Executive assessment
Today's brief leads with Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
What changed: Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user.
Technical evidence: CVE-2026-0768; CVSS v3.1 9.8; weakness CWE-94; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patching, restrict Langflow interaction to trusted networks; for Rails, set VIPS_BLOCK_UNTRUSTED when using libvips 8.13 or later, call Vips.block_untrusted(true) with ruby-vips 2.2.1 or later, or remove libvips if it is older than 8.13. Both CVEs are exploited in the wild: CVE-2026-0768 activity included credential harvesting, while CVE-2026-66066 activity established C2, and public Rails proof-of-concept exploits exist. ([zerodayinitiative.com](https://www.zerodayinitiative.com/advisories/ZDI-26-034/), [discuss.rubyonrails.org](https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432), [securityweek.com](https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/amp/), +1 more)
Action: Map CVE-2026-0768 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: thehackernews.com](https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html)
Finding 02 — Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild
What changed: Exploitation of the authentication bypass vulnerability CVE-2026-82329 started just days after its public disclosure. The cited source identifies the affected product and the available advisory or remediation status.
Technical evidence: CVE-2026-82329; CVSS v3.1 9.8; weakness CWE-287; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching is delayed, block untrusted access to /access/api/v1/registry/; monitor Access request logs for POST /access/api/v1/registry/join from non-cluster hosts followed by POST /access/api/v1/tokens, and audit for unexpected non-expiring admin-scoped tokens. watchTowr reports in-the-wild exploitation involving attackers minting admin tokens, and a public reproducible PoC is available. ([github.com](https://github.com/dinosn/cve-2026-82329-jfrog-artifactory), [x.com](https://x.com/watchtowrcyber/status/2094639075726668267), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-82329))
Action: Map CVE-2026-82329 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: securityweek.com](https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/)
Finding 03 — Multiple vulnerabilities in Rockwell Automation
What changed: CVE coverage: CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625, CVE-2025-12768, CVE-2026-12661, CVE-2021-42260, CVE-2026-9637, CVE-2026-9633, CVE-2026-9634, CVE-2026-16675. The cited advisories disclose: RSLinx Classic; Historian ME; ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix; Logix Platform; Redundancy Module Configuration Tool; FactoryTalk Activation Manager.
Technical evidence: CVE-2026-9621; CVSS v4.0 9.2; weakness CWE-190; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: If patching is not immediately possible, block direct internet access to affected control-system assets, isolate control networks from business networks behind firewalls, and allow remote access only through VPNs updated to the latest version. CISA reports no known public exploitation targeting these vulnerabilities; CVE-2026-9633 and CVE-2026-9634 are not remotely exploitable. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-01), [cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-02), [cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-03), +3 more)
Action: Map CVE-2026-9621 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-01)
Finding 04 — NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) The cited source identifies the affected product and the available advisory.
What changed: NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) The cited source identifies the affected product and the available advisory or remediation status. CVE coverage: CVE-2026-79675.
Technical evidence: CVE-2026-79675; CVSS v4.0 9.3; weakness CWE-88; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patching, prevent untrusted input, configuration or environment values from reaching NLTK's java_options or trusted_raw_options; allow only heap/stack sizing, -verbose, -server/-client and --add-modules, and block or alert on other JVM arguments including -agentpath, -javaagent, -agentlib, -Xrunjdwp, @argfile, -XX: and -D. The GitHub advisory contains a public proof of concept demonstrating the validation bypass. ([github.com](https://github.com/advisories/GHSA-m4rf-3fr8-xwx3), [github.com](https://github.com/nltk/nltk/commit/8fa9650b6009aacfdebbc33d2a08d32c0858ea6c), [github.com](https://github.com/nltk/nltk/releases/tag/v3.10.3))
Action: Map CVE-2026-79675 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: github.com](https://github.com/advisories/GHSA-m4rf-3fr8-xwx3)
Finding 05 — rsync 3.2.3: Incorrect Calculation of Buffer Size
What changed: rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length.
Technical evidence: CVE-2026-70457; CVSS v4.0 8.3; weakness CWE-131, CWE-787; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-70457 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-70457)
Finding 06 — rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending.
What changed: rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling.
Technical evidence: CVE-2026-53789; CVSS v4.0 7.1; weakness CWE-807; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-53789 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-53789)
Finding 07 — OpenMetadata is a unified metadata platform.
What changed: OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates.
Technical evidence: CVE-2026-22244; CVSS v4.0 8.5; weakness CWE-1336; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patched, block PATCH requests to /api/v1/docStore/{templateId} and monitor email-template changes, particularly when followed by password changes, user invitations, account-activity notifications or test-email requests. The vendor advisory contains a working public proof of concept. Versions 1.5.0 through 1.11.3 are affected; version 1.11.4 is fixed. ([github.com](https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7), [github.com](https://github.com/advisories/GHSA-5f29-2333-h9c7))
Action: Map CVE-2026-22244 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-22244)
Finding 08 — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.
What changed: axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object.
Technical evidence: CVE-2026-67320; CVSS v4.0 8.3; weakness CWE-200; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching is not immediately possible, set an own proxy: false on affected requests or axios instances, use the Node fetch adapter where compatible, and avoid request interceptors that return regular-object clones of the configuration. A public proof of concept is included in the axios security advisory. Affected releases are axios >=0.31.1 and <0.33.0, and >=1.15.2 and <1.18.0; fixes are available in 0.33.0 and 1.18.0. ([github.com](https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9), [vulncheck.com](https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter))
Action: Map CVE-2026-67320 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-67320)
Finding 09 — elFinder: SSRF protection bypass via DNS rebinding in the 'fsock_get_contents()' fallback The cited source identifies the affected product and the available advisory or remediation status.
