Executive assessment
Today's brief leads with Multiple vulnerabilities in Linux kernel. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 14 should lead because it is the only item marked as exploited in the wild, and the listed control gives a direct management-access reduction path despite no fixed version being listed. Patch order: Finding 14 (It is the only finding marked exploitation=in_the_wild; block RouterOS SSH access from untrusted networks and allow only trusted management IPs or VPN access); Finding 03 (It is critical with exploitation=poc, has fixed version 0.0.31, and the listed control is to avoid unpickling untrusted or tampered data until patched); Finding 02 (It is critical account takeover with fixed versions 1.7.4 and 2.0.0-beta.4 listed, and Discord OAuth can be disabled until updating); Finding 01 (It is critical Linux kernel coverage in the brief, although exploitation, fixed status and controls are not listed); Finding 09 (It is high severity with exploitation=poc, has a listed fix in libpcap 1.10.7, and has a specific filter-validation control).
Finding 01 — Multiple vulnerabilities in Linux kernel
What changed: Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.
Technical evidence: CVE-2025-38724; CVSS v3.1 9.8; weakness CWE-416; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Affected: Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. ([ubuntu.com](https://ubuntu.com/security/notices/USN-8819-2))
Action: Map CVE-2025-38724 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8819-2)
Finding 02 — FriendsOfFlarum OAuth: Insufficient Verification of Data Authenticity
What changed: GitHub Advisory Database published GHSA-g7vj-c29h-3h5m for CVE-2026-92161 (FriendsOfFlarum OAuth): Insufficient Verification of Data Authenticity, CVSS v3.1 9.8; affected: fof/oauth versions earlier than 1.7.4, and versions from 2.0.0-beta.1 through 2.0.0-beta.3.
Technical evidence: CVE-2026-92161; CVSS v3.1 9.8; weakness CWE-345; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Disable the Discord OAuth provider in the extension settings until an update can be applied. ([osv.dev](https://osv.dev/vulnerability/GHSA-g7vj-c29h-3h5m), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-92161))
Affected: fof/oauth versions earlier than 1.7.4, and versions from 2.0.0-beta.1 through 2.0.0-beta.3. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-92161))
Fix: 1.7.4 and 2.0.0-beta.4. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-92161))
Action: Map CVE-2026-92161 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-g7vj-c29h-3h5m)
Finding 03 — Multiple vulnerabilities in picklescan
What changed: CVE coverage: CVE-2025-10155, CVE-2025-10157. The cited advisories disclose: picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension.
Technical evidence: CVE-2025-10155; CVSS v4.0 9.3; weakness CWE-20; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patched, do not unpickle data from untrusted sources or data that could have been tampered with. For untrusted data, use a safer serialisation format such as JSON. mmaitre314's GitHub advisories publish PoC procedures for both vulnerabilities. ([docs.python.org](https://docs.python.org/3/library/pickle.html), [github.com](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-jgw4-cr84-mqxg), [github.com](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr))
Fix: 0.0.31 ([github.com](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-jgw4-cr84-mqxg), [github.com](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr))
Action: Map CVE-2025-10155 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-10155)
Finding 04 — Archer AX53 and AX12: Heap-based Buffer Overflow
What changed: Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed field. This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120 and Archer AX12 v1.0: up to 1.5.1 Build 20260721.
Technical evidence: CVE-2025-62673; CVSS v4.0 8.6; weakness CWE-122; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For Archer AX53, block UDP/20002 to the router from untrusted adjacent network segments. CISA ADP Vulnrichment reports exploitation as "none". ([tp-link.com](https://www.tp-link.com/us/support/faq/4943/), [talosintelligence.com](https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2290), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2025-62673), +2 more)
Action: Map CVE-2025-62673 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-62673)
Finding 05 — Multiple vulnerabilities in Chromium
What changed: Chromium carries 2 CVEs across 2 advisories: CVE-2025-2135 Type Confusion in V8; Use After Free. CVE coverage: CVE-2025-2135, CVE-2026-87536.
Technical evidence: CVE-2025-2135; CVSS v3.1 8.8; weakness CWE-843; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: On managed Chrome or Edge, set DefaultJavaScriptJitSetting to BlockJavaScriptJit. If global blocking is impractical, use JavaScriptJitBlockedForSites for selected URL patterns. CISA's SSVC assessment, published in the NVD record, lists exploitation as 'none'. ([raw.githubusercontent.com](https://raw.githubusercontent.com/chromium/chromium/main/components/policy/resources/templates/policy_definitions/ContentSettings/DefaultJavaScriptJitSetting.yaml), [learn.microsoft.com](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/javascriptjitblockedforsites), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-2135), +5 more)
Affected: Google Chrome versions before 134.0.6998.88; Google Chrome versions prior to 153.0.8010.36 ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-2135), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-87536))
Fix: Chrome 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and Mac ([chromereleases.googleblog.com](https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html), [api.msrc.microsoft.com](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Mar), [chromereleases.googleblog.com](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html))
Action: Map CVE-2025-2135 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: msrc.microsoft.com](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-2135)
Finding 06 — RTI Connext Professional: Exposure of Private Personal Information to an Unauthorized Actor
What changed: Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.2.0 before 7.3.1.
Technical evidence: CVE-2025-10450; CVSS v4.0 8.3; weakness CWE-359; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: RTI states that there are no mitigations for this vulnerability. CISA ADP Vulnrichment reports exploitation as none. ([community.rti.com](https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/#cve-2025-10450), [community.rti.com](https://community.rti.com/static/documentation/connext-dds/current/doc/manuals/connext_dds_professional/release_notes/whats_fixed/770/fixes_vulnerabilities.html#critical-potential-unauthorized-access-to-instance-information-in-connext-applications), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2025-10450))
Fix: RTI lists Connext Professional 7.3.1 and 7.7.0 as containing fixes. ([community.rti.com](https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/#cve-2025-10450), [community.rti.com](https://community.rti.com/static/documentation/connext-dds/current/doc/manuals/connext_dds_professional/release_notes/whats_fixed/770/fixes_vulnerabilities.html#critical-potential-unauthorized-access-to-instance-information-in-connext-applications))
Action: Map CVE-2025-10450 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-10450)
Finding 07 — RTI Connext Micro: Out-of-bounds Read
What changed: Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. This issue affects Connext Micro: from 4.0.0 before 4.3.0, from 2.4.5 before 2.4..
Technical evidence: CVE-2026-30802; CVSS v4.0 8.8; weakness CWE-125; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Enable the Lightweight Security Plugin, or protect the network against unauthorised access. CISA ADP Vulnrichment reports no exploitation. ([community.rti.com](https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/index.html#cve-2026-30802), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-30802))
Action: Map CVE-2026-30802 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-30802)
Finding 08 — Multiple vulnerabilities in AOS-CX Switches
What changed: AOS-CX Switches carries 2 CVEs across 2 advisories: OS Command Injection; Command Injection. CVE coverage: CVE-2026-23816, CVE-2026-23814.
Technical evidence: CVE-2026-23814; CVSS v3.1 8.8; weakness CWE-77; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict management-interface access to a dedicated Layer 2 segment or VLAN, and use Layer 3 policies and Control Plane ACLs so only trusted hosts can reach HTTPS/REST endpoints. Disable HTTP(S) interfaces where management access is unnecessary, and enable logging and accounting for unauthorised access attempts. CISA ADP Vulnrichment reports no exploitation. ([securityonline.info](https://securityonline.info/critical-9-8-cvss-bypass-unearthed-in-hpe-aruba-aos-cx-switches/), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-23814), [support.hpe.com](https://support.hpe.com/hpesc/public/api/document/hpesbnw05027en_us))
Affected: AOS-CX 10.17.0001 and below, 10.16.1020 and below, 10.13.1160 and below, and 10.10.1170 and below ([securityonline.info](https://securityonline.info/critical-9-8-cvss-bypass-unearthed-in-hpe-aruba-aos-cx-switches/), [support.hpe.com](https://support.hpe.com/hpesc/public/api/document/hpesbnw05027en_us))
Fix: AOS-CX 10.17.1001 and above, 10.16.1030 and above, 10.13.1161 and above, and 10.10.1180 and above ([securityonline.info](https://securityonline.info/critical-9-8-cvss-bypass-unearthed-in-hpe-aruba-aos-cx-switches/), [support.hpe.com](https://support.hpe.com/hpesc/public/api/document/hpesbnw05027en_us))
Action: Map CVE-2026-23814 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-23814)
Finding 09 — libpcap: Improper Validation of Array Index
What changed: It was discovered that libpcap did not properly validate BPF instructions in some situation. An attacker could possibly use this issue to perform out of bound memory operations.
Technical evidence: CVE-2026-0799; CVSS v3.1 8.7; weakness CWE-129, CWE-125, CWE-787; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Validate every filter program that was not produced by a local pcap_compile() call. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-0799))
Affected: libpcap versions before 1.10.7. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-0799))
Fix: libpcap 1.10.7. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-0799))
Action: Map CVE-2026-0799 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8824-1)
Finding 10 — Mediawiki EmbedVideo Extension: Cross-site Scripting
What changed: GitHub Advisory Database published GHSA-v65j-hff3-753c for CVE-2026-57440 (Mediawiki EmbedVideo Extension): Cross-site Scripting, CVSS v3.1 7.5; affected: <= 4.0.0.
Technical evidence: CVE-2026-57440; CVSS v3.1 7.5; weakness CWE-79, CWE-80; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Set $wgEmbedVideoRequireConsent to true until patching. Restrict page-edit permissions to trusted users while the vulnerable configuration remains in use. The GitHub repository security advisory publishes a proof of concept that escapes the iframe src attribute using double quotes. ([github.com](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-57440))
Affected: <= 4.0.0 ([github.com](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c))
Fix: 4.1.0 ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-57440))
Action: Map CVE-2026-57440 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-v65j-hff3-753c)
Finding 11 — JetBrains IDE Services: Missing Authorization
What changed: NVD records CVE-2025-58334 (JetBrains IDE Services): Missing Authorization, CVSS v3.1 8.1.
Technical evidence: CVE-2025-58334; CVSS v3.1 8.1; weakness CWE-862; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2025-58334 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-58334)
Finding 12 — UPDF: Uncontrolled Search Path Element
What changed: NVD records CVE-2025-10214 (UPDF): Uncontrolled Search Path Element, CVSS v4.0 7.
Technical evidence: CVE-2025-10214; CVSS v4.0 7; weakness CWE-427; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Use Windows application control to block UPDF.exe 1.8.5.0 from running; configure Sysmon to alert when UPDF.exe loads FREngine.dll from the affected user-writable directory. INCIBE-CERT reports no exploitation for CVE-2025-10214. ([incibe.es](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf), [learn.microsoft.com](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol), [learn.microsoft.com](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon))
Action: Map CVE-2025-10214 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-10214)
Finding 13 — N-central Windows Agent and Probe: Incorrect Default Permissions
What changed: NVD records CVE-2025-10231 (N-central Windows Agent and Probe): Incorrect Default Permissions, CVSS v3.1 7; affected: N-central versions before 2025.3.
Technical evidence: CVE-2025-10231; CVSS v3.1 7; weakness CWE-276; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CISA ADP reports no exploitation. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2025-10231))
Affected: N-central versions before 2025.3. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2025-10231))
Fix: N-central 2025.3. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2025-10231))
Action: Map CVE-2025-10231 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-10231)
Finding 14 — Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
What changed: CISA added CVE-2026-67279 (Mikrotik RouterOS) to the Known Exploited Vulnerabilities catalogue: CWE-841, CVSS v4.0 6.9; affected: RouterOS 7.24 to below 7.24.2, 7.0.0 to below 7.23.4, and 6.0.0 to below 6.49.21.
Technical evidence: CVE-2026-67279; CVSS v4.0 6.9; weakness CWE-841; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Analyst note: Block SSH access from untrusted networks; permit it only from trusted management IPs or through a VPN such as WireGuard, without exposing management ports. Monitor logs for SSH activity involving user -2 and investigate any unexpected highly privileged user named "ops". ([mikrotik.com](https://mikrotik.com/supportsec/september-2026-vulnerability/), [cert.pl](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/), [cert.pl](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/))
Affected: RouterOS 7.24 to below 7.24.2, 7.0.0 to below 7.23.4, and 6.0.0 to below 6.49.21. ([cert.pl](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/))
Action: Map CVE-2026-67279 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?vulnId=CVE-2026-67279)
Finding 15 — Vulnerability in JetBrains Junie
What changed: NVD records CVE-2025-58335 (JetBrains Junie): CWE-356, CVSS v3.1 5.5.
Technical evidence: CVE-2025-58335; CVSS v3.1 5.5; weakness CWE-356; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2025-58335 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits:** fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-58335)