An integer overflow vulnerability, identified as CVE-2026-116366, has been discovered in ClickHouse Server, allowing unauthenticated remote code execution. The vulnerability can be triggered remotely, leading to command injection.
ClickHouse versions affected include 26.3 < 26.3.62.3-lts, 26.8 < 26.8.36.3-lts, 26.9 < 26.9.27.3-stable, and 26.10 < 26.10.3.7-stable. Users are advised to upgrade to versions 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, or 26.10.3.7-stable or later to mitigate the vulnerability.
The vulnerability in ClickHouse is not exploitable if the vulnerable endpoint is not exposed to untrusted networks.
Separately, FortiGuard Labs has confirmed active exploitation of multiple zero-day vulnerabilities in Ivanti Connect Secure. The vulnerabilities, CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, lead to unauthenticated root-level code execution.
Ivanti Connect Secure appliances running versions 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier are affected. Ivanti confirmed that a limited number of customers were affected before the vulnerabilities were disclosed.
CISA has added these Ivanti vulnerabilities to its Known Exploited Vulnerabilities catalog.