Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.
Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).
CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.
CISA added CVE-2026-75650 (Adobe Commerce and Magento, improper neutralization in a template engine), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow), and CVE-2026-86218 (N-able N-central static code injection) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on exposed assets that grant total control post-exploitation and check for pre-patch compromise. All organizations are encouraged to prioritize these flaws in risk-based patching.
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
A zero-day dubbed StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited, with the first observed incident on September 4 on a fully patched site. The exploit injects PHP code via Magento's template system through a fake 'failed-payment' email to achieve code execution, installing a Rust-based backdoor disguised as kworker/u:8:0 or fc-cache with a 30-minute cron job for persistence. The backdoor communicates via TLS/WebSockets or UDP port 123 masquerading as NTP traffic, checks TracerPid to detect tracing, and can receive remote commands. Adobe confirmed it is working on a fix with no timeline; Sansec recommends disabling GraphQL as mitigation and monitoring for suspicious cron entries and kworker or fc-cache processes. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.
Threat actors are actively exploiting a zero-day RCE in Adobe Commerce and Magento 2.4.7-2.4.9, injecting PHP code via generated failure reports and executing it through Magento's payment-failure email, with no user interaction required. Exploitation began September 4 and succeeds even against stores running the July and August 2026 patches; the Rust backdoor disguises itself as kworker/u:8:0 or fc-cache and hides C&C communication inside fake NTP replies. Adobe's September 8 Patch Tuesday updates may not include a StyleSmuggler fix.
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.
Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.
· Adobe Commerce · Adobe Commerce B2B KEV PoC mass
Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
CVE-2026-86218 is a static code injection flaw (CWE-96) in N-able's N-central on-premises remote monitoring and management (RMM) platform, carrying a maximum CVSS 4.0 score of 10.0. An unauthenticated, remote attacker triggers it by sending crafted network input to the N-central server that is improperly neutralized and persisted into application-managed code, which the server then executes — no privileges (PR:N) or user interaction (UI:N) are required. Successful exploitation yields full server compromise with high impact on confidentiality, integrity, and availability, and because N-central acts as the management hub for downstream customer endpoints, compromise can expose the entire managed estate. Any organization running an affected N-central release (before 2026.3.1.14) — primarily MSPs and corporate IT departments using N-able RMM — is affected. The flaw is confirmed exploited in the wild: N-able patched it as a zero-day, CISA added it to the KEV catalog on 2026-09-08, and it is the fourth N-central hotfix in five weeks, though no public PoC is known and ransomware use is unknown.
· N-able N-central before 2026.3.1.14 KEV PoC large
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.
· Google Chrome prior to 152.0.7977.82 · Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82 KEV PoC ×5mass
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.
· MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC ×2mass
Eval Injection RCE in Adobe ColdFusion (CVSS 9.9, low-privileged attacker)
CVE-2026-48273 is a critical (CVSS 9.9) eval injection flaw (CWE-95) in Adobe ColdFusion in which untrusted input is not properly neutralized before it is placed into dynamically evaluated code. A remote attacker who has only low-privileged access to a vulnerable ColdFusion server can trigger the flaw over the network, with no user interaction required. Successful exploitation yields arbitrary code execution in the context of the current user, and the changed CVSS scope (S:C) indicates the impact can extend beyond the directly vulnerable component, a pattern typical of ColdFusion flaws that enable broader system-level code execution. All Adobe ColdFusion deployments are potentially affected; the source data does not specify affected version ranges, so admins should consult Adobe's bulletin for the exact versions fixed. As of this writing there is no known public proof-of-concept and the flaw is not in CISA KEV, though EPSS assigns a 1.7% probability of exploitation within 30 days; the fix shipped in Adobe's large recent patch batch, which also addressed three CVSS 10.0 ColdFusion and Campaign Classic flaws.
SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).
· MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)mass
Access Control Filter Bypass in N-able N-central Exposes Internal APIs
N-able N-central contains a flaw in the access-control filter that protects its internal API (CWE-791, incomplete filtering), allowing requests to bypass the filter and reach internal APIs without authorization. The issue is exploitable over the network with no privileges and no user interaction, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). An attacker gains unauthorized, low-impact access to internal APIs (VC:L); the vector indicates no integrity or availability impact and no evidence of code execution from this flaw. Any organization running an affected N-central release — a remote monitoring and management (RMM) platform operated by managed service providers — is affected, and the fix is available in N-central 2026.3 HF3 and 2026.4. The flaw is not on the CISA KEV list and has no known public PoC or confirmed in-the-wild exploitation, though it was disclosed in the same patching cycle as actively exploited N-central unauthenticated RCE flaws.
· N-able N-central Releases prior to 2026.3 HF3; fixed in 2026.3 HF3 and 2026.4large
X.509 Signature Forgery Enables TLS Impersonation in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x improperly verifies RSA/PKCS#1 v1.5 signatures when validating X.509 certificate chains, accepting malformed signatures (CWE-347, Improper Verification of Cryptographic Signature). Because the RouterOS trust store includes a root CA whose public key uses the small exponent e=3, an attacker who can control or redirect one of the router's outbound TLS connections (for example via a network man-in-the-middle position, DNS hijacking, or a compromised upstream path) can forge an intermediate CA signed with the root's public key, without ever holding its private key, and mint trusted certificates for arbitrary hostnames. This lets the attacker impersonate TLS servers the router connects to, with low confidentiality and integrity impact per the CVSS 4.0 score of 6.3 (medium), which reflects the network vector, no privileges required, but a high attack requirement of holding such a network position. Any deployment running RouterOS 7.x before 7.23.4 (Long-term) or 7.24.2 (Stable) is affected, spanning home/SOHO, enterprise, and ISP/WISP infrastructure; the 6.x branch is not listed as affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and EPSS gives a 0.2% probability of exploitation within 30 days, although related headlines note other MikroTik flaws have recently been chained to hack routers.
· MikroTik RouterOS 7.x before 7.23.4 (Long-term) and before 7.24.2 (Stable); the 6.x branch is not affectedmass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.