Reachability Watch: 906 New CVEs and Three AI Tools That Never Asked for a Password

Somewhere in AutoAgent’s codebase, someone wrote an authentication check. It’s real code…it just never runs, because nobody set the one environment variable that would switch it on. Cua’s computer-server has the same problem. So does excel-mcp-server. Three different AI tools, three different vendors, one identical bug: the auth check only runs if a specific environment variable is set, and none of the three fail safe when it isn’t.

The gap between “we wrote the check” and “the check runs” is the throughline for this entire edition, and it shows up again in the Microsoft batch, in AVideo’s return appearance, and in the featured flaw below.

Vulnerabilities By The Numbers

For September 4–10, 2026, 906 new network-exploitable CVEs (Common Vulnerabilities and Exposures) were published. 96 cleared our severity bar (CVSS 8.6+), including 5 rated a perfect 10.0. 

A few worth knowing about:

• Three AI-agent tools, one missing config flag: CVE-2026-86124 (9.8) lets anyone reach AutoAgent’s TCP server and execute commands as root. CVE-2026-86121 (9.8) does the same to Cua’s computer-server whenever its CONTAINER_NAME variable isn’t set. CVE-2026-85661 (9.8) lets excel-mcp-server read and write arbitrary files when EXCEL_FILES_PATH is left blank. This is the fourth edition running where AI agent infrastructure and “reachable by default” have shown up in the same sentence.
• A fourth entry in the same pattern: CVE-2026-85688 (9.8) let TEN Framework’s TMAN Designer API accept unauthenticated file read and write requests outright, with no environment variable needed.
• Microsoft’s biggest single-day batch this series has tracked: on September 9, Microsoft shipped fixes for 15 critical network CVEs in one release, 14 of them rated 9.8, spanning Windows DNS, DHCP Server, RPC Runtime, USB Mass Storage, and the Telnet Client, plus CVE-2026-69356 (9.3) in Exchange Server.
• WWBN AVideo is back: the platform we featured last edition for a non-expiring admin token shipped another critical this week, CVE-2026-86189 (9.8), a path traversal that lets unauthenticated attackers write files to arbitrary locations on the server.
• CVE-2026-82004 (10.0, CRITICAL): Adobe Campaign Classic is exposed to OS command injection, giving an attacker arbitrary code execution in the context of the current user.

Every one of these is a service that was one setting away from being invisible to an attacker, and stayed reachable instead.

No Authentication Required: This Edition’s Most Dangerous Vulnerability

The standout is CVE-2026-86124, an unauthenticated remote code execution vulnerability in AutoAgent, an open-source framework for building and orchestrating AI agents. 

The flaw sits in AutoAgent’s TCP server, which lets one agent hand tasks off to another, locally or across a cluster. That server binds to every network interface by default, not just localhost, and it doesn’t check who’s connecting before acting on what they send.

The practical effect: any command sent to that port gets executed, and it runs as root. There’s no authentication handshake to intercept, no token to steal, no session to hijack, because none of those things exist in the request path at all. An attacker doesn’t need to find a flaw in how AutoAgent checks permissions; they need to find the port.

That’s a meaningfully worse failure mode than a broken auth check that a security review can catch, a fuzzer can trip, or a penetration test can flag. A missing check is a bug in intent; there was nothing there to break. And because AutoAgent’s TCP server is designed to accept orchestration commands, “execute this” isn’t a side effect of the vulnerability, it’s the server’s actual job. The exploit doesn’t have to trick the software into doing something unintended. It just has to ask.

The scenario this creates is a familiar one for anyone who’s watched internal tooling drift onto shared infrastructure. A team spins up AutoAgent to coordinate a handful of agents on a dev box, doesn’t think about it as a network service because it feels more like a library, and never puts it behind a firewall rule because nothing in the setup docs suggested it needed one. Weeks later, that dev box is reachable from a broader internal network, or worse, briefly exposed to the internet during a cloud migration, and the TCP server has been sitting there the entire time, waiting for root-level instructions from whoever finds it first.

This week’s other three entries in the same pattern (Cua’s computer-server, excel-mcp-server, and TEN Framework) all fail the same way for a smaller reason: a specific environment variable left unset. AutoAgent doesn’t even have that excuse. The exposure is the default.

How Identity-First Reachability Closes This Gap

Identity-First Reachability doesn’t ask whether a service remembered to check a password, an environment variable, or a config flag before responding. It asks whether the requester has already been authenticated and authorized, before the service is network-visible at all. If the answer is no, there’s nothing to reach.

If AutoAgent, Cua’s computer-server, or excel-mcp-server had been sitting behind Identity-First Reachability, the missing environment variable would have been a bug to fix on the next release cycle, not a live exposure. The service itself would never have been reachable by a request that hadn’t already proven who was asking.

Don’t Be the Next Reachability Watch Headline

906 new CVEs in a week is more than any team patches its way through, and four of this week’s most dangerous flaws share one root cause: a security check that only fires if someone remembers to configure it. Code that can enforce authentication isn’t the same as code that does, by default, every time.

See how NetFoundry’s Identity-First Reachability makes your AI agents and internal tools invisible to attackers, no matter how their configuration is set. See How It Works →

---

Frequently Asked Questions

What does it mean for a tool to “skip authentication when an environment variable is unset”?

It means the software’s default behavior, out of the box, is insecure. The developer built a security check, but wired it to only activate if someone configures a specific setting. Skip that step, or simply not know it exists, and the tool runs wide open.

Why do AI agent and MCP (Model Context Protocol) tools keep shipping like this?

Speed. These tools are being built fast, often by small teams racing to ship agent capabilities before competitors do. Authentication and access control tend to be the first things treated as “add later,” especially in tools designed to run locally or in trusted-sounding environments. A lot of these tools end up bound to every network interface by default, regardless of where the developer imagined them running.

Why does a single Microsoft patch release matter to a tracker focused on reachability?

Volume and consistency. A batch of 15 critical, network-exploitable vulnerabilities patched in one day is a reminder that even mature vendors with dedicated security teams ship reachable, high-severity flaws on a predictable cadence.

Why does NetFoundry use a CVSS 8.6+ floor instead of tracking every published CVE?

Volume. Hundreds of CVEs publish every week, and most never get exploited in practice. CVSS 8.6+ isolates the ones that combine real severity with network exploitability.

How does Identity-First Reachability prevent this class of attack?

Identity-First Reachability is a security model where every connection requires a verified identity and an explicit policy before a service becomes visible on the network at all, rather than relying on an application-level setting that may or may not have been configured correctly.