CISA Adds Seven Exploited Vulnerabilities in SonicWall, JFrog and Kestra to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has added seven known exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively targeting products from SonicWall, JFrog and Kestra.
Two of the flaws affect the remote-access appliance SonicWall SMA1000. CVE-2026-83548 is a server-side request forgery vulnerability that allows unauthenticated attackers to reach protected internal functions. CVE-2026-83549 permits an authenticated administrator to execute arbitrary operating-system commands on the underlying host.
A third critical issue, CVE-2026-82329, resides in the software-distribution platform JFrog Artifactory. The flaw stems from improper authentication handling and can be exploited remotely to obtain full administrative control without prior credentials.
Additionally, Kestra OSS, an open-source workflow-automation platform, is affected by CVE-2026-49869, an operating-system command-injection vulnerability that enables attackers to run arbitrary commands on the server.
CISA has set a remediation deadline of 5 September 2026 for five of the seven vulnerabilities for all US federal civilian agencies and has directed organizations to conduct compromise assessments.
Related articles
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.
Windows 11 Update KB5124010 Triggers Crashes in Battlefield 6 and Other Titles
An optional non-security update KB5124010 for Windows 11 versions 24H2 and 25H2 is causing sudden game crashes for players of Battlefield 6, Battlefield 2042, and titles using Easy Anti-Cheat. The patch, initially distributed to Windows Insider participants and later made available broadly in early September, leads to silent exits within 15-30 seconds or a few minutes after launch. Reinstalling games, verifying DirectX installations, and repairing anti-cheat components have failed to resolve the issue, while uninstalling KB5124010 has restored functionality in multiple cases. The crashes are suspected to stem from conflicts with anti-cheat systems, including Electronic Arts' Javelin used in Battlefield titles and Easy Anti-Cheat in games such as Wardogs, which reports error WD-L020-95bc94d86a0d. Microsoft has not officially confirmed any link to anti-cheat software, and the problems affect users across diverse hardware configurations. Players are advised to skip the optional update until further clarification or a fix is provided.
WordPress Issues Critical Security Update 7.1.2 Five Days After Previous Patch
WordPress has released version 7.1.2 to fix a new critical vulnerability that was not addressed in the 7.1.1 update issued just five days earlier. The flaw, tracked as CVE-2026-87902, is a path traversal issue rated Critical that can be exploited without authentication. It resides in the page template resolution process and allows execution of arbitrary local PHP files located outside the theme directory, provided certain conditions such as the presence of a page- prefixed directory in the parent or child theme are met. The update was published on September 22, 2026, and affects the prior release from September 17. Administrators are urged to apply the patch immediately to prevent potential remote code execution.