---
title: "Security digest: April 14, 2026"
url: https://erroneo.us/security/2026-04-14/
description: "April 14, 2026 vulnerability digest: 2 briefs (FortiSandbox: Two Exploited Pre-Auth Command…); 2 CISA KEV additions (Microsoft); 7 critical advisories (npm…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-04-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 14, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 7 critical advisories.

## Take stock

- Act now: FortiSandbox: Two Exploited Pre-Auth Command Injections . Owners of on-premises FortiSandbox appliances and VMs on 4.2, 4.4.0-4.4.8 or 5.0.0-5.0.5, and FortiSandbox PaaS 5.0.4-5.0.5, most urgently where the web UI or API is reachable from untrusted networks.
- Check exposure: Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE . Owners of Windows hosts that act as IKEv2 responders (RRAS or IKEv2 VPN servers, Windows IPsec gateways) or otherwise accept UDP 500/4500 from the internet or untrusted networks, if they lack the April 2026 or later update.
- Do you run any of these? Microsoft SharePoint Server, Microsoft Office. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-28.
- Go: 3 critical advisories ( github.com/oxia-db/oxia , github.com/patrickhener/goshs , github.com/patrickhener/goshs/v2 , github.com/oauth2-proxy/oauth2-proxy/v7 , github.com/oauth2-proxy/oauth2-proxy ). Check with govulncheck ./... .
- npm: 2 critical advisories ( @openai/codex , @vendure/core ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( wwbn/avideo ). Check with composer audit .
- Maven: 1 critical advisory ( io.openremote:openremote-manager ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [FortiSandbox: Two Exploited Pre-Auth Command Injections](https://erroneo.us/security/briefs/fortinet-fortisandbox-cve-2026-39808-25089-unauth-command-injection/index.md): If any FortiSandbox runs 4.2, 4.4 below 4.4.9 or 5.0 below 5.0.6, upgrade now and check it for compromise: both bugs need no login, one has a public exploit, and attacks began in June.
- **Check exposure** [Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE](https://erroneo.us/security/briefs/windows-ike-cve-2026-33824-pre-auth-rce/index.md): The fix shipped in April, so most fleets are already covered; the real risk is any unpatched Windows host that answers IKE on UDP 500 or 4500 from untrusted networks, and those need patching or blocking today.

## Known exploited (CISA KEV)

- [CVE-2026-32201](https://erroneo.us/security/cve/CVE-2026-32201/index.md) Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability (CISA due 2026-04-28)
- [CVE-2009-0238](https://erroneo.us/security/cve/CVE-2009-0238/index.md) Microsoft Office: Microsoft Office Remote Code Execution (CISA due 2026-04-28)

## Critical advisories

- [CVE-2025-61260](https://erroneo.us/security/cve/CVE-2025-61260/index.md) OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files — npm @openai/codex <= 0.23.0 → no fix
- [CVE-2026-40911](https://erroneo.us/security/cve/CVE-2026-40911/index.md) WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks — Composer (PHP) wwbn/avideo <= 29.0 → no fix
- [CVE-2026-40946](https://erroneo.us/security/cve/CVE-2026-40946/index.md) Oxia has an OIDC token audience validation bypass via SkipClientIDCheck — Go github.com/oxia-db/oxia <= 0.16.1 → 0.16.2
- [CVE-2026-40884](https://erroneo.us/security/cve/CVE-2026-40884/index.md) goshs has an empty-username SFTP password authentication bypass — Go github.com/patrickhener/goshs <= 1.1.4 → no fix; Go github.com/patrickhener/goshs/v2 < 2.0.0 → 2.0.0
- [CVE-2026-40887](https://erroneo.us/security/cve/CVE-2026-40887/index.md) @vendure/core has a SQL Injection vulnerability — npm @vendure/core >= 3.0.0, < 3.5.7 → 3.5.7; npm @vendure/core >= 3.6.0, < 3.6.2 → 3.6.2; npm @vendure/core >= 1.7.4, < 2.3.4 → 2.3.4
- [CVE-2026-39842](https://erroneo.us/security/cve/CVE-2026-39842/index.md) Expression Injection in OpenRemote — Maven io.openremote:openremote-manager <= 1.21.0 → 1.22.0
- [CVE-2026-34457](https://erroneo.us/security/cve/CVE-2026-34457/index.md) OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode — Go github.com/oauth2-proxy/oauth2-proxy/v7 < 7.15.2 → 7.15.2; Go github.com/oauth2-proxy/oauth2-proxy <= 3.2.0 → no fix

---
Source page: https://erroneo.us/security/2026-04-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt