Adobe Commerce Zero-Day, SonicWall RCE Chain, and MikroTik Exploitation Lead This Week’s CVE Priorities

By SAFE Threat Research Team

This week’s highest-priority vulnerabilities span e-commerce platforms, secure-access appliances, network infrastructure, print management, browsers, unified communications, automation platforms, and AI infrastructure. The strongest new signals include active exploitation of Adobe Commerce and the Magento CVE-2026-75650 vulnerability, a SonicWall SMA1000 vulnerability chain that can enable unauthenticated command execution, and attacks against MikroTik RouterOS devices via chained SSH authentication and privilege flaws.

PaperCut exploitation also continues against internet-accessible servers, while Google Chrome, Sangoma Switchvox, Kestra, and LiteLLM add further exposure across endpoints and enterprise application infrastructure. The mix is not limited to newly disclosed vulnerabilities: 11 of the 14 CVEs showing confirmed exploitation activity this week are pre-existing issues, reinforcing that attackers continue to reuse reliable vulnerabilities wherever exploitable systems remain exposed.

Vulnerability Landscape

NVD published 2,204 CVEs this week, including 838 rated critical or high severity. Within the disclosure set, one vulnerability had a public exploit or proof of concept available, while one carried a stronger weaponized exploit signal.

The disclosure volume alone provides limited guidance for remediation. The more useful prioritization signal comes from combining exploitability with observed exploitation, external exposure, the affected system’s role, and the impact an attacker can achieve after compromise. This week, those factors place several perimeter appliances, administrative platforms, and infrastructure services ahead of many more newly disclosed but less operationally relevant vulnerabilities.

Trending Vulnerabilities

Confirmed exploitation remains the stronger signal for prioritization this week. 14 CVEs showed real-world exploitation activity, including 3 newly published vulnerabilities and 11 pre-existing issues

Top CVEs to Watch

Adobe Commerce and Magento CVE-2026-75650: StyleSmuggler Zero-Day Exploitation Targets E-Commerce Servers

CVE-2026-75650 is a critical unauthenticated remote code execution vulnerability affecting Adobe Commerce and Magento Open Source. The flaw, now associated with the StyleSmuggler attack chain, involves improper handling of attacker-controlled input by the application’s template engine. Adobe assigned the vulnerability a CVSS score of 10.0 and confirmed that it is being exploited in the wild. The attack uses a two-stage chain in which attacker-controlled PHP content is first written into application-managed data and later executed through Magento’s template-processing workflow.

Adobe released a Priority 1 hotfix on September 7 covering affected Adobe Commerce, Adobe Commerce B2B, and Magento Open Source release lines. Because exploitation began before the vendor fix became available, affected organizations should treat patching and compromise assessment as separate activities. Systems that were internet-facing while vulnerable should be reviewed for unexpected PHP files, modified application data, persistence mechanisms, scheduled tasks, and anomalous processes or outbound connections.

SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549: Zero-Day Chain Enables Unauthenticated RCE

Two newly disclosed vulnerabilities affecting SonicWall SMA1000 secure-access appliances are being actively exploited. CVE-2026-83548 is a CVSS 10.0 pre-authentication SSRF vulnerability in the Appliance Work Place interface that allows an unauthenticated attacker to reach sensitive functionality through an unintended access path. CVE-2026-83549 is an OS command-injection vulnerability in the Appliance Management Console; exploiting this flaw requires authenticated administrative access and specific system conditions. However, the SSRF vulnerability can be used to reach the vulnerable management functionality, allowing the flaws to be chained into unauthenticated OS command execution. Both vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalog.

Affected SMA1000 6210, 7210, and 8200v appliances should be upgraded to 12.4.3-03526 or 12.5.0-02952 platform-hotfix releases, depending on the installed branch. Since exploitation was occurring before public disclosure, organizations should also investigate previously exposed appliances rather than treating deployment of the hotfix as sufficient remediation. If compromise is identified, SonicWall recommends re-imaging or redeploying the appliance, changing user and administrator passwords, and resetting TOTP tokens.

MikroTik RouterOS CVE-2026-67276 and CVE-2026-86060: Exploited SSH Chain Provides Full Administrative Access

Two newly disclosed RouterOS vulnerabilities are being chained against MikroTik devices with SSH exposed to the internet. CVE-2026-67276 is an SSH public-key authentication flaw in which RouterOS does not compare the complete RSA public key associated with an authorized user. Under the required conditions, an attacker who knows the target username and public-key modulus can authenticate without possessing the corresponding private key. CVE-2026-86060 affects SSH session privilege handling and allows a crafted username to produce a session with full RouterOS administrative privileges. CERT Polska has confirmed real-world attacks combining the flaws to take control of internet-accessible RouterOS devices.

MikroTik released fixes in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. Exposure is an important qualifier: MikroTik’s default configuration blocks SSH access from the internet, so the highest-risk systems are devices where administrators have deliberately exposed management services to untrusted networks. After upgrading, organizations should inspect devices for unexpected users, scripts, scheduled tasks, proxy configuration, tunnels, and RouterOS’s Flagged compromise status.

PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078: Exploitation Continues Against Public-Facing Servers

PaperCut NG and MF remain a high-priority exposure following confirmed exploitation of a two-vulnerability chain. CVE-2026-81578 is an access-control flaw in the web management interface that, under specific conditions, allows unauthenticated requests to trigger administrative backend actions before access validation is completed and modify system configuration. CVE-2026-82078 is an unsafe dynamic-class-loading vulnerability in the database utilities: attacker-controlled configuration can influence which Java classes are instantiated, enabling arbitrary Java bytecode already present on the application classpath to execute under the PaperCut server process. Chaining the configuration modification primitive with the dynamic-loading flaw provides a path from unauthenticated network access to code execution.

PaperCut has confirmed customer incidents and reports a second wave of attacks against publicly accessible systems that are not fully patched, with more sophisticated post-compromise behavior than initially observed. Emergency Patch Release 3, published September 1 for supported v24, v25, and v26 deployments, supersedes earlier emergency releases and adds additional hardening against observed attack paths. Internet-facing Application Servers should receive Release 3 even if an earlier emergency patch was installed; where exposure is unnecessary, PaperCut recommends restricting the web interfaces to trusted addresses. Previously exposed servers should also be reviewed for suspicious PaperCut child processes, unexpected remote-access tooling, altered logs, and other indicators of prior compromise.

Google Chrome CVE-2026-85046: V8 Type Confusion Zero-Day Exploited in the Wild

CVE-2026-85046 is a high-severity type-confusion vulnerability in Chrome’s V8 JavaScript engine. A remote attacker can trigger the flaw through crafted HTML content and obtain arbitrary code execution within the Chrome sandbox. Google confirmed that an exploit for the vulnerability exists in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on September 4. Chrome users should update to 152.0.7977.82/.83 or later, depending on the platform. 

Sangoma Switchvox CVE-2026-9586: Unauthenticated SQL Injection Escalates to Server RCE

CVE-2026-9586 is a critical unauthenticated SQL-injection vulnerability affecting Sangoma Switchvox SMB Edition. The unauthenticated /pa endpoint processes XML requests and directly incorporates the attacker-controlled PhoneIP value into PostgreSQL queries without appropriate sanitization or parameterization. A single crafted request can therefore execute arbitrary SQL statements against the backend database, with the vulnerability record explicitly identifying remote code execution as a possible outcome. Researchers reported valid exploitation attempts against deployed Switchvox systems on September 1, and CISA added the vulnerability to KEV the following day.

The vulnerability affects Switchvox SMB Edition 8.3, build 104997, and earlier releases; Sangoma addressed the flaw in version 8.4.0.2. Internet-reachable Switchvox deployments should be upgraded and reviewed for suspicious requests to the /pa endpoint, unexpected database activity, and processes spawned by the application. The combination of unauthenticated reachability, SQL execution, and a path to operating-system command execution makes exposed unified-communications infrastructure a high-priority remediation target.

Kestra CVE-2026-49869 and LiteLLM CVE-2026-59822: Exploited Control-Plane Flaws Hit Automation and AI Infrastructure

CVE-2026-49869 is a CVSS 10.0 unauthenticated RCE vulnerability in Kestra OSS. The application’s AuthenticationFilter used a suffix comparison to exempt its public configuration endpoint from authentication; as a result, API paths ending in /configs could bypass authentication entirely. An unauthenticated attacker can use this behavior to create and execute workflows. Because Kestra includes shell and Python script-execution plugins by default, successful exploitation can result in code execution as root inside the Kestra worker container. The flaw is fixed in Kestra 1.0.45 and 1.3.21 and was added to CISA KEV on September 2.

CVE-2026-59822 affects LiteLLM’s MCP Streamable HTTP endpoint. A failed LiteLLM key check could incorrectly fall through to the OAuth2 passthrough logic, producing an empty authenticated-user object and allowing an attacker with a fabricated Bearer token to establish an MCP session without a valid LiteLLM key. From there, an attacker can enumerate and invoke configured MCP tools and access services exposed through those integrations. Honeypot telemetry has observed exploitation of this authentication bypass, and CISA added the vulnerability to KEV on September 2. Versions before LiteLLM 1.84.0 are affected; organizations unable to update should disable or block access to MCP routes. The impact depends heavily on which MCP tools are configured and the permissions they carry, so the vulnerability should not be described as unconditional RCE on the LiteLLM host.

What Security Teams Should Prioritize

This week’s highest-priority exposures are concentrated in systems that provide direct access to enterprise infrastructure or can extend an attacker’s reach beyond the initially vulnerable application.

• Internet-facing infrastructure: Prioritize SonicWall SMA1000, MikroTik RouterOS, PaperCut NG/MF, and Sangoma Switchvox where affected services are reachable from untrusted networks. These vulnerabilities can provide administrative access, code execution, or control over infrastructure that attackers can use for further access.
• Adobe Commerce and Magento: Treat CVE-2026-75650 as both a remediation and compromise-assessment priority. Exploitation began before the vendor hotfix was available, so organizations with previously exposed systems should investigate for evidence of code execution, persistence, and application modification in addition to applying the update.
• Endpoints and browsers: Accelerate deployment of the Chrome update addressing CVE-2026-85046, particularly for administrator, developer, and other high-privilege endpoints. Active exploitation makes browser patch latency more important than the vulnerability’s severity score alone.
• Automation and AI infrastructure: Identify exposed Kestra and LiteLLM deployments and review what downstream capabilities they can access. Exploitation of these platforms can become significantly more consequential when workflows, MCP tools, secrets, or infrastructure integrations carry elevated permissions.
• Investigate previously exposed systems: For vulnerabilities exploited before disclosure or patch availability, patch deployment should not be treated as the end of remediation. Review authentication activity, configuration changes, spawned processes, persistence mechanisms, newly created users or tokens, and unusual outbound connections where relevant to the affected product.

The remediation order should therefore be driven by confirmed exploitation, internet exposure, achievable attacker impact, and business context. Older vulnerabilities should remain prioritized when exploitation signals reappear, while newly disclosed issues should move rapidly up the queue when evidence shows attackers have already operationalized them.

For exposure-management programs, this means continuously reassessing vulnerabilities as evidence of exploitation changes. SAFE CTEM combines threat activity with exploitability, asset context, business impact, and compensating controls to help security teams focus remediation on exposures that materially change organizational risk.