Why Should I Care? — 2026-09-09 | 🔴 3 HIGH · 🟡 4 MEDIUM · 🔵 25 RADAR · ⚪ 67 FILTERED

📋 Briefing — 2026-09-09

32 vendor intel items scanned  |  🔴 3 HIGH  |  🟡 4 MEDIUM  |  🔵 25 RADAR  |  ⚪ 67 FILTERED

🔴 Critical — action required:

1. CISA Adds Four Known Exploited Vulnerabilities to Catalog — Yes, if you run any of the affected versions of Adobe Commerce, Microsoft Windows, or N-able N-central, as these vulnerabilities are actively exploited.
2. JWT used for authentication in web GUI signed with static key — Yes, if you run FortiMonitorOnSight web portal with the affected versions: the static key used for JWT authentication can be exploited to bypass authentication.
3. Improper Authentication of FortiPAM Server — Yes, if you run FortiPAM Server with the affected Fortinet Privileged Access Agent Chrome Extension: this vulnerability allows attackers to intercept your browser traffic.

Everything else can wait.

🟡 Medium — review when time permits:

1. ZTNA Portal Improper Certificate Validation — Yes, if you run FortiOS or FortiProxy Agentless ZTNA portal versions 7.0.0 to 7.2.4: this vulnerability allows attackers to intercept and manipulate your communications.
2. Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information — Yes, if you run FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS WEB UI: an unauthenticated attacker could exploit this to access sensitive information.
3. Cron Job Injection in Remote Backup — Yes, if you run FortiSandbox versions 6.2.0 to 6.2.9: this vulnerability allows attackers to inject commands and execute unauthorized actions.
4. CareCam Pro IP Cameras — Yes, if you run ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26: An attacker with physical access can take full control of your device.

🔵 15 items on the radar — see below ↓

Why Should I Care? 🔴 HIGH — Handle Now

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV]

❓ Why Should I Care?
Yes, if you run any of the affected versions of Adobe Commerce, Microsoft Windows, or N-able N-central, as these vulnerabilities are actively exploited.

🎯 Affected versions: Adobe Commerce and Magento, Microsoft Windows, N-able N-central

🎭 In plain English:
These vulnerabilities allow attackers to exploit your software to gain unauthorized access or execute malicious code. For example, an attacker could use the Adobe Commerce vulnerability to inject malicious code into your website, potentially stealing sensitive data.

🔧 Prerequisites:

• Running an affected version of the software
• Lack of proper security updates

⏱ Urgency: High urgency due to active exploitation and the potential for total control of affected systems.

JWT used for authentication in web GUI signed with static key

Fortinet PSIRT | CVSS 9.6

❓ Why Should I Care?
Yes, if you run FortiMonitorOnSight web portal with the affected versions: the static key used for JWT authentication can be exploited to bypass authentication.

🎯 Affected versions: All versions prior to the patched versions

🎭 In plain English:
The software uses a fixed key to sign login tokens, which means anyone who knows this key can create fake login tokens and log in as any user. For example, an attacker could create a fake token to log in as an admin and take control of the system.

🔧 Prerequisites:

• The attacker knows the static key used for JWT signing

⏱ Urgency: High urgency due to the high CVSS score and the risk of unauthorized access to the system.

✅ Fixed in: 2.5.0, 2.6.1

💡 Context: The root cause is the inclusion of a static key in the source code, which should never be done for security-sensitive operations like authentication.

Improper Authentication of FortiPAM Server

Fortinet PSIRT | CVSS 9.1

❓ Why Should I Care?
Yes, if you run FortiPAM Server with the affected Fortinet Privileged Access Agent Chrome Extension: this vulnerability allows attackers to intercept your browser traffic.

🎯 Affected versions: All versions of the Fortinet Privileged Access Agent Chrome Extension prior to the patched version

🎭 In plain English:
If you use the Fortinet Privileged Access Agent Chrome Extension, a hacker could set up a fake website that, when visited, would allow them to see everything you do in your browser, like a spy. For example, they could see your passwords or sensitive information.

🔧 Prerequisites:

• User must have the affected Fortinet Privileged Access Agent Chrome Extension installed
• User must visit a malicious website

⏱ Urgency: High urgency due to the potential for attackers to intercept sensitive data like passwords and personal information.

✅ Fixed in: The latest version of the Fortinet Privileged Access Agent Chrome Extension

💡 Context: The root cause is a flaw in the authentication mechanism that allows unauthorized access to the browser traffic.

Why Should I Care? 🟡 MEDIUM (4)

ZTNA Portal Improper Certificate Validation

Fortinet PSIRT | CVSS 7.3 | null

❓ Why Should I Care?
Yes, if you run FortiOS or FortiProxy Agentless ZTNA portal versions 7.0.0 to 7.2.4: this vulnerability allows attackers to intercept and manipulate your communications.

🎯 Affected versions: 7.0.0 to 7.2.4
Not affected: null

🎭 In plain English:
This vulnerability means that an attacker could eavesdrop on your secure communications, pretending to be the ZTNA portal or the website you're trying to access. For example, an attacker could intercept your login credentials when you try to access a secure website through the ZTNA portal.

🔧 Prerequisites:

• The attacker must be able to intercept network traffic between the ZTNA portal and the backend website

⏱ Urgency: High urgency due to the potential for sensitive data interception and manipulation.

✅ Fixed in: 7.2.5, 7.3.0

💡 Context: The root cause is a flaw in the certificate validation process, allowing attackers to use fake certificates to impersonate legitimate services.

Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

Fortinet PSIRT | CVSS 8.9

❓ Why Should I Care?
Yes, if you run FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS WEB UI: an unauthenticated attacker could exploit this to access sensitive information.

🎯 Affected versions: All versions prior to the patched versions

🎭 In plain English:
This vulnerability means that anyone on the internet could send a special request to your system and get sensitive information that should be private. For example, an attacker could see user credentials or other confidential data.

🔧 Prerequisites:

• The attacker does not need any credentials to exploit this vulnerability.

⏱ Urgency: High urgency because an attacker can access sensitive information without needing any login credentials.

✅ Fixed in: The latest versions that include the fix

💡 Context: The root cause is an improper access control mechanism in the WEB UI of the affected products.

Cron Job Injection in Remote Backup

Fortinet PSIRT | CVSS 6.7

❓ Why Should I Care?
Yes, if you run FortiSandbox versions 6.2.0 to 6.2.9: this vulnerability allows attackers to inject commands and execute unauthorized actions.

🎯 Affected versions: 6.2.0 to 6.2.9
Not affected: 6.0.0 to 6.1.9, 6.3.0 and above

🎭 In plain English:
An attacker could send a special request to your FortiSandbox, tricking it into running commands they want, like deleting files or stealing data. For example, an attacker could send a request that makes your system delete critical backup files.

🔧 Prerequisites:

• Attacker must have privileged access
• Target system must be running an affected version of FortiSandbox

⏱ Urgency: High urgency due to the potential for unauthorized command execution, which can lead to data loss or system compromise.

✅ Fixed in: 6.3.0, 6.2.10

💡 Context: The root cause is the lack of proper input validation for HTTP requests, allowing command injection.

CareCam Pro IP Cameras

CISA Advisories | CVSS 6.8 | CVE-2026-85083

❓ Why Should I Care?
Yes, if you run ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26: An attacker with physical access can take full control of your device.

🎯 Affected versions: ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn13796_/_Bootloader_U-Boot_2010.06_compiled_2020-08-26

🎭 In plain English:
The camera uses a hard-coded password that anyone can use to access and control the device. An attacker could change the firmware and configuration, potentially taking full control of the camera.

🔧 Prerequisites:

• Physical access to the device

⏱ Urgency: High urgency because an attacker with physical access can exploit this vulnerability to take full control of the device.

💡 Context: The root cause is the use of a hard-coded credential for bootloader authentication.

Why Should I Care? 🔵 On the Radar (25)

• DoppelCart fraud network uses 119,000 fake shops to steal credit cards (BleepingComputer) — A large-scale fraud operation named DoppelCart is using over 119,000 fake online stores to steal credit card information. This could impact any e-commerce platform or payment processor that doesn't have robust security measures in place.
• ShinyHunters hackers claim breach of Florida "DAVID" DMV database (BleepingComputer) — A hacking group claims to have stolen over 200,000 driver records from Florida's DMV database. This could impact anyone using or managing DMV-related systems in Florida, potentially exposing sensitive personal data.
• Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days (BleepingComputer) — Microsoft has released a massive update to fix 966 security flaws, including two zero-days. If you use Microsoft products, these updates are crucial to protect your systems from potential attacks.
• Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit (BleepingComputer) — Hackers are targeting F5 BIG-IP APM devices with a Linux rootkit that can inject malicious code into memory, potentially giving them access to your network without leaving traces on disk. For example, if your company relies on F5 devices for secure access, this could mean unauthorized access to sensitive data.
• WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls (The Hacker News) — A security flaw in WeChat allows attackers to take over accounts simply by making a call, even if the call isn't answered. This affects iPhone and Android users. Tencent has mitigated the issue, but the underlying flaw's status is unclear.
• Adobe fixes critical Magento zero-day exploited to backdoor servers (BleepingComputer) — A serious security flaw in Magento and Adobe Commerce was exploited by hackers to install backdoors on servers. Adobe has released a fix.
• Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell (The Hacker News) — Adobe has patched a critical vulnerability in Adobe Commerce and Magento Open Source that allows attackers to execute arbitrary code. This flaw has been exploited to deploy a Rust backdoor and a PHP web shell, impacting the security of affected systems.
• FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials (The Hacker News) — A critical flaw in FreeIPA allows attackers to create administrator credentials without logging in, potentially giving them full control over your Linux domain. This impacts any system using FreeIPA or Red Hat's Identity Management product.
• 220 million traveler records exposed in Vietnam-linked APIS leak (BleepingComputer) — A massive data leak exposed 220 million traveler records due to a security lapse in an APIS system linked to Vietnam. This could affect anyone who travels or manages travel data.
• The EU CRA's Real Question: What Shipped, and When Did You Know? (BleepingComputer) — The EU Cyber Resilience Act requires software vendors to report actively exploited flaws within 24 hours, starting September 11. This means companies must have a clear record of what products were shipped and when vulnerabilities were discovered to comply.
• Hackers build AI frameworks for widescale credential theft (BleepingComputer) — Hackers are using advanced AI to automate credential theft, making attacks more efficient and harder to detect. For example, if your company uses weak passwords or has poor multi-factor authentication practices, you're at higher risk.
• Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults (BleepingComputer)
• Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution (The Hacker News) — New threat actor targeting Brazilian financial institutions.
• China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (CISA Advisories) — News item reporting industrial-scale distillation campaigns.
• What It Took to Reach 1 Billion Build Manifests (The Hacker News) — Chainguard's container build manifest output growth.

⚪ 67 low-priority items filtered.

🦅 Aggregated and triaged by Donna AI  |  Sources: 8 vendor feeds  |  CISA KEV