Daily Threat Briefing
← All briefings

Hummingbird WordPress Plugin · MikroTik RouterOS · AutoAgent

Date: 2026-09-06 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

A Magento/Adobe Commerce zero-day is reportedly being exploited in the wild to backdoor online stores without authentication; organizations operating affected e-commerce platforms should treat this as an emergency investigation and containment priority. New high-severity exposure also affects Hummingbird WordPress, MikroTik RouterOS and several internet-facing self-hosted applications. A recent TeamCity compromise at JetBrains’ Cadence environment further reinforces the need to rotate credentials associated with CI/CD execution systems.

Critical Vulnerabilities

CVE-2026-83627 — Hummingbird WordPress Plugin

  • Severity: CVSS 9.8
  • EPSS: 0.82 — high exploitation probability
  • Technical detail: Hummingbird versions up to and including 3.21.0 contain a remote-code-execution vulnerability in the log_msg() function. Exploitation could allow attackers to execute code through a vulnerable WordPress installation, potentially leading to site takeover, credential theft or server compromise. The supplied intelligence does not confirm exploitation.
  • Exploitation status: No exploitation reported; high predicted exploitation probability.
  • Remediation: Upgrade Hummingbird to a vendor-fixed release when available. If patching is not immediately possible, restrict administrative access, disable the plugin where operationally feasible and review web-server logs, WordPress administrator activity and recently modified PHP files.

CVE-2026-86060 — MikroTik RouterOS

  • Severity: CVSS 9.2
  • EPSS: Not available
  • Technical detail: An SSH argument-handling flaw allows manipulation of the RouterOS trusted-policy mask through specially crafted usernames beginning with a prohibited character. Affected versions include RouterOS 6.0.0 before 6.49.21, 7.0.0 before 7.23.4 and 7.24 before 7.24.2. Internet-reachable management services increase exposure.
  • Exploitation status: No exploitation reported in the supplied intelligence.
  • Remediation: Upgrade RouterOS to a fixed release. Restrict SSH and WebFig access to dedicated management networks, review administrator and SSH logs, and validate policy-mask, user-account and configuration changes.

CVE-2026-86124 — AutoAgent

  • Severity: CVSS 9.3
  • EPSS: Not available
  • Technical detail: AutoAgent contains an unauthenticated remote-code-execution vulnerability in its TCP server. The service binds to all interfaces by default and executes attacker-supplied commands as root, making exposed development or AI infrastructure particularly high risk.
  • Exploitation status: No exploitation reported in the supplied intelligence.
  • Remediation: Upgrade to a fixed release when available or remove the service from untrusted networks. Bind it to localhost or a restricted interface, enforce authentication and monitor for unexpected root processes, command execution and outbound connections.

CVE-2026-86207 — N-able N-central

  • Severity: CVSS 7.7
  • EPSS: Not available
  • Technical detail: N-central versions before 2026.3 HF 3 contain an authentication bypass affecting internal-only APIs. Although the affected interfaces are described as internal, compromise of an adjacent management system or insufficient network segmentation could permit unauthorized administrative actions.
  • Exploitation status: No exploitation reported in the supplied intelligence.
  • Remediation: Upgrade to N-central 2026.3 HF 3 or version 2026.3.1.13 as applicable. Confirm that management interfaces are not internet-accessible, review authentication and API activity, and investigate unexpected changes to managed endpoints.

CVE-2026-86152 — Tenda CP3

  • Severity: CVSS 10.0
  • EPSS: 0 — no exploitation probability currently reported
  • Technical detail: Tenda CP3 firmware 27.5.57.101 contains a critical flaw in the Kylin component’s CAutoAddWifi::ThreadProc function. The supplied record provides insufficient detail to establish the precise attack vector or impact beyond the critical severity rating; related high-severity CP3 issues were also published in the same period.
  • Exploitation status: No exploitation reported in the supplied intelligence.
  • Remediation: Check vendor support for a fixed firmware version and remove affected devices from enterprise networks where they are not business-essential. Restrict administration, segment wireless infrastructure and monitor for unexpected configuration changes. Assess related CVEs CVE-2026-86148, CVE-2026-86149 and CVE-2026-86153.

