Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices

Summary: SAP released security updates for two critical flaws, one involving an outdated Apache Log4j 1.2.17 artifact vulnerable to CVE-2019-17571 that allows an unprivileged attacker to execute arbitrary code remotely, and CVE-2026-27685, a deserialization validation issue that requires high privileges to exploit. The same patch cycle included Microsoft fixing 84 vulnerabilities, Adobe fixing 80 (four critical in Commerce and Magento Open Source, five critical in Illustrator), and HPE fixing five in Aruba Networking AOS-CX, including CVE-2026-23813, an authentication bypass rated 9.8 that could let an unauthenticated remote actor reset the admin password.
Key Takeaway: An unauthenticated attacker who resets the admin password on an AOS-CX switch can take full control of the network device and, as Corsica Technologies CISO Ross Filipek put it, compromise an entire system undetected - disruption of network communications or erosion of key business service integrity follows.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-17571 CVE-2026-23813 CVE-2026-27685
Related: ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More Cyber Risks ·
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026