Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.
Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.
Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.
CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.
CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. CVE-2026-83548 is a critical (CVSS 10.0) pre-authentication SSRF in the SMA1000 Appliance Work Place interface; CVE-2026-83549 is a high (CVSS 7.8) post-authentication OS command injection leading to RCE in the Appliance Management Console. SMA1000 models 6210, 7210, and 8200v running 12.4.3-03453 or 12.5.0-02835 platform-hotfix and older are affected; fixes ship in 12.4.3-03526 and 12.5.0-02952. Qualys customers can detect vulnerable assets via QID 388624.
Veeam patched critical CVE-2026-65641 (CVSS 9.3) in Veeam ONE, exploitable by unauthenticated network attackers to coerce SMB authentication from the service account.
Veeam released patches for its Veeam ONE monitoring, reporting, and capacity planning software addressing CVE-2026-65641, rated critical with a CVSS score of 9.3. Successful exploitation allows an unauthenticated network attacker to coerce SMB authentication from the Veeam ONE service account, creating relay-style attack opportunities. Qualys ThreatPROTECT relayed the vendor advisory; administrators should apply the patches promptly. No in-the-wild exploitation is noted in the advisory.
PaperCut NG/MF zero-days CVE-2026-82078 and CVE-2026-81578 are actively exploited, chaining to pre-auth RCE on the Application Server.
PaperCut issued an urgent security advisory for two actively exploited vulnerabilities, CVE-2026-82078 and CVE-2026-81578, affecting all versions of PaperCut NG and PaperCut MF. When chained, the flaws enable pre-authentication remote code execution on the PaperCut Application Server, originating from a request-confusion and authorization gap. PaperCut is widely deployed for print management in enterprises and education, making unpatched instances a high-value target.
Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution
CVE-2026-3910 is an out-of-bounds memory flaw — CISA classifies it as improper restriction of operations within the bounds of a memory buffer — caused by an inappropriate implementation in the V8 JavaScript and WebAssembly engine used in Google Chrome. A remote attacker triggers it by luring a user to a crafted HTML page, so exploitation requires user interaction but no privileges or special conditions. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, which confines the compromise to the renderer process rather than the full system, but still exposes data and credentials handled within the browser session. Anyone running Google Chrome prior to 146.0.7680.75 — or a Chromium-based browser that embeds the vulnerable V8 code — is affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-13, and it comes amid a string of actively exploited Chrome V8 zero-days that Google has fixed during 2026.
· google chrome prior to 146.0.7680.75 (fixed in 146.0.7680.75) KEVmass
Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users
CVE-2026-2441 is a use-after-free (CWE-416) in Google Chromium's CSS handling that a remote attacker can trigger by getting a user's browser to process a crafted HTML page, potentially corrupting the heap. Successful exploitation yields a memory-corruption primitive in the browser; CVSS scoring is not yet available, but Chromium memory-safety flaws of this class can range from crashes to potential code execution depending on how the corruption is leveraged. Anyone running Chromium or a Chromium-based browser — Google Chrome, Microsoft Edge, Opera, and numerous embedded/branded browsers — is potentially affected, making the exposed population effectively all modern browser users. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-17, confirming it is being exploited in the wild; EPSS assigns a 22% probability of exploitation within 30 days (98th percentile), no public PoC is known, and any ransomware association is unknown. This lands amid an accelerating series of actively exploited Chrome zero-days in 2026 described in recent reporting, making rapid patching urgent.
· Google Chromium · Google Chrome (Chromium-based) KEV PoC mass
Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation
CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days.
Out-of-Bounds Write in Google Chrome for Android WebGL Allows Sandbox Escape
CVE-2026-85050 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android, fixed in version 152.0.7977.82. An attacker can trigger it by persuading a user to open a crafted HTML page, since exploitation requires user interaction but no privileges. Successful exploitation yields arbitrary code execution outside the browser sandbox, giving the attacker the privileges of the user on the device, hence the critical 9.6 CVSS with scope change. Only Chrome on Android versions prior to 152.0.7977.82 are affected by this bug; desktop Chrome is not indicated in the advisory. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this specific CVE is known, though a related Chrome zero-day (CVE-2026-85046) was reported exploited in the wild and addressed in the same release.
