The vulnerability landscape just jumped into overdrive: 2025 closed with more than 48,000 CVEs, attackers weaponized a growing share of those flaws within hours, and this week’s must‑patch list includes critical, actively exploited defects in n8n, Fortinet FortiCloud SSO, WinRAR and GNU InetUtils telnetd that demand immediate action from IT and security teams.
The scale and velocity of disclosed vulnerabilities increased markedly through 2025, with industry trackers and news briefs pointing to both sheer volume and sharply shorter time‑to‑exploit windows. TechTarget’s roundup notes the CVE database recorded over 48,000 entries for 2025, an increase of roughly 20% over 2024 and 66% over 2023, and projects 2026 totals could approach between 57,600 and 79,680 CVEs if current trends persist. That same briefing cites a DeepStrike finding that 28% of vulnerabilities were exploited within one day of disclosure in 2025, an operational acceleration from an average of 30 days in 2020.
Those headline numbers aren’t just academic: intelligence vendors and incident multiple “n‑day” and zero‑day campaigns in 2025 where proof‑of‑concepts and weaponized toolchains translated disclosed weaknesses into intrusions in hours or days. Recorded Future and other analysts reported similar acceleration in exploitation velocity and PoC publication throughout 2025, underscoring the operational risk of delayed remediation.
Why that matters: the combination of more vulnerabilities, more published exploit code, and faster attacker automation forces a change in how organizations triage and patch — prioritize exploitability and business impact, not simply CVE count.
Act now: patch the critical and high‑severity items, harden management planes, rotate secrets used by automation, and treat this acceleration in attacker behavior as the new baseline for vulnerability management. Failure to adapt processes to this pace will make “patch available” functionally meaningless — and leave your environment exposed to the next automated campaign.
Source: TechTarget News brief: Patch critical and high-severity vulnerabilities now | TechTarget
Background / Overview
The scale and velocity of disclosed vulnerabilities increased markedly through 2025, with industry trackers and news briefs pointing to both sheer volume and sharply shorter time‑to‑exploit windows. TechTarget’s roundup notes the CVE database recorded over 48,000 entries for 2025, an increase of roughly 20% over 2024 and 66% over 2023, and projects 2026 totals could approach between 57,600 and 79,680 CVEs if current trends persist. That same briefing cites a DeepStrike finding that 28% of vulnerabilities were exploited within one day of disclosure in 2025, an operational acceleration from an average of 30 days in 2020. Those headline numbers aren’t just academic: intelligence vendors and incident multiple “n‑day” and zero‑day campaigns in 2025 where proof‑of‑concepts and weaponized toolchains translated disclosed weaknesses into intrusions in hours or days. Recorded Future and other analysts reported similar acceleration in exploitation velocity and PoC publication throughout 2025, underscoring the operational risk of delayed remediation.
Why that matters: the combination of more vulnerabilities, more published exploit code, and faster attacker automation forces a change in how organizations triage and patch — prioritize exploitability and business impact, not simply CVE count.
What changed this week: the four high‑priority incidents
1) n8n — sandbox bypasses give attackers full remote control
- What happened: JFrog Security Research disclosed two critical vulnerabilities in the n8n workflow platform: CVE‑2026‑1470 (CVSS 9.9) and CVE‑2026‑0863 (CVSS 8.5). The flaws bypass n8n’s expression and Code‑node sandboxing, enabling remote code execution (RCE) when an attacker can create or edit workflows. These issues affect both cloud and unpatched self‑hosted deployments.
- Technical summary: n8n executes user expressions through an evaluation engine and offered sandboxing via AST sanitization. JFrog’s research shows the AST checks were insufficient: crafted inputs escape the sanitizer and reach the underlying JavaScript/Python runtime, enabling arbitrary OS commands and process control. The Python Code node’s “internal” mode was explicitly bypassed in one of the findings.
- Impact: Successful exploit yields the privileges of the n8n process — typically high‑value because n8n automations often hold secrets (API keys, model tokens, database credentials) and orchestrate business logic. Compromise can lead to credential theft, supply‑chain abuse (manipulating workflows), and lateral movement into backend systems.
