Severity Daily

IT and AI security incidents, checked against the primary source

Tag: CVE-2026-87491

  • In all nine of today’s stories the patch already existed — what arrived today was the record

    In all nine of today’s stories the patch already existed — what arrived today was the record

    Four vulnerabilities entered CISA’s Known Exploited Vulnerabilities catalog today, and three of them come due Saturday, September 12. The one to deal with first is Cisco’s. CVE-2026-20079 is a 10.0 authentication bypass in Secure Firewall Management Center, and Cisco revised a six-month-old advisory on the same day to say active exploitation has been observed. Advisory revision, exploitation confirmation, KEV listing, and a three-day federal clock all landed together, on the box that administers the firewalls.

    It is not the day’s biggest number. That belongs to Mathspace, which says 1,079,819 people were exposed after attackers reached its self-hosted Metabase. But that breach is over: the intrusion ran from August 10, the data left on August 27, the patch went on August 29, and individual notifications began September 6. There is nothing in it for a defender to do tonight. The Cisco deadline is in three days, and the appliance is reachable from the network.

    The thread today is not the KEV batch, and it is the more uncomfortable one. In all nine of today’s stories, a fix already existed before the thing that finally made anyone look. Open WebUI’s 0.11.1 shipped 15 days before the 16 CVEs it closes were published inside a single hour, and its release notes say plainly that some security fixes were being withheld. AWS’s 1.1.7 reached PyPI 76 days before the bulletin disclosing the 9.6 it fixes, and 71 days before a separate bulletin credited that same release with a 6.5. Tencent patched a wormable zero-click WeChat flaw on August 21, and it still has no CVE and no advisory. Metabase’s advisory was August 6. The F5 BIG-IP rootkit Sophos took apart runs on a flaw whose federal remediation deadline passed on March 30, 2026, and Shadowserver still counts 795 vulnerable hosts. The gap this publication keeps finding is not between the flaw and the fix. It is between the fix and the record that would tell an administrator the upgrade was worth taking a window for.

    After Cisco, the other two Saturday deadlines. The 9.3 NetScaler authentication bypass is harder to act on than to read about: the CVE record carries no description at all, only a mangled version range, and Citrix’s advisory, unchanged since August 19, lists its mitigations as “None.” The 2025 FortiOS heap overflow scores 9.8 in the record and 8.1 from Fortinet, and CISA names FortiSASE among the affected products while the record does not; FortiOS 6.4 has no fixed build in either source. The exploited Chrome V8 zero-day runs to September 23, which is time you will want, because Google rates it Medium and the release note CISA links to still says its security section is coming.

    The two evening records are patch-soon work behind all of that: the AWS Postgres MCP server, where AWS’s advisory and AWS’s own patch comment disagree about which mode was exposed, and Open WebUI, where the 8.1 OAuth bypass only bites SQLite deployments — which is the default one.

    What is still open. Fortinet’s own advisory could not be read at all from here, so its affected list, fixed builds, and any exploitation language are missing from our story rather than absent from the world. Citrix has said nothing about exploitation three weeks after publishing. Google’s release note has now been blank for two days on a flaw CISA lists as exploited. And the WeChat flaw, patched on August 21, remains invisible to every scanner in every fleet, because there is no identifier to scan for.

    Sourcing note: this recap introduces no facts beyond the nine stories it links, each of which carries its own sourcing note. The KEV dates above are carried from those pages, which verified them against CISA’s own cisagov/kev-data mirror on GitHub, since cisa.gov returns 403 to automated retrieval. A re-read of that mirror during this run returned an older catalog version and truncated content, and the NVD records for CVE-2026-20079 and CVE-2026-87491 do not yet carry cisaExploitAdd or cisaActionDue — NVD lags the catalog by hours.

  • Google rates the exploited Chrome V8 zero-day Medium, and its release note still lists no security fixes; CISA’s deadline is September 23

    Google rates the exploited Chrome V8 zero-day Medium, and its release note still lists no security fixes; CISA’s deadline is September 23

    CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog on September 9, 2026 with a September 23 deadline, citing a Chrome release note whose security section has not been written yet.

    What happened

    Google published the stable channel update for desktop Chrome 153.0.8010.36 on Tuesday, September 8, 2026 — 153.0.8010.36 for Linux, and 153.0.8010.36 and .37 for Windows and Mac. Where a Chrome release note normally carries its “Security Fixes and Rewards” table, this one carries a single line: “Security changes to be updated shortly.” As retrieved for this story on the afternoon of September 9, that line was still there. No CVE list, no severity labels, no reporter credits, and no sentence about an exploit existing in the wild.

    Early on September 9, 2026, NVD published CVE-2026-87491. Google is the CNA, and the description Google supplied reads: “Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)”

    The record is in “Received” status. It carries CWE-787 and no CVSS score of any kind — not a Google vector, not a NIST vector. Its two references are the September 8 release note and Chromium issue 543557673, which requires a sign-in to read.

    Later the same day, CISA added the CVE to the KEV catalog under the name “Google Chromium V8 Out of Bounds Write Vulnerability,” with dateAdded of 2026-09-09 and dueDate of 2026-09-23 — a 14-day window. forensicTriage is No, so the obligation is remediation without a mandatory compromise assessment. knownRansomwareCampaignUse is Unknown. CISA’s description adds the scope the CVE record leaves implicit: the flaw “could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.”

    The single vendor link in CISA’s entry is the September 8 release note — the one with no security section.

    Why it matters

    Two things on this record do not fit together, and both are worth an operator’s attention before the coverage settles into a shape that hides them.

    The first is the severity word. Google’s own annotation on the CVE it authored says “Chromium security severity: Medium.” A US federal agency has, within a day, determined the same flaw is being exploited and put it on a two-week clock for every civilian agency. Medium-severity entries in the KEV catalog are not unheard of — this publication has covered one before, where a mid-scored flaw yielded root — but they are rare enough to be a signal rather than noise. Chromium’s severity scale measures the security impact of the bug on its own terms, and a V8 out-of-bounds write that stays inside the renderer sandbox is, by that scale, a lesser thing than one that escapes it. Exploitation in the wild does not change the technical reach of a bug. It does change the calculus for anyone deciding what to push this week, and a “Medium” in a patch-prioritization queue will not survive contact with a KEV listing that says the bug is already in use.

    The practical consequence is concrete. Organizations that gate browser rollouts on vendor severity, and there are many, will have looked at “Medium” and scheduled it behind whatever else is queued. The KEV entry says that decision is wrong for this CVE. Anyone whose patch policy reads severity labels rather than exploitation status should check what their tooling did with this one over the past 24 hours.

    The second is that Google has not published the security material for this release. A release note that says “Security changes to be updated shortly” is a normal, temporary state — Chrome routinely ships the binary before the write-up, holding fix details back while updates propagate. What is not normal is that the write-up is still missing after a federal agency has cited that exact page as the vendor reference for an exploited vulnerability. CISA’s KEV entry points a reader at a page that does not mention the CVE.

    Anyone following the chain the way it is meant to be followed — catalog entry to vendor advisory — arrives with nothing. The information that exists in public is split across a CVE record with no score, a bug tracker that requires a sign-in, and an agency description that is currently the only public statement tying this identifier to real-world exploitation. Secondary coverage has filled the gap in the meantime, describing Chrome 153 as carrying 230 security fixes and this as the seventh exploited Chrome zero-day of 2026. Neither figure appears on Google’s page as retrieved, and neither is verifiable against a primary source today. They may well be right. They are not, at this hour, checkable.

    There is also a cadence worth noting. CISA added a different V8 flaw, CVE-2026-85046, to the catalog on September 4, 2026, with a September 18 deadline. That entry was covered here. Five days later a second V8 out-of-bounds write is in the catalog with a September 23 deadline. Two Chromium engine bugs listed as exploited inside one week is a pattern that argues for treating browser updates as an operational cadence rather than a monthly chore, whatever severity word the vendor attaches to any individual one.

    What to do

    Update desktop Chrome to 153.0.8010.36 or later on Linux, and 153.0.8010.36 or .37 or later on Windows and Mac. Verify the rollout rather than trusting the update channel: managed fleets frequently have a meaningful tail of machines that have not restarted, and a Chrome that has downloaded a fix but not relaunched is not a patched Chrome.

    Extend the check past Chrome. CISA names Microsoft Edge and Opera explicitly and says the list is not exhaustive; anything shipping the affected V8 needs its own vendor’s build, on its own schedule, and those schedules do not line up with Google’s. Electron-based desktop applications inherit Chromium too, and typically lag furthest behind.

    Federal civilian agencies have until Wednesday, September 23, 2026. The entry does not carry the forensic-triage obligation, so remediation discharges it. For everyone else, the useful posture is to ignore the “Medium” label on this one and treat it at the priority the KEV listing implies. If your patch tooling ingests vendor severity to set deadlines, this CVE is a good test case for whether that logic has an exploitation override in it.

    Sourcing note

    Checked: Google’s Chrome Releases post for the stable channel desktop update of September 8, 2026, retrieved on the afternoon of September 9, 2026, for the version numbers and the state of its security section; the NVD record for CVE-2026-87491 for the description, status, weakness, absence of any CVSS score, and references; and CISA’s KEV catalog entry for the dates, deadline, flags, and product scope.

    cisa.gov returns 403 to automated fetching, so the KEV entry was read from cisagov/kev-data on GitHub, which CISA maintains as a mirror of the cisa.gov/kev data files. The file used is catalog version 2026.09.09, dateReleased 2026-09-09T19:00:50.2591Z.

    Could not reach: Chromium issue 543557673, which requires authentication, and the Chrome Releases label index, which is disallowed to automated retrieval. If Google has published the security section for this release at another URL, it was not found.

    Unresolved: whether Google will revise the “Medium” label now that the flaw is listed as exploited; when the release note’s security section will appear; who reported the bug and when; and what the exploitation looked like, which CISA does not publish. The widely reported figures of 230 fixes in Chrome 153 and a seventh Chrome zero-day for 2026 come from secondary coverage and are not confirmed against a primary source here.