---
title: "Security digest: January 13, 2026"
url: https://erroneo.us/security/2026-01-13/
description: "January 13, 2026 vulnerability digest: 1 brief (FortiOS CVE-2025-25249 and CVE-2025-61624 Now…); 1 CISA KEV addition (Microsoft); 4 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-01-13
date_modified: 2026-10-16
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: January 13, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Act now: FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited . Owners of FortiGate firewalls and FortiSwitchManager, FortiProxy or FortiPAM appliances below the fixed builds, starting with any device that has the fabric service or CAPWAP (UDP 5246-5249) reachable from untrusted networks.
- Do you run any of these? Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-03.
- npm: 2 critical advisories ( @orval/mcp , opencode-ai ). Check with npm audit (or: npm ls <package>) .
- RubyGems: 1 critical advisory ( openc3 ). Check with bundle audit check --update .
- NuGet: 1 critical advisory ( UmbracoForms ). Check with dotnet list package --vulnerable --include-transitive .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [FortiOS CVE-2025-25249 and CVE-2025-61624 Now Exploited](https://erroneo.us/security/briefs/fortios-cve-2025-25249-capwap-rce-cve-2025-61624/index.md): If you run FortiGates, get to FortiOS 7.4.10+ or 7.6.5+ now and hunt for implants: one bug gives unauthenticated attackers code execution over CAPWAP and is being exploited at scale, and the other turns stolen admin logins into root implants.

## Known exploited (CISA KEV)

- [CVE-2026-20805](https://erroneo.us/security/cve/CVE-2026-20805/index.md) Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability (CISA due 2026-02-03)

## Critical advisories

- [CVE-2025-68271](https://erroneo.us/security/cve/CVE-2025-68271/index.md) openc3-api Vulnerable to Unauthenticated Remote Code Execution — RubyGems openc3 >= 5.0.6, < 6.10.2 → 6.10.2
- [CVE-2025-68924](https://erroneo.us/security/cve/CVE-2025-68924/index.md) UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation — NuGet UmbracoForms <= 8.13.16 → no fix
- [CVE-2026-22785](https://erroneo.us/security/cve/CVE-2026-22785/index.md) orval MCP client is vulnerable to a code injection attack. — npm @orval/mcp < 7.18.0 → 7.18.0
- [CVE-2026-22813](https://erroneo.us/security/cve/CVE-2026-22813/index.md) Malicious website can execute commands on the local system through XSS in the OpenCode web UI — npm opencode-ai < 1.1.10 → 1.1.10

---
Source page: https://erroneo.us/security/2026-01-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt