This brief covers the trailing ~48 hours (September 2–4, 2026). Every item below was checked against its primary source — the vendor advisory, the CISA KEV entry, or the original researcher’s disclosure — and the CVE IDs, scores, and dates come from those pages.
CISA adds seven flaws to KEV: SonicWall SMA 1000 zero-days, JFrog Artifactory auth bypass, Sangoma Switchvox SQLi, plus Starlette, Kestra and LiteLLM
CISA · September 2, 2026
CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog in a single update. The headline entries are the two SonicWall SMA 1000 zero-days — CVE-2026-83548 (CVSS 10.0, pre-auth SSRF via an unintended forward proxy in the Work Place interface) and CVE-2026-83549 (CVSS 7.8, post-auth OS command injection in the Appliance Management Console) — which SonicWall disclosed on September 1 with confirmation of in-the-wild exploitation. Affected models are SMA 1000 6210, 7210 and 8200v on 12.4.3-03453 and 12.5.0-02835 and earlier; fixes are 12.4.3-03526 and 12.5.0-02952, and SonicWall advises re-imaging, password resets and TOTP resets if IoCs are found.
Also added: CVE-2026-82329 (CVSS 9.8), an improper-authentication bug in self-hosted JFrog Artifactory that grants admin privileges under default configuration — patched August 28, with watchTowr reporting attackers minting admin tokens within days; CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox’s /pa endpoint that reaches PostgreSQL superuser and yields RCE, fixed in Switchvox 8.4.0.2 (July 14) and observed exploited by Horizon3/Defused honeypots from August 30; CVE-2026-48710 (CVSS 6.5, Starlette request smuggling); CVE-2026-49869 (CVSS 10.0, Kestra OSS command injection, tied to a Microsoft-reported crypto-miner intrusion); and CVE-2026-59822 (CVSS 8.8, LiteLLM MCP endpoint improper authentication). All are patched. Federal remediation deadline is September 5 for most, September 16 for the Starlette and LiteLLM entries.
“IMPORTANT: These vulnerabilities have been confirmed as being actively exploited in the wild.” — SonicWall, Product Notice SNWLID-2026-0016
“…we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted.” — Zach Hanley, Horizon3
Source: CISA alert · SonicWall SNWLID-2026-0016 · Horizon3 disclosure · SecurityWeek (Artifactory) · The Hacker News
Google patches Chrome V8 type-confusion zero-day exploited in the wild (CVE-2026-85046)
Google Chrome · September 3, 2026
Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) ships 12 security fixes, including CVE-2026-85046, a high-severity type confusion in the V8 JavaScript engine reported by Salvatore Gulizia (Serotav) on August 4 and rated CVSS 8.8. Google confirms an exploit exists in the wild and has restricted bug details; this is the sixth Chrome zero-day patched in 2026. Not yet listed in KEV at time of writing. The same release also fixes a V8 race condition (CVE-2026-85045) and out-of-bounds write in WebGL (CVE-2026-85050). Chromium-based browsers (Edge, Brave, Opera, Vivaldi) will need their own updates.
“Google is aware that an exploit for CVE-2026-85046 exists in the wild.” — Google Chrome Releases
Source: Chrome Releases – Stable Channel Update · The Hacker News
Cisco: critical unauthenticated root RCE in Silicon One-based Nexus 9000 switches (CVE-2026-20212)
Cisco PSIRT · September 2, 2026
CVE-2026-20212 (CVSS 9.8, CWE-1327) affects Nexus 9000 Series switches that include a Silicon One ASIC — PIDs N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804 and N9K-C9808. TCP ports 43210 and 43211 are reachable in the default L3 VRF; crafted input to that service executes as root and can crash the S1HAL process to reload the device. Fixed software is available, Cisco has published a Live Protect shield as a temporary mitigation, and infrastructure ACLs blocking those ports are a documented workaround. Cisco PSIRT is not aware of exploitation; the bug surfaced during a TAC case. Not in KEV.