- Mitigation and remediation:
- Apply vendor patches immediately: JFrog and n8n published fixed versions; the advisory lists specific fixed builds for each branch — upgrade cloud/self‑hosted instances without delay.
- Short term: restrict who can create or modify workflows, rotate credentials used by n8n, enforce least privilege for n8n service accounts, and firewall/ACL access to n8n control planes.
- Critical analysis: The strengths of n8n (ease of integration, low‑code automation, built‑in credential stores) are also the attack surface. Sandbox escapes are difficult to fully mitigate because the execution model depends on interpreted languages; AST sanitizers are fragile when inputs are complex. The risk to organizations using n8n to integrate large language models and other sensitive services is especially acute — adversaries who gain execution there can abuse downstream credentials and API flows.
2) Fortinet FortiCloud SSO — authentication bypass at scale (CVE‑2026‑24858)
- What happened: Multiple researchers and IR firms observed automated campaigns exploiting a critical FortiCloud SSO authentication bypass, tracked as CVE‑2026‑24858. Attackers with a registered FortiCloud account and any registered device were able to authenticate against other customers’ devices when FortiCloud SSO was enabled, allowing mass‑scale compromise of firewall appliances and related products. Arctic Wolf documented the campaign activity and Fortinet temporarily disabled FortiCloud SSO while issuing updates and guidance. Shadowserver reported thousands of vulnerable instances.
- Technical summary: The vulnerability allows an alternate authentication path to succeed when FortiCloud SSO is active; exploit chains observed included automated login, configuration export, local admin account creation, and enabling of VPN persistence. Prior fixes for related CVEs (CVE‑2025‑59718/59719) did not fully prevent this new vector.
- Impact: Network security devices are high‑value targets. Attackers can alter firewall rules, exfiltrate configs (containing secrets and topology), implant backdoor accounts, and establish persistent VPN/remote access. Compromised appliances are also conduit points for lateral movement and supply‑chain style misconfiguration attacks.
- Mitigation and remediation:
- Upgrade to vendor‑released fixed firmware immediately where available and follow Fortinet hardening guidance.
- If patching will be delayed: disable FortiCloud SSO, restrict management plane access to trusted IPs, rotate administrative credentials, and restore verified configurations from known clean backups if compromise is suspected.
- Critical analysis: The attack model here exploits convenience features (cloud‑assisted SSO) that administrators may enable during device registration. The tradeoff between management convenience and risk has flipped: cloud SSO simplified operations but expanded attacker access if the cloud authentication channel is flawed. Vendor responses (temporary SSO disablement, hotfixes) were appropriate, but the incident underlines the need for defense‑in‑depth: device hardening, management plane segmentation and configuration integrity monitoring.
3) WinRAR CVE‑2025‑8088 — patched but widely exploited (n‑day)
- What happened: A high‑severity path traversal bug in WinRAR, CVE‑2025‑8088 (patched in July 2025), continues to be actively abused in targeted campaigns and by state‑linked groups. Attackers use Alternate Data Streams (ADS) and directory traversal in crafted RAR archives to write payloads into system startup folders and achieve persistence. Google’s Threat Intelligence Group and multiple security outlets warned of ongoing exploitation months after the patch because many systems remained unpatched.
- Technical summary: The flaw permits crafted archive entries (including ADS constructs like innocuous.pdf:malicious.lnk) combined with traversal sequences to extract hidden payloads outside the expected extraction directory. When the payload lands in startup/autorun locations, it executes at user login, creating a stealthy persistence mechanism.
- Impact: Because WinRAR is ubiquitous and often updated manually, attackers can reach a broad set of unpatched machines with relatively low operational cost. Campaigns have targeted military and government entities as well as commercial victims; espionage and compromise for persistent access are both documented outcomes.
- Mitigation and remediation:
- Update to WinRAR 7.13 or later immediately. Vendors do not always auto‑push updates; organizations must enforce application patching policies.
- As tactical mitigations: block or sandbox untrusted archive handling, enforce mail gateway filtering, and train users to treat unexpected archives with caution.
- Critical analysis: This incident is textbook “patch‑filed but not patched across the fleet.” The technical fix is straightforward; the failure is operational. It demonstrates that even well‑patched ecosystems can be hollow if endpoint hygiene, inventory and automated update controls are weak. The presence of ADS abuse also serves as a reminder to monitor for unusual LNK/DLL creations and suspicious extractions to startup paths.
4) GNU InetUtils telnetd — critical telnet authentication bypass (CVE‑2026‑24061)
- What happened: Researchers disclosed CVE‑2026‑24061, a critical authentication bypass in GNU InetUtils’ telnetd implementation that affects versions up to 2.7 and waspite the patch, scanning shows an estimated ~800,000 Telnet instances remain exposed — mostly legacy devices and IoT equipment — and rapid probing followed the disclosure. Security advisories strongly recommend disabling telnet or applying the update promptly.
- Technical summary: The bug allows unauthenticated access to telnet servers by bypassing expected authentication checks. Because telnet runs with little or no encryption and is commonly embedded in legacy firmware, exploitation can yield shell access and full device control.
- Impact: Telnet‑exposed IoT devices, routers and embedded controllers can be fully commandeered, providing attackers sensor data, pivoting capability and persistent footholds on poorly maintained infrastructure.
- Mitigation and remediation:
- Upgrade InetUtils to 2.8 where feasible. Where devices cannot be patched, disable telnetd, block TCP/23 at the perimeter, and segment management networks.
- Hunt for indicators: new SSH/telnet sessions, unexpected outbound connections, and sudden config changes on legacy devices.
- Critical analysis: Telnet’s survival in production gear is a long‑standing operational hazard. This CVE is a timely reminder that protocols deprecated for decades still expose large populations of devices — and once a simple authentication bypass appears, attackers treat them like low‑hanging fruit. The practical mitigation is decommissioning telnet where possible, but realistic remediation plans must account for legacy dependencies and upgrade windows.
Broader context: why these incidents matter and what they say about risk
- Faster exploitation demands faster triage. The industry trend toward shorter time‑to‑exploit — a rising percentage of flaws weaponized in hours or days — means traditional monthly patch cycles are insufficient for the most critical items. Prioritization must be threat‑informed (KEV/CISA lists, observed exploitation, PoC availability) and asset‑aware. TechTarget and incident reports highlight this temporal compression.
- Many attacks exploit convenience features or legacy behaviors: cloud SSO convenience (FortiCloud), low‑code automation (n8n), ubiquitous desktop utilities (WinRAR), and legacy protocols (telnet). Each convenience or compatibility feature can expand blast radius when its trust assumptions fail.
- Operational failures persist: unpatched WSUS, unpatched WinRAR installs, orphaned telnet services, and default‑enabled cloud toggles all point to gaps in asset inventory, change windows and automated patching. The WSUS RCE incident from 2025 — which forced emergency out‑of‑band patches — is a cautionary example of a single privileged service amplifying ecosystem risk.
Practical playbook: how Windows and mixed environments should respond now
The following checklist is tactical and prioritized for immediate operational use.- Emergency triage (first 24–72 hours)
- Identify exposed assets: list internet‑facing appliances and management interfaces (firewalls, FortiGates, FortiManager/Analyzer, n8n endpoints, file‑server clients with WinRAR installed, IoT devices running telnetd).
- Apply patches or vendor fixes for the following high‑priority CVEs: n8n CVE‑2026‑1470/CVE‑2026‑0863, Fortinet CVE‑2026‑24858, WinRAR CVE‑2025‑8088 (if present), GNU InetUtils CVE‑2026‑24061. If immediate patching is impossible, apply compensating controls (disable services, block ports, disable FortiCloud SSO).
- Hardening & containment
- Disable or restrict management plane access to trusted IPs and management VLANs.
- Rotate credentials and API tokens accessible to automation platforms (n8n), and revoke stale sessions.
- Segment or isolate legacy devices (telnet) behind dedicated management networks and restrict outbound connections.
- Detection & hunt
- Deploy hunts for signs of exploitation patterns: new local admin accounts on Fortinet appliances, unexpected workflow creations or code executions in n8n logs, extraction activity leading to startup folders (WinRAR), and unknown telnet logins/sessions.
- Tune EDR/SIEM rules to flag new autorun entries, suspicious LNK/DLL creation in startup folders, and large config dumps from firewall web GUIs.
