55
30
30
55
30
55
55
30
30
55
30
30
30
30
30
57
30
30
42
30
55
30
NIST Warns of Unique Security Risks in Multi-Cloud Environments
NIST catalogued 23 novel security challenges unique to multi-cloud environments and urged the community to develop solutions.
NIST published an analysis identifying 23 distinct security challenges that arise specifically in multi-cloud environments. The agency explicitly encouraged the cybersecurity community to work on solutions for these gaps. The publication reflects growing official concern that spanning multiple cloud providers creates risk patterns not covered by single-cloud security models.
30
30
55
55
55
55
30
30
30
30
Commvault security advisory (AV26-899)
Canadian Cyber Centre warns Commvault Cloud versions prior to 11.36.123, 11.40.72, 11.44.20, and 11.46.20 are affected by vulnerabilities; updates required.
The Canadian Centre for Cyber Security issued advisory AV26-899 stating that Commvault Cloud is affected by vulnerabilities as of September 8, 2026. Affected branches are 36.0 before 11.36.123, 40.0 before 11.40.72, 44.0 before 11.44.20, and 46.0 before 11.46.20. The advisory links to Commvault's own security advisories and urges administrators to apply available updates; no CVE identifiers, severity ratings, or exploitation details are provided.
25
42
30
Commvault security advisory (AV26-895)
Canada's Cyber Centre advisory AV26-895 warns Commvault Cloud builds before 11.36.123/11.40.72/11.44.20/11.46.20 are affected by a Command Center API authentication bypass.
The Canadian Centre for Cyber Security alerted users that Commvault Cloud versions 11.36, 11.40, 11.44 and 11.46, prior to fixed builds 11.36.123, 11.40.72, 11.44.20 and 11.46.20, are affected by issue CV_2026_07_1, a Command Center API authentication bypass. Administrators are encouraged to review the linked vendor advisories and apply the available updates.
32
55
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.
CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.
72
42
30