Forwarded from Taiwan Computer Emergency Response Team / Coordination Center Security Information Alert TWCERTCC-200-202610-00000001
[Content Description]
【CVE-2026-7273】Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (CVSS v3.1: 8.8)
【Whether Exploited by Ransomware: Unknown】 A stack-based buffer overflow vulnerability exists in the CGI program of Zyxel GS1900 series switches, which may allow unauthenticated attackers on the local network to execute OS commands through specially crafted HTTP requests.
【CVE-2026-93952】Arista VeloCloud Orchestrator Improper Input Validation Vulnerability (CVSS v3.1: 10.0)
【Whether Exploited by Ransomware: Unknown】 An improper input validation vulnerability exists in the on-premises version of Arista VeloCloud Orchestrator, which may allow remote attackers to access privileged internal functions, potentially compromising the confidentiality, integrity and availability of the Orchestrator and the data it manages.
【CVE-2026-94127】F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability (CVSS v3.1: 9.8)
【Whether Exploited by Ransomware: Unknown】 A heap-based buffer overflow vulnerability exists in F5 BIG-IP APM. When a virtual server is configured with an access policy and OAuth profile, an unauthenticated attacker may exploit this vulnerability to achieve remote code execution.
【CVE-2026-93616】Check Point Multiple Products Path Traversal Vulnerability (CVSS v3.1: 9.8)
【Whether Exploited by Ransomware: Unknown】 A path traversal vulnerability exists in Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent, which may allow unauthenticated attackers to upload and execute arbitrary scripts.
【CVE-2026-85102】Check Point Multiple Products Improper Certificate Validation Vulnerability (CVSS v3.1: 9.8)
【Whether Exploited by Ransomware: Unknown】 An improper certificate validation vulnerability exists in Check Point Security Gateway and Check Point Spark Firewall using Site-to-Site VPN or Remote Access VPN, which may allow unauthenticated remote attackers to execute arbitrary code on the Gateway.
【CVE-2026-5430】WSO2 Multiple Products Path Traversal Vulnerability (CVSS v3.1: 10.0)
【Whether Exploited by Ransomware: Unknown】 A path traversal vulnerability exists in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway, which may allow unrestricted file uploads, potentially leading to remote code execution.
【CVE-2026-71362】Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVSS v3.1: 9.1)
【Whether Exploited by Ransomware: Unknown】 An incorrect authorization vulnerability exists in Adobe Commerce and Magento, which may allow attackers to access sensitive resources with elevated privileges without requiring any user interaction.
【CVE-2026-67279】Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability (CVSS v3.1: 6.5)
【Whether Exploited by Ransomware: Unknown】 An improper enforcement of behavioral workflow vulnerability exists in MikroTik RouterOS, which may allow unauthenticated clients to open session channels and send execution requests.
【CVE-2026-65660】Microsoft SharePoint Code Injection Vulnerability (CVSS v3.1: 8.8)
【Whether Exploited by Ransomware: Unknown】 A code injection vulnerability exists in Microsoft SharePoint, which may allow authorized attackers to execute code over the network.
【CVE-2026-87902】WordPress Core Remote File Inclusion Vulnerability (CVSS v3.1: 8.1)
【Whether Exploited by Ransomware: Unknown】 A remote file inclusion vulnerability exists in WordPress Core, which may allow unauthenticated attackers to cause the page template parsing mechanism to include readable local .php files, potentially leading to remote code execution.
【CVE-2026-88772】Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS v3.1: 8.1)
【Whether Exploited by Ransomware: Unknown】 An improper restriction of operations within the bounds of a memory buffer vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway, which may allow attackers to remotely execute code or cause a denial of service.
【CVE-2026-88771】Citrix NetScaler Improper Input Validation Vulnerability (CVSS v3.1: 9.8)
【Whether Exploited by Ransomware: Unknown】 An improper input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway, which may allow unauthenticated attackers to execute arbitrary commands.
[Impacted Platforms]
【CVE-2026-7273】Please refer to the affected versions listed by the vendor https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026
【CVE-2026-93952】Please refer to the affected versions listed by the vendor https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
【CVE-2026-94127】Please refer to the affected versions listed by the vendor https://my.f5.com/manage/s/article/K000162605
【CVE-2026-93616】Please refer to the affected versions listed by the vendor https://support.checkpoint.com/results/sk/sk1000171/
【CVE-2026-85102】Please refer to the affected versions listed by the vendor https://support.checkpoint.com/results/sk/sk1000117
【CVE-2026-5430】Please refer to the affected versions listed by the vendor https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
【CVE-2026-71362】Please refer to the affected versions listed by the vendor https://www.adobe.com/trust/security/products/commerce/apsb26-92.html
【CVE-2026-67279】Please refer to the affected versions listed by the vendor https://mikrotik.com/supportsec/september-2026-vulnerability/
【CVE-2026-65660】Please refer to the affected versions listed by the vendor https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
【CVE-2026-87902】Please refer to the affected versions listed by the vendor https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
【CVE-2026-88772】Please refer to the affected versions listed by the vendor https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
【CVE-2026-88771】Please refer to the affected versions listed by the vendor https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
[Recommended Measures]
【CVE-2026-7273】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026
【CVE-2026-93952】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183
【CVE-2026-94127】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://my.f5.com/manage/s/article/K000162605
【CVE-2026-93616】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://support.checkpoint.com/results/sk/sk1000171/
【CVE-2026-85102】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://support.checkpoint.com/results/sk/sk1000117
【CVE-2026-5430】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
【CVE-2026-71362】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://www.adobe.com/trust/security/products/commerce/apsb26-92.html
【CVE-2026-67279】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://mikrotik.com/supportsec/september-2026-vulnerability/
【CVE-2026-65660】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660
【CVE-2026-87902】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
【CVE-2026-88772】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
【CVE-2026-88771】 The vendor has released a security update for the vulnerability. Please update to the relevant version https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096