Bastion Codex – Weekly Defender Brief (2026-09-07)

This weekly defender brief summarizes vulnerability movement observed over the past 7 and 30 days.

The goal is simple: highlight signal that matters to frontline defenders — patch workload pressure, severity shifts, and KEV movement.

Bastion Codex – Weekly Defender Brief

Week of 2026-09-07

Executive Snapshot

  • 2187 CVEs observed in the last 7 days
  • 185 Critical
  • 645 High
  • 6 KEV-listed vulnerabilities in last 30 days

Week-over-Week Movement

  • Total CVEs: -346 (from 2533 to 2187, -13.7%)
  • Critical: -88 (from 273 to 185, -32.2%)
  • High: -130 (from 775 to 645, -16.8%)
  • Medium: 69 (from 695 to 764, 9.9%)
  • Low: -18 (from 102 to 84, -17.6%)
  • Unknown: -179 (from 688 to 509, -26.0%)

Defender Takeaways

  • Elevated volume of Critical vulnerabilities this week. Prioritize external-facing asset review.
  • Recently added KEV vulnerabilities detected. Review CISA remediation timelines.
  • High severity volume suggests increased patch workload. Focus on internet-exposed services first.

Severity Breakdown (7 Days)

  • Critical: 185
  • High: 645
  • Medium: 764
  • Low: 84
  • Unknown: 509

Top Vendors (30 Days)

  • PaperCut: 2
  • SonicWall: 2
  • Google: 1
  • JFrog: 1

Top Products (30 Days)

  • NG/MF: 2
  • SMA1000 Appliances: 2
  • Artifactory: 1
  • Chromium V8: 1

Priority Watchlist (Top 10)

  • CVE-2026-49869 | CVSS: 10.0 | KEV: True | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.g
  • CVE-2026-83548 | CVSS: 10.0 | KEV: True | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A r
  • CVE-2025-67038 | CVSS: 9.8 | KEV: True | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user’s authenticatio
  • CVE-2026-9586 | CVSS: 9.8 | KEV: True | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content
  • CVE-2026-81578 | CVSS: 9.8 | KEV: True | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, u
  • CVE-2026-82329 | CVSS: 9.8 | KEV: True | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network
  • CVE-2026-82078 | CVSS: 9.1 | KEV: True | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application in
  • CVE-2026-85046 | CVSS: 8.8 | KEV: True | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
  • CVE-2026-59822 | CVSS: 8.2 | KEV: True | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM’s MCP Streamable HTTP endpoin
  • CVE-2026-83549 | CVSS: 7.8 | KEV: True | Post-authentication Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability has been identi

Generated via Bastion Codex pipeline at 2026-09-07T23:09:54.064291+00:00