Vulnerability intelligence

CVE-2026-85103 is identified as a heap-based buffer overflow vulnerability found within the VPN certificate ASN.1 decoding process. This flaw may enable an unauthenticated remote attacker to execute arbitrary code on affected systems. Specifically, it impacts Check Point Quantum Security Management and Quantum Security Gateway systems, as well as Check Point Spark Firewalls. The vulnerability affects several Check Point versions, including R81.20, R82, R82.10, and older end-of-support versions ranging from R80 to R81.10. Check Point has addressed this issue by releasing fixes through its automated LivePatch service and via Jumbo Hotfix Accumulator packages for the relevant product versions.

CVE-2026-85102 is a vulnerability found in Check Point Quantum Security Gateway products, specifically related to improper certificate trust validation during VPN negotiation. This flaw, categorized under CWE-295 (Improper Certificate Validation), affects Security Gateways and can be triggered by an unauthenticated remote attacker. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the Security Gateway by exploiting the improper validation of certificate data during the VPN negotiation process. This issue impacts various versions of Check Point's Security Gateway, Security Management Server, and Spark Firewall when using Site-to-Site or Remote Access VPN.

CVE-2026-20079 is an authentication bypass vulnerability found in the web interface of Cisco Secure Firewall Management Center (FMC) Software. This flaw allows an unauthenticated, remote attacker to circumvent authentication mechanisms by sending specially crafted HTTP requests to an affected device. The root cause of the vulnerability stems from an improper system process that is created during the device's boot sequence, which introduces an alternate authentication path. Successful exploitation of CVE-2026-20079 enables the attacker to execute script files on the compromised device, ultimately leading to root access to the underlying operating system. This vulnerability affects Cisco Secure FMC Software across all device configurations.

CVE-2026-86060 is an argument-handling flaw identified in MikroTik RouterOS, specifically within its SSH login path. This vulnerability arises when usernames begin with a prohibited character, which can be manipulated to alter the trusted RouterOS policy mask. Such a change ultimately leads to privilege escalation within the system. Exploitation of CVE-2026-86060 requires an unauthenticated SSH session to successfully reach the RouterOS login helper. This flaw is often discussed in conjunction with CVE-2026-67276, an SSH authentication bypass, as chaining these two vulnerabilities can allow an attacker to gain full, unauthenticated control over affected MikroTik devices. MikroTik has released fixes for this issue in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

CVE-2026-67277 is a vulnerability affecting the bandwidth-test service within MikroTik RouterOS. This flaw allows an unauthenticated client to establish a "related" btest connection before the primary session has completed its authentication process. An attacker can leverage this state to initiate an IPv4 UDP test. When the `random-data` parameter is set to `false`, the sender transmits an uninitialized tail from a kernel packet buffer, which can lead to the leakage of kernel memory. Additionally, an unchecked, inverted packet-size interval can cause an unsigned integer underflow and anomalously large fragmented output, potentially resulting in a remote denial-of-service (DoS) attack that restarts the RouterOS kernel or crashes the device.

CVE-2026-87491 is an out-of-bounds write vulnerability found in V8, Google Chrome's JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The vulnerability was reported by Jihyeon Jeong of the Compsec Lab at Seoul National University on August 6, 2026. Google has confirmed that an exploit for CVE-2026-87491 exists in the wild, making it an actively exploited zero-day vulnerability. The issue has been addressed in Chrome version 153.0.8010.36 for Windows, macOS, and Linux, and is the seventh actively exploited Chrome zero-day patched by Google in 2026.