SHIFTWIRE
Log inGet Early Access

LIVE INTELLIGENCE

The Wire

Verified technology, security, and framework changes — structured for the people responsible for keeping systems running.

UPDATED CONTINUOUSLY

63 VERIFIED SHIFTS

SW-000233AWS · AMAZON ATHENA · ATHENA QUERY FEDERATION - SYNAPSE CONNECTORHIGHACTION REQUIRED6H AGO

AWS discloses SQL injection flaw (CVE-2026-12283) in Athena Synapse connector

AWS published a security bulletin for CVE-2026-12283, a vulnerability in the Athena Federated Query Synapse connector that lets a user with Azure Synapse access craft a table name causing unintended data to be returned when queried via Athena. The issue affects connector versions from v2022.20.1 through v2026.19.1 and is fixed in v2026.21.1.

DATA · CLOUD · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000234AMAZON WEB SERVICES · ION-JAVAHIGHACTION REQUIRED6H AGO

ion-java memory-amplification DoS bugs: v1.12.0 fix incomplete, upgrade to 1.12.1+

AWS disclosed two denial-of-service vulnerabilities in the ion-java library (CVE-2026-75935 and CVE-2026-75936) affecting versions before 1.12.0, caused by memory amplification via declared-length preallocation and compressed-data expansion. A September 2026 update to this bulletin states the originally recommended mitigation (disabling GZIP decompression) does not fully fix the issue on primary parse paths, and customers must instead upgrade to ion-java 1.12.1 or later, per the corrected Security Bulletin 2026-100-AWS.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000235AWS · CONTAINERD · CRI PLUGINHIGHACTION REQUIRED6H AGO

AWS discloses five containerd CRI plugin CVEs affecting EKS, ECS, Fargate, Bottlerocket

AWS published a security bulletin describing five vulnerabilities in the containerd CRI plugin (versions 1.7 through 2.3) that affect AWS managed container services including EKS, ECS, Fargate, Bottlerocket, and Amazon Linux. The flaws include image cache poisoning via checkpoint references (CVE-2026-50195, CVSS 8.8), unsanitized image LABEL propagation enabling host command execution (CVE-2026-53488, CVSS 8.3), CDI annotation injection bypassing device enforcement (CVE-2026-53492, CVSS 6.8), symlinked log path exploitation for arbitrary host file read (CVE-2026-53489, CVSS 6.5), and a memory exhaustion DoS from crafted images (CVE-2026-47262, CVSS 6.5). Fixes are available upstream, and AWS is deploying patched runtimes across managed fleets while self-managed users must patch independently.

SECURITY · CLOUD · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000236AWS · S2N-TLSHIGHACTION REQUIRED6H AGO

s2n-tls fixes TLS 1.3 record-drop flaw and QUIC memory leak (CVE-2026-16317/16318)

AWS disclosed two vulnerabilities in the open-source s2n-tls library affecting versions up to v1.7.5, both fixed in v1.7.6. CVE-2026-16317 allows an active man-in-the-middle to silently drop TLS 1.3 application data records undetected due to missing validation of the outer content_type byte. CVE-2026-16318 causes a memory leak in QUIC-enabled TLS 1.3 connections during HelloRetryRequest handshakes due to incorrect memory allocation handling.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000237AMAZON WEB SERVICES · STRANDS AGENTS TOOLS · STRANDS-AGENTS-TOOLS PACKAGEHIGHACTION REQUIRED6H AGO

CVE-2026-19111: IDOR in Strands Agents Tools memory tools enables cross-tenant data access

An insecure direct object reference vulnerability (CVE-2026-19111) in the strands-agents-tools package's mongodb_memory, elasticsearch_memory, and mem0_memory tools lets a remote authenticated user manipulate the namespace parameter via a crafted LLM prompt to read, modify, or delete another tenant's memories, or inject false memories. The standalone mongodb_memory and elasticsearch_memory functions also expose connection parameters that could redirect the memory layer to an attacker-controlled cluster. Versions before 0.8.3 are affected; 0.8.3 fixes the issue.

AI · SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000243AMAZON WEB SERVICES · AWS COMMON RUNTIME · AWS-C-HTTPHIGHACTION REQUIRED6H AGO

AWS discloses CVE-2026-12043 heap double-free in aws-c-http HTTP/2 handling

AWS published security bulletin 2026-043-AWS describing CVE-2026-12043, a heap double-free vulnerability in the aws-c-http library caused by improper handling of HPACK dynamic table size updates. A malicious HTTP/2 server could send a crafted sequence of HEADERS frames to corrupt memory on a connecting client, with potential for arbitrary code execution. The issue affects aws-c-http versions 0.4.22 through 0.10.15 and is fixed in 0.11.0.

SECURITY · NETWORK · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000245AWS · AWSLABS.AWS-API-MCP-SERVER · AWS API MCP SERVERHIGHACTION REQUIRED6H AGO

AWS API MCP Server CVE-2026-16584: startup failure can bypass security policy checks

AWS disclosed CVE-2026-16584 affecting the open-source AWS API MCP Server (awslabs.aws-api-mcp-server), versions >=0.2.13 and <1.3.47. If the server's security-policy enforcement data fails to load at startup, the server continues running with per-request policy checks skipped for the life of the process, allowing denied or gated AWS CLI operations to execute unchecked. IAM permissions remain enforced and are unaffected. The issue is fixed in version 1.3.47.

SECURITY · AI · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000246AWS · AMAZON BEDROCK AGENTCORE · BEDROCK AGENTCORE PYTHON SDK (BEDROCK-AGENTCORE)HIGHACTION REQUIRED6H AGO

CVE-2026-15737: AgentCore Python SDK leaked prompts via OpenTelemetry spans

AWS disclosed CVE-2026-15737 affecting the Bedrock AgentCore Python SDK (bedrock-agentcore) versions 1.4.8 and 1.5.0. The SDK's OpenTelemetry instrumentation wrote raw user prompts and full agent responses into span attributes on every invocation without filtering, exposing this data in the customer's aws/spans CloudWatch log group to any local authenticated user with CloudWatch Logs read access.

SECURITY · AI · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000248AWS · KUBERNETES · AMAZON EFS CSI DRIVERHIGHACTION REQUIRED6H AGO

AWS discloses mount option injection flaw in EFS CSI Driver (CVE-2026-6437)

AWS published a security bulletin describing CVE-2026-6437, a vulnerability in the Amazon EFS CSI Driver that allows a user with PersistentVolume creation privileges to inject arbitrary mount options through two unsanitized fields. The issue affects versions up to and including v3.0.0 and is fixed in v3.0.1.

STORAGE · SECURITY · CLOUD · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000249AMAZON WEB SERVICES (AWS) · AMAZON Q DEVELOPER IDE PLUGINS · LANGUAGE SERVERS FOR AWSHIGHACTION REQUIRED6H AGO

AWS patches trust-boundary and symlink flaws in Q Developer language servers

AWS disclosed two vulnerabilities, CVE-2026-12957 and CVE-2026-12958, in Language Servers for AWS, the runtime underlying Amazon Q Developer's AI coding assistant across its VS Code, JetBrains, Eclipse, and Visual Studio IDE plugins. CVE-2026-12957 is an improper trust boundary enforcement issue (versions before 1.65.0) allowing automatic execution of commands from a maliciously crafted workspace's project configuration files if a user trusts the workspace when prompted. CVE-2026-12958 is a missing symlink-validation issue (versions before 1.69.0) that can let a crafted symlink in a workspace resolve to a file path outside the trust boundary. Both are fixed in Language Servers for AWS version 1.69.0 and the corresponding Amazon Q Developer plugin releases. No workarounds exist.

SECURITY · DEVOPS · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000205AWS · JSII-DIFF (AWS JSII)HIGHACTION REQUIRED3D AGO

CVE-2026-15895: OS command injection in jsii-diff versions before 1.131.0

AWS disclosed CVE-2026-15895, an OS command injection vulnerability in jsii-diff, a CLI tool used to compare API differences between jsii assemblies. Specially formatted command line arguments can be used to execute arbitrary shell commands. The issue affects jsii-diff versions prior to 1.131.0 and is fixed in that version.

DEVOPS · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000206CISCO · SECURE ENDPOINT CONNECTOR (WINDOWS, LINUX, MAC) AND SECURE ENDPOINT PRIVATE CLOUD · CISCO SECURE ENDPOINTHIGHACTION REQUIRED3D AGO

Cisco patches multiple ClamAV DoS vulnerabilities in Secure Endpoint Connector

Cisco disclosed seven ClamAV vulnerabilities (CVE-2026-20213 through CVE-2026-20217, CVE-2026-20243, CVE-2026-20244) affecting the ClamAV scanning engine used by Cisco Secure Endpoint Connector on Windows, Linux, and Mac. The flaws stem from improper boundary checks and temporary resource handling in file format parsers (InstallShield, PE, FSG, 7z, PESpin, ALZ, DMG), allowing an unauthenticated remote attacker to crash the ClamAV scanning process and cause a denial of service. No workarounds exist; Cisco has released fixed software for affected connector versions.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT
SW-000209RED LION CONTROLS · N-TRON 700 SERIESHIGHACTION REQUIRED3D AGO

CISA details 7 vulnerabilities in Red Lion N-Tron 700 Series industrial switches

CISA published ICS advisory ICSA-26-281-01 describing seven vulnerabilities in Red Lion Controls' N-Tron 700 Series industrial switches, affecting firmware versions up to 3.11.0 and bootloader versions up to 2.0.6.1. The flaws include hard-coded and weakly protected credentials, unauthenticated SNMP-based administrative actions, unauthenticated firmware/bootloader updates, a remotely triggerable reboot condition, and a physical-access authentication bypass. CVSS v3 scores range up to 8.3 (High) and CVSS v4 scores up to 9.3 (Critical). The reporter was Idaho National Laboratory; no known public exploitation has been reported.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT
SW-000210CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)HIGHACTION REQUIRED3D AGO

CISA, FBI, allies warn Integrity Technology Group enables Chinese state data-theft campaign

A joint advisory from the FBI, CISA, NSA, and international partners (AA26-281A, published Oct 8, 2026) details how the China-based Integrity Technology Group enables Chinese government-linked threat actors—associated with Flax Typhoon, Ethereal Panda, and Red Juliett activity—to exploit networks worldwide, including US critical infrastructure in government, critical manufacturing, healthcare, and IT sectors. The actors combine open-source scanning tools, a custom scanner called MicroScan, XSS-based credential harvesting, password spraying/guessing against Microsoft Exchange via the EBurst tool, SoftEther VPN for persistence, and custom scripts (Curlc4.txt, DC.exe, office-cli) to exfiltrate emails, credentials, and Active Directory data. Eight historical CVEs are listed as exploited via MicroScan scripts.

