Week 38, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-76460 Cisco Identity Services Engine Authentication Bypass Vulnerability

  Cisco · Cisco Identity Services Engine Software · Cisco ISE Passive Identity Connector

  EPSS 76%
• Critical 9.8
  CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

  Cisco · Cisco Secure Email

  EPSS 30%
• Critical 9.8
  CVE-2026-84434 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

  Gravity Forms · Gravity Forms

  EPSS 3.9%
• Critical 9.8
  CVE-2026-90817 An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user …

  Vanderbilt University · REDCap

  EPSS 3.7%
• Critical 9.1
  CVE-2026-90703 D-Link DWR-M921 formDiskCreateShare system os command injection

  D-Link · DWR-M921

  EPSS 3.6%
• Critical 9.1
  CVE-2026-90702 D-Link DWR-M921 formDiskFormat system os command injection

  D-Link · DWR-M921

  EPSS 3.6%
• Critical 9.8
  CVE-2026-54617 GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

  GravitLauncher · Launcher

  EPSS 3.5%
• Critical 9.1
  CVE-2026-90847 EFM ipTIME C200E System Setup iux_set.cgi os command injection

  EFM · ipTIME C200E

  EPSS 3.4%
• Critical 9.9
  CVE-2026-90699 D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection

  D-Link · DWR-M920

  EPSS 3.3%
• Critical 9.1
  CVE-2026-92398 Ruijie RG-EW3000GX user_list_note admin os command injection

  Ruijie · RG-EW3000GX

  EPSS 3.2%
• Critical 9.1
  CVE-2026-92397 Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection

  Ruijie · RG-EW3000GX

  EPSS 3.2%
• Critical 10.0
  CVE-2026-94097 Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

  Netcore · NBR200V2

  EPSS 3%
• Critical 9.8
  CVE-2026-61560 @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

  zereight · gitlab-mcp

  EPSS 2.9%
• Critical 9.4
  CVE-2026-58146 Unauthorized remote code execution in T-Mobile 5G Box IDU routers

  WNC · T-Mobile 5G Box IDU

  EPSS 2.9%
• Critical 9.1
  CVE-2026-93958 D-Link R95 DHMAPI ssi system os command injection

  D-Link · R95

  EPSS 2.7%

All 504 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2026-77692 Unauthenticated remote crash of named via a single DoH SIG(0) request

  ISC · BIND 9

  EPSS 6.6%
• Medium 6.5
  CVE-2026-76698 Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

  Hewlett Packard Enterprise (HPE) · EdgeConnect SD-WAN Gateways

  EPSS 4.5%
• High 8.8
  CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

  Phoenix Contact · Pepperl+Fuchs · Carlo Gavazzi Automation · ICE3-8IOL1-G65L-V1D

  EPSS 2.9%
• High 8.8
  CVE-2026-27549 Command Injection in /index.php/attached_devices_tab/do_upload

  Phoenix Contact · Pepperl+Fuchs · Carlo Gavazzi Automation · ICE3-8IOL-K45P-RJ45

  EPSS 2.9%
• High 8.8
  CVE-2026-27558 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files

  Phoenix Contact · Pepperl+Fuchs · Carlo Gavazzi Automation · IOL MA8 EIP DI8

  EPSS 2.9%
• High 8.8
  CVE-2026-27559 Command Injection via GET in /api/status/data

  Phoenix Contact · Pepperl+Fuchs · Carlo Gavazzi Automation · YN115CEI8RPIO

  EPSS 2.9%
• High 8.8
  CVE-2026-27551 Command Injection in /index.php/ajax/parameterManage

  Phoenix Contact · Pepperl+Fuchs · Carlo Gavazzi Automation · ICE2-8IOL1-G65L-V1D

  EPSS 2.9%
• High 8.8
  CVE-2026-27550 Command Injection in Field_Shadow_Password Class

  Phoenix Contact · Pepperl+Fuchs · Carlo Gavazzi Automation · ICE2-8IOL-K45S-RJ45

  EPSS 2.9%