[NEW] [low] patch: Multiple vulnerabilities allow denial of service

lowCVE-2026-56288 CVE-2026-56289

An attacker can exploit multiple vulnerabilities in patch to carry out a denial of service attack.

CSIRTS triage

product: patch Denial of service

What: Multiple vulnerabilities in patch can be exploited to carry out denial-of-service attacks.
Who is affected: Users of the affected patch software.
Urgency: Remediation is low urgency as the impact is limited to denial-of-service.
Action: Apply the latest updates for the patch software.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch patch

Get an email when a new patch advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: low
Published: 2026-07-28
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2274

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-562880.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-562890.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-56288	coverage & exploitation status	NVD · CVE.org
CVE-2026-56289	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for patch

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalGHSA-6g6r-q6gw-w8fg: PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (p…ghsa · 2026-08-25
unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.ncsc-nl · 2026-08-25
unknownNCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloakncsc-nl · 2026-08-25
mediumCVE-2026-76837: Baserow interpolates a user's display name into the rich-text mention markup without HTML enco…nvd · 2026-08-24
unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian productsncsc-nl · 2026-08-24
unknownCVE-2026-74672: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_m…nvd · 2026-08-22