Sécurité IT 2026-09-03

Niveau Critique — 88/100 — 2026-09-03

Journée « Critique » : 16 sujets classés, 7 des 10 premiers signalés comme activement exploités, 7 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Sangoma Switchvox SQL Injection Vulnerability (75/100).

  1. Sangoma Switchvox SQL Injection Vulnerability — 75/100 (CVE-2026-9586)
  2. JFrog Artifactory Improper Authentication Vulnerability — 74/100 (CVE-2026-82329)
  3. Kestra OSS OS Command Injection Vulnerability — 70/100 (CVE-2026-49869)
  4. Kludex Starlette HTTP Request/Response Smuggling Vulnerability — 68/100 (CVE-2026-48710)
  5. SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — 68/100 (CVE-2026-83548)
  6. BerriAI LiteLLM Improper Authentication Vulnerability — 65/100 (CVE-2026-59822)
  7. SonicWall SMA1000 Appliances OS Command Injection Vulnerability — 64/100 (CVE-2026-83549)
  8. microsoft copilot studio: Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate… — 39/100 (CVE-2026-80098)
  9. microsoft power platform: Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over… — 38/100 (CVE-2026-65818)
  10. CVE-2026-62916 — Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacke… — 38/100 (CVE-2026-62916)