The Daily CVE Update

In this episode of The Daily CVE Update, Corrine Jefferson delivers crucial insights on two significant vulnerabilities threatening UK small businesses: CVE-2026-86296 and CVE-2026-75650. Discover the details of these high-severity risks in the D-Link DIR-822A and Adobe Commerce systems. Corrine explains how such vulnerabilities could lead to severe breaches, causing financial and reputational damage to your business. She also emphasises the importance of rapid action, highlighting real-world consequences and offering strategies to turn these challenges into competitive advantages. Learn how to effectively communicate these risks to your board and take proactive steps to secure your network and protect your clients’ trust.

In today’s episode of The Daily CVE Update, Corrine Jefferson explores critical vulnerabilities affecting small businesses in the UK. The focus is on two significant threats: Tenda router vulnerabilities (CVE-2026-86152 and CVE-2026-86167) and WordPress plugin vulnerabilities (CVE-2026-16310 and CVE-2026-75816). These vulnerabilities pose severe risks, allowing attackers to gain remote access and reset administrator passwords. Corrine outlines the importance of regular updates and patch management, particularly for small businesses that may feel shielded by their size. She also discusses how addressing these vulnerabilities can be turned into a competitive advantage by strengthening security measures and enhancing business reputation. The episode concludes with Corrine offering actionable recommendations, including auditing network devices, scrutinising CMS security, and ensuring Managed Service Providers are proactive in their approach. By empowering listeners to take decisive actions, Corrine emphasises the need for businesses to stay vigilant and secure.

An actively exploited Chrome zero-day and a mass WordPress attack campaign are targeting UK businesses right now. CISA has confirmed active exploitation of CVE-2026-85046, a type confusion vulnerability in Chrome’s V8 JavaScript engine that requires no user interaction beyond visiting a malicious webpage. Over 440,000 exploit attempts have been documented against WordPress sites running vulnerable versions of Super Forms and Elementor Pro plugins. Both issues have patches available, but the gap between patch availability and patch deployment is where incidents happen. This episode walks through the specific actions required today: restarting Chrome browsers across all devices to force update installation, and applying WordPress plugin updates for CVE-2026-14894 and CVE-2026-32475. Corrine explains why small business size offers no protection against automated scanning campaigns, how to verify patches with IT providers, and why documented patch management provides both regulatory defence under UK GDPR Article 32 and commercial differentiation during client procurement.

On 3 September 2026, the National Vulnerability Database published two critical vulnerabilities in Microsoft’s cloud infrastructure, each scoring CVSS 10.0. CVE-2026-70352 affects Azure AI Language and allows unauthenticated privilege escalation. CVE-2026-83711 targets Azure Active Directory B2C with an authorisation bypass. A third flaw, CVE-2026-62916, scored CVSS 9.1 for an authentication bypass in Microsoft Entra ID. These vulnerabilities sit within the identity and authentication layers used by millions of UK small businesses relying on Microsoft 365 and Azure-based services. Separately, attackers are actively exploiting CVE-2026-32475, a critical file upload vulnerability in Elementor Pro, a WordPress plugin installed on approximately six million websites. The exploit allows remote code execution, leading to backdoor installation and site compromise. This episode provides specific remediation steps: verify Elementor Pro is updated to version 3.27.3 or later, enforce multi-factor authentication across all Microsoft 365 accounts, audit administrator privileges, and obtain written confirmation from managed service providers that cloud environments have been assessed. The episode emphasises that whilst Microsoft deploys cloud-side patches, businesses remain responsible for configuration verification and must understand their exposure to vendor infrastructure vulnerabilities.

Two critical vulnerabilities affecting business infrastructure have been added to CISA’s Known Exploited Vulnerabilities catalogue, with confirmed active exploitation in the wild. CVE-2026-9586 in Sangoma Switchvox allows unauthenticated remote code execution via SQL injection, affecting approximately 4,000 internet-facing instances. Meanwhile, SonicWall’s SMA1000 remote access gateways are vulnerable to an attack chain combining CVE-2026-83548, a CVSS 10.0 server-side request forgery flaw, with CVE-2026-83549, an OS command injection vulnerability. Both products are common in UK small business environments, and patches are available for all three CVEs. This episode examines the technical mechanisms behind these vulnerabilities, explains why internet-facing infrastructure requires emergency patching outside scheduled maintenance windows, and provides four concrete actions for business owners to verify their systems are protected. The NCSC’s vulnerability management guidance and GDPR Article 32 obligations are discussed in the context of patch management responsibilities.

Three critical vulnerabilities disclosed this week share a common weakness: password reset logic that fails to validate tokens properly. CVE-2026-18550 in the Nokri Job Board WordPress theme allows unauthenticated attackers to hijack admin accounts through an empty token bypass. CVE-2026-84699 in Team Password Manager permits unauthorised password resets without authentication, exposing concentrated credential stores. CVE-2026-84480 in WWBN AVideo allows permanently valid reset tokens with no expiry. Meanwhile, Shadowserver Foundation confirms 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911, an authentication bypass allowing unauthenticated mailbox access. This episode examines why account recovery flows represent a systemic weak point in authentication systems, how attackers exploit reset endpoints that lack proper validation, and what UK small businesses should verify with IT providers about password reset security across their entire technology estate.

CISA confirmed on 31 August that two vulnerabilities in PaperCut NG and MF print management software are being actively exploited in the wild. CVE-2026-81578 allows unauthenticated remote attackers to bypass authentication and access admin functions, whilst CVE-2026-82078 enables arbitrary code execution once inside. The vulnerabilities are designed to be chained together, and the initial emergency patch issued by PaperCut was broken by security researchers within days, forcing a second fix. For UK small businesses running PaperCut, this warrants same-day action: confirm your version, verify the second patch has been applied, and restrict internet-facing admin panels to internal network access only. The episode also covers Manic, a new Android banking trojan that exfiltrates credentials through peer-to-peer relay without requiring a direct internet connection, raising questions about SMS-based two-factor authentication on personal devices used for business access. Practical steps include checking your mobile device policy and migrating from SMS codes to authenticator apps where feasible.

This episode examines two urgent threat areas affecting UK small businesses: three critical router vulnerabilities with maximum severity scores and publicly available exploit code, and a cluster of WordPress plugin and theme flaws including an authentication bypass that grants administrator access without credentials. Corrine analyses CVE-2026-82542 affecting the Tenda HG10 router with a CVSS score of 10.0, two critical D-Link DIR-825M vulnerabilities scoring 9.9, and CVE-2026-15980 affecting the MyHome Core WordPress plugin with a score of 9.8. The episode highlights how widely deployed commodity hardware and popular WordPress plugins create exploitable attack surfaces in small office environments. Practical guidance covers identifying affected devices, applying firmware updates, auditing WordPress installations, and establishing basic monthly review processes. The common thread across both threat areas is unmanaged infrastructure: routers and websites that accumulate over time without systematic patching processes. Corrine emphasises that these are not sophisticated attack chains but documented, publicly exploitable flaws in equipment and software currently running in small businesses across the UK.

Three critical vulnerabilities have been confirmed as actively exploited in the wild, triggering urgent additions to CISA’s Known Exploited Vulnerabilities catalogue. CVE-2023-49105, an authentication bypass in ownCloud, allows attackers to access, modify, or delete files without credentials when only a username is known. Despite being disclosed in 2023, active exploitation has only now escalated. CVE-2026-53362, a Linux kernel privilege escalation flaw affecting major distributions and cloud infrastructure, enables attackers to gain full administrative control from limited footholds. Two openssl_encrypt vulnerabilities (CVE-2026-81702 and CVE-2026-81707) permit sophisticated identity spoofing attacks, compromising encrypted communications and fingerprint verification mechanisms. For UK small businesses, the regulatory exposure is concrete: unauthenticated file access triggers UK GDPR breach notification obligations, and running unpatched software with confirmed active exploits undermines defensibility to the ICO. This episode provides specific, actionable steps to verify patch status with IT providers and MSPs, establish documented accountability, and meet Cyber Essentials compliance requirements within the scheme’s fourteen-day patching window for high-severity actively exploited CVEs.

Three critical vulnerabilities are being actively exploited in the wild, all with patches available. Microsoft SQL Server’s CVE-2019-1068, a remote code execution flaw first patched in 2019, remains weaponised against unpatched systems seven years later. WordPress sites running the Avada theme and Fusion Builder plugin face a 9.8-rated vulnerability (CVE-2026-18431) allowing unauthenticated attackers to achieve full site compromise. Gitea, the self-hosted Git service, is being targeted via CVE-2026-60004, enabling arbitrary code execution through malicious Git hooks. CISA has confirmed all three as actively exploited. This episode explains the technical impact of each vulnerability, identifies the patched versions required, and sets out immediate actions for UK small businesses: verifying SQL Server patch status with IT providers, updating WordPress components to Avada 7.17 and Fusion Builder 3.17, auditing Gitea instances, and formalising patch management processes to meet Cyber Essentials requirements and avoid ICO enforcement action.