· Google Chrome (Android) prior to 152.0.7977.82mass
Use-after-free in Google Chrome DevTools enables sandbox-escaping code execution
CVE-2026-85042 is a use-after-free vulnerability (CWE-416) in the DevTools component of Google Chrome, affecting all versions prior to 152.0.7977.82. An attacker triggers the flaw by convincing a user to open a crafted HTML page, which corrupts memory in the DevTools code path. Successful exploitation allows a remote attacker to execute arbitrary code outside the Chrome sandbox, meaning code runs with the privileges of the browser process rather than being confined to a renderer — a significant escalation given the browser's usual sandbox protections. All Chrome users running builds earlier than 152.0.7977.82 are affected until they update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days; a related Chrome zero-day (CVE-2026-85046) has been reported exploited in the wild, but no in-the-wild exploitation of this specific flaw has been confirmed.
· google chrome all versions prior to 152.0.7977.82mass
Heap Buffer Overflow RCE in Windows Routing and Remote Access Service (RRAS)
Microsoft's Routing and Remote Access Service (RRAS) contains a heap-based buffer overflow (CWE-122) that permits remote code execution on the host running the service. An attacker can trigger the flaw by sending crafted network requests to the RRAS service, such as on a server configured as a VPN, dial-in, or routing endpoint; the CVSS vector (AV:N/PR:L/UI:N) indicates the attacker needs low-privilege access and no user interaction is required. Successful exploitation yields code execution with high confidentiality, integrity, and availability impact, giving the attacker unauthorized access to the victim machine. Only systems with RRAS enabled are affected — typically Windows Servers acting as VPN or remote-access/routing endpoints — because the role is optional and not installed by default. As of the September 2026 Patch Tuesday release there are no reports of in-the-wild exploitation, no known public proof-of-concept, and the CVE is not in CISA's KEV catalog, with EPSS estimating roughly a 0.9% probability of exploitation within 30 days.
· Microsoft Windows Routing and Remote Access Service (RRAS)large
Use-After-Free in Chrome Compositing Enables Sandbox Escape (CVE-2026-85048)
CVE-2026-85048 is a use-after-free vulnerability in the Compositing component of Google Chrome in versions prior to 152.0.7977.82. An attacker can trigger the flaw by inducing a user to load a crafted HTML page; the bug is exploitable after the attacker has already compromised the Chrome renderer process, and the memory corruption then lets them escape it. Successful exploitation yields arbitrary code execution outside the Chrome sandbox, with high impact on confidentiality, integrity, and availability of the underlying system (CVSS 3.1: 8.3, High). Anyone running an affected Chrome build is exposed, with no privileges required on the target beyond user interaction with attacker-controlled web content. As of now, there is no known public proof-of-concept and the flaw is not in CISA's KEV catalog, with a low EPSS score of 0.3%, though a sibling Chrome zero-day (CVE-2026-85046) was reported exploited in the wild, suggesting urgent patching is warranted.
Use-after-free RCE in Microsoft Windows Reliable Multicast Transport Driver (RMCAST)
CVE-2026-78449 is a use-after-free flaw (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST, rmcast.sys), the Windows driver that implements the PGM reliable multicast transport used by features such as Message Queuing (MSMQ). An unauthorized remote attacker could trigger it by sending crafted network traffic that causes the driver to access freed memory, although the high attack complexity (CVSS AC:H) means exploitation depends on favorable timing or state conditions. Successful exploitation would allow arbitrary code execution in the context of the driver, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.1, High). Only systems running the affected RMCAST driver - typically Windows hosts where the optional Reliable Multicast Protocol/MSMQ multicast capability is installed, enabled, and network-reachable - are exposed; the specific affected Windows versions are enumerated in Microsoft's September 2026 Patch Tuesday release. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns it a low 0.5% probability of exploitation within 30 days, so exploitation has not yet been observed.
· Microsoft Windows - Reliable Multicast Transport Driver (RMCAST / rmcast.sys)large
Heap-based Buffer Overflow in Microsoft Excel Enables Local Code Execution
CVE-2026-81951 is a heap-based buffer overflow (CWE-122) in Microsoft Excel, the spreadsheet component of Microsoft Office and Microsoft 365. Per the CVSS vector (AV:L with UI:R and no privileges required), exploitation requires user interaction, most plausibly a user opening a crafted spreadsheet, rather than any network-reachable service. Successful exploitation lets an unauthorized attacker execute arbitrary code locally, with the CVSS scoring high impact on confidentiality, integrity, and availability. All supported Excel-bearing releases are affected: Microsoft 365 Apps/Microsoft 365, Office 2016, Office 2019, Office 2021, and Office 2024. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days, indicating no known in-the-wild exploitation as of the September 2026 Patch Tuesday that shipped the fix.
Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio
CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.