Daily brief · 2026-09-22 · updated 2026-10-12
12 Critical Security Fixes You Need Today
VeloCloud Orchestrator on-prem
A maximum-severity vulnerability affecting VeloCloud Orchestrator on-prem is currently being actively exploited. Discovered by an external party, this exposure allows unauthenticated remote attackers to gain access to privileged functionality without requiring any credentials.
Why it matters: A remote attacker can exploit this to access privileged internal functionality and directly impact the host system.
What to do: Apply patches for the 5.2.3 train (5.2.3.16 and later) or 6.4.2 train (6.4.2.8 and later).
CVEs: CVE-2026-93952
npm package indexed-btree
A malicious npm package indexed-btree mimics a legitimate utility to load malware onto systems. Specifically, it disguises itself as the legitimate sorted-btree package, an ordinary B-tree and indexing utility. The malware loader is hidden directly within a commonly called function, allowing it to execute without relying on standard installation scripts.
Why it matters: This results in the execution of malicious code the moment users call the infected library function.
What to do: Remove the indexed-btree package and audit dependencies.
Also today
CrowdSec SaaS console
The CrowdSec SaaS console recently suffered a source code leak directly from their GitHub repository.
What to do: No direct client action required, as no customer data was compromised.
D-Link DIR-822A
A critical, unauthenticated remote vulnerability with a publicly available proof of concept currently affects the D-Link DIR-822A.
What to do: Await updates as the status is ‘Under Investigation’.
CVEs: CVE-2026-86296
Zyxel GS1900 Smart Managed Switches
A threat actor successfully exploited a vulnerability in Zyxel GS1900 Smart Managed Switches to steal data from hundreds of switches globally.
What to do: Change default credentials and apply firmware updates.
CVEs: CVE-2026-7273
Linux KVM/arm64
A guest-to-host escape vulnerability has been discovered that affects Linux KVM/arm64 hosts utilizing nested virtualization.
What to do: Apply the patch provided in mainline commit 8053393680d4.
CVEs: CVE-2026-89775
Microsoft Office SharePoint
A remote code execution vulnerability currently affects Microsoft Office SharePoint servers.
What to do: Apply the August 11, 2026 security updates.
CVEs: CVE-2026-65660
Red Hat ACM / multicluster-engine
A privilege escalation flaw has been discovered in Red Hat Advanced Cluster Management for Kubernetes, specifically impacting the Red Hat ACM / multicluster-engine.
What to do: Apply patches for RHACM and MCE.
CVEs: CVE-2026-17107
Red Hat OpenShift oc-mirror
The Red Hat OpenShift oc-mirror tool incorrectly verifies PGP signatures, which could allow malicious payloads to be executed.
What to do: Apply the necessary updates to the oc-mirror tool from Red Hat.
CVEs: CVE-2026-75939
Veeam Agent for Microsoft Windows
The Veeam Agent for Microsoft Windows contains a local privilege escalation vulnerability.
What to do: Update to Veeam Backup & Replication 13.0.2.29.
CVEs: CVE-2026-32996
WordPress Core
An unauthenticated stored XSS vulnerability in WordPress Core allows script injection via comments.
What to do: Update to WordPress 7.1.1 or a patched maintenance release.
CVEs: CVE-2026-93485
Zyxel GS1900 Series Switches
CISA has added CVE-2026-7273, which affects Zyxel GS1900 Series Switches, to the KEV catalog due to active exploitation.
What to do: Update firmware and follow CISA KEV deadlines.
CVEs: CVE-2026-7273
Sources
Tags: velocloud-orchestrator-on-prem, npm-package-indexed-btree, crowdsec-saas-console, d-link-dir-822a, zyxel-gs1900-smart-managed-switches, linux-kvm, microsoft-office-sharepoint, red-hat-acm, red-hat-openshift-oc-mirror, veeam-agent-for-microsoft-windows, wordpress-core, zyxel-gs1900-series-switches