14th September – Threat Intelligence Report
Check Point weekly digest: Microsoft's record 974-vuln Patch Tuesday ships two actively exploited Windows zero-days; IDScan.net, Mathspace, Revolut suffer breaches.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited privilege-escalation zero-days, CVE-2026-85880 and CVE-2026-81963, plus 20 flaws allowing unauthenticated remote code execution. Disclosed breaches include IDScan.net (identity documents), Mathspace (over 1 million people via Metabase CVE-2026-72898), Revolut, and Florida DMV (ShinyHunters). GitLab fixed critical CVSS 10.0 path traversal CVE-2026-85706, and MikroTik fixed chainable RouterOS flaws CVE-2026-67276 and CVE-2026-86060. The report also covers the PuzzleMask LLM jailbreak technique, GoldFactory's Gigabud Android fraud, and the BlueMoon Chromium exploit chain (CVE-2026-85046).
- Microsoft patches record 974 flaws; two Windows zero-days actively exploited.
- GitLab CVE-2026-85706 (CVSS 10.0) allows unauthenticated arbitrary file read.
- MikroTik RouterOS flaws chain into passwordless SSH and full admin control.
- Mathspace breach affected 1M+ people via Metabase SQL injection.
- August saw 1,042 ransomware attacks, nearly double August 2025.
- CVEs
- CVE-2026-72898CVE-2026-85880CVE-2026-81963CVE-2026-85706CVE-2026-67276CVE-2026-86060CVE-2026-85046
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 | 6% | KEVPoC ×3 | KEV |
| CVE-2026-72898 | Unauthenticated SQL Injection in Metabase Grants Admin Access | 10.0 | 99% | KEVPoC ×3 | KEV |
CVE-2026-81963+1 related CVE | Local Privilege Escalation via Link Following in Windows Update Stack | 7.8 | <1% | KEV | KEV |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
4 min read at research.checkpoint.com
For the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES IDScan. net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1.
By urias · research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.