PatchDay Alert
Subscribe →
Daily Digest · 3 min read · 5 CVEs · Issue 37 By PatchDay Alert

MariaDB Galera hits CVSS 10.0: unauthenticated RCE through a clustering feature

A shell injection in wsrep_notify_cmd gives attackers full code execution on MariaDB Galera clusters with no auth required. Also: a Chrome macOS use-after-free (8.8), a 389 Directory Server heap smash reachable by any domain user (7.6), and a MongoDB server-side JS memory leak (8.8).

Patch now
1
Within 24h
2
This week
2
Exploited
0
389 Directory ServerFreeIPARed Hat Identity ManagementLinuxIEI IVECNetwork ApplianceMariaDBGaleraWindowsGoogle ChromeChromiumMacOS

Five patches today, nothing exploited in the wild yet, but one deserves your full attention right now. MariaDB with Galera replication has a CVSS 10.0 unauthenticated RCE: if you have `wsrep_notify_cmd` enabled, an attacker controlling a joiner node name can inject shell commands straight into the server. Chrome on macOS and MongoDB also picked up 8.8-rated use-after-free bugs worth patching this cycle.

Today's CVEs

Sorted by urgency

01

CVE-2026-11774

NVD
7.6
CVSS
Patch within 24h HIGH
389 Directory ServerFreeIPARed Hat Identity ManagementLinux

An integer overflow in the SASL I/O layer of 389 Directory Server lets an attacker bypass the max packet size check and smash the heap with about 2 MB of controlled data. The catch: the attacker needs a successful SASL bind first (SSF > 0), so they need valid credentials. In FreeIPA or Red Hat IdM environments, that bar is low: any domain user, enrolled host, or service account with a Kerberos ticket can trigger this remotely for a crash or potential code execution.

Included because
authenticated but low bar in domain environments; network-reachable; critical infrastructure component; heap overflow with RCE potential
Affected estate
Any system running 389-ds-base (standalone or as part of FreeIPA/Red Hat IdM). All versions with the vulnerable sasl_io.c code in sasl_io_start_packet().
How to check
Run `rpm -q 389-ds-base` or `dnf info 389-ds-base` to confirm the installed version. Check if SASL binds are enabled (they are by default in FreeIPA/IdM).
Action
Update 389-ds-base to the vendor-patched version via dnf/yum, then restart the directory server instance.
Urgency
Patch within 24 hours
Why it matters
Any authenticated domain principal can crash or potentially get code execution on your directory server, which is the backbone of your identity infrastructure.
Source
Red Hat / 389-ds-base upstream advisory

Evidence trail

02

CVE-2026-11845

NVD
7.2
CVSS
Patch this week HIGH
IEI IVECNetwork Appliance

A privileged remote attacker can inject arbitrary OS commands into the IEI iVEC Virtualization Edge Computer and run them on the device. You need elevated access to exploit this, which lowers the real-world risk somewhat, but if an attacker already has a privileged session (or steals one), they own the box completely.

Included because
command injection; network-reachable management interface; edge appliance often internet-adjacent
Affected estate
IEI Integration Corp iVEC-IEI Virtualization Edge Computer appliances.
How to check
Log into the iVEC management console and verify the firmware version against IEI's advisory.
Action
Update firmware to the patched version. If unavailable, isolate the management interface behind a firewall or VPN.
Urgency
Patch this week
Why it matters
Full OS command execution on an edge compute appliance gives an attacker a pivot point into your network.
Source
IEI Integration Corp advisory

Evidence trail

03

CVE-2026-49261

NVD
10.0
CVSS
Patch now CRITICAL
MariaDBGaleraLinuxWindows

This is a CVSS 10.0. If you run MariaDB with Galera replication and have `wsrep_notify_cmd` enabled, an attacker who controls the joiner node name can embed shell commands in it and the server will execute them. That's full remote code execution with no authentication required, straight through a clustering feature. The blast radius covers MariaDB 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.

Included because
unauthenticated; CVSS 10.0; shell injection; common database product; clustering often network-exposed between nodes
Affected estate
MariaDB versions 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, and 12.3.1 with wsrep_notify_cmd configured.
How to check
Run `SELECT VERSION();` and check if `wsrep_notify_cmd` is set: `SHOW GLOBAL VARIABLES LIKE 'wsrep_notify_cmd';`. If it returns a non-empty value, you're exposed.
Action
Upgrade MariaDB to the fixed version for your branch. If that's not possible tonight, run `SET GLOBAL wsrep_notify_cmd='';` and remove it from your config file, then restart.
Urgency
Patch immediately
Why it matters
CVSS 10.0 unauthenticated RCE through a clustering feature. An attacker who can reach the Galera replication port can execute arbitrary commands as the MariaDB service user.
Source
MariaDB upstream advisory

Evidence trail

04

CVE-2026-12020

NVD
8.8
CVSS
Patch within 24h HIGH
Google ChromeChromiumMacOS

A use-after-free bug in Chrome's Autofill feature on macOS lets an attacker corrupt heap memory through a crafted web page. All it takes is getting a user to visit a malicious site. Chromium rates this High severity, and at CVSS 8.8 it's worth patching quickly even though there's no known exploitation yet.

Included because
no user interaction beyond visiting a page; high CVSS; widely deployed browser; macOS-specific
Affected estate
Google Chrome on macOS prior to 149.0.7827.115. Other Chromium-based browsers on macOS may also be affected until they pull the upstream fix.
How to check
Open chrome://version or query your endpoint management tool for the Chrome version on macOS devices.
Action
Push Chrome 149.0.7827.115 or later through your MDM or software update tool. Confirm users restart the browser to apply the update.
Urgency
Patch within 24 hours
Why it matters
A single click on a malicious link could give an attacker heap corruption in the browser process, potentially leading to code execution on the endpoint.
Source
Google Chrome Releases / Chromium security advisory

Evidence trail

05

CVE-2026-11933

NVD
8.8
CVSS
Patch this week HIGH
MongoDBLinuxWindowsMacOS

A use-after-free in MongoDB's server-side JavaScript engine lets an authenticated user with read privileges leak process memory or crash the server. The attacker needs to be able to run server-side JS, which means using operators like $where or $function. If you've disabled server-side JavaScript (which many hardening guides recommend), you're not exposed.

Included because
authenticated but low privilege bar; common database product; info disclosure and DoS; server-side JS enabled by default
Affected estate
MongoDB Server instances with server-side JavaScript enabled (the default). All versions containing the vulnerable BSON-to-JS-array conversion code.
How to check
Connect with `mongosh` and run `db.adminCommand({getParameter: 1, javascriptEnabled: 1})`. If it returns true and you have users with read privileges, you're exposed.
Action
Upgrade to the patched MongoDB version. If you can't upgrade quickly, set `security.javascriptEnabled: false` and restart mongod.
Urgency
Patch this week
Why it matters
An authenticated user with basic read access can crash your database or leak sensitive data from mongod process memory.
Source
MongoDB Server advisory

Evidence trail

One email, every weekday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →