Weekly security intelligence digest covering the most critical vulnerabilities, threats, and breach news from the past week.

🚨 Critical: CISA Known Exploited Vulnerabilities

These vulnerabilities are being actively exploited in the wild. Immediate action required.

CVE-2026-9082: Drupal Core SQL Injection Vulnerability

Vendor/Product: Drupal Core

Description: Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.

Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA Due Date: 2026-05-27

Reference: CVE-2026-9082 - NVD

Expert take: If this sounds familiar, it should — SQL injection in Drupal’s database abstraction layer is basically Drupalgeddon all over again. The original one back in 2014 was getting mass-exploited within hours of disclosure, before most teams had even read the advisory. Same pattern here: it’s in core, it chains from SQL injection straight to privilege escalation and remote code execution, and Drupal runs a lot of public-facing sites, including plenty of government and enterprise ones. So an attacker doesn’t need a login — they hit the site directly and walk away with full control. If you run Drupal and it’s reachable from the internet, patching isn’t a “this week” task, it’s a “right now” task. And if you were even a few hours late, don’t just patch and move on — check for new admin users, unexpected modules, and modified files, because the gap between disclosure and exploitation on Drupal core bugs is tiny.

CVE-2025-34291: Langflow Origin Validation Error Vulnerability

Vendor/Product: Langflow Langflow

Description: Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA Due Date: 2026-06-04

Reference: CVE-2025-34291 - NVD

Expert take: Langflow is a visual builder for AI workflows — drag-and-drop pipelines wiring up LLMs, tools, and data — so it’s another reminder that AI dev tooling is now squarely in attackers’ sights. The mechanics here are a browser problem, not a server one: a too-loose CORS policy plus a refresh-token cookie set to SameSite=None means any random webpage your logged-in user visits can quietly make credentialed requests to your Langflow instance, grab a fresh token, and from there reach authenticated endpoints and run code. The user doesn’t click anything obvious — they just have a Langflow tab open and browse somewhere malicious. This is on CISA’s actively-exploited list, so don’t sit on it. Patch, lock the CORS config down to known origins, and don’t leave Langflow exposed to the open internet — it’s a dev tool, treat it like one.

CVE-2026-34926: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Vendor/Product: Trend Micro Apex One

Description: Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA Due Date: 2026-06-04

Reference: CVE-2026-34926 - NVD

Expert take: This is the kind of bug that makes security people wince, because Apex One is the thing that’s supposed to be protecting your endpoints. It needs some access to the box first, but once an attacker has that, they can tamper with a key table on the server and inject code that gets pushed out to every agent on the fleet. Read that again — your endpoint protection becomes the delivery truck for the malware. That’s maximum blast radius, and it abuses the trust agents are built on, since they’re designed to accept whatever the management server tells them. It’s already being exploited in the wild as a zero-day. If you run on-prem Apex One, patch ahead of everything else, and don’t assume you’re clean just because the console looks normal — check what got deployed to your agents recently.

CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability

Vendor/Product: Microsoft Windows

Description: Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.

Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA Due Date: 2026-06-03

Reference: CVE-2008-4250 - NVD

Expert take: Yeah, that date is right — 2008. This is MS08-067, the Server Service RPC bug that Conficker rode to infect millions of machines and that’s been the opening exploit in every pentest course for fifteen years. So why is it in a 2026 digest? Because CISA keeps it on the list, and the uncomfortable truth is some networks still have something vulnerable to it. If you do, the CVE isn’t really your problem — the problem is you’re running Windows old enough to be exposed to a wormable, no-auth, remote code execution bug from 2008. That means unsupported Server 2003/2008 or XP-era boxes sitting somewhere on the network. The fix isn’t a patch, it’s a decision: isolate those machines now and plan to retire them, because anything that old is a liability well beyond this one CVE.

CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability

Vendor/Product: Microsoft DirectX

Description: Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA Due Date: 2026-06-03

Reference: CVE-2009-1537 - NVD

Expert take: Another one from the archives — 2009, a flaw in how DirectShow’s QuickTime parser handles media files. The attack is client-side: someone opens a booby-trapped video and it runs code on their machine. Same story as the MS08-067 entry above — if this can still hit you in 2026, the real issue is that you’re running Windows old enough to be unpatched against a sixteen-year-old bug. Updated systems closed this long ago. So treat both legacy entries as one signal: scan for end-of-life Windows on your network, because if these CVEs apply to you, they’re the symptom, not the disease.

đź“° This Week’s Security News

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. […]…

Read more: Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

Netherlands seizes 800 servers of hosting firm enabling cyberattacks

Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation c…

Read more: Netherlands seizes 800 servers of hosting firm enabling cyberattacks

Trend Micro warns of Apex One zero-day exploited in the wild

Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems. […]…

Read more: Trend Micro warns of Apex One zero-day exploited in the wild

âś… What You Should Do This Week

  • Immediate: Patch CVE-2026-9082, CVE-2025-34291 (actively exploited)
  • Verify: Check your systems against CISA KEV catalog
  • Monitor: Review Azure AD sign-in logs for suspicious activity
  • Audit: Verify MFA is enforced for all privileged accounts
  • Backup: Test your disaster recovery procedures

📬 Stay Updated

Subscribe to receive weekly security digests directly in your inbox.

Questions or feedback? Contact us

GRC Vitrix provides cloud security and compliance intelligence for financial services professionals. This digest is curated from publicly available sources including CISA, Microsoft MSRC, and industry news.