CriticalExploitedMirageEPSS 11%Palo Alto Unit 42CVE-2026-109618
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP, a widely used scripting language for web servers and CMS systems. Both vulnerabilities involve improper handling of memory during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions that can be exploited in subsequent requests. Over 22.6 million exposed instances potentially vulnerable have been identified. Palo Alto Networks provides protections through multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should review the PHP Group’s security advisory for patching guidance.
A use-after-free vulnerability exists in the librsvg2 library when XML includes contain duplicated entities. This issue is addressed by a security update from Red Hat for their Enterprise Linux 9.8 Extended Update Support releases. The vulnerability is rated as important by Red Hat Product Security.
A security update has been issued for the grafana-pcp plugin in Red Hat Enterprise Linux 9.4 to address a vulnerability in the golang crypto/x509 package (CVE-2026-111943) that could allow man-in-the-middle attacks via untrusted intermediate certificates. This vulnerability affects the handling of intermediate certificates in TLS connections. Red Hat has released updated packages to fix this issue for multiple architectures and product variants of RHEL 9.4.
CVE-2026-100420 is a medium severity vulnerability in TP-Link Deco BE63 V2.0 that allows authenticated attackers to retrieve plaintext TP-Link ID account passwords via the cloud-client daemon. This exposure of sensitive information could enable attackers to compromise the associated cloud account and perform unauthorized actions. The vulnerability is identified as CWE-202 (Exposure of Sensitive Information Through Data Queries). No patch or remediation information is currently provided.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.
CVE-2026-76529 is a vulnerability in Splunk SOAR where the product does not sufficiently protect all possible user access paths to restricted functionality or resources. This issue relates to improper protection of alternate paths, categorized under CWE-424. The vulnerability affects versions prior to 8.7.0. Cisco addressed this issue as part of a broader internal security review and software hardening release.
CVE-2026-76528 is a vulnerability in Splunk SOAR where the product fails to use or incorrectly uses a protection mechanism, resulting in insufficient defense against directed attacks. This issue was identified during Cisco's internal security review and is categorized under CWE-693, which relates to protection mechanism failures. The vulnerability affects Splunk SOAR versions from 0 up to but not including 8.7.0. No CVSS score is provided, and there is no indication of known exploits in the wild.
CVE-2026-76527 is a vulnerability in Splunk SOAR where the software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation. This issue relates to improper checks or handling of exceptional conditions, categorized under CWE-703. The vulnerability affects versions from 0 up to but not including 8.7.0. Cisco addressed this issue as part of an internal security review resulting in a software hardening release. No CVSS score is provided, and there are no known exploits in the wild.
CVE-2026-76526 affects Splunk SOAR versions prior to 8.7.0 and involves improper neutralization of structured messages or data. The product does not ensure or incorrectly ensures that these messages are well-formed and meet certain security properties before processing. Cisco addressed this issue as part of a software hardening release following an internal security review.
CVE-2026-76408 is a vulnerability in Splunk SOAR involving improper control of a resource throughout its lifecycle, categorized under CWE-664. It affects versions from 0 up to but not including 8.7.0. Cisco identified this issue during an internal security review and addressed it in a software hardening release. No CVSS score or public exploit information is available for this vulnerability.
CVE-2026-76407 is an improper access control vulnerability in Splunk SOAR that allows unauthorized actors to access restricted resources. This issue was identified during Cisco's internal security review and addressed in a software hardening release. The vulnerability is categorized under CWE-284, indicating insufficient access restrictions. It affects Splunk SOAR versions from 0 up to but not including 8.7.0. No CVSS score is available, and no known exploits are reported in the wild.
CVE-2026-76406 affects Splunk SOAR versions prior to 8.7.0. It allows an unauthenticated user who already has access to encrypted credential data from the affected instance to submit Basic authentication data to the REST API and decrypt that data. This occurs because Splunk SOAR decrypts Basic authentication values before completing authentication checks. Exploitation requires possession of encrypted credential data, limiting the vulnerability's ease of exploitation.
CVE-2026-76308 affects Splunk SOAR versions prior to 8.7.0, where an authenticated user can change the Enterprise Security edition license via the REST API without proper authorization checks. This vulnerability arises because Splunk SOAR authenticates requests but fails to verify the caller's authorization before applying license changes.
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.
The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVE-2026-76306 is a vulnerability in Splunk SOAR versions prior to 8.7.0 where users with the 'Observer' role can infer password hashes and authorization tokens of other users via REST API query filters. This occurs because the product applies query filters before protecting sensitive fields, leading to unauthorized information disclosure.
CVE-2026-76305 is a vulnerability in Splunk SOAR versions prior to 8.7.0 where an authenticated user without the appropriate role permission to view apps can download an archive of an installed app. This flaw occurs because the software does not perform an authorization check before returning the app archive, potentially exposing proprietary source code and sensitive information contained within the app archive.
CVE-2026-76304 affects Splunk SOAR versions prior to 8.7.0. It allows an authenticated user without the required Automation Broker edit permission to download the Automation Broker Docker Compose configuration file. This file contains sensitive information such as the URL of the Splunk SOAR instance, container image location, and Automation Broker version. The vulnerability exists because the software does not enforce authorization checks when serving this configuration file.
In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation, Splunk SOAR could run that content in the browser of the user who opened the app documentation. With this access, the first user could access data and make changes that the user who opened the app documentation could make.
The vulnerability is possible because Splunk SOAR does not sanitize app documentation content before it displays that content.
The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user that holds a role with the install_apps capability should not be able to exploit the vulnerability at will.
For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.6.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
CVE-2026-76301 is a vulnerability in Splunk Enterprise involving improper or missing protection mechanisms that fail to adequately defend against directed attacks. Cisco identified this issue during an internal security review and addressed it with a software hardening release. The vulnerability relates to weakness CWE-693, which concerns insufficient protection mechanisms. Multiple versions of Splunk Enterprise prior to specific patch versions are affected.