Critical vulnerability in Cisco IOS XR with CVSS 9.8, part of security hardening release addressing seven critical internally-discovered flaws (CVE-2026-20274 through CVE-2026-20280). Not known to be actively exploited but requires urgent patching due to severity.
Upgrade to fixed IOS XR software versions indicated in Cisco advisories. No workarounds available. Prioritize internet-facing and critical infrastructure devices. Implement enhanced monitoring during upgrade window.
Source: GTIG • Published: 2026-09-02
Elevation-of-privilege zero-day in Pixel cellular modem with CVSS 8.0. Exploited in limited targeted attacks by sophisticated actors. Allows attackers within radio proximity to escalate privileges without user interaction. Low-complexity attack requiring no victim engagement.
Install September 2026 Google Pixel security update (patch level 2026-09-05) immediately. Verify update installation on Pixel 6-11 series, Tablet, and Fold devices. Note Pixel 6/6 Pro reach EOL October 2026.
Source: GTIG • Published: 2026-09-15
Systemic security crisis in MCP affecting 200,000+ instances across 150M+ package downloads. Design-level command execution vulnerability in official Python, TypeScript, Java, and Rust SDKs. OX Security identified 43% of tested MCP servers vulnerable to command injection, 36.7% to SSRF. OWASP documented eight real-world compromises.
Implement input sanitization at client level (Anthropic classified STDIO behavior as intentional). Restrict MCP server execution privileges. Use network segmentation. Audit all MCP configurations. Treat MCP outputs as untrusted and validate rigorously.
Source: OWASP • Published: 2026-04-01
CVE-2026-20277: Critical vulnerability in Cisco IOS XR with CVSS 9.8, part of security hardening release addressing seven critical internally-discovered flaws (CVE-2026-20274 through CVE-2026-20280). Not known to be actively exploited but requires urgent patching due to severity.