Executive assessment
Today's brief leads with Authentication Bypass by Capture-replay in ZenHive mpp. All 12 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Authentication Bypass by Capture-replay in ZenHive mpp
What changed: ZenHive mpp versions 0.3.0 before 0.6.3 accept transaction-hash credentials without binding proof to the current challenge or prior use. An unauthenticated client can replay a matching settled transfer to obtain static-price paid resources repeatedly; version 0.6.3 fixes the affected path.
Technical evidence: CVE-2026-67581; CVSS v4.0 8.7; weakness CWE-294; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Price each challenge uniquely using per-challenge or single-use amounts and keep challenge expiry short; use the Tempo method for on-chain payments where feasible. ([cna.erlef.org](https://cna.erlef.org/cves/CVE-2026-67581.html), [raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67581.json), [github.com](https://github.com/ZenHive/mpp/security/advisories/GHSA-vp5h-xh25-44wf))
Affected: ZenHive mpp versions 0.3.0 before 0.6.3. ([cna.erlef.org](https://cna.erlef.org/cves/CVE-2026-67581.html))
Fix: ZenHive mpp 0.6.3. ([github.com](https://github.com/ZenHive/mpp/security/advisories/GHSA-vp5h-xh25-44wf))
Panel assessment: Patch affected deployments this week: the issue is unauthenticated and can turn one valid settled transfer into repeated access to static-price paid resources, but the record says no exploitation is reported. The likely attack path is capture and replay of a matching historical transaction hash against later payment challenges, reaching the paid resource guarded by that check without a fresh payment. (priority: this week)
Action: Map CVE-2026-67581 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-67581)
Finding 02 — MISP: Cross-Site Request Forgery
What changed: A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests.
Technical evidence: CVE-2026-85236; CVSS v4.0 8.8; weakness CWE-352; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patching, configure the reverse proxy or WAF to block GET requests to /events/cullEmptyEvents, permitting only POST. ([github.com](https://github.com/MISP/MISP/commit/2b6b3ac90), [vulnerability.circl.lu](https://vulnerability.circl.lu/vuln/cve-2026-85236), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-85236), +2 more)
Affected: MISP versions through 2.5.45. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-85236))
Fix: MISP 2.5.46. ([api.github.com](https://api.github.com/repos/MISP/MISP/compare/v2.5.45...v2.5.46), [github.com](https://github.com/MISP/MISP/releases/tag/v2.5.46))
Panel assessment: Prioritise remediation this week: no exploitation is reported, but the vulnerable action is irreversible and can be triggered through a crafted URL loaded by an already-authenticated MISP user with sufficient privileges. The likely attack path is browser-driven CSRF that rides the victim’s existing session to /events/cullEmptyEvents, reaching event cleanup rather than credentials or downstream pipelines. (priority: this week)
Action: Map CVE-2026-85236 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85236)
Finding 03 — MISP: Improper Restriction of Excessive Authentication Attempts
What changed: A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP values.
Technical evidence: CVE-2026-85237; CVSS v4.0 8.6; weakness CWE-307; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Disable email OTP until MISP can be patched: sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting Security.email_otp_enabled 0. CISA reports no exploitation. ([github.com](https://github.com/MISP/MISP/issues/9249), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-85237), [misp-project.org](https://www.misp-project.org/2026/09/10/misp.2.4.46.released.html/))
Affected: MISP versions up to and including 2.5.45. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-85237))
Fix: MISP 2.5.46. ([misp-project.org](https://www.misp-project.org/2026/09/10/misp.2.4.46.released.html/))
Panel assessment: Patch this week: there is no reported exploitation and the attacker must already reach the OTP stage, but the flaw weakens a second-factor control on a high-severity authentication path. The likely attack path is stolen or guessed primary credentials followed by repeated email_otp() attempts against a still-valid code, leading to the victim’s authenticated MISP access and whatever threat-intelligence data or account actions that role permits. (priority: this week)
Action: Map CVE-2026-85237 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85237)
Finding 04 — Multiple vulnerabilities in PJSIP
What changed: CVE coverage: CVE-2026-57159, CVE-2026-57161. The cited advisories disclose: 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled; acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response in pjsua_acc.c).
