Week 9, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-20127 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

  Cisco · Cisco Catalyst SD-WAN Manager

  EPSS 88%
• Critical 9.8
  CVE-2026-27966 Langflow has Remote Code Execution in CSV Agent

  langflow-ai · langflow

  EPSS 35%
• Critical 9.8
  CVE-2026-21902 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

  Juniper Networks · Junos OS Evolved

  EPSS 18%
• Critical 9.4
  CVE-2026-27577 n8n: Expression Sandbox Escape Leads to RCE

  n8n-io · n8n

  EPSS 11%
• Critical 9.3
  CVE-2026-28517 openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

  openDCIM · openDCIM

  EPSS 6.3%
• Critical 9.8
  CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
  EPSS 6%
• Critical 9.1
  CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

  rustfs · rustfs

  EPSS 5.1%
• Critical 9.8
  CVE-2026-3301 Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection

  Totolink · N300RH

  EPSS 4.4%
• Critical 9.0
  CVE-2026-24663 Copeland XWEB and XWEB Pro OS Command Injection

  Copeland · Copeland XWEB 300D PRO · Copeland XWEB 500B PRO · Copeland XWEB 500D PRO

  EPSS 3.7%
• Critical 10.0
  CVE-2026-28409 WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection

  LabRedesCefetRJ · WeGIA

  EPSS 3.6%
• Critical 9.3
  CVE-2026-26341 Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials

  Tattile s.r.l. · Smart+ Traffic Light · Vega53 · Vega11

  EPSS 2.9%
• Critical 9.8
  CVE-2026-28411 WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`

  LabRedesCefetRJ · WeGIA

  EPSS 2.7%
• Critical 9.8
  CVE-2025-50857 ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a craft…
  EPSS 2.6%
• Critical 9.8
  CVE-2026-2624 Authentication Bypass in ePati's Antikor NGFW

  ePati Cyber ​​Security Technologies · Antikor Next Generation Firewall (NGFW)

  EPSS 2.3%
• Critical 10.0
  CVE-2026-24849 OpenEMR Arbitrary File Read Vulnerability

  openemr · openemr

  EPSS 2.2%

All 130 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2026-20133 A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vul…

  Cisco · Cisco Catalyst SD-WAN Manager

  EPSS 35%
• Medium 6.3
  CVE-2026-3065 HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection
  EPSS 33%
• Medium 5.4
  CVE-2026-20122 Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

  Cisco · Cisco Catalyst SD-WAN Manager

  EPSS 26%
• Medium 6.3
  CVE-2026-3064 HummerRisk Cloud Task Scheduler ResourceCreateService.java command injection
  EPSS 22%
• High 8.1
  CVE-2026-22719 VMware Aria Operations command injection vulnerability

  VMware · Telco Cloud Platform · VMware Aria Operations · Telco Cloud Infrastructure

  EPSS 18%
• Medium 5.9
  CVE-2026-28208 Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix

  junrar · junrar

  EPSS 15%
• Medium 6.3
  CVE-2026-3066 HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection
  EPSS 13%
• High 8.8
  CVE-2026-27483 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

  MindsDB · MindsDB

  EPSS 11%