- Policy & process
- Ensure CISA/KEV lists map into your patching priorities; treat KEV items as emergency fixes when applicable.
- Enforce application update policies for frequently missed desktop utilities — WinRAR, 7‑Zip, PDF readers — using software management tooling.
- Maintain an inventory of management features that may enable cloud SSO or similar convenience options and ensure change control reviews these toggles.
- Longer term
- Move away from fragile sandboxing models where possible: treat workflow automation platforms as high‑risk application tier and run them behind strong network controls and dedicated secret‑management boundaries.
- Decommission legacy protocols (Telnet, older NTLM uses) and modernize management paths to authenticated, encrypted channels (SSH, modern identity flows).
- Regu appliance registration procedures; ensure default cloud toggles do not auto‑enable risky features.
Strengths, limitations and risks — critical analysis
- Strengths of current defenses:
- Rapid vendor response in many cases (Fortinet advisory and temporary SSO disablement; WinRAR issued 7.13; JFrog responsibly disclosed n8n issues) shows maturity in researcher‑vendor coordination.
- The growth of KEV catalogs and government directives forces prioritized remediation for widely exploited CVEs, creating actionable levers for organizations to accelerate patch windows.
- Limitations and risks:
- Operational inertia remains the single largest vulnerability: unpatched endpoints and weak inventory permit attackers to exploit patched‑but‑not‑updated systems at scale (WinRAR, WSUS examples).
- Convenience features and legacy compatibility (cloud SSO, telnet, ADS handling in WinRAR) continued to produce large‑impact vulnerabilities because they broaden trust boundaries.
- Sandboxing and AST sanitization are fragile; attacker creativity finds edge cases. For platforms like n8n that evaluate user‑supplied expressions, assume sandboxing will be bypassed unless the platform forbids untrusted code execution or enforces kernel‑level isolation.
A prioritized 10‑point action card for IT managers (digestible checklist)
- Treat KEV/CISA additions and observed exploitation telemetry as urgent — patch within SLA windows dictated by risk (hours to days for exploitable critical items).
- Patch n8n instances and rotate secrets used by automation immediately.
- Apply Fortinet fixes, disable FortiCloud SSO if uncertain, rotate firewall admin credentials, and inspect configs for unauthorized changes.
- Push WinRAR updates across endpoints; block archive handling in sandboxed viewers on critical machines.
- Disable telnetd or block TCP/23 and upgrade InetUtils to 2.8 where practical.
- Hunt for indicators of compromise tied to these campaigns: new local accounts, outbound VPN tunnels, autorun file creation, and suspicious web GUI downloads.
- Enforce least privilege for automation tools; treat orchestration platforms as high‑risk infrastructure and isolate their network access.
- Improve patch automation and asset inventory — WSUS and other centralized services deserve special attention because a compromise there compounds risk.
- Review vendor feature defaults and registration flows (cloud SSO toggles, remote management defaults) and disable any nonessential remote access features.
- Communicate the risk upward: boards and executive teams must understand the business impact of delayed patching — insurers and regulators increasingly treat remediation posture as a risk control in underwriting.
Conclusion
This week’s advisory cluster is a practical demonstration of a larger truth: vulnerabilities are increasing in number and shrinking in the time attackers need to weaponize them. The technical fixes are often available; the failure mode is operational. That means your most effective defense is not magic — it’s process, inventory, and disciplined execution: find high‑value endpoints, prioritize known‑exploited CVEs, patch and harden immediately, and assume convenience features can be exploited. The n8n sandbox bypasses, FortiCloud SSO bypass, continued WinRAR exploitation and telnet authentication flaw are not isolated headlines — they are case studies in the same failure chain that turns disclosed defects into breaches when organizations lack rapid, threat‑informed remediation.Act now: patch the critical and high‑severity items, harden management planes, rotate secrets used by automation, and treat this acceleration in attacker behavior as the new baseline for vulnerability management. Failure to adapt processes to this pace will make “patch available” functionally meaningless — and leave your environment exposed to the next automated campaign.
Source: TechTarget News brief: Patch critical and high-severity vulnerabilities now | TechTarget