SECURITY · NETWORK · EMAIL · IDENTITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CISA (JOINT ADVISORY WITH FBI, NSA, NCSC-UK, ASD'S ACSC, CANADIAN CENTRE FOR CYBER SECURITY, JAPAN NPA/NCO, NCSC-NZ, AND SPAIN'S CNI)VIEW SHIFT
SW-000211SATEL · SATEL NETCO DESIGNHIGHACTION REQUIRED3D AGO

CISA advisory: Satel Netco Design vulnerable to XSS, ReDoS, and path traversal flaws

CISA published an ICS advisory detailing four vulnerabilities in Satel Netco Design versions prior to v2.1.7, including stored cross-site scripting, inefficient regular expression complexity (ReDoS), and two relative path traversal issues affecting data import and export functionality. The highest-severity flaw (CVE-2026-101024) carries a CVSS v3.1 score of 8.8 and could allow unauthorized file creation, modification, or arbitrary code execution. Satel advises updating to v2.1.7.

SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT
SW-000212AMAZON WEB SERVICES · AMAZON AGENT PLUGINS FOR AWS · DATABASES-ON-AWS PLUGINHIGHACTION REQUIRED3D AGO

OS command injection flaw (CVE-2026-107322) in AWS databases-on-aws plugin before 1.7.1

AWS disclosed CVE-2026-107322, an OS command injection vulnerability in the databases-on-aws plugin for Amazon Agent Plugins for AWS, affecting versions 1.0.0 through 1.7.0. An incomplete input denylist could let a remote unauthenticated actor supply crafted content that, if an AI coding agent later passes it to the local psql connection helper, results in command execution on the host with the helper process's permissions. The Aurora DSQL service itself and database privilege enforcement are not affected. A fix is available in version 1.7.1 (or commit 8b13a503746a4ebb0402b936645163224058bde3 and later for pinned revisions), released August 26, 2026.

EFFECTIVE AUG 26, 2026SECURITY · DATA · DEVOPS · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000214AMAZON WEB SERVICES · AWS-CDK-LIB · AWS CDKHIGHACTION REQUIRED3D AGO

CVE-2026-107608: Symlink injection in AWS CDK Docker asset bundling before v2.267.0

AWS disclosed CVE-2026-107608 affecting all aws-cdk-lib versions prior to 2.267.0. A malicious or misconfigured Docker file used during AWS CDK asset bundling could insert symlinked files or directories into the bundling output without those symlinks being part of the original input, potentially exposing unexpected file content. The issue is fixed in aws-cdk-lib 2.267.0.

DEVOPS · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE AWSVIEW SHIFT
SW-000218CISCO · CISCO FINESSEHIGHACTION REQUIRED3D AGO

Cisco Finesse SSRF flaw (CVE-2026-20362) allows unauthenticated remote attacks

Cisco disclosed a server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse, caused by improper input validation of certain HTTP requests. An unauthenticated remote attacker can send a crafted HTTP request to obtain limited sensitive information about services associated with the affected device. CVSS base score is 7.2 (High). No workarounds exist; fixed releases are planned for early 2027.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT
SW-000182CLOUDFLARE · CLOUDFLARE WAF · CLOUDFLARE MANAGED RULESETHIGHACTION REQUIRED5D AGO

Cloudflare WAF adds detection for F5 BIG-IP CVE-2026-94127 and updates injection rule

Cloudflare's October 6, 2026 Managed Ruleset release adds a new rule detecting CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP that can allow arbitrary code execution, with action set to Block. It also merges tested beta logic into the existing 'Command Injection - Generic 8 - uri' rule, changing its action from Log to Block. A separate rule for Next.js cache poisoning (CVE-2026-94543) had only its metadata description refined, with detection and action (Block) unchanged.

EFFECTIVE OCT 6, 2026SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITY · BEHAVIOR CHANGESOURCE CLOUDFLAREVIEW SHIFT
SW-000181AMAZON WEB SERVICES · AMAZON BEDROCK AGENTCORE · BEDROCK-AGENTCORE-STARTER-TOOLKITHIGHACTION REQUIRED5D AGO

AWS fixes code injection and SSRF flaws in Bedrock AgentCore Starter Toolkit

AWS disclosed two vulnerabilities, CVE-2026-105812 (code injection) and CVE-2026-106032 (external reference handling causing SSRF or local file access), in the open-source bedrock-agentcore-starter-toolkit Python package used to import Amazon Bedrock Agents into local environments. Versions 0.1.4 through 0.3.13 are affected; version 0.3.14 contains the fix.

AI · SECURITY · DEVOPS · VULNERABILITY · SECURITY ADVISORY · DEPRECATIONSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000160KASEYA · DATTO RMM · DATTO RMM MACOS AGENTHIGHACTION REQUIRED7D AGO

Datto RMM macOS agent connectivity issue identified; fix deployed across all platforms

Kaseya reported a connectivity issue affecting Datto RMM macOS agents across all supported regions (EU1, EU2, US West, US East, APAC). Newly installed macOS agents could not connect, and existing agents could go offline if the host device was restarted. After investigating with Apple, Kaseya developed and deployed a fix to all platforms, and is now monitoring to confirm recovery; some macOS agents may still require manual remediation.

EFFECTIVE OCT 2, 2026ENDPOINT · NETWORK · SERVICE INCIDENT · BEHAVIOR CHANGESOURCE KASEYA INCVIEW SHIFT
SW-000124APPLE · VISIONOS 2.6 · APPLE VISION PROHIGHACTION REQUIRED14D AGO

visionOS 2.6 patches multiple memory-corruption and info-disclosure vulnerabilities

Apple released visionOS 2.6 on July 29, 2025, addressing numerous security vulnerabilities across components including afclip, CFNetwork, CoreAudio, CoreMedia, ICU, ImageIO, Kernel, libxml2, libxslt, Metal, Model I/O, SQLite, and WebKit. Fixes address memory corruption, unexpected app termination, denial-of-service, and information disclosure issues, several of which are tied to publicly assigned CVEs including some in open-source components shared across other Apple platforms. Some entries were added or updated as late as October 15, 2025.

EFFECTIVE JUL 29, 2025SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE APPLEVIEW SHIFT
SW-000106AWS · S2N-QUIC · S2N-QUICHIGHACTION REQUIRED17D AGO

s2n-quic CVE-2026-94450: DoS via crafted Retry packet UDP datagram

AWS published a security bulletin for CVE-2026-94450 affecting the open-source s2n-quic Rust QUIC implementation. Servers configured to issue QUIC Retry packets fail to properly validate the Destination Connection ID length, letting an unauthenticated attacker crash the server endpoint with a single crafted UDP datagram. The issue is fixed in s2n-quic 1.89.0. AWS states no AWS services are affected and AWS service customers need not act; impact is limited to server deployments that explicitly enable Retry packet issuance.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000105AWS · PGCOLLECTIONHIGHACTION REQUIRED17D AGO

CVE-2026-96883: Type confusion bug in AWS pgcollection extension enables RCE

AWS disclosed CVE-2026-96883, a type confusion vulnerability in the open-source pgcollection PostgreSQL extension affecting versions 2.0.0 through 2.1.1. An authenticated database user can trigger the flaw by requesting a stored icollection value as an incompatible type, causing the extension to misinterpret the datum representation, which can crash the PostgreSQL backend or lead to arbitrary code execution.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000099LWIP · LWIP (LIGHTWEIGHT IP) APIHIGHACTION REQUIRED18D AGO

CISA advisory: lwIP double free vulnerability CVE-2026-91018 rated CVSS 8.8

CISA published an ICS advisory for a double free vulnerability (CVE-2026-91018) in the lwIP (Lightweight IP) API, versions >=2.0.1 and <=2.2.1. Successful exploitation could cause a system crash, denial of service, memory corruption, or potentially code execution. The vulnerability is not exploitable remotely and no known public exploitation has been reported.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT
SW-000091CISCO · CISCO SECURE FIREWALL ADAPTIVE SECURITY APPLIANCE (ASA) SOFTWARE AND SECURE FIREWALL THREAT DEFENSE (FTD) SOFTWAREHIGHACTION REQUIRED19D AGO

Cisco ASA/FTD IKEv2 certificate authentication flaw allows unauthenticated DoS reload

Cisco disclosed a high-severity vulnerability (CVE-2026-20249) in the IKEv2 certificate authentication logic of Secure Firewall ASA and FTD Software. An unauthenticated remote attacker can send a crafted certificate during IKEv2 VPN connection setup to crash the IKEv2 process and force an unexpected device reload. No workarounds exist; Cisco has released fixed software releases across multiple ASA and FTD/FMC version trains.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT
SW-000088AMAZON WEB SERVICES · DEEP JAVA LIBRARY (DJL)HIGHACTION REQUIRED20D AGO

CVE-2026-85228: DJL tensor buffer integer overflow allows OOB read/DoS

AWS disclosed CVE-2026-85228, an integer overflow in the tensor buffer validation logic of the Deep Java Library (DJL), affecting versions 0.13.0 through 0.36.0 on all platforms. A crafted tensor shape can cause the computed byte size to wrap past the 32-bit signed integer range, letting an undersized buffer pass validation and leading to an out-of-bounds read during a later tensor operation.

AI · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000090MITSUBISHI ELECTRIC · GX WORKS3 AND MOTION CONTROL SETTINGSHIGHACTION REQUIRED20D AGO

CVE-2026-15688 lets local attacker bypass block password in GX Works3, Motion Control Settings

CISA republished a Mitsubishi Electric advisory (2026-007) describing CVE-2026-15688, a CWE-303 Incorrect Implementation of Authentication Algorithm flaw affecting all versions of GX Works3 and its packaged Motion Control Settings component. A local attacker can authenticate despite an invalid block password by running the affected product and modifying part of the executable module in memory, enabling viewing, tampering with, destruction, or deletion of control programs.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT
SW-000073ABB · ABB ABILITY EDGENIUS GATEWAY - BE100 · ABB ABILITY EDGENIUSHIGHACTION REQUIRED21D AGO

ABB Ability Edgenius affected by Linux kernel privilege escalation flaw CVE-2026-31431

ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1 contain a Linux kernel vulnerability (CVE-2026-31431, 'Copy Fail') in the algif_aead cryptographic interface that can allow a locally authenticated user or compromised container workload to escalate to root privileges. ABB has released version 3.2.4.1 to fix the issue and recommends applying the update as soon as possible.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISA (REPUBLISHING ABB PSIRT ADVISORY 7PAA024620)VIEW SHIFT
SW-000084AMAZON WEB SERVICES · AWS SYSTEMS MANAGER · AWS SYSTEMS MANAGER AGENT (SSM AGENT)HIGHACTION REQUIRED21D AGO

CVE-2026-89049: SSRF in SSM Agent port forwarding exposes IAM role credentials

AWS disclosed a server-side request forgery vulnerability in SSM Agent's Session Manager remote-host port forwarding feature. An authenticated user with port-forwarding permission could bypass the remote destination denylist to reach link-local endpoints and potentially retrieve the managed instance's temporary IAM role credentials, allowing actions with that role's permissions from outside the instance.