“A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.” — Cisco Security Advisory cisco-sa-n9k-s1-rce-EH8dEtr
Source: Cisco advisory · SecurityWeek
Broadcom fixes VM-escape bugs in VMware Workstation and Fusion (CVE-2026-59346, CVE-2026-59347)
Broadcom VMSA-2026-0007 · September 3, 2026
Two guest-to-host code execution flaws affect VMware Workstation and Fusion 25H2 and 26H1. CVE-2026-59346 (CVSS 9.3, Critical) is an integer overflow in the VMXNET3 virtual NIC; CVE-2026-59347 (CVSS 8.1) is a stack-based buffer overflow in HGFS that executes code as the host-side VMX process. Both require local admin on a guest VM. Fixed in 26H1u1; no workarounds. Reported privately (ZDI and Tencent Xuanwu Lab credited); no known exploitation and not in KEV.
“A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.” — Broadcom, VMSA-2026-0007
Source: Broadcom VMSA-2026-0007 · SecurityWeek
“PostGREShell”: Cyera details 12-year-old PostgreSQL logical-decoding bug that turns REPLICATION privilege into server takeover (CVE-2026-6471)
Cyera / PostgreSQL · September 4, 2026 (patched August 13)
Cyera published research on CVE-2026-6471 (CVSS 7.2, missing authorization), in which the logical-decoding plugin name is passed unsanitized to dlopen(), letting any account with the REPLICATION attribute load an arbitrary shared object and run code as the postgres OS user — then write itself into pg_authid for permanent superuser and persistence. Every release from 9.4 through 18 is affected; the PostgreSQL project shipped fixes in 18.6, 17.11, 16.15, 15.19 and 14.24 on August 13 and added an output_plugin_libraries allowlist parameter. No exploitation reported; not in KEV. Audit which accounts hold REPLICATION — backup tools, monitoring agents and pipelines commonly do.
“Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server…” — PostgreSQL Security, CVE-2026-6471
Source: PostgreSQL security page · SecurityWeek
Still developing
GitSpawn: repository-supplied Git config runs attacker code through seven AI coding agents; four still unpatched
Manifold Security · September 2, 2026
Manifold disclosed eight findings in which a repo’s own .git/config (chiefly core.fsmonitor) names a command that CLI coding agents execute at session startup — before any trust prompt, outside the sandbox, as the user. Fixed: goose 1.44.0 (CVE-2026-72718, CVSS 7.0 per GitHub advisory), Codex CLI 0.131.0 and Codex Desktop (OpenAI published three CVEs including CVE-2026-19592), Claude Code 2.1.196 on the fsmonitor path, and Cursor. Still executing repo-supplied commands at Manifold’s September 1 retest: Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path via ultrareview. Exploitation requires the repo to arrive as files with .git intact (archive, shared drive, USB), not a normal clone. No exploitation reported; none in KEV. Mitigation: git config --global core.fsmonitor false and inspect .git/config before opening received directories with an agent.
“The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath…” — Manifold Security
Source: The Hacker News · goose GHSA-r5pp-p5r8-466r
Langflow unauthenticated RCE (CVE-2026-0768) under active exploitation for credential theft
VulnCheck · September 1, 2026
VulnCheck reports in-the-wild exploitation of CVE-2026-0768 (CVSS 9.8), an unauthenticated Python exec() injection in Langflow’s custom-component validator affecting all releases through 1.4.2, publicly disclosed by ZDI as a zero-day in January. Observed post-exploitation: reading environment variables, the Langflow secret key, cloud API keys, .env files and SSH keys, with 360+ attempts against canaries by September 1. Not yet in KEV. VulnCheck counts 11 additional Langflow CVEs exploited so far in 2026.
Source: SecurityWeek · ZDI-26-034
This brief covers the trailing ~48 hours (September 2–4, 2026).
Primary sources:
- CISA – Adds Seven Known Exploited Vulnerabilities to Catalog (Sept 2, 2026)
- SonicWall – SNWLID-2026-0016
- Horizon3 – CVE-2026-9586 Sangoma Switchvox RCE
- Google – Chrome Stable Channel Update (Sept 3, 2026)
- Cisco – cisco-sa-n9k-s1-rce-EH8dEtr
- Broadcom – VMSA-2026-0007
- PostgreSQL – CVE-2026-6471
- GitHub – goose GHSA-r5pp-p5r8-466r (CVE-2026-72718)
- ZDI – ZDI-26-034 (Langflow CVE-2026-0768)