[NEW] [low] patch: Multiple vulnerabilities allow denial of service

lowCVE-2026-56288 CVE-2026-56289

An attacker can exploit multiple vulnerabilities in patch to carry out a denial of service attack.

CSIRTS triage

product: patch Denial of service

What: Multiple vulnerabilities in patch can be exploited to carry out denial-of-service attacks.
Who is affected: Users of the affected patch software.
Urgency: Remediation is low urgency as the impact is limited to denial-of-service.
Action: Apply the latest updates for the patch software.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch patch

Get an email when a new patch advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: low
Published: 2026-08-27
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2274

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-562880.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-562890.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-56288	coverage & exploitation status	NVD · CVE.org
CVE-2026-56289	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for patch

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-88892: OpenPanel is an analytics platform. In all versions (no patched release available at time of p…nvd · 2026-09-10
highCVE-2026-88861: Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched …nvd · 2026-09-10
mediumCVE-2026-61915: An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An…nvd · 2026-09-09
highCVE-2026-86729: WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthori…nvd · 2026-09-08
high[NEU] [hoch] SAP Patch Day September 2026: Mehrere Schwachstellencert-bund · 2026-09-08
mediumCVE-2026-86512: A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the func…nvd · 2026-09-08