Monday, March 9, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Monday's vulnerability disclosures include critical remote code execution flaws in Wavlink routers and Delta Electronics COMMGR2 industrial software, both scoring CVSS 9.8. The brief covers 2 critical CVEs (down 60% from Sunday) and 61 high-priority CVEs (down 25%), reflecting a quieter start to the week. Fifteen vulnerabilities have confirmed active exploitation, spanning Roundcube Webmail, VMware Aria Operations, Google Chromium, GitLab, and legacy flaws in Apple, Hikvision, and Rockwell Automation products. Attack patterns include authentication bypass, remote code execution, and memory corruption across networking equipment, enterprise collaboration platforms, and industrial control systems. No patches are currently available for the disclosed CVEs, making compensating controls and network segmentation essential in the interim.

  • CVE-2026-3703 and CVE-2026-3630 rated CVSS 9.8 — critical RCE in Wavlink NU516U1 routers and Delta Electronics COMMGR2 industrial software
  • 2 critical CVEs disclosed, down 60% from Sunday's 5 critical vulnerabilities
  • 61 high-priority CVEs (CVSS 7.0–8.9), a 25% decrease from the prior day's 81
  • Active exploitation confirmed in Roundcube Webmail, VMware Aria Operations, Google Chromium, Qualcomm chipsets, and GitLab
  • 0% patch availability across all disclosed CVEs — no vendor fixes released yet
  • 15 actively exploited vulnerabilities include legacy flaws dating back to 2008 in Microsoft Windows and 2017 in Hikvision products

Immediate action: Prioritize network segmentation and access restrictions for Wavlink routers, Delta Electronics COMMGR2 systems, and any exposed Roundcube Webmail or VMware Aria Operations instances. With no patches currently available, apply compensating controls such as WAF rules, disabling unnecessary services, and monitoring for indicators of compromise associated with the 15 actively exploited CVEs.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation