Topic
Defects that allow network access without valid credentials, often via faulty state or credential-validation logic.
Citrix's critical NetScaler flaw CVE-2026-19490 is exploitable only on appliances running a Gateway or AAA virtual server role, a DEV Community analysis of the advisory says. The other August flaw depends on a different setting, so role sets the patch order.
Reality
In CVE-2026-88008, Traefik tunnels raw bytes once a backend answers a client's h2c Upgrade with 101, so later HTTP/2 requests bypass every middleware. According to a DEV Community write-up, the tunnel opens only when the backend accepts the upgrade.
Reality
CISA added Kestra's CVE-2026-49869 to its known-exploited catalog on September 2 at CVSS 10.0, after an auth-filter bug let unauthenticated callers run commands as root. Teams on affected Kestra OSS builds should upgrade to 1.0.45 or 1.3.21.
Reality
Horizon3 detailed how two AhsayCBS backup-server flaws chain into unauthenticated code execution as SYSTEM and root. Attackers were already planting webshells through the chain before Ahsay issued hotfixes on 12 October 2026.
Reality
Cisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that is already exploited and has no workaround. A dev.to analysis says one Manager can administer up to 6,000 devices, so patching is the only defense.
Reality
Kestra's AuthenticationFilter skips authentication for any request path ending in "/configs", letting an unauthenticated attacker reach root remote code execution. Naming a flow "configs" is enough, because the REST API puts the flow name in the path. The bug is CVE-2026-49869.
Reality
Alluxio's S3 REST proxy skipped AWS signature checks by default, a flaw NVD scores 9.3 as CVE-2026-79787. An attacker needs only a network route to the port, so internal reachability decides which clusters are exposed until they upgrade.
Reality
CVE-2026-82329 is reported as a pre-auth authentication bypass in JFrog Artifactory's Access microservice, and it reaches every dependency your builds pull from the platform. One publisher, no vendor advisory.
Reality
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
Reality
CISA added Kestra's unauthenticated code-execution flaw CVE-2026-49869, rated 10.0, to its exploited list on 2 September, three months after the fix. Orchestrators hold their workflows' credentials, so any reachable unpatched instance needs a compromise check as well as an upgrade.
Reality
MCP Atlassian releases before 0.22.0 fall back to the operator's credentials whenever an HTTP caller has no verified identity (CVE-2026-77244). HTTP deployments need the upgrade, and the endpoint should be reachable only through a management network or an authenticating proxy.
Reality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishersReality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8 CVSS flaw that lets anyone reaching SD-WAN Manager's API act as admin with no credentials. Managers patched for the May and June flaws still need the new releases, because those fixes predate this one.
Reality
Attackers are chaining three self-hosted JFrog Artifactory flaws, one rated CVSS 9.8, to mint administrator tokens in under five minutes. Because every build resolves its packages through that one repository, it is as efficient to attack as to run.
Reality
Exposure to CVE-2026-19490, a CVSS 9.8 NetScaler bypass CISA lists as exploited, depends on each appliance's exact build and SAML setup. Older builds qualify with any Gateway or AAA virtual server, while later builds short of the fix also need a SAML action configured.
Reality
Unauthenticated attackers can drop PHP onto WordPress sites running Forminator 1.56.1 or earlier. The install base is 600,000; the exposed subset depends on how the forms were built.
Reality
CVE-2026-19490 lets an unauthenticated attacker past NetScaler gateway and AAA virtual servers. Rapid7 has seen no exploitation yet and expects it shortly.
Perspective Coverage
5 publishersReality
Patchstack says attackers are chaining CVE-2026-61979 and CVE-2026-15981 to mint WordPress admin sessions. Only the free edition got an advisory; Standard needs 17.0.6.
Perspective Coverage
5 publishersReality
Wordfence and Patchstack disclosed five critical bugs in WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP. Only one of them fires with no configuration precondition. That is what sets the patch order.
Reality
Huntress has seen exploitation in two customer environments. One flaw hands over PaperCut's configuration without a login, the second turns that configuration into a class loader, so patching and config review are one job.
Perspective Coverage
10 publishersReality
Security · September 16, 2026 · Confirmed2 publishers
Build · September 19, 2026 · Confirmed2 publishers