Technical evidence: CVE-2026-57159; CVSS v4.0 8.4; weakness CWE-129, CWE-787; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: For CVE-2026-57159, disable PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP or accept remote SDP only from trusted peers. For CVE-2026-57161, restrict registration to trusted registrars over TLS. ([github.com](https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2), [github.com](https://github.com/pjsip/pjproject/security/advisories/GHSA-xc62-j9h2-mp84))
Affected: pjproject versions through 2.17 are affected; CVE-2026-57159 requires PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled, while CVE-2026-57161 affects applications using the PJSUA/PJSUA2 account API ([github.com](https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2), [github.com](https://github.com/pjsip/pjproject/security/advisories/GHSA-xc62-j9h2-mp84))
Fix: No patched release version is listed for either CVE; the vendor provides patches in the master branch. ([github.com](https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2), [github.com](https://github.com/pjsip/pjproject/security/advisories/GHSA-xc62-j9h2-mp84))
Action: Map CVE-2026-57159 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-57159)
Finding 05 — Multiple vulnerabilities in Dell SCG 5.0 Appliance
What changed: CVE coverage: CVE-2026-80133, CVE-2026-80178, CVE-2026-78484, CVE-2026-78493. The cited advisories disclose: versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability.
Technical evidence: CVE-2026-80133; CVSS v3.1 7.4; weakness CWE-23; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: SOCRadar reports a public exploit for CVE-2026-78493, while VulDB reports that no exploit exists. ([dell.com](https://www.dell.com/support/kbdoc/en-us/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-application-and-appliance-multiple-vulnerabilities), [socradar.io](https://socradar.io/free-tools/cve-radar/CVE-2026-78493), [vuldb.com](https://vuldb.com/vuln/401802))
Affected: Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00 and Appliance versions prior to 5.36.00.16. ([dell.com](https://www.dell.com/support/kbdoc/en-us/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-application-and-appliance-multiple-vulnerabilities))
Fix: Dell Secure Connect Gateway 5.0 Application 5.36.00.00 or later and Appliance 5.36.00.16 or later. ([dell.com](https://www.dell.com/support/kbdoc/en-us/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-application-and-appliance-multiple-vulnerabilities))
Action: Map CVE-2026-80133 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-80133)
Finding 06 — Vulnerability in hawtio-operator
What changed: A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client).
Technical evidence: CVE-2026-80219; CVSS v3.1 8.7; weakness CWE-1390; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Manually patch the hawtio-operator-created OAuthClient to set grantMethod to 'prompt' instead of 'auto', and add a client secret. Monitor OpenShift OAuth server audit logs for unexpected grants to the hawtio OAuthClient. ([access.redhat.com](https://access.redhat.com/security/cve/cve-2026-80219), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-80219))
Affected: Red Hat lists rhbac-4/hawtio-operator-bundle and rhbac-4/hawtio-rhel9 for Red Hat build of Apache Camel - HawtIO 4 as affected; the CVE record states that all versions are affected. ([access.redhat.com](https://access.redhat.com/security/cve/cve-2026-80219), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-80219))
Action: Map CVE-2026-80219 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-80219)
Finding 07 — DataCube contained a path traversal issue affecting security feature
What changed: DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release.
Technical evidence: CVE-2026-77091; CVSS v4.0 8.5; weakness CWE-22; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Feedly reports no evidence of a public proof-of-concept or exploitation. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_07_3.html), [feedly.com](https://feedly.com/cve/CVE-2026-77091))
Affected: Commvault 11.36.0–11.36.122, 11.40.0–11.40.71, 11.44.0–11.44.19 and 11.46.0–11.46.19 on Linux and Windows. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_07_3.html))
Fix: Commvault 11.36.123, 11.40.72, 11.44.20 and 11.46.20 or higher. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_07_3.html))
Action: Map CVE-2026-77091 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-77091)
Finding 08 — Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability.
What changed: Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release.
