---
title: "Security digest: August 24, 2026"
url: https://erroneo.us/security/2026-08-24/
description: "August 24, 2026 vulnerability digest: 1 CISA KEV addition (Oracle); 4 critical advisories (PyPI, Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-24
date_modified: 2026-08-24
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 24, 2026

1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Do you run any of these? Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-27.
- Maven: 3 critical advisories ( org.apache.camel:camel-undertow , org.apache.camel:camel-atmosphere-websocket , org.apache.camel:camel-azure-storage-blob ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( mcp-contextforge-gateway ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-21962](https://erroneo.us/security/cve/CVE-2026-21962/index.md) Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (CISA due 2026-08-27)

## Critical advisories

- [CVE-2026-53710](https://erroneo.us/security/cve/CVE-2026-53710/index.md) mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server — PyPI mcp-contextforge-gateway <= 1.0.1 → 1.0.2
- [CVE-2026-78329](https://erroneo.us/security/cve/CVE-2026-78329/index.md) Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes — Maven org.apache.camel:camel-undertow >= 4.11.0, < 4.14.9 → 4.14.9; Maven org.apache.camel:camel-undertow >= 4.15.0, < 4.18.4 → 4.18.4; Maven org.apache.camel:camel-undertow >= 4.19.0, < 4.22.0 → 4.22.0
- [CVE-2026-71300](https://erroneo.us/security/cve/CVE-2026-71300/index.md) Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace — Maven org.apache.camel:camel-atmosphere-websocket >= 4.0.0, < 4.14.9 → 4.14.9; Maven org.apache.camel:camel-atmosphere-websocket >= 4.15.0, < 4.18.4 → 4.18.4; Maven org.apache.camel:camel-atmosphere-websocket >= 4.19.0, < 4.22.0 → 4.22.0
- [CVE-2026-66906](https://erroneo.us/security/cve/CVE-2026-66906/index.md) Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir — Maven org.apache.camel:camel-azure-storage-blob >= 4.0.0, < 4.14.9 → 4.14.9; Maven org.apache.camel:camel-azure-storage-blob >= 4.15.0, < 4.18.4 → 4.18.4; Maven org.apache.camel:camel-azure-storage-blob >= 4.19.0, < 4.22.0 → 4.22.0

---
Source page: https://erroneo.us/security/2026-08-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt