Digest · Monday

Security digest: August 24, 2026

1 known exploited (cisa kev) addition and 4 critical advisories.

Take stock

Do you run any of these? Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-27.
Maven: 3 critical advisories (org.apache.camel:camel-undertow, org.apache.camel:camel-atmosphere-websocket, org.apache.camel:camel-azure-storage-blob). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 1 critical advisory (mcp-contextforge-gateway). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-21962	Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability	2026-08-27

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow… CVE-2026-78329 CVSS 9.8 Critical
org.apache.camel:camel-undertow >= 4.11.0, < 4.14.9 → fixed in 4.14.9; org.apache.camel:camel-undertow >= 4.15.0, < 4.18.4 → fixed in 4.18.4; org.apache.camel:camel-undertow >= 4.19.0, < 4.22.0 → fixed in 4.22.0
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers… CVE-2026-71300 CVSS 9.8 Critical
org.apache.camel:camel-atmosphere-websocket >= 4.0.0, < 4.14.9 → fixed in 4.14.9; org.apache.camel:camel-atmosphere-websocket >= 4.15.0, < 4.18.4 → fixed in 4.18.4; org.apache.camel:camel-atmosphere-websocket >= 4.19.0, < 4.22.0 → fixed in 4.22.0
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without… CVE-2026-66906 CVSS 9.1 Critical
org.apache.camel:camel-azure-storage-blob >= 4.0.0, < 4.14.9 → fixed in 4.14.9; org.apache.camel:camel-azure-storage-blob >= 4.15.0, < 4.18.4 → fixed in 4.18.4; org.apache.camel:camel-azure-storage-blob >= 4.19.0, < 4.22.0 → fixed in 4.22.0

Check: pip-audit (or: pip show <package>)

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server CVE-2026-53710 CVSS 10.0 Critical
mcp-contextforge-gateway <= 1.0.1 → fixed in 1.0.2