Week 24, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-10520 An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-le…

  ivanti · Sentry

  EPSS 100%
• Critical 9.8
  CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

  Splunk · Splunk Enterprise

  EPSS 97%
• Critical 9.8
  CVE-2026-35273 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are af…

  Oracle · PeopleSoft Enterprise PeopleTools

  EPSS 97%
• Critical 9.3
  CVE-2026-50751 User Authentication Bypass in VPN Remote Access and Mobile Access

  checkpoint · Quantum Security Gateway · Spark Firewalls

  EPSS 85%
• Critical 10.0
  CVE-2026-48558 SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

  SimpleHelp · SimpleHelp

  EPSS 80%
• Critical 9.1
  CVE-2026-25089 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiS…

  Fortinet · FortiSandbox · FortiSandbox PaaS · FortiSandbox Cloud

  EPSS 76%
• Critical 9.9
  CVE-2026-10523 An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to …

  ivanti · Sentry

  EPSS 54%
• Critical 9.4
  CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

  FlowiseAI · Flowise

  EPSS 33%
• Critical 9.8
  CVE-2026-47291 HTTP.sys Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 25%
• Critical 9.8
  CVE-2026-45657 Windows Kernel Remote Code Execution Vulnerability

  Microsoft · Windows Server 2022 · Windows Server 2025 · Windows Server 2025 (Server Core installation)

  EPSS 15%
• Critical 9.8
  CVE-2026-11499 Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow

  Tenda · HG10 · HG9 · HG7

  EPSS 6.6%
• Critical 9.8
  CVE-2026-53787 Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

  Amasty · Order Attributes for Magento 2

  EPSS 5.6%
• Critical 9.1
  CVE-2026-50627 Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

  Apache Software Foundation · Apache CXF

  EPSS 4.1%
• Critical 9.8
  CVE-2026-48611 Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access …

  phpBB · phpBB

  EPSS 3.9%
• Critical 9.4
  CVE-2026-44963 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

  Veeam · Backup and Replication

  EPSS 2.4%

All 135 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2026-49160 HTTP.sys Denial of Service Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 57%
• High 8.8
  CVE-2026-53435 Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

  Jenkins Project · Jenkins

  EPSS 51%
• High 8.8
  CVE-2026-45484 Microsoft SharePoint Elevation of Privilege Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 34%
• High 7.5
  CVE-2026-49975 Apache HTTP Server: mod_http2 denial of service

  Apache Software Foundation · Apache HTTP Server

  EPSS 33%
• High 8.8
  CVE-2026-20251 Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

  Splunk · Splunk Enterprise · Splunk Cloud Platform · Splunk Secure Gateway

  EPSS 31%
• Medium 5.0
  CVE-2026-45502 Microsoft Exchange Server Information Disclosure Vulnerability

  Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 14 · Microsoft Exchange Server Subscription Edition RTM

  EPSS 20%
• High 7.2
  CVE-2026-10727 An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrar…

  ivanti · Endpoint Manager Mobile

  EPSS 13%
• High 8.6
  CVE-2026-44492 Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

  axios · axios

  EPSS 12%