Technical evidence: CVE-2026-77097; CVSS v4.0 8.8; weakness CWE-306; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict network exposure of the Private Metrics Server and ensure it is not reachable from untrusted networks until it can be updated. CISA ADP reports exploitation as none. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html), [ionix.io](https://www.ionix.io/threat-center/cve-2026-77097/), [raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77097.json))
Affected: Commvault on Linux and Windows: 11.46.0–11.46.19, 11.44.0–11.44.19, 11.40.0–11.40.71 and 11.36.0–11.36.122. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html))
Fix: 11.46.20 and higher, 11.44.20 and higher, 11.40.72 and higher, and 11.36.123 and higher. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html))
Action: Map CVE-2026-77097 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-77097)
Finding 09 — Cvlaunchd contained a missing authorization issue affecting command execution authorization.
What changed: Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release.
Technical evidence: CVE-2026-77106; CVSS v4.0 7.7; weakness CWE-862; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CISA ADP Vulnrichment reports exploitation as 'none'. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-77106), [documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html))
Affected: Commvault 11.36.0–11.36.122, 11.40.0–11.40.71, 11.44.0–11.44.19 and 11.46.0–11.46.19 on Linux and Windows. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html))
Fix: Commvault 11.36.123, 11.40.72, 11.44.20 and 11.46.20, or higher releases in the respective branches. ([documentation.commvault.com](https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html))
Action: Map CVE-2026-77106 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-77106)
Finding 10 — XenForo: Incorrect Authorization
What changed: XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending.
Technical evidence: CVE-2026-73313; CVSS v4.0 7.6; weakness CWE-863; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Researcher BomboBombone published a proof of concept for the two-account login. ([github.com](https://github.com/BomboBombone/CVE-2026-73313), [vulncheck.com](https://www.vulncheck.com/advisories/xenforo-mfa-bypass-via-passkey-tfa-provider), [bombobombone.github.io](https://bombobombone.github.io/posts/cve-2026-73313))
Affected: XenForo before 2.3.13; reproduction was confirmed on XenForo 2.3.12 build 2031270. ([vulncheck.com](https://www.vulncheck.com/advisories/xenforo-mfa-bypass-via-passkey-tfa-provider), [bombobombone.github.io](https://bombobombone.github.io/posts/cve-2026-73313))
Fix: XenForo 2.3.13. ([bombobombone.github.io](https://bombobombone.github.io/posts/cve-2026-73313))
Action: Map CVE-2026-73313 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-73313)
Finding 11 — Multiple vulnerabilities in Samsung Mobile (SMR Sep-2026)
What changed: CVE coverage: CVE-2026-21087, CVE-2026-21090, CVE-2026-21091, CVE-2026-21094. The cited source identifies the affected product and the available advisory or remediation status.
Technical evidence: CVE-2026-21087; CVSS v4.0 8.6; weakness CWE-787; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Samsung reports each of the four vulnerabilities as privately disclosed. ([security.samsungmobile.com](https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09))
Affected: CVE-2026-21087: Android 15, 16 and 17; CVE-2026-21090, CVE-2026-21091 and CVE-2026-21094: Android 14, 15, 16 and 17. ([security.samsungmobile.com](https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09))
Fix: SMR Sep-2026 Release 1 ([security.samsungmobile.com](https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=09))
Action: Map CVE-2026-21087 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21087)
Finding 12 — IBM DataStage on Cloud Pak for Data: Authorization Bypass Through User-Controlled Key
What changed: IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples.
Technical evidence: CVE-2026-81210; CVSS v3.1 7.7; weakness CWE-639; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Affected: IBM DataStage on Cloud Pak for Data 5.4.0.0. ([ibm.com](https://www.ibm.com/support/pages/security-bulletin-datastage-cloud-pak-data-has-several-vulnerabilities-due-open-source-software-22))
Fix: IBM DataStage on Cloud Pak for Data 5.4 patch 5 or later. ([ibm.com](https://www.ibm.com/support/pages/security-bulletin-datastage-cloud-pak-data-has-several-vulnerabilities-due-open-source-software-22))
Action: Map CVE-2026-81210 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-81210)