SECURITY · CLOUD · IDENTITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000080AMAZON WEB SERVICES · AMAZON EKS · AWS-NETWORK-POLICY-AGENT (AMAZON EKS NETWORK POLICY AGENT)HIGHACTION REQUIRED22D AGO

CVE-2026-86831: NetworkPolicy bypass in EKS Network Policy Agent before v1.4.0

AWS disclosed CVE-2026-86831, a vulnerability in the Amazon EKS Network Policy Agent (aws-network-policy-agent) affecting versions before v1.4.0 and Amazon VPC CNI Managed Add-on versions 1.14.0 up to but not including 1.22.3, that can allow cross-namespace NetworkPolicy enforcement to be bypassed.

SECURITY · NETWORK · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000082MITSUBISHI ELECTRIC · CC-LINK IE TSN COMMUNICATION PROTOCOLHIGHACTION REQUIRED22D AGO

Mitsubishi Electric CC-Link IE TSN protocol flaw enables network DoS via data tampering

CISA advisory ICSA-26-211-07 (Update A) describes CVE-2026-13584, a CWE-924 message-integrity flaw in Mitsubishi Electric's CC-Link IE TSN communication protocol. An attacker on the same network segment can send specially crafted packets under specific timing conditions to tamper with control input/output data, potentially causing a denial-of-service condition across a very large list of affected MELSEC controllers, motion modules, remote I/O modules, servos, inverters, robot controllers, GOT3000 HMIs, and related CC-Link IE TSN software/SDKs. Mitsubishi Electric has stated no fix is planned and instead recommends network and physical access mitigations.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT
SW-000078MICROSOFT · MICROSOFT ENTRA · MICROSOFT ENTRA IDHIGHACTION REQUIRED23D AGO

Entra begins passkey-default migration and schedules native SMS/voice retirement

Microsoft has begun a passkey-default migration for eligible Entra ID users and has scheduled retirement of Microsoft-provided SMS and voice authentication. Most in-scope users reach the retirement milestone on February 1, 2027, while Global Administrators and external users have a later July 1, 2027 milestone.

DEADLINE FEB 1, 2027IDENTITY · AUTHENTICATION · DEPRECATION · AUTHENTICATION CHANGESOURCE MICROSOFTVIEW SHIFT
SW-000063AWS · AWS IAM IDENTITY CENTER · TEMPORARY ELEVATED ACCESS MANAGEMENT (TEAM)HIGHACTION REQUIRED23D AGO

CVE-2026-86830: TEAM for AWS IAM Identity Center allows unintended privilege escalation

AWS disclosed CVE-2026-86830 affecting Temporary Elevated Access Management (TEAM), an open-source sample solution for managing temporary elevated access via AWS IAM Identity Center. Versions before 1.5.1 contain an incorrect privilege assignment flaw that could let an authenticated application-level user obtain unintended temporary elevated access to AWS accounts managed by TEAM. The issue is fixed in version 1.5.1; no workaround exists.

IDENTITY · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000070PALO ALTO NETWORKS · PAN-OS · PAN-OS (FIREWALLS, PANORAMA, PRISMA ACCESS, CLOUD NGFW)HIGHACTION REQUIRED23D AGO

PAN-OS CVE-2026-0310: XML processing buffer overflow enables DoS or root RCE

Palo Alto Networks disclosed CVE-2026-0310, a buffer overflow (CWE-787) in PAN-OS XML processing. An unauthenticated network attacker reaching the management web interface or dataplane interface can trigger a denial-of-service condition on VM-Series firewalls or achieve arbitrary code execution with root privileges on PA-Series hardware firewalls. Panorama is also impacted. Prisma Access and Cloud NGFW are affected at a lower, authenticated-access severity. No known workarounds exist; fixed versions are available across multiple PAN-OS release trains.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE PALO ALTO NETWORKSVIEW SHIFT
SW-000066SIEMENS · MENDIX · MENDIX SAML MODULEHIGHACTION REQUIRED23D AGO

Siemens Mendix SAML module vulnerable to signature bypass enabling account hijack

CISA republished a Siemens ProductCERT advisory (SSA-887643) describing CVE-2026-80465, a vulnerability in the Mendix SAML module where affected versions fail to properly validate SAML response signatures. This could allow an unauthenticated remote attacker to hijack a user account/session in specific SSO configurations. CVSS 3.1 base score is 8.7 (HIGH). Siemens has released fixed versions and recommends updating.

IDENTITY · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISA (REPUBLISHING SIEMENS PRODUCTCERT ADVISORY SSA-887643)VIEW SHIFT
SW-000053AMAZON WEB SERVICES · AWS SDK FOR GO V2 · AWS SDK FOR GO V2HIGHACTION REQUIRED27D AGO

AWS SDK for Go v2 fixes DoS bug in EventStream header decoder (CVE-2026-89090)

AWS disclosed CVE-2026-89090, a denial-of-service vulnerability in the EventStream header decoder of AWS SDK for Go v2. Versions prior to 2026-03-23 can be crashed by a malformed EventStream response frame containing an invalid header value type byte. The issue is fixed in version 2026-03-23 and later; no workaround is available.

DEVOPS · SECURITY · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000048CISCO · CISCO IOS XE SOFTWARE · BEEP (BLOCKS EXTENSIBLE EXCHANGE PROTOCOL) FEATUREHIGHACTION REQUIRED28D AGO

Cisco IOS XE BEEP feature DoS vulnerability (CVE-2026-20263), CVSS 8.6, patched

Cisco disclosed a high-severity denial-of-service vulnerability (CVE-2026-20263, CVSS base 8.6) in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software. An unauthenticated remote attacker can send a crafted BEEP SOAP request to cause an affected device to reload unexpectedly. The issue is due to improper handling when parsing BEEP SOAP requests. Cisco has released fixed software; no workarounds exist. Only devices with BEEP configured (e.g., NETCONF over BEEP or a BEEP listener via bingd) are affected. IOS Software, IOS XR Software, and NX-OS Software are confirmed not vulnerable. Cisco PSIRT is not aware of any public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT
SW-000049AMAZON WEB SERVICES · KIRO IDE · KIRO IDEHIGHACTION REQUIRED28D AGO

CVE-2026-89332: Kiro IDE agent-edited config could exfiltrate workspace data via Powers URL

AWS disclosed CVE-2026-89332 affecting Kiro IDE versions before 0.8.135, where the Kiro agent could write to a workspace's settings file in an untrusted repository, redirecting the Powers registry URL to an attacker-controlled endpoint and causing sensitive workspace data to be sent when the Powers panel was opened.

SECURITY · DEVOPS · AI · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000043AWS LABS · AWSLABS POSTGRES-MCP-SERVER (PYTHON PACKAGE) · POSTGRES-MCP-SERVERHIGHACTION REQUIRED1MO AGO

CVE-2026-87911: OS command injection bypasses read-only mode in postgres-mcp-server

AWS disclosed CVE-2026-87911, an OS command injection flaw in the SQL validation logic of awslabs.postgres-mcp-server before version 1.1.7. A crafted COPY ... TO PROGRAM statement can bypass the server's default read-only enforcement and execute OS commands on a self-managed PostgreSQL host when the connected database role holds superuser or pg_execute_server_program privileges. The issue is fixed in version 1.1.7 on PyPI.

SECURITY · DATA · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000045CISCO · IOS SOFTWARE AND IOS XE SOFTWARE · XMCP SERVER FEATUREHIGHACTION REQUIRED1MO AGO

Cisco IOS/IOS XE XMCP Server flaw allows unauthenticated remote DoS via malformed packet

Cisco disclosed CVE-2026-20301, a high-severity vulnerability (CVSS 8.6) in the Extensible Messaging Client Protocol (XMCP) Server feature of Cisco IOS and IOS XE Software. An unauthenticated remote attacker can send a malformed XMCP packet to cause an affected device to reload, resulting in a denial of service. Only devices with the XMCP Server feature enabled (service-routing xmcp listen configured) are affected. IOS XR and NX-OS are confirmed not vulnerable. Cisco has released fixed software; no workarounds exist, though an access-list based mitigation is described. Cisco PSIRT is not aware of any public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT
SW-000031AMAZON WEB SERVICES · EC2 F2 INSTANCES · AWS FPGA DEVELOPMENT KIT (AWS-FPGA)HIGHACTION REQUIRED1MO AGO

CVE-2026-85028: Insecure temp file permissions in AWS FPGA Dev Kit allow root code execution

AWS disclosed CVE-2026-85028 affecting AWS FPGA Development Kit (aws-fpga) versions before 2.3.4. The FPGA management tool installation component creates a temporary file at a predictable path in a world-writable directory, which is read after the installer elevates its own privileges, allowing local users to execute arbitrary code as root. The issue is fixed in version 2.3.4.

SECURITY · DEVOPS · VULNERABILITY · SECURITY ADVISORYSOURCE AWSVIEW SHIFT
SW-000032AMAZON WEB SERVICES · AMAZON ATHENA · ATHENA FEDERATED QUERYHIGHACTION REQUIRED1MO AGO

AWS fixes CVE-2026-77810 in Athena Federated Query Neptune Connector

AWS disclosed CVE-2026-77810, a vulnerability in the Neptune connector used by Athena Federated Query. A user with Neptune access through Athena could gain access to properties of the Lambda function that provides compute for the connector. The issue affects connector versions <=v2026.28.1 and >=v2024.15.1 and is fixed in v2026.30.1.

SECURITY · CLOUD · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICESVIEW SHIFT
SW-000034AWS · AMAZON LINUX 2 · LOG4J-CVE-2021-44228-HOTPATCHHIGHACTION REQUIRED1MO AGO

AWS discloses OS command injection flaw in log4j-cve-2021-44228-hotpatch (CVE-2026-85656)

AWS published a security bulletin describing CVE-2026-85656, an OS command injection vulnerability in the log4j-cve-2021-44228-hotpatch package used on Amazon Linux 2 to patch the Log4j CVE-2021-44228 JNDI lookup issue without restarting Java processes. Versions up to 1.3-8.amzn2 are affected; the fix is included in 1.3-9.amzn2.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000038CONNECTWISE · CONNECTWISE AUTOMATEHIGHACTION REQUIRED1MO AGO

ConnectWise Automate 2026.5 patches CVE-2026-9089 agent integrity-check flaw

ConnectWise released Automate 2026.5 to fix CVE-2026-9089, a CWE-494 'Download of Code Without Integrity Check' vulnerability affecting the agent's plugin loading and self-update processes. The flaw has a CVSS base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated Important severity with Priority 2 (Moderate), meaning ConnectWise recommends remediation within normal change management timelines but no later than 30 days.

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CONNECTWISEVIEW SHIFT
SW-000039NEXTGEN HEALTHCARE · MIRTH CONNECTHIGHACTION REQUIRED1MO AGO

CISA advisory: three vulnerabilities in NextGen Mirth Connect <=v4.7.1 allow data exfiltration, DoS

CISA published an ICS Medical Advisory describing three vulnerabilities (CVE-2026-82583, CVE-2026-78224, CVE-2026-82578) affecting NextGen Healthcare Mirth Connect versions 4.7.1 and earlier. The flaws include an authenticated SQL injection via the Database Connector API and two XXE injection issues in XSLT transformation and XML batch processing, which could allow credential disclosure, arbitrary file write, data exfiltration, or denial-of-service. NextGen recommends updating to v4.7.2 or later, available via the customer portal. No known public exploitation has been reported.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT
SW-000027GOOGLE CLOUD · CLUSTER DIRECTOR · CLUSTER DIRECTORHIGHACTION REQUIRED1MO AGO

Cluster Director patches high-severity Slurm sbcast flaw CVE-2026-65107

Google published a security bulletin (GCP-2026-060) for Cluster Director describing a high-severity flaw in the Slurm sbcast tool that lets shared library files bypass security checks and can crash cluster nodes. Google fixed the issue in the default OS image family (NVIDIA driver 580) as of August 27, 2026; the non-default image family (NVIDIA driver 570) will not receive the patch.

EFFECTIVE AUG 27, 2026SECURITY · CLOUD · SECURITY ADVISORY · VULNERABILITYSOURCE GOOGLE CLOUDVIEW SHIFT
SW-000029CARECAM · CARECAM PRO IP CAMERAS (ANJIA AJL33PC0801)HIGHACTION REQUIRED1MO AGO

CareCam Pro IP camera bootloader uses hard-coded credential, risking full device takeover

CISA advisory ICSA-26-251-01 discloses CVE-2026-85083, a hard-coded credential vulnerability (CWE-798) in the bootloader of the CareCam Pro ANJIA AJL33PC0801 IP camera running a specific 2020 U-Boot firmware build. An attacker with physical access could exploit the hard-coded credential to gain privileged bootloader access and fully compromise the device. CareCam has not responded to CISA's coordination attempts.

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT
SW-000030AWS · OPENSEARCH DASHBOARDS · TSVB PLUGIN (TIME SERIES VISUAL BUILDER)HIGHACTION REQUIRED1MO AGO

CVE-2026-18420: RCE via Prototype Pollution in OpenSearch Dashboards TSVB Plugin

AWS published a security bulletin describing a remote code execution vulnerability in the TSVB plugin of OpenSearch Dashboards, affecting versions 3.0.0 up to but not including 3.8.0, in both self-managed and AWS Managed OpenSearch Service deployments.

SECURITY · DATA · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000026CLOUDFLARE · ZERO TRUST NETWORKS API / CLOUDFLARE TUNNEL API · CLOUDFLARE TUNNEL, CLOUDFLARE MESHHIGHACTION REQUIRED1MO AGO

Cloudflare retires CIDR-based route endpoints and tunnel connections field on Oct 5, 2026

Cloudflare will remove two API surfaces on October 5, 2026: the CIDR-encoded route creation/update/delete endpoints in the Zero Trust Networks API, and the connections array returned in list and get responses for Cloudflare Tunnel (cfd_tunnel) and Cloudflare Mesh (warp_connector) resources. Both changes require administrators to update any direct API calls, scripts, or automation that rely on the old shapes before the removal date.

DEADLINE OCT 5, 2026NETWORK · DEVOPS · CLOUD · BREAKING CHANGE · DEPRECATION · RETIREMENTSOURCE CLOUDFLAREVIEW SHIFT
SW-000024GOOGLE CLOUD · CLUSTER TOOLKIT · SLURM SBCAST TOOLHIGHACTION REQUIRED1MO AGO

Google patches Slurm sbcast flaw CVE-2026-65107 in Cluster Toolkit OS images

Google Cloud issued security bulletin GCP-2026-060 for Cluster Toolkit, addressing CVE-2026-65107, a high-severity flaw in the Slurm sbcast tool that lets shared library files bypass security checks and can crash cluster nodes. Google has updated the OS images that Cluster Toolkit supports with the necessary patch.

SECURITY · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE GOOGLE CLOUDVIEW SHIFT
SW-000022CISCO · CISCO CATALYST SD-WAN CONTROLLER, MANAGER, AND VALIDATOR · CISCO CATALYST SD-WAN CONTROLLER / SD-WAN MANAGER / SD-WAN VALIDATOR (FORMERLY VSMART/VMANAGE/VBOND)HIGHACTION REQUIRED1MO AGO

Cisco Catalyst SD-WAN privilege escalation flaw (CVE-2026-20245) actively exploited, fixes released

Cisco disclosed CVE-2026-20245, a CLI input-validation flaw (CWE-116) in Catalyst SD-WAN Controller, Manager, and Validator (formerly vSmart/vManage/vBond) that lets an authenticated netadmin-level local attacker upload a crafted file to execute arbitrary commands as root, affecting all deployment types (on-prem, Cloud-Pro, Cisco-managed cloud, and FedRAMP). CVSS base score is 7.8. Cisco PSIRT confirmed exploitation in the wild as of June 2026, with some cases resulting in unauthorized configuration changes pushed to edge devices. No workarounds exist; Cisco has released fixed software across multiple release trains and also offers a temporary 'Live Protect' shield that disables SD-WAN Disaster Recovery and Manager cluster creation/expansion while deployed.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT
SW-000023CLOUDFLARE · CLOUDFLARE APIHIGHACTION REQUIRED1MO AGO

Cloudflare deprecates API Service Key auth, removal set for Sept 30 2026

Cloudflare is deprecating Service Key authentication for its API, effective March 19 2026, with full removal on September 30 2026. API Tokens are the designated replacement, offering the same functionality plus fine-grained scoping, expiration, and IP restrictions.

DEADLINE SEP 30, 2026IDENTITY · SECURITY · DEPRECATION · RETIREMENTSOURCE CLOUDFLAREVIEW SHIFT
SW-000021SCHNEIDER ELECTRIC · EASERGY, ECOSTRUXURE, POWERLOGIC, AND SAITEL PRODUCTSHIGHACTION REQUIRED1MO AGO

Schneider Electric Easergy, EcoStruxure, PowerLogic, Saitel devices hit by insufficient entropy flaw

CISA republished a Schneider Electric CPCERT advisory (Update A) describing CVE-2026-4827, a CWE-331 Insufficient Entropy vulnerability affecting numerous Easergy, EcoStruxure, PowerLogic, and Saitel product lines used in electrical distribution and substation automation. An attacker on the network could exploit weak session-management entropy to hijack sessions and perform unauthorized operations. CVSS v3.1 base score is 8.3 (High).

SECURITY · ENDPOINT · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT
SW-000019AMAZON WEB SERVICES · AMAZON OPENSEARCH SERVICE · OPENSEARCH SQL PLUGINHIGHACTION REQUIRED1MO AGO

CVE-2026-83497: Authenticated RCE via Cursor Deserialization in OpenSearch SQL Plugin

AWS published a security bulletin for CVE-2026-83497, a Java deserialization vulnerability in the OpenSearch SQL Plugin's cursor pagination feature. A remote authenticated user with only basic read/search permissions can send a crafted cursor parameter to the plugins/sql endpoint to execute arbitrary code on the server.

SECURITY · DATA · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT
SW-000017CISCO · SECURE ENDPOINT CONNECTOR (WINDOWS, LINUX, MAC); SECURE ENDPOINT PRIVATE CLOUD · CLAMAV (BUNDLED IN CISCO SECURE ENDPOINT)HIGHACTION REQUIRED1MO AGO

Cisco patches multiple ClamAV DoS vulnerabilities in Secure Endpoint Connector

Cisco disclosed seven ClamAV vulnerabilities (CVE-2026-20337, -20338, -20339, -20345, -20346, -20347, -20348) affecting the ClamAV scanning engine used in Cisco Secure Endpoint Connector for Windows, Linux, and Mac. The flaws stem from improper boundary checks and memory handling in parsers for zip, PESpin, GPT, PDF, Mach-O, and XAR file formats, and could allow an unauthenticated remote attacker to crash the ClamAV scanning process, causing a denial-of-service condition. Cisco has released fixed software for the affected connectors; no workarounds exist. Secure Endpoint Private Cloud itself is not vulnerable, but the connector software it distributes is affected and requires a pushed update.

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT
SW-000018OPENAI · OPENAI API · GPT-5-NANO-2025-08-07HIGHACTION REQUIRED1MO AGO

OpenAI to retire gpt-5-nano-2025-08-07 from API on Dec 11, 2026

OpenAI notified developers on June 11, 2026 that the gpt-5-nano-2025-08-07 model snapshot is deprecated and will be removed from the API on December 11, 2026. The recommended replacement is gpt-5.6-luna.

DEADLINE DEC 11, 2026AI · DEPRECATION · RETIREMENTSOURCE OPENAI DEVELOPERSVIEW SHIFT
SW-000003MICROSOFT · MICROSOFT ENTRA · MICROSOFT ENTRA IDHIGHACTION REQUIRED2MO AGO

Microsoft Entra begins shift from SMS and voice MFA to passkeys

Microsoft is making passkeys the default authentication experience in Entra ID and plans to retire Microsoft-provided SMS and voice authentication delivery.

DEADLINE FEB 1, 2027IDENTITY · SECURITY · RETIREMENT · BEHAVIOR CHANGESOURCE MICROSOFTVIEW SHIFT
SW-000001MICROSOFT · MICROSOFT INTUNE · INTUNEHIGHACTION REQUIRED2MO AGO

Microsoft retiring two Intune agent experiences August 31

Microsoft is now retiring the Policy Configuration Agent and Change Review Agent experiences in Intune, requiring organizations that rely on them to complete active work and prepare replacement workflows.

DEADLINE AUG 31, 2026ENDPOINT · SECURITY · AI · RETIREMENT · BREAKING CHANGESOURCE MICROSOFTVIEW SHIFT