Vulnerabilities
OpenSSL and WolfSSL Patch High‑Severity DTLS Vulnerabilities (CVE‑2026‑84782, CVE‑2026‑84783)
OpenSSL and WolfSSL released updates fixing a dozen critical bugs, including CVE‑2026‑84782 that lets unauthenticated attackers leak heap fragments or crash DTLS sessions. The flaw can be triggered during a DTLS handshake and is exploitable over the network without credentials. Defenders should upgrade to the latest releases and verify DTLS configurations.
What happened
OpenSSL and WolfSSL have issued new releases that address roughly a dozen vulnerabilities each. The most prominent is CVE‑2026‑84782 in OpenSSL, a high‑severity flaw affecting Datagram TLS (DTLS) used in VPNs, VoIP and IoT devices.
Impact
During a DTLS handshake, the library may retransmit a message while another is stalled, causing leftover heap data to be sent in cleartext. An attacker can read fragments of memory or trigger a crash, resulting in a denial‑of‑service. The CVSS score is 8.2 and the vulnerability is exploitable remotely without authentication.
What to do
- Upgrade OpenSSL to 3.2.3 or later and WolfSSL to the latest patch level.
- Validate that DTLS endpoints are using the updated libraries and that no legacy or insecure configurations remain.
- Monitor logs for abnormal DTLS handshake failures or memory‑leak patterns.
- Apply any vendor‑specific mitigations if the update cannot be applied immediately.
Related vulnerabilities
Windows Overlay Filter RCE Vulnerability (CVE‑2026‑69959) – Immediate Patch Required
Microsoft has disclosed a high‑severity out‑of‑bounds read in the Windows Overlay Filter that allows an authorized user to execute arbitrary code locally. The flaw is fixed in the latest security update; administrators must apply the patch and verify system integrity.
Read briefing
Google Patches Pixel Modem Privilege Escalation Flaw (CVE-2026-58704)
Google released a patch for a high‑severity privilege escalation flaw in the Pixel Cellular Modem (CVE‑2026‑58704). The vulnerability, which can be exploited without user interaction, has been observed in limited, targeted attacks. Defenders should update devices to the September 2026 build and monitor for anomalous modem activity.
Read briefing
Oracle VirtualBox VirtioSCSI Uninitialized Memory Disclosure – CVE‑2026‑71132
A flaw in VirtualBox’s VirtioSCSI driver lets a local attacker with high‑privileged guest code read hypervisor data. Oracle has released a patch; defenders should update immediately and review guest privilege levels.
Read briefing
Ivanti Connect Secure Zero‑Day Exploited in the Wild (CVE‑2026‑104935)
A high‑severity authentication bypass in Ivanti Connect Secure allowed unauthenticated attackers to execute arbitrary commands. The flaw was already exploited before disclosure, prompting CISA to add it to the KEV catalog. Defenders must patch immediately and harden VPN access.
Read briefing