US Authorities Warn of Active Exploitation of Apple CoreGraphics and Cisco SD-WAN Vulnerabilities
US authorities have issued warnings about actively exploited vulnerabilities in Apple products and Cisco Catalyst SD-WAN Manager. The Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its Known Exploited Vulnerabilities catalog, requiring rapid remediation by federal agencies.
CVE-2026-86950 was added on September 29, 2026. The vulnerability resides in the CoreGraphics framework used by iOS, iPadOS, and macOS. It permits out-of-bounds memory writes that can lead to arbitrary code execution when successfully exploited.
CVE-2026-76504 was added the following day. The issue affects the API of Cisco Catalyst SD-WAN Manager and stems from improper URI encoding processing. Attackers can bypass authentication and obtain administrative privileges without valid credentials.
Federal agencies must complete remediation and compromise assessments by October 2 for the Apple flaw and October 3 for the Cisco flaw. CISA emphasizes both patching and investigation of potential prior intrusions.
Related articles
Mozilla Releases Firefox 158.0.1 Security Update Fixing High-Severity Vulnerabilities and Compromised Certificates
Mozilla Foundation has published Firefox 158.0.1 on October 20, 2026, delivering fixes for four CVEs rated at high overall severity. Two vulnerabilities received a High rating, including a boundary condition flaw in the SVG component tracked as CVE-2026-113399 and a certificate blocklist issue identified as CVE-2026-113470. The update also refreshes the OneCRL list to block an intermediate certificate from eMudhra that was compromised earlier in the month. Mozilla delivered the updated blocklist via RemoteSettings on October 17 and embedded the changes directly into the browser release. This approach ensures compromised certificates remain blocked even when RemoteSettings is disabled or network access is unavailable. One Moderate and one Low severity issue complete the set of addressed flaws.
Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module
The Drupal team has released patches for a critical vulnerability in the Field UI module that can enable remote code execution under specific component combinations. Although the core CMS alone is insufficient for exploitation, at least one known attack path requires no authentication, eliminating the need for an administrator password. The flaw, tracked as CVE-2026-108097, arises when combined with third-party modules or custom site code that exposes vulnerable functionality. Fixes are included in Drupal versions 11.4.10, 11.3.19, and 10.6.19, with temporary mitigation achieved by removing the Field UI module. Drupal Steward provides partial protection against known variants but does not cover all possibilities. A separate RCE issue, CVE-2026-108099, was also fixed in the Entity List module version 3.0.10, which similarly allows unauthenticated exploitation in certain configurations. Prior to the patches, developers warned that exploits could appear within hours or days, though no active attacks have been reported.
Roundcube Webmail Issues Security Updates to Address Multiple Vulnerabilities
The Roundcube Webmail development team released versions 1.7.5 and 1.6.20 on October 19, 2026, to resolve approximately 20 security issues affecting email viewing, authentication, and external content handling. The updates address command injection flaws in IMAP actions that could be triggered via newline characters, as well as header injection vulnerabilities involving sender display names and parameters such as References, In-Reply-To, Message-ID, and From. Additional fixes cover subject lines and data URIs in forwarded attachments, media types in inline images, and bypasses in server-side request forgery filters. The patches also mitigate cross-site request forgery evasion in spam reporting and cross-site scripting issues stemming from password driver error responses. Administrators are urged to apply the updates promptly to prevent exploitation of these weaknesses.
Cybercriminals Exploit Command Injection Vulnerability in SiteGuard WAF Server Edition
EG Secure Solutions has confirmed active exploitation of CVE-2026-106931, a command injection flaw in the statistics processing function of SiteGuard Server Edition. The vulnerability, classified as CWE-78, allows local attackers with low privileges to execute arbitrary system commands as root on Unix systems or SYSTEM on Windows without user interaction. CVSS scores rate the issue at 8.5 under version 4.0 and 7.8 under version 3.0, affecting installations from version 2.20 onward when statistics are enabled by default. Specific version ranges for Apache, Nginx, and IIS editions on FreeBSD and other platforms determine the exact impact, with some IIS versions remaining unaffected. The vendor notified direct support customers on September 29, followed by public advisories from JVN on October 14 and JPCERT/CC. Organizations unable to update can apply a targeted patch or disable the statistics feature, though the patch erases attack traces, requiring prior diagnostic data collection.