ONGOING

  • CVE-2026-85046 (Chromium V8): Actively exploited and KEV-listed; complete browser patch deployment and endpoint hunting.
  • CVE-2026-63520 (Microsoft SharePoint): Active exploitation and public PoC remain reported; patch and inspect for web shells.
  • CVE-2026-19490 (Citrix NetScaler): Attacks remain reported; verify patching and management-interface restrictions.
  • CVE-2026-81578 / CVE-2026-82078 (PaperCut): Exploitation remains reported; patch before the 2026-09-14 KEV deadline.
  • CVE-2026-83548 / CVE-2026-83549 (SonicWall SMA1000): Active exploitation remains reported; patch and assess for compromise.
  • CVE-2026-0768 (Langflow): Active exploitation remains reported; upgrade and rotate exposed credentials.
  • CVE-2026-60004, CVE-2026-49869, CVE-2026-82329 and CVE-2026-9586: KEV remediation remains required.

European Advisories

CERT-PL reporting, reflected in the EUVD data, identifies multiple high-severity MikroTik RouterOS vulnerabilities. In addition to CVE-2026-86060, the set includes SSH key-validation weaknesses (CVE-2026-67276), an unauthenticated btest abuse condition (CVE-2026-67277) and unauthenticated WebFig file read (CVE-2026-67281). Upgrade affected RouterOS branches and restrict management services; the primary critical item is covered above.

No new BSI or CERT-EU advisories were supplied for the reporting period. The remaining EUVD entries predominantly affect WordPress plugins and smaller self-hosted applications; prioritize those with internet exposure, privileged functions or access to credentials and customer data.

Active Threats and Campaigns

  • Magento/Adobe Commerce “StyleSmuggler” exploitation — NEW: Sansec reportedly observed exploitation beginning 2026-09-04, allowing unauthenticated attackers to execute malicious code and backdoor online stores. The Hacker News report does not provide a CVE or confirmed vendor fix. Isolate affected storefronts where necessary, preserve web and application logs, search for unauthorized PHP files, admin accounts, payment-page modifications and suspicious outbound connections, and follow vendor/Sansec mitigation guidance.
  • TeamCity compromise at JetBrains Cadence — NEW: Attackers reportedly exploited an unpatched TeamCity vulnerability to access the Cadence environment and extract AWS credentials. Rotate all credentials and secrets used by Cadence executions, CI/CD runners and associated cloud roles. The Hacker News
  • ClickFix delivery infrastructure — STATUS CHANGE: More than 5,400 compromised websites reportedly serve payloads whose instructions are stored in blockchain smart contracts. Review web-proxy, DNS and endpoint telemetry for suspicious PowerShell, shell or “paste into Run” activity. BleepingComputer
  • TerminalFix, Ted/curlRAT, RMM phishing, developer supply-chain compromise and Virtualizor malicious updates remain ongoing without material new developments.

Security News and Context

  • Broadcom released updates for VMware Workstation and Fusion, including critical CVE-2026-59346, reportedly enabling host-code execution under specific local elevated-privilege conditions. The Hacker News
  • PaperCut exploitation targeting schools and universities in the US and Europe remains active, with credential theft and reconnaissance reported. The Hacker News
  1. Investigate Magento/Adobe Commerce storefronts immediately for web shells, altered payment pages and unauthorized accounts.
  2. Patch or isolate Hummingbird WordPress deployments, prioritizing internet-facing sites.
  3. Upgrade MikroTik RouterOS and restrict SSH, WebFig and testing services to management networks.
  4. Remove or isolate exposed AutoAgent services and hunt for root-level command execution.
  5. Patch N-central and review management API authentication logs.
  6. Rotate Cadence, TeamCity and associated AWS credentials; review CI/CD execution history.
  7. Continue Chrome/Chromium remediation for actively exploited CVE-2026-85046.
  8. Continue remediation of previously reported items: SharePoint, Citrix NetScaler, PaperCut, Langflow and SonicWall SMA1000.