The Exploit Bulletin — Saturday, September 19, 2026: 3 issues require action
Saturday, September 19, 2026 — 3 issues require action. If you run none of the software below, you are done.
Affects: Linux · Gravity Forms · conductor-oss / Orkes Conductor
1. Zero-length TLS record mishandling in the Linux kernel TLS receive path corrupts record processing (CVE-2025-39682)
CISA KEV (due 2026-09-21) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
CISA added this kernel flaw to KEV on 2026-09-18 with a 2026-09-21 remediation deadline and a public exploit is catalogued in VulnCheck XDB, so kTLS-enabled hosts left on unpatched kernels are exposed to an attacker who can simply connect to them.
The kernel TLS (kTLS) receive path fails to check for a zero-length record pulled from rx_list, letting a remote peer bypass recvmsg() record-type handling so that subsequent records are processed under wrong zero-copy and queuing assumptions. The flaw is reachable over the network without authentication and is rated as fully compromising confidentiality, integrity and availability of the host.
Affected: Linux kernel from commit 84c61fe1a75b (kTLS zero-copy receive, 6.0) up to the stable fix commits 2902c3eb, c09dd377, 3439c15a, 29c0ce3c, 62708b94; Linux 6.0
How to Test: Confirm the running kernel version and verify it contains one of the stable fix commits listed in the advisory (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or the Debian LTS update from the October 2025 debian-lts-announce; identify hosts where kernel TLS offload (the kernel tls socket option) is enabled in the TLS-terminating service, since only those expose the vulnerable receive path. On such hosts review kernel logs for TLS-related oopses or warnings and unexpected TLS sessions from unknown peers around the time of exposure.
How to Patch: Upgrade to a kernel containing the stable fix commits (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or your distribution's equivalent (Debian LTS: see the October 2025 debian-lts-announce update; Siemens customers: SSA-032379) and reboot. If an upgrade must wait, disable kernel TLS offload in the TLS-terminating application so the vulnerable receive path is not used.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA alert: added to KEV based on evidence of active exploitation · The Hacker News: CISA flags Linux kernel flaws exploited in the wild · VulnCheck XDB public exploit
2. Unauthenticated arbitrary file upload via hidden file field in Gravity Forms leads to RCE (CVE-2026-84434)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
VulnCheck added this flaw to its known-exploited catalog on 2026-09-18, the day the fix shipped, and any WordPress site with a Gravity Forms form containing a file upload field remains open to unauthenticated webshell upload until it is updated.
Gravity Forms up to 3.1.0.4 validates file extensions in one pipeline but persists uploads in another, so a hidden file upload field's rejected file is still passed to upload_file() without re-validation. An unauthenticated visitor can upload an executable file to the site and run code on the web server.
Affected: Gravity Forms (WordPress plugin) <= 3.1.0.4
How to Test: In WordPress admin, check Plugins for the Gravity Forms version; anything at or below 3.1.0.4 is vulnerable. Identify forms that contain a file upload field (the exploit requires one). Review the Gravity Forms upload directory and the web server's writable directories for recently added files with executable extensions (e.g. .php) and check access logs for unauthenticated POST submissions to those forms followed by direct requests to uploaded file paths.
How to Patch: Update Gravity Forms to 3.1.1 (the patched version per Patchstack). If the update must wait, remove or disable file upload fields on publicly reachable forms.
Evidence: VulnCheck KEV · patchstack.com: exploitation reported (cited by VulnCheck)
3. Unauthenticated OS command execution via unsandboxed GraalVM script evaluators in Orkes/Netflix Conductor workflow API (CVE-2026-58138)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.3
Fortinet, reported by The Hacker News and SecurityWeek on 2026-09-18/19, confirms this pre-auth RCE is being exploited against exposed Conductor servers, and five public exploits exist, so any unpatched instance reachable by attackers should be treated as a compromise target now.
Conductor 3.21.21 through 3.30.1 evaluates JavaScript and Python expressions in INLINE, LAMBDA, DO_WHILE and SWITCH tasks with GraalVM host access set to ALL, and the workflow API accepts inline workflow definitions before authentication. A remote attacker can submit a workflow whose expression reaches Java reflection or ProcessBuilder and runs arbitrary OS commands on the Conductor server.
Affected: conductor-oss / Orkes Conductor >= 3.21.21 and < 3.30.2
How to Test: Check the deployed Conductor server version; anything from 3.21.21 up to but not including 3.30.2 is vulnerable. Review workflow API access logs and stored workflow definitions for unexpected inline workflow submissions containing INLINE, LAMBDA, DO_WHILE or SWITCH tasks whose JavaScript or Python expressions reference Java classes, reflection, Runtime, ProcessBuilder or subprocess calls, and check the Conductor host for unexpected child processes spawned by the server JVM.
How to Patch: Upgrade to Conductor 3.30.2 (release of 03 Jun containing PR #1123 'Restrict graaljs further' / commits 87a7d96a and c691e35e, which deny script access to Class, ClassLoader, reflection, Runtime, ProcessBuilder, Process, System and Thread). If the upgrade must wait, remove direct network exposure of the workflow API and place it behind authentication so untrusted clients cannot submit workflow definitions.
Evidence: VulnCheck KEV · The Hacker News: Fortinet reports in-the-wild exploitation of CVE-2026-58138 · SecurityWeek: Critical Orkes Conductor vulnerability exploited in attacks · VulnCheck XDB public exploit · VulnCheck XDB public exploit
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
