Monday, September 21, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Today's Security Brief

Netcore's NBR200V2 router accounts for five of the day's critical entries, including CVE-2026-94097 at CVSS 10, alongside a cluster of OrdaSoft Joomla Gallery flaws rated 9.3 to 9.4. The brief covers 15 critical CVEs (down 32% from 22 the prior day) and 72 high-priority CVEs (down 1% from 73), from 87 total disclosures. Beyond the Netcore set, CVE-2026-55366 (CVSS 9.8) affects Google Android and CVE-2026-86462 (CVSS 9.1) affects the Apache Airflow FAB provider, where the authentication layer is the exposed component. The pattern favours internet-facing network equipment and web application extensions, which matters most to organisations running consumer-grade routers at branch sites and Joomla-based public web properties. Six CVEs carry confirmed active exploitation, including CVE-2026-76460 in Cisco Identity Services Engine and CVE-2026-58704 in Google Pixel. Restrict management interfaces on edge routers to trusted networks, and treat Joomla extension code and Airflow web endpoints as priority review targets.

  • Netcore NBR200V2 routers carry five critical CVEs, topped by CVE-2026-94097 at CVSS 10
  • 15 critical CVEs, down 32% from 22 the prior day
  • 72 high-priority CVEs, down 1% from 73 the prior day
  • Remote code execution and authentication weaknesses dominate, affecting Netcore router firmware and the Apache Airflow FAB provider (CVE-2026-86462, CVSS 9.1)
  • Check first: Netcore NBR200V2 devices, Joomla sites running OrdaSoft Gallery, Cisco Identity Services Engine, and Android or Pixel fleet builds
  • Six CVEs have confirmed active exploitation, including Cisco ISE (CVE-2026-76460), Acronis Backup (CVE-2026-87886) and three Linux kernel entries

Immediate action: Prioritise Netcore NBR200V2 routers, Cisco Identity Services Engine, Acronis Backup, and Joomla installations running OrdaSoft Gallery, along with Android and Pixel device fleets, since these carry either maximum-severity ratings or confirmed exploitation. Confirm fix status in each vendor's advisory before scheduling remediation, and where no fix is documented, restrict network access to the affected management interfaces in the interim.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation