HIGH/ SEPTEMBER 20, 2026TODAY’S BRIEFING — #184
SolarWinds, Orkes RCE flaws under exploitation; Linux kernel vulnerabilities added to CISA KEV
SolarWinds ARM hard-coded key flaw (CVE-2026-28326, CVSS 8.8) patched; Orkes Conductor pre-auth RCE (CVE-2026-58138, CVSS 9.8/9.3) actively exploited in wild. Three Linux kernel vulnerabilities added to CISA KEV catalog. Gyazo breach impacts 23.6 million users.
CVE-2026-28326SolarWinds Access Rights Manager (ARM) — Hard-coded cryptographic key enabling unauthenticated RCE; patchedCVE-2026-58138Orkes Conductor Workflow Platform — Unauthenticated pre-auth RCE (CVSS 9.8/9.3); actively exploited in the wildCVE-2025-39964Linux Kernel — Race condition in AF_ALG socket; added to CISA KEV, federal remediation due 2026-09-21CVE-2026-53266Linux Kernel — Out-of-bounds write in ebtables SNAT target; added to CISA KEV, federal remediation due 2026-09-21
Read the full briefing →