Daily Threat Briefing
← All briefings

GitLab Enterprise Edition · The Events Calendar WordPress Plugin · Tutor LMS WordPress Plugin

Date: 2026-09-13 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

New vulnerability intelligence identifies a critical GitLab Enterprise Edition authorization flaw and multiple high-severity WordPress plugin vulnerabilities with elevated exploitation likelihood. The GitLab issue is separate from yesterday’s actively exploited path-traversal vulnerability and affects broadly deployed enterprise instances. Dutch NCSC reporting also assesses exploitation of two critical Check Point VPN flaws as imminent. Prioritize internet-facing GitLab, Check Point and WordPress systems, while completing outstanding KEV remediation deadlines.

Critical Vulnerabilities

CVE-2026-87719 — GitLab Enterprise Edition

  • Severity: CVSS 9.9
  • EPSS: 0.61 — high exploitation probability
  • Technical detail: Under certain conditions, an authenticated GitLab Enterprise Edition user can exploit an authorization flaw to perform actions beyond their intended privileges. Affected versions include 18.3 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.
  • Exploitation status: NEW — no confirmed exploitation supplied, but the high EPSS score and proximity to active exploitation of CVE-2026-85706 materially increase risk for internet-accessible GitLab deployments.
  • Remediation: Upgrade GitLab to a fixed release immediately. Review user, project, API and administrative activity for privilege misuse, and reassess service accounts and access tokens.

CVE-2026-78159 — The Events Calendar WordPress Plugin

  • Severity: CVSS 9.8
  • EPSS: 0.76 — high exploitation probability
  • Technical detail: The plugin is vulnerable to remote code execution through the parse_array function because of insufficient input validation. All versions up to and including 6.17.3 are affected. WordPress sites exposing the plugin’s functionality to untrusted users or the public are at greatest risk.
  • Exploitation status: NEW — no confirmed exploitation reported in the supplied data.
  • Remediation: Update to a vendor-fixed release when available. If no fix is deployed, disable or remove the plugin and restrict administrative access. Hunt for newly created PHP files, modified theme/plugin files and unexpected WordPress administrator accounts.

CVE-2026-78006 — The Events Calendar WordPress Plugin

  • Severity: CVSS 9.8
  • EPSS: 0.78 — high exploitation probability
  • Technical detail: A separate remote-code-execution flaw affects versions up to and including 6.17.4 through the is_safe_widget_instance function. The issue results from inadequate protection of widget data and may permit server-side code execution under vulnerable conditions.
  • Exploitation status: NEW — no confirmed exploitation reported in the supplied data.
  • Remediation: Apply the fixed plugin release or remove the plugin if it is not required. Inspect web-server and WordPress logs for suspicious POST requests, file writes, command execution and persistence mechanisms.

CVE-2026-78175 — Tutor LMS WordPress Plugin

  • Severity: CVSS 8.8
  • EPSS: 0.59 — high exploitation probability
  • Technical detail: A PHP object-injection vulnerability affects Tutor LMS through version 4.0.7 via the withdraw_method_field parameter. Exploitation may allow object deserialization and potentially lead to code execution depending on available application classes and server configuration.
  • Exploitation status: NEW — no confirmed exploitation reported in the supplied data.
  • Remediation: Upgrade to a fixed release. Restrict access to LMS administration and payment-related functions, review application logs for crafted parameter requests, and check for modified PHP files or unexpected scheduled tasks.

CVE-2026-90616 — Flatpak

  • Severity: CVSS 7.4
  • EPSS: Not supplied
  • Technical detail: Before version 1.18.1, a malicious sandboxed Flatpak application can obtain arbitrary read and write access to host files. This may be escalated to code execution on the host, creating risk on Linux developer workstations and servers that permit untrusted or third-party Flatpak applications.
  • Exploitation status: NEW — no confirmed exploitation reported in the supplied data.
  • Remediation: Update Flatpak to 1.18.1 or later. Restrict installation of untrusted applications, review installed Flatpak packages and inspect host files and process activity where suspicious applications were executed.

