Tuesday, June 9, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Archived Security Brief

SAP NetWeaver Application Server ABAP and Apache HTTP Server anchor Tuesday's disclosures, with SAP CVE-2026-44748 (CVSS 9.9) and Apache CVE-2026-44631 (CVSS 9.8) exposing widely deployed enterprise and web-facing systems to remote compromise. The day brought 12 critical CVEs, up from 3 the prior day (+300%), alongside 62 high-priority CVEs, up from 33 (+88%). Google Chrome accounted for a cluster of critical browser flaws including CVE-2026-11634 and CVE-2026-11638 (both CVSS 9.6), while CVE-2026-27671 (CVSS 9.8) marks a second critical SAP NetWeaver ABAP issue and CVE-2026-11499 (CVSS 9.8) affects Tenda HG-series routers. Remote code execution and unauthenticated access dominate the high-impact set, spanning enterprise application servers, web servers, browsers, and edge networking hardware. No patches were recorded as available at disclosure across this set, and six CVEs—including issues in the Linux Kernel, Android Framework, Check Point Security Gateway, and SolarWinds Serv-U—are under active exploitation, warranting a treat-as-unpatched, mitigation-first posture.

  • SAP NetWeaver Application Server ABAP carries two critical flaws (CVE-2026-44748 at CVSS 9.9 and CVE-2026-27671 at CVSS 9.8), placing core ERP infrastructure at highest exposure
  • Critical CVEs rose to 12 from 3 the prior day, a 300% increase
  • High-priority CVEs climbed to 62 from 33, an 88% increase
  • Remote code execution and unauthenticated access patterns dominate, affecting Apache HTTP Server (CVE-2026-44631), Google Chrome (CVE-2026-11634, CVE-2026-11638), and Tenda HG-series routers (CVE-2026-11499)
  • Patch availability stands at 0% across this disclosure set, requiring compensating controls and exposure reduction in the interim
  • Six CVEs show active exploitation, including the Linux Kernel, Android Framework, Check Point Security Gateway, and SolarWinds Serv-U

Immediate action: Prioritize SAP NetWeaver ABAP, Apache HTTP Server, and internet-facing Tenda routers for immediate review, and update Chrome through managed channels as fixes ship. With no patches available at disclosure, apply vendor mitigations, restrict network exposure of affected services, and monitor the actively exploited Linux Kernel, Android, Check Point, and SolarWinds Serv-U issues closely.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation