Week 40, 2026

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

  Ahsay · AhsayCBS

  EPSS 82%
• Critical 9.8
  CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

  Cisco · Cisco Catalyst SD-WAN Manager

  EPSS 39%
• Critical 9.4
  CVE-2026-102489 Undisclosed RCE in Zammad v6.3 and higher

  zammad · zammad

  EPSS 22%
• Critical 9.9
  CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

  GitLab · GitLab AI Gateway

  EPSS 17%
• Critical 9.4
  CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

  zammad · zammad

  EPSS 11%
• Critical 9.8
  CVE-2026-104286 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 thro…

  Fortinet · FortiMail

  EPSS 4.6%
• Critical 9.1
  CVE-2026-101261 Ziroom ZHOME A0101 firstSetup_wifi command injection

  Ziroom · ZHOME A0101

  EPSS 4.2%
• Critical 9.1
  CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injection

  Ziroom · ZHOME A0101

  EPSS 3%
• Critical 10.0
  CVE-2026-101001 Netcore NBR200V2 Web Management network_tools eval os command injection

  Netcore · NBR200V2

  EPSS 2.6%
• Critical 10.0
  CVE-2026-103956 Missing authentication for critical function in Loom for AWS

  AWS · loom

  EPSS 2.5%
• Critical 9.1
  CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

  Ziroom · ZHOME A0101

  EPSS 2.5%
• Critical 9.1
  CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

  Ziroom · ZHOME A0101

  EPSS 2.4%
• Critical 9.1
  CVE-2026-101262 Ziroom ZHOME A0101 set_online_client command injection

  Ziroom · ZHOME A0101

  EPSS 2.4%
• Critical 9.1
  CVE-2026-101264 Ziroom ZHOME A0101 set_passwd command injection

  Ziroom · ZHOME A0101

  EPSS 2.3%
• Critical 9.1
  CVE-2026-101263 Ziroom ZHOME A0101 set_online_client command injection

  Ziroom · ZHOME A0101

  EPSS 2.3%

All 314 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.3
  CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

  Ahsay · AhsayCBS

  EPSS 79%
• High 8.8
  CVE-2026-86950 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, …

  Apple · macOS · iOS and iPadOS

  EPSS 26%
• High 8.7
  CVE-2026-88779 Memory overflow vulnerability leading to Denial of Service

  NetScaler · ADC · Gateway

  EPSS 11%
• High 8.8
  CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central

  Zohocorp · DDI Central

  EPSS 7%
• High 8.8
  CVE-2026-12268 Authenticated PowerShell Injection leads to RCE

  Zohocorp · DDI Central

  EPSS 4.7%
• High 7.2
  CVE-2026-12267 Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE

  Zohocorp · DDI Central

  EPSS 3.6%
• High 7.2
  CVE-2026-102096 Kiteworks Core OS command injection

  Kiteworks · Core

  EPSS 3.3%
• High 7.2
  CVE-2026-102114 Kiteworks Core OS Command Injection

  Kiteworks · Core

  EPSS 3.1%