What changed: elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback The cited source identifies the affected product and the available advisory or remediation status. CVE coverage: CVE-2026-81889.
Technical evidence: CVE-2026-81889; CVSS v3.1 8.6; weakness CWE-918; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching is not immediately possible, reject URL uploads via urlUploadFilter, particularly where PHP cURL is unavailable. A public Docker-based proof of concept is attached to the advisory. Versions through 2.1.69 are affected; version 2.1.70 contains the fix. ([github.com](https://github.com/advisories/GHSA-8x3q-jpjh-qh5c), [tenable.com](https://www.tenable.com/cve/CVE-2026-81889))
Action: Map CVE-2026-81889 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: affected product not structured
[Evidence source: github.com](https://github.com/advisories/GHSA-8x3q-jpjh-qh5c)
Finding 10 — When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution.
What changed: When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets".
Technical evidence: CVE-2020-5411; CVSS v3.1 8.1; weakness CWE-502; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: If patching is not immediately possible, disable Jackson default typing and prevent untrusted write access to the JobRepository data store, as exploitation requires Jackson-backed ExecutionContext serialisation and malicious data-store writes. Spring lists versions 4.2.0.RELEASE through 4.2.2.RELEASE as affected and 4.2.3.RELEASE as fixed. ([spring.io](https://spring.io/security/cve-2020-5411/), [github.com](https://github.com/spring-projects/spring-batch/issues/3729))
Action: Map CVE-2020-5411 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2020-5411)
Finding 11 — A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c.
What changed: A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
Technical evidence: CVE-2022-27666; CVSS v3.1 7.8; weakness CWE-787; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: For non-containerised RHEL 8, set user.max_user_namespaces=0; Red Hat says not to apply this on containerised or OpenShift deployments and that it does not protect systems where an IPsec security association is already configured. A public local privilege-escalation exploit is available for Ubuntu Desktop 21.10. Linux kernels before 5.16.15 are affected, and the fixing commit is identified in 5.17-rc8. ([access.redhat.com](https://access.redhat.com/security/cve/cve-2022-27666), [github.com](https://github.com/plummm/CVE-2022-27666), [alioth-lists.debian.net](https://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/2022-March/098894.html))
Action: Map CVE-2022-27666 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2022-27666)
Finding 12 — An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4.
What changed: An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information.
Technical evidence: CVE-2021-3506; CVSS v3.1 7.1; weakness CWE-125; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Until patched, block untrusted local users from mounting arbitrary filesystems; Debian states the flaw is triggered by a crafted F2FS filesystem and requires such mount permission. DevGuard reports detected exploitation attempts but says it found no public exploit in GitHub or Exploit-DB. Upstream Linux kernel versions before 5.12.0-rc4 are affected, and Red Hat lists 5.12.0-rc4 as the fixed version. ([debian.org](https://www.debian.org/lts/security/dla-2690-1), [docs.devguard.org](https://docs.devguard.org/vulnerability-database/DEBIAN-CVE-2021-3506/), [cve.org](https://www.cve.org/CVERecord?id=CVE-2021-3506), +1 more)
Action: Map CVE-2021-3506 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2021-3506)
Finding 13 — Multiple vulnerabilities in Linux
What changed: CVE coverage: CVE-2022-26490, CVE-2022-4696. The cited advisories disclose: kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.
Technical evidence: CVE-2022-26490; CVSS v3.1 7.8; weakness CWE-120; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst assessment: If patching cannot occur immediately, apply generic Linux kernel hardening controls: restrict unprivileged local execution and container workloads, disable unused subsystems or kernel modules where feasible, and enforce strict host segmentation. Because kernel memory-corruption flaws generally require local code execution to trigger the vulnerable path, practical exposure is bounded by which untrusted users or processes can reach those kernel interfaces. Watch for kernel oops or panic traces, unexplained system reboots, abnormal process privilege changes, and unexpected root shells spawning from low-privilege accounts. (Generic reasoning about this weakness class, not vendor-specific guidance; no additional source found.)
Action: Map CVE-2022-26490 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
affected product not structured
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2022-26490)
Finding 14 — gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
What changed: gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation The cited source identifies the affected product and the available advisory or remediation status. CVE coverage: CVE-2026-84304.
Technical evidence: CVE-2026-84304; CVSS v4.0 8.7; weakness CWE-400; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: No public exploit is reported as available. Affected versions are gRPC-Go 1.83.0 and earlier; version 1.83.1 contains the fix. ([cybersecurity-help.cz](https://www.cybersecurity-help.cz/vdb/vulns/144264/), [github.com](https://github.com/advisories/GHSA-vp52-pcj8-j9qc))
Action: Map CVE-2026-84304 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: affected product not structured
[Evidence source: github.com](https://github.com/advisories/GHSA-vp52-pcj8-j9qc)
Finding 15 — Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled The cited source identifies the affected product and the available advisory or remediation status.
What changed: Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled The cited source identifies the affected product and the available advisory or remediation status. CVE coverage: CVE-2026-77567.
Technical evidence: CVE-2026-77567; CVSS v3.1 8.1; weakness CWE-287; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: If patching is delayed, disable recovery codes for app-based MFA or switch users to email-based MFA, and monitor for successful Filament logins without a corresponding TOTP verification event or MFA challenge requests with useRecoveryCode=true and blank code fields. DevGuard reports observed exploitation activity but says it found no public exploit in GitHub repositories or Exploit-DB. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-77567/), [docs.devguard.org](https://docs.devguard.org/vulnerability-database/CVE-2026-77567/), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-77567))
Action: Map CVE-2026-77567 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits:** fixed version or patch state unknown
affected product not structured
[Evidence source: github.com](https://github.com/advisories/GHSA-52xp-w8hr-xv3c)