--- title: "Security digest: September 8, 2026" url: https://erroneo.us/security/2026-09-08/ description: "September 8, 2026 vulnerability digest: 1 brief (Windows Zero-Days: Update Stack and ALPC EoP…); 4 CISA KEV additions (Adobe, Microsoft, N-able); 14…" type: security-digest-day section: "Security Digest" date_published: 2026-09-08 date_modified: 2026-09-08 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 8, 2026 1 editorial brief, 4 known exploited (cisa kev) additions and 14 critical advisories. ## Take stock - Patch this week: Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026) . Anyone with Windows 10, Windows 11 or Windows Server 2012 through 2025 machines that have not installed the September 8, 2026 or a later cumulative update, starting with desktops and multi-user servers. - Do you run any of these? N-able N-central, Microsoft Windows, Adobe Commerce and Magento. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-11. - npm: 5 critical advisories ( next , maplibre-gl , @deepseek-ai/dsh-client-connection , astro ). Check with npm audit (or: npm ls ) . - PyPI: 3 critical advisories ( nltk , GitPython ). Check with pip-audit (or: pip show ) . - Go: 2 critical advisories ( github.com/semaphoreui/semaphore , gitea.dev ). Check with govulncheck ./... . - Composer (PHP): 2 critical advisories ( predis/predis , cakephp/cakephp , cakephp/database ). Check with composer audit . - Maven: 1 critical advisory ( io.netty:netty-handler ). Check with mvn dependency:tree -Dincludes=: . - NuGet: 1 critical advisory ( Microsoft.Native.Quic.MsQuic.OpenSSL , Microsoft.Native.Quic.MsQuic.Schannel ). Check with dotnet list package --vulnerable --include-transitive . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Patch this week** [Windows Zero-Days: Update Stack and ALPC EoP (Sep 2026)](https://erroneo.us/security/briefs/windows-update-stack-alpc-zero-days-cve-2026-81963-85880/index.md): Make sure every Windows machine has the September 2026 or a later cumulative update; both bugs are exploited, but an attacker needs code running on the box first. ## Known exploited (CISA KEV) - [CVE-2026-86218](https://erroneo.us/security/cve/CVE-2026-86218/index.md) N-able N-central: N-able N-central Static Code Injection Vulnerability (CISA due 2026-09-11) - [CVE-2026-85880](https://erroneo.us/security/cve/CVE-2026-85880/index.md) Microsoft Windows: Microsoft Windows Heap-Based Buffer Overflow Vulnerability (CISA due 2026-09-22) - [CVE-2026-81963](https://erroneo.us/security/cve/CVE-2026-81963/index.md) Microsoft Windows: Microsoft Windows Link Following Vulnerability (CISA due 2026-09-22) - [CVE-2026-75650](https://erroneo.us/security/cve/CVE-2026-75650/index.md) Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CISA due 2026-09-11) ## Critical advisories - [CVE-2026-73294](https://erroneo.us/security/cve/CVE-2026-73294/index.md) Semaphore U: OS Command Injection — Go github.com/semaphoreui/semaphore < 0.0.0-20260704181911-7e8a9434bd81 → 0.0.0-20260704181911-7e8a9434bd81 - [CVE-2026-79657](https://erroneo.us/security/cve/CVE-2026-79657/index.md) NLTK: Allowlisted pickle loaders still permit code execution in current source — PyPI nltk <= 3.10.2 → 3.10.3 - [CVE-2026-84372](https://erroneo.us/security/cve/CVE-2026-84372/index.md) Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections — Composer (PHP) predis/predis >= 3.0.0-RC1, < 3.3.0 → 3.3.0 - [CVE-2026-78683](https://erroneo.us/security/cve/CVE-2026-78683/index.md) NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution — PyPI nltk <= 3.9.4 → 3.10.0 - [CVE-2026-60004](https://erroneo.us/security/cve/CVE-2026-60004/index.md) Gitea: Remote Code Execution via diffpatch Git Hook Installation — Go gitea.dev >= 1.17.0, < 1.27.1 → 1.27.1 - [CVE-2026-75604](https://erroneo.us/security/cve/CVE-2026-75604/index.md) Next.js: Unauthenticated Remote Code Execution on windows-hosted servers — npm next >= 13.4.0, < 15.5.24 → 15.5.24; npm next >= 16.0.0, < 16.3.3 → 16.3.3 - [CVE-2026-85061](https://erroneo.us/security/cve/CVE-2026-85061/index.md) MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip — npm maplibre-gl <= 6.4.0 → 6.4.1 - [CVE-2026-77635](https://erroneo.us/security/cve/CVE-2026-77635/index.md) CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver — Composer (PHP) cakephp/cakephp >= 5.3.0, < 5.3.7 → 5.3.7; Composer (PHP) cakephp/cakephp >= 5.2.0, < 5.2.15 → 5.2.15; Composer (PHP) cakephp/cakephp >= 5.1.0, < 5.1.10 → 5.1.10 - [CVE-2026-75595](https://erroneo.us/security/cve/CVE-2026-75595/index.md) Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext — Maven io.netty:netty-handler >= 4.2.0.Final, <= 4.2.16.Final → 4.2.17.Final; Maven io.netty:netty-handler <= 4.1.136.Final → 4.1.137.Final - [CVE-2026-62815](https://erroneo.us/security/cve/CVE-2026-62815/index.md) Microsoft QUIC: Remote Code Execution Vulnerability — NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.3, < 2.5.10 → 2.5.10; NuGet Microsoft.Native.Quic.MsQuic.Schannel >= 2.5.3, < 2.5.10 → 2.5.10; NuGet Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.19 → 2.4.19 - [CVE-2026-82533](https://erroneo.us/security/cve/CVE-2026-82533/index.md) DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API — npm @deepseek-ai/dsh-client-connection < 0.1.2-alpha.1 → 0.1.2-alpha.1 - [GHSA-2xp9-vwfh-vxw4](https://erroneo.us/security/ghsa/GHSA-2xp9-vwfh-vxw4/index.md) Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used — npm next >= 10.0.0, < 15.5.24 → 15.5.24; npm next >= 16.0.0, < 16.3.3 → 16.3.3 - [CVE-2026-78676](https://erroneo.us/security/cve/CVE-2026-78676/index.md) GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE — PyPI GitPython <= 3.1.58 → 3.1.59 - [GHSA-26w7-cxv4-gfx2](https://erroneo.us/security/ghsa/GHSA-26w7-cxv4-gfx2/index.md) Astro: Remote code execution through AVIF image optimization — npm astro < 7.2.8 → 7.2.8 --- Source page: https://erroneo.us/security/2026-09-08/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt