Published · 21h agoBuild10 min read
Entra's CVSS 10.0 needs nothing from you, and GitLab's 9.4 is already being exploited. Sorted by score, the only bug that is both live and yours to patch ranks tenth.
Written for builders.See today for builders
Compiled by The EngineerSomething wrong?How this is made
The highest-scoring item of the week is the one that will not appear on anybody's change calendar. Microsoft says CVE-2026-69836 in Entra ID, a deserialization of untrusted data that lets an unauthorised attacker execute code over a network, carries a CVSS score of 10.0 and has been exploited in the wild [1]. Microsoft also says the flaw is fully mitigated and that there is no action for users of the service to take [2]. A CVSS vector describes what an attacker gets. It is silent on who is in a position to act, and for a multi-tenant identity service the vendor holds the entire remediation surface. The maximum score therefore converts into zero hours of your patch window plus one item you cannot close, because Microsoft has published no account of how the bug was exploited, when that began, whether it is ongoing, or how it was discovered [3]. Track that as vendor assurance. It does not belong at the head of a queue where nobody downstream can do anything about it.
The ordering that survives contact with a real maintenance window asks who holds the fix, whether anyone is using the bug today, and what a successful use of it reaches. Applied to this week's set, that ordering barely resembles the score ordering.
GitLab's CVE-2026-19478 is a code injection reachable through a GraphQL directive that lets an unauthenticated attacker modify or delete publicly accessible projects and rewrite their data, with no credentials, no user interaction and no obscure configuration required, at CVSS 9.4 [4]. watchTowr told The Hacker News it reproduced the bug within minutes of disclosure and then saw in-the-wild exploitation against its honeypot network [5]. Of everything on the desk this week, this is the only item that is simultaneously being used by attackers and dependent on a customer to apply the fix [39]: Entra is exploited but already closed by the vendor, and Cisco's set was found in internal testing and is not known to be exploited [12].
The 9.4 also undersells what a compromise touches. According to watchTowr, an attacker can delete entire repositories, forge merge records so that it appears a fix landed when it did not, and ban project maintainers [6]. Deleted repositories are recoverable from backups. Forged merge history is a trust problem in the artefact your build pipeline consumes, and it is not obvious how you would detect it after the fact.
The remediation is unusually well specified for something moving this fast. Fixed builds exist on four branches, 19.2.4, 19.1.6, 19.0.8 and 18.11.11, against affected ranges 19.2 before 19.2.4, 19.1 before 19.1.6, 19.0 before 19.0.8 and 18.2 before 18.11.11 [7]. If the window cannot be taken now, unauthenticated access to /api/graphql can be restricted or public repository access removed, and web logs can be searched for requests containing "@gl_introduced" [8]. watchTowr's Jake Knott framed the timing bluntly, saying AI-enabled attackers compress the interval from disclosure to exploitation and that waiting for the next patch cycle is often too late [9].
Cisco's release is where the count itself is wrong, in both directions. The Hacker News reports nine CVEs across Crosswork and Secure Workload: in Crosswork, SQL injection (CVE-2026-20030), missing authentication for a critical function (CVE-2026-20357) and external control of file system (CVE-2026-20358) at 10.0, plus insufficiently protected credentials (CVE-2026-20359) at 9.9 [10]; in Secure Workload, improper access control (CVE-2026-20315) and improper authentication (CVE-2026-20317) at 10.0, injection (CVE-2026-20231) at 9.9, input validation and path traversal (CVE-2026-20318) at 9.6, and buffer issues (CVE-2026-20319) at 7.5 [11]. SecurityWeek counts the same day as 15 vulnerabilities across Cisco's products and notes Cisco's own statement that each CVE groups multiple issues under one underlying vulnerability class [14]. So nine identifiers represent more than nine defects, and a reader who sized the window from the two-product story would have missed CVE-2026-20320, a high-severity XML external entity flaw in the BroadWorks Open Client Interface parser that a remote unauthenticated attacker can use to read sensitive configuration files, fixed in RI.2026.07 [16].
Blast radius is the reason Crosswork outranks its own score. Crosswork Network Controller 7.2 onboards devices, runs Zero Touch Provisioning, manages software image repositories and activation, deploys configuration templates, and holds configuration backups [17]. SecurityWeek reports that successful exploitation of the Crosswork defects could yield remote code execution, authentication bypass, path traversal and file overwrite or deletion [15]. Missing authentication on the machine that pushes images and templates to routers is not a single-host problem, whatever the score says.
Agency here is also split down the middle, which is easy to miss. Crosswork 7.2.1 and earlier is fixed in 7.2.1-SP, while Secure Workload is affected in both SaaS and on-premises deployments, with 3.10 and earlier fixed in 3.10.9.1 and 4.0 fixed in 4.0.4.16 [13]. Part of that remediation is Cisco's to perform and part is yours, and only the second part consumes your engineers.
The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, all published from the same owner account on 20 August 2026 and all removed within 86 to 107 minutes [18]. The payload sat in the build script of an injected typosquat dependency, proc-macro1, so resolving it during a build was enough to run the code and nothing from the crates themselves had to be called [19]. Delivery worked because the owner account yanked 0.3.5 through 0.3.9 within the same minute as the malicious publish, leaving the compromised release as the only version Cargo would not warn about; the reporter, GitHub user jhobern, said that warning is exactly how he hit it [22].
There is no patched version and no CVE, and the RustSec advisories record no evidence that any malicious version was used, a finding The Hacker News says it queried, along with the download counts for the deleted versions, without receiving a response [20]. That gap is worth sizing. arrayref shows 245,385,500 downloads all time, 53,905,601 in the 90 days ending 20 August, and 403 distinct dependent crates [21]. At that recent average rate, roughly 36,000 arrayref downloads occur in any 86-minute stretch and roughly 45,000 in 107 minutes [40]. That is not a count of malicious resolutions, and it should not be read as one, but it is the order of magnitude of traffic passing the shelf while the bad tin was on it, and the yank trick was designed to steer exactly that traffic. "No evidence of usage" is a statement about what was observed, not a measurement.
The response costs almost nothing: search ~/.cargo/registry/cache for the deleted files and pin arrayref at 0.3.9 or earlier, the versions the Rust Security Response Team unyanked during the incident [23]. The npm case has the same shape. Trend Micro's TrendAI reported 14 trojanised npm packages that deliver the RedShell Linux beacon from RedC2 4.0, where a single import anywhere in the dependency graph, including a transitive one, executes the payload with no install hook required [31]. That toolkit sells for $99.99 on a clearnet site branded Red Offsec, advertised in early June 2026 by an actor calling itself MarlboroMan [32]. Both jobs are a lockfile query and a cache grep. Neither has a CVE, so neither appears anywhere in a queue sorted by severity, and both would be finished before the first Cisco reboot completes.
Check Point Research's BTR Reforged work uses Microsoft Defender's own signed boot-time removal driver, BTR.sys, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver brought in from outside the machine [25]. Because BTR.sys is a required Windows component, it cannot be added to the Vulnerable Driver Blocklist or blocked via WDAC without breaking Defender itself [26]. The two containers a defender would normally reach for are closed by design.
What is left is detection, and the paper hands over the content for it: installation via direct HKLM writes with Type=1, Start=1 and Group="Boot Bus Extender", which bypasses the Service Control Manager and produces no Event ID 7045, with the resulting operations attributed in telemetry to the System process, PID 4 [28]. Check Point demonstrated the tool deleting the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active, during the interval after the filesystem becomes writable but before Defender's user-mode services start [30]. It also says it found no evidence of real-world abuse, which makes proactive detection engineering feasible before weaponisation appears [29]. That is the only scheduling advantage in the whole batch: the work can be done before it is needed.
Whether it ever leaves the detection column is unresolved in the sources. Exploitation requires an administrator holding SeLoadDriverPrivilege, and Check Point says MSRC confirmed the findings do not meet the criteria for immediate servicing; the proof-of-concept repository states that no patch is planned, a characterisation Microsoft has not confirmed publicly [27].
Two of this week's items have no defender-side action at all, and the honest thing to do is move them out of the engineering queue rather than let them sit there unattended. Researchers at UMass Amherst revived expired Visa contactless cards for real purchases by rewriting the expiry date the terminal reads over NFC, breaking no cryptography, using physical possession or sustained NFC proximity plus a man-in-the-middle relay, and relying on the account staying open under the same primary account number and the issuer not re-checking expiry [33]. The mechanism is a binding failure in one network's kernel: Visa's Kernel 3 does not require the terminal-facing date and Track 2 to be consistent, and the fDDA signature excludes tag 5F24, whereas Mastercard's Kernel 2 performs a consistency check and declines, and American Express's Kernel 4 binds expiry into the static data covered by offline authentication [34]. Bank behaviour diverges too: of three banks tested with expired and replaced physical cards, one allowed the modification and accepted transactions from more than one card, one detected it and accepted only one active card, and a third detected it and still accepted more than one [35]. Disclosure went to Visa and the affected banks in May 2025 with follow-up in December 2025, no CVE was assigned, and The Hacker News found no advisory or mitigation guidance from Visa, EMVCo, Mastercard, Discover, American Express or terminal vendor SumUp as of 20 August 2026 [36]. Nothing in a maintenance window touches this.
The car head units are the sharper version of the same problem. Kaspersky attributes malware found in DoFun-based Android head unit firmware to the MoYu Group with high confidence, spread through the units' own built-in updaters for ad fraud and a proxy botnet, and calls it the first documented case of head unit malware with an infection chain specific to that device type [37]. Kaspersky says the issue driving the distribution abuse has been addressed following disclosure, in a channel where a legitimate system app, TWCore, pulls APK updates via an MQTT broker on a cardoor.cn subdomain [38]. The fix and the infection travel the same wire, and a fleet operator's only lever is the firmware vendor's diligence.
Sorted by score, GitLab's 9.4 lands tenth, behind six 10.0s (five from Cisco, one from Microsoft), two 9.9s and a 9.6 [41]. Sorted by who can act and how fast the clock is running, it is first and nothing is close: it is exploited today [5] and it is yours to patch [7]. Cisco's management planes follow, on blast radius rather than the maximum scores, because Crosswork reaches every device it onboards [17] and nothing in that set is known to be under attack [12]. The two registry sweeps come next because they cost minutes and no vendor patch is coming for either [23][31]. BTR.sys detection content is fourth, and it is the only item where the schedule is genuinely yours to choose, because the technique has not been observed in use [29]. Entra ranks last, or rather it leaves the queue entirely and becomes a question for your account team [2][3].
The general form is dull and holds up: severity tells you how bad an event is for whoever is exposed, and remediation agency tells you whether you are that party. Cisco's own framing shows why the numbers cannot carry the ordering on their own, since each identifier bundles multiple defects under one class and one score [14]. Two of this week's most consequential items, the crates.io compromise and BTR.sys, have no CVE and no score at all [20][27], and a queue built on CVSS never sees them.
Ranked by verification strength, evidence, and original report placement.
Microsoft warned of CVE-2026-69836 in Entra ID, CVSS 10.0, a deserialization of untrusted data allowing an unauthorized attacker to execute code over a network, and said it has been exploited in the wild.
Microsoft said the Entra ID vulnerability "has already been fully mitigated by Microsoft" and that "There is no action for users of this service to take."
As of publication there were no details on how CVE-2026-69836 was exploited, when the activity began, whether it is ongoing, or how the flaw was discovered.
GitLab CVE-2026-19478 (CVSS 9.4) is a code injection, exploitable via a GraphQL directive, that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data without credentials, user interaction, or obscure configuration.
watchTowr told The Hacker News it reproduced CVE-2026-19478 within minutes of disclosure and observed in-the-wild exploitation against its honeypot network.
watchTowr said an attacker can delete entire repositories, forge merge records to make it appear as if a fix landed when it didn't, and ban project maintainers.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
