Critical vulnerabilities, curated daily for security professionals
π
Archived Security Brief
Adobe Campaign Classic and Microsoft Windows dominate Wednesday's disclosures, with two maximum-severity Adobe Campaign Classic flaws (CVSS 10) and a cluster of CVSS 9.8 Windows kernel, DHCP client, and HTTP.sys issues. The brief covers 18 critical vulnerabilities, up 50% from the prior day's 12, alongside 27 high-priority CVEs, down 56% from 62. Named critical entries include CVE-2026-47938 and CVE-2026-48303 in Adobe Campaign Classic, CVE-2026-44815 in the Windows DHCP Client, and CVE-2026-45447 affecting OpenSSL PKCS#7/S/MIME processing. Remote code execution and authentication bypass patterns predominate, spanning enterprise security appliances from Fortinet, Cisco, Check Point, and Arista. No fixes are currently published for the disclosed set, so affected organizations should prioritize compensating controls and monitor vendor advisories; nine CVEs across Fortinet, SolarWinds, and Cisco platforms show confirmed active exploitation.
Adobe Campaign Classic carries two maximum-severity flaws (CVE-2026-47938, CVE-2026-48303, both CVSS 10) enabling remote compromise
Critical CVEs rose 50% to 18, led by Microsoft Windows kernel, DHCP client, HTTP.sys, and Azure Stack Edge issues at CVSS 9.8
High-priority CVEs fell 56% to 27 from the prior day's 62
Remote code execution and authentication bypass dominate, affecting Fortinet FortiSandbox, OpenSSL, and Microsoft Windows components
Patch availability stands at 0% across the disclosed set, requiring interim mitigations and advisory monitoring
Nine vulnerabilities show active exploitation, including Fortinet FortiOS and FortiAnalyzer, SolarWinds Serv-U, and Cisco Catalyst SD-WAN Manager
Immediate action: Prioritize Adobe Campaign Classic and Microsoft Windows systems, along with internet-facing Fortinet, Cisco, Check Point, SolarWinds, and Arista appliances showing active exploitation. With no patches yet published for the disclosed CVEs, apply vendor-recommended compensating controls, restrict exposed management interfaces, and watch advisories for fix availability.
How to read this brief
CVSS score (e.g. 9.1) β severity from 0β10. Red marks critical (9+), orange high (7β8.9).
Exploitability β how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical β how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges β the access they need first. No privileges means no login required.
No interaction / User interaction β whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale β βNetwork Β· No privileges Β· No interactionβ is the worst case: hit from anywhere, no credentials, no victim action.
π΄ Actively exploited β confirmed under attack in the wild (CISAβs Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS Β· Nth percentile β FIRST.orgβs estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% β a statistical signal itβs unusually likely to be targeted, separate from whether attacks are confirmed.
π‘ Tip: Swipe CVE cards left to β star, right to β remove
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
An authentication bypass vulnerability in various Fortinet products allows attackers to log into devices registered to other accounts if FortiCloud SSO is enabled.
SolarWinds Serv-U is vulnerable to an uncontrolled resource consumption flaw allowing unauthenticated attackers to crash the service via specially crafted POST requests.
LiteLLM contains a command injection vulnerability in its MCP server test endpoints that, when chained with a host header bypass, enables unauthenticated remote code execution.
Adobe Campaign Classic is vulnerable to an incorrect authorization flaw that allows unauthenticated attackers to achieve arbitrary code execution via crafted HTTP/2 requests.
An OS command injection vulnerability in FortiSandbox allows unauthenticated attackers to execute unauthorized commands via specifically crafted HTTP requests.
An authentication bypass vulnerability in Ivanti Sentry allows unauthenticated attackers to create arbitrary administrative accounts and gain full access.
The bitbank2 AnimatedGIF library contains a buffer overflow in the DecodeLZW function that can lead to remote code execution or denial of service via a crafted GIF file.
A buffer overflow vulnerability in the Perl DBI module occurs when error messages are written to a fixed-size 200-byte buffer without length validation.
An SQL injection vulnerability in Netcad Software E-Δ°mar allows unauthorized attackers to manipulate database queries and potentially access sensitive data.
The MOSK Information Technologies Ltd. CBS Platform contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary database commands.
A heap overflow vulnerability in the FreeSWITCH mod_verto module allows unauthenticated attackers to trigger memory corruption via crafted HTTP requests.
A use-after-free vulnerability exists in the FullScreen component of Google Chrome on Windows, potentially allowing memory corruption or arbitrary code execution.
A use-after-free vulnerability exists within the Payments component of Google Chrome, which could be leveraged to cause memory corruption or arbitrary code execution.
A use-after-free vulnerability exists in the Ozone platform abstraction layer of Google Chrome on Linux, potentially allowing for memory corruption or code execution.
A privilege escalation vulnerability in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate their permissions over a network.
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over the network.
A SQL injection vulnerability in the Oracle RemoteControl API allows an authenticated attacker to inject malicious queries via the invite_participants and remind_participants methods.
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute arbitrary code over a network via a malicious server.
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network by enticing a user to connect to a malicious server.