[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities can be exploited to escalate privileges, manipulate data, or disclose confidential information.

Who is affected

Deployments of FreeBSD OS are affected.

Urgency

Remediation is high priority due to the potential for severe impacts from exploitation.

Action

Update to the latest version of FreeBSD as per the advisory.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-20

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2590

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-580830.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-580870.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-580880.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-580840.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-580850.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-580860.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• highCVE-2026-58088: The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for t…nvd
• highCVE-2026-58087: The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target se…nvd
• unknownCVE-2026-58086: As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a …nvd
• unknownCVE-2026-58085: After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed…nvd
• unknownCVE-2026-58084: To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the …nvd
• highCVE-2026-58083: While the kernel was copying knotes during fork, a knote with a timer-based filter could fire …nvd

Recent advisories for FreeBSD Project FreeBSD OS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund · 2026-08-26
• medium[NEW] [medium] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund · 2026-08-20
• high[UPDATE] [high] FreeBSD Project FreeBSD OS: Multiple Vulnerabilitiescert-bund · 2026-08-13

More from CERT-Bund (BSI) Security Advisories

• medium[NEW] [medium] Langflow: Multiple vulnerabilities2026-09-04
• medium[NEW] [medium] Grafana Enterprise: Multiple vulnerabilities allow gaining user or administrator privileges2026-09-04
• low[NEW] [low] Checkmk: Vulnerability allows Denial of Service2026-09-04
• low[NEW] [low] ImageMagick: Multiple vulnerabilities allow Denial of Service2026-09-04
• critical[NEW] [critical] vm2: Multiple vulnerabilities allow code execution2026-09-04