IT security 2026-09-03

Level Critical — 88/100 — 2026-09-03

Critical day: 16 stories ranked, 7 of the top 10 reported as actively exploited, 7 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Sangoma Switchvox SQL Injection Vulnerability (75/100).

  1. Sangoma Switchvox SQL Injection Vulnerability — 75/100 (CVE-2026-9586)
  2. JFrog Artifactory Improper Authentication Vulnerability — 74/100 (CVE-2026-82329)
  3. Kestra OSS OS Command Injection Vulnerability — 70/100 (CVE-2026-49869)
  4. Kludex Starlette HTTP Request/Response Smuggling Vulnerability — 68/100 (CVE-2026-48710)
  5. SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — 68/100 (CVE-2026-83548)
  6. BerriAI LiteLLM Improper Authentication Vulnerability — 65/100 (CVE-2026-59822)
  7. SonicWall SMA1000 Appliances OS Command Injection Vulnerability — 64/100 (CVE-2026-83549)
  8. microsoft copilot studio: Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate… — 39/100 (CVE-2026-80098)
  9. microsoft power platform: Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over… — 38/100 (CVE-2026-65818)
  10. CVE-2026-62916 — Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacke… — 38/100 (CVE-2026-62916)