.15.0.
• Exploitation mechanics: Remote attackers with write access to the target Amazon S3 bucket craft object keys containing directory traversal sequences.
• Filesystem risk: Unpacking the logs writes arbitrary files outside the target directory with the local privileges of the CLI operator.
• Remediation release: AWS released ParallelCluster CLI version 3.16.0, adding path sanitization to reject S3 object keys with traversal patterns.

Why it matters.Linux virtual machines in cloud fleets frequently update dependencies during automated scaling cycles. When package managers accept unverified archives over plain HTTP connections, network-positioned attackers gain root administrative execution across production servers. System administrators should configure HTTPS repository endpoints across instance fleets immediately. Infrastructure engineers should apply security updates provided under Canonical USN-8996-1 and Debian DSA-6607-1.

• Vulnerability mechanics: Tracked as CVE-2026-109518 with an 8.1 CVSS score, the defect allows network-adjacent attackers to force installation of unverified software.
• Trigger conditions: The issue manifests when the APT package manager downloads packages over unencrypted HTTP mirrors with connection retries enabled.
• Exploitation impact: In-path network attackers manipulate retry responses to inject unsigned packages, executing maintainer scripts with root privileges.
• Affected platforms: The vulnerability impacts default installations of Ubuntu 22.04 LTS and later alongside Debian 12 and later.
• Remediation guidance: AWS urged operators to apply upstream patches from Canonical and Debian or disable HTTP retries by setting Acquire::Retries=0.

Why it matters.Enterprise employees use mobile devices and laptops in public and corporate spaces with active wireless radios. When proximity protocols fail to enforce pairing rate limits, nearby attackers connect without physical interaction and compromise local process memory. Enterprise fleet administrators should enforce immediate OS updates across employee hardware. Security teams should advise users to disable Bluetooth when operating in untrusted environments.

• Vulnerability mechanics: Tracked under CVE-2026-113968 and CVE-2026-113970, the defects include logic errors and use-after-free flaws in AirPlay and Bluetooth pairing.
• Proximity vector: Attackers within physical wireless range exploit flawed state machines to bypass pairing-code rate limits during device negotiation.
• Memory corruption: Malicious connection sequences corrupt wireless daemon memory to execute arbitrary code with local service privileges.
• System coverage: Apple deployed fixes across iOS 27.2.1, iPadOS 27.2.1, macOS Golden Gate 27.2.1, and maintenance builds for earlier operating systems.
• Remediation updates: Apple resolved the flaws by tightening state management and improving boundary checks across CoreUtils wireless handlers.