FortiSandbox, SharePoint, and WordPress RCE all exploited in the wild

A buffer overflow in DD-WRT's UPnP handler lets an unauthenticated attacker on your internal network crash or potentially take over the router by sending a crafted M-SEARCH request. The saving grace: UPnP is off by default and only listens on internal interfaces, so you're only exposed if you manually turned it on. This is exploited in the wild.

Affected estate

Anyone running DD-WRT firmware older than build 45724 with UPnP enabled

How to check

SSH into the router and check the build number, or look at the DD-WRT web UI status page. Confirm whether UPnP is enabled under Services > UPnP.

Included because

unauthenticated; exploit in the wild; CVSS 8.1; mitigated by non-default config

Action

Flash DD-WRT build 45724 or newer. Disable UPnP if you don't need it.

Why it matters

A compromised router gives an attacker a pivot point into your entire internal network, plus the ability to intercept or redirect traffic.

Source

NVD, CISA KEV

Attackers can hit your SharePoint server over the network with a deserialization attack that runs arbitrary code, no authentication needed. This is already exploited in the wild. If you run on-prem SharePoint, this is a drop-everything fix.

Affected estate

Anyone running on-prem Microsoft SharePoint (all supported versions until confirmed otherwise)

How to check

Run 'Get-SPFarm | Select BuildVersion' in the SharePoint Management Shell to check your current patch level. Compare against the fixed build in Microsoft's advisory.

Included because

unauthenticated; network-exploitable; common enterprise product; exploit in the wild

Action

Install the security update from Microsoft's advisory via Windows Update or manual download from the Microsoft Update Catalog.

Why it matters

Unauthenticated remote code execution on SharePoint means an attacker can own your file stores, internal wikis, and potentially pivot deeper into your domain.

Source

Microsoft Security Update Guide, CISA KEV

A nasty chain: a route confusion bug in WordPress's REST API batch endpoint can be combined with a SQL injection flaw (CVE-2026-60137) to achieve full remote code execution. CVSS 9.8, no auth required, and attackers are already using it. WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are vulnerable.

Affected estate

Anyone running self-hosted WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1

How to check

Log into wp-admin and check the version in the bottom-right corner, or run 'wp core version' via WP-CLI. Check all sites if you manage a fleet.

Included because

unauthenticated; internet-facing; extremely common product; CVSS 9.8; exploit in the wild

Action

Update to WordPress 6.9.5 or 7.0.2. Review access logs for unusual POST requests to /wp-json/batch/v1 as a sign of exploitation attempts.

Why it matters

Unauthenticated RCE on a public-facing CMS means full server compromise, defacement, data theft, or use as a launchpad for further attacks.

Source

WordPress.org security release, CISA KEV

Langflow, the open-source LLM workflow builder, lets remote attackers run arbitrary code by loading functionality from an untrusted source. No special conditions mentioned. This is exploited in the wild, and the EPSS score (0.10, 95th percentile) shows strong attacker interest.

Affected estate

Anyone running Langflow instances, especially those exposed to the internet or shared networks

How to check

Run 'pip show langflow' or check the version in the Langflow UI. Compare against the vendor's security advisory for the fixed version.

Included because

remote code execution; exploit in the wild; commonly internet-exposed; high EPSS

Action

Upgrade Langflow via 'pip install --upgrade langflow' or pull the latest Docker image. Restrict network access to the Langflow interface.

Why it matters

Langflow instances often have access to API keys, LLM credentials, and internal data sources. Remote code execution here can expose your entire AI/ML pipeline and connected systems.

Source

CISA KEV, vendor advisory