The Exploit Bulletin — Saturday, September 19, 2026: 3 issues require action

Saturday, September 19, 2026 — 3 issues require action. If you run none of the software below, you are done.

Affects: Linux · Gravity Forms · conductor-oss / Orkes Conductor

1. Zero-length TLS record mishandling in the Linux kernel TLS receive path corrupts record processing (CVE-2025-39682)

CISA KEV (due 2026-09-21) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8

CISA added this kernel flaw to KEV on 2026-09-18 with a 2026-09-21 remediation deadline and a public exploit is catalogued in VulnCheck XDB, so kTLS-enabled hosts left on unpatched kernels are exposed to an attacker who can simply connect to them.

The kernel TLS (kTLS) receive path fails to check for a zero-length record pulled from rx_list, letting a remote peer bypass recvmsg() record-type handling so that subsequent records are processed under wrong zero-copy and queuing assumptions. The flaw is reachable over the network without authentication and is rated as fully compromising confidentiality, integrity and availability of the host.

Affected: Linux kernel from commit 84c61fe1a75b (kTLS zero-copy receive, 6.0) up to the stable fix commits 2902c3eb, c09dd377, 3439c15a, 29c0ce3c, 62708b94; Linux 6.0

How to Test: Confirm the running kernel version and verify it contains one of the stable fix commits listed in the advisory (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or the Debian LTS update from the October 2025 debian-lts-announce; identify hosts where kernel TLS offload (the kernel tls socket option) is enabled in the TLS-terminating service, since only those expose the vulnerable receive path. On such hosts review kernel logs for TLS-related oopses or warnings and unexpected TLS sessions from unknown peers around the time of exposure.

How to Patch: Upgrade to a kernel containing the stable fix commits (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or your distribution's equivalent (Debian LTS: see the October 2025 debian-lts-announce update; Siemens customers: SSA-032379) and reboot. If an upgrade must wait, disable kernel TLS offload in the TLS-terminating application so the vulnerable receive path is not used.

Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA alert: added to KEV based on evidence of active exploitation · The Hacker News: CISA flags Linux kernel flaws exploited in the wild · VulnCheck XDB public exploit

Full entry with sources →

2. Unauthenticated arbitrary file upload via hidden file field in Gravity Forms leads to RCE (CVE-2026-84434)

REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8

VulnCheck added this flaw to its known-exploited catalog on 2026-09-18, the day the fix shipped, and any WordPress site with a Gravity Forms form containing a file upload field remains open to unauthenticated webshell upload until it is updated.

Gravity Forms up to 3.1.0.4 validates file extensions in one pipeline but persists uploads in another, so a hidden file upload field's rejected file is still passed to upload_file() without re-validation. An unauthenticated visitor can upload an executable file to the site and run code on the web server.

Affected: Gravity Forms (WordPress plugin) = 3.21.21 and < 3.30.2

How to Test: Check the deployed Conductor server version; anything from 3.21.21 up to but not including 3.30.2 is vulnerable. Review workflow API access logs and stored workflow definitions for unexpected inline workflow submissions containing INLINE, LAMBDA, DO_WHILE or SWITCH tasks whose JavaScript or Python expressions reference Java classes, reflection, Runtime, ProcessBuilder or subprocess calls, and check the Conductor host for unexpected child processes spawned by the server JVM.

How to Patch: Upgrade to Conductor 3.30.2 (release of 03 Jun containing PR #1123 'Restrict graaljs further' / commits 87a7d96a and c691e35e, which deny script access to Class, ClassLoader, reflection, Runtime, ProcessBuilder, Process, System and Thread). If the upgrade must wait, remove direct network exposure of the workflow API and place it behind authentication so untrusted clients cannot submit workflow definitions.

Evidence: VulnCheck KEV · The Hacker News: Fortinet reports in-the-wild exploitation of CVE-2026-58138 · SecurityWeek: Critical Orkes Conductor vulnerability exploited in attacks · VulnCheck XDB public exploit · VulnCheck XDB public exploit

Full entry with sources →

Read on the web · Every past edition

The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.

Spot an error, or an exploit we missed? here or email [email protected] .