The latest edition of NetFoundry’s regular Reachability Watch articles, covering September 4 – 10, 2026 and written by Mark Jaffe, our Chief Strategy and Marketing Officer, is up:
https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-11/
And with this edition, a new “back of the envelope” drawing by Yours Truly, which shows the “env var” pattern behind two of the CVEs in this report.
In this edition:
- 906 new network-exploitable CVEs
- 96 clearing the CVSS 8.6+ bar
- 5 at a perfect 10.0
Microsoft shipped 15 critical network CVEs in a single release, 14 of them at 9.8, across DNS, DHCP Server, RPC Runtime, USB Mass Storage, and Telnet Client.
The most notable part of this Reachability Watch is this set of CVEs:
- CVE-2026-86124 (9.8): AutoAgent’s inter-agent TCP server executes whatever you send it, as root, with no authentication in the request path at all
- CVE-2026-86121 (9.8): Same outcome in Cua’s computer-server, gated on
CONTAINER_NAMEbeing set - CVE-2026-85661 (9.8):
excel-mcp-serverreads and writes arbitrary files whenEXCEL_FILES_PATHis blank - CVE-2026-85688 (9.8): TEN Framework’s TMAN Designer API takes unauthenticated file reads and writes with no env var required
The CVEs come from four different projects, but they all have the same shape: reachable by default, with authentication either optional or absent. In two of them, the auth check exists as real code, wired behind a conditional on an environment variable, and it fails open when the variable is missing. It’s not that anyone turned security off; instead nobody confirmed it was on.
Here’s my own opinion of what the main take-away for this edition is: The environment variable may be the headline, but the bind address is the actual exposure. AutoAgent’s server binds every interface by default, not loopback. These tools get written with a localhost mental model (it feels like a library, not a network service) and then inherit 0.0.0.0 from whatever framework default was closest to hand.
The auth flag and the bind address are two independent decisions, and the second one is what turns a local misconfiguration into something an attacker can reach. If AutoAgent’s default bind was loopback, the attack approach would have resulted in a configuration bug and not an unauthenticated RCE, and it wouldn’t have required anyone to write an auth system at all.
All this is the argument for handling reachability underneath the app: An overlay doesn’t care whether the service remembered to check a password, because an unauthorized requester never gets a path to the port in the first place.
Once again, the latest edition is Reachability Watch is here:
https://netfoundry.io/ai/reachability-watch-cve-kev-tracker-2026-09-11/