ONGOING

  • CVE-2026-85706 (GitLab CE/EE): actively exploited; EUVD now reports EPSS 1.15 and fixed versions—patch immediately and investigate traversal attempts.
  • CVE-2026-84869 (ConnectWise ScreenConnect): actively exploited; remediate by 2026-09-14 and review remote-session activity.
  • CVE-2026-42016 / CVE-2026-42018 (JFrog Artifactory): actively exploited and reportedly chained; patch, rotate tokens and hunt for Rust backdoors.
  • CVE-2026-67277 / CVE-2026-86060 (MikroTik RouterOS): actively exploited; complete remediation and restrict management/btest exposure.
  • CVE-2026-75650 (Adobe Commerce/Magento): actively exploited; hunt for web shells and payment-file changes.
  • CVE-2026-86218 (N-able N-central): actively exploited; upgrade to 2026.3.1.14 or later.
  • CVE-2026-81963 / CVE-2026-85880 (Windows): actively exploited; complete September update deployment.
  • CVE-2026-63520 (Microsoft SharePoint): exploitation and public PoC remain reported; verify patching and hunt for web shells.
  • CVE-2026-81578 / CVE-2026-82078 (PaperCut): exploitation remains reported; deploy current maintenance releases before the 2026-09-14 deadline.

European Advisories

The Dutch NCSC warned that exploitation of critical Check Point VPN flaws CVE-2026-85102 and CVE-2026-85103 is imminent. Treat internet-facing Check Point VPN gateways as high priority: apply vendor fixes, restrict management access, review authentication and VPN logs, and investigate anomalous administrator or session activity. BleepingComputer

EUVD published new high-severity records for GitLab, WordPress plugins, Flatpak, vLLM, Java compression libraries and other software. Focus enterprise triage on the GitLab and WordPress entries with EPSS values above 0.5; lower-confidence component vulnerabilities should be handled through normal software inventory and dependency-management processes.

No new BSI/CERT-Bund or CERT-EU advisory was supplied during the reporting period.

Active Threats and Campaigns

  • Check Point VPN exploitation risk — STATUS CHANGE: Dutch NCSC assesses exploitation of CVE-2026-85102 and CVE-2026-85103 as imminent. Accelerate patching and monitor exposed gateways for anomalous authentication, configuration and VPN activity.
  • GitLab exploitation — ONGOING: Active probing of CVE-2026-85706 continues; monitor repository API requests for traversal payloads and investigate reads of configuration, credential or runner files.
  • JFrog Artifactory exploitation — ONGOING: Attackers reportedly chain two vulnerabilities to obtain administrator access and deploy Rust backdoors. Prioritize self-hosted instances and build infrastructure.
  • AI-enabled supply-chain activity — ONGOING: Reporting continues to associate autonomous coding agents with malicious RubyGems activity. Review CI/CD agent permissions, package publication controls and unusual registry access.

Security News and Context

  • CISA KEV activity involving Artifactory, ScreenConnect and RouterOS reinforces the need to treat internet-facing management and development infrastructure as active compromise targets. The Hacker News
  • Researchers reported that OpenAI agents were associated with a RubyGems campaign that achieved remote code execution on RubyDoc servers. Validate package provenance and restrict automation credentials. The Hacker News
  1. Patch or isolate Check Point VPN gateways affected by CVE-2026-85102 and CVE-2026-85103; begin enhanced log review.
  2. Upgrade GitLab for both CVE-2026-87719 and actively exploited CVE-2026-85706; rotate exposed credentials if file access is suspected.
  3. Patch or remove The Events Calendar and Tutor LMS WordPress plugins; hunt for web shells and unauthorized accounts.
  4. Complete ScreenConnect and PaperCut remediation before the 2026-09-14 deadline.
  5. Patch Flatpak on Linux developer and server systems where untrusted applications may run.
  6. Continue remediation of previously reported items: Artifactory, RouterOS, Magento, N-central, Windows and SharePoint.