--- title: "Security digest: September 11, 2026" url: https://erroneo.us/security/2026-09-11/ description: "September 11, 2026 vulnerability digest: 4 CISA KEV additions (ConnectWise, GitLab, JFrog); 4 critical advisories (PyPI, npm, Maven). What to patch and who…" type: security-digest-day section: "Security Digest" date_published: 2026-09-11 date_modified: 2026-09-11 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 11, 2026 4 known exploited (cisa kev) additions and 4 critical advisories. ## Take stock - Do you run any of these? GitLab Community Edition and Enterprise Edition, ConnectWise ScreenConnect, JFrog Artifactory. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-14. - PyPI: 2 critical advisories ( mysql-mcp-server , prowler-cloud ). Check with pip-audit (or: pip show ) . - npm: 1 critical advisory ( yayson ). Check with npm audit (or: npm ls ) . - Maven: 1 critical advisory ( com.linecorp.centraldogma:centraldogma-server ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-85706](https://erroneo.us/security/cve/CVE-2026-85706/index.md) GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability (CISA due 2026-09-14) - [CVE-2026-84869](https://erroneo.us/security/cve/CVE-2026-84869/index.md) ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability (CISA due 2026-09-14) - [CVE-2026-42018](https://erroneo.us/security/cve/CVE-2026-42018/index.md) JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability (CISA due 2026-09-25) - [CVE-2026-42016](https://erroneo.us/security/cve/CVE-2026-42016/index.md) JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability (CISA due 2026-09-25) ## Critical advisories - [CVE-2026-59971](https://erroneo.us/security/cve/CVE-2026-59971/index.md) MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) — PyPI mysql-mcp-server < 0.4.2 → 0.4.2 - [CVE-2026-59151](https://erroneo.us/security/cve/CVE-2026-59151/index.md) Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover — PyPI prowler-cloud < 5.30.3 → 5.30.3 - [CVE-2026-61534](https://erroneo.us/security/cve/CVE-2026-61534/index.md) yayson: Prototype pollution in Store/LegacyStore deserialization — npm yayson <= 4.2.0 → 4.3.0 - [CVE-2026-11746](https://erroneo.us/security/cve/CVE-2026-11746/index.md) Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover — Maven com.linecorp.centraldogma:centraldogma-server < 0.84.0 → 0.84.0 --- Source page: https://erroneo.us/security/2026-09-11/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt