ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “endpoint management”

38 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 1308Ransomware 1024Malware 632Industry 530Exploit / PoC 482Data breach 430Policy & legal 342Threat actor 223Phishing & fraud 142AI tools & infra 111Tools 67AI safety & security 61Advisory 38Research 33
SeverityAllcritical 2537high 1272medium 895low 475info 320

Ivanti security advisory (AV26-897)

Canada's Cyber Centre relayed Ivanti's September 2026 security updates for Endpoint Manager Mobile, Neurons for ITSM, and Sentry, urging administrators to patch.

The Canadian Centre for Cyber Security forwarded Ivanti's September 2026 security updates covering Endpoint Manager Mobile, Neurons for ITSM (cloud/SaaS and on-prem), and Sentry. Affected releases include Endpoint Manager Mobile prior to 12.10.0.0, Sentry prior to R10.8.2, and Neurons for ITSM on-prem prior to 2026.2. The advisory references CVE-2026-18851 for Endpoint Manager Mobile and CVE-2026-83527 for Sentry, plus multiple CVEs in Neurons for ITSM. No exploitation is described in the advisory text.

Canadian Centre for Cyber Security · 8d agoAdvisoryCVE-2026-18851CVE-2026-83527

Best Practices for Good Endpoint Hardening | Huntress

Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.

Huntress published defensive guidance on endpoint hardening for small and mid-sized businesses, drawing on observations from its SOC. The post describes common intrusion vectors: internet-exposed RDP brute-forced by automated scanners, phishing emails delivering attacker-controlled remote monitoring and management (RMM) tools, with Huntress reporting a 277% spike in RMM abuse in 2025, and ClickFix attacks using fake CAPTCHA pages that trick users into running malicious commands. Recommended controls include scanning for exposed RDP, SSH, and VPN interfaces, removing unneeded local admin rights, enabling Windows Defender tamper protection, disabling SMBv1, and standardizing on one approved remote access tool, guided by CIS and NIST frameworks.

Huntress · 6d agoAdvisory

CISA Red Team Fully Compromised Two Critical Infrastructure Orgs

CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.

CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.

Security Affairs · 21d agoAdvisory1

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA Advisories · 1d agoAdvisoryCVE-2026-73807CVE-2026-82567

Cisco Identity Services Engine Authentication Bypass Vulnerability

Cisco patched an unauthenticated API authentication bypass in Identity Services Engine allowing attackers to access the web-based management interface.

A vulnerability in an API of Cisco Identity Services Engine (ISE) stems from insufficient authentication control on an API endpoint. An unauthenticated remote attacker can send a crafted request to bypass authentication and gain unauthorized access to the device via the web-based management interface. Cisco has released software updates and no workarounds are available.

Cisco Security Advisories · 13h agoAdvisory 15 sources

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.

CISA advisory AA26-237A, 'A Tale of Two SOCs,' describes two simultaneous red team assessments of a Government Services organization and a Water and Wastewater Systems organization, both compromised to the domain level. Organization A never detected the intrusion, enabled by default credentials, a misconfigured AD CS template (ESC1), cleartext credentials, non-expiring static AWS keys, and over-permissioned Entra ID applications. Organization B detected and isolated phishing within 2-20 minutes, though the red team still reached krbtgt via DCSync from cleartext SCCM credentials. CISA attributes the outcome gap to people and processes rather than the security tools themselves.

The Hacker News · 21d agoAdvisory

Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update

Microsoft's September 2026 Patch Tuesday updates (KB5124008) can break Remote Desktop Services, causing RDP failures and freezes across Windows clients and servers.

Microsoft confirmed its September 2026 security updates, including KB5124008 for Windows 11 24H2/25H2, introduced a reliability regression where RDP connections fail after several minutes and servers hang at the 'Please wait for the Remote Desktop Configuration' screen. MMC, RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page may also stop responding. The issue affects Windows 10/11 clients and Windows Server 2012 through 2025; Microsoft marked it Mitigated on September 11 and is developing a permanent fix, with VM restart offered as a temporary workaround.

Cyber Security News · 2d agoAdvisory1

NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery

NIST released IR 8587 giving agencies and cloud providers recommendations to prevent identity token forgery, theft, and misuse in SSO and API environments.

NIST Internal Report 8587, released September 15, 2026, provides implementation recommendations covering token creation, signing, validation, storage, revocation, and lifecycle management for SAML, OpenID Connect, and OAuth 2.0 environments. It builds on SP 800-53 Rev. 5.1.1 and incorporates lessons from breaches involving stolen signing keys, abused OAuth applications, and replayed federated assertions. Recommendations include strong signing algorithms, strict claim validation, short token lifetimes, token binding, leakage prevention, and monitoring for abnormal token use.

GBHackers · 22h agoAdvisory 2 sources

7th September – Threat Intelligence Report

Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.

Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.

Check Point Research · 9d agoAdvisory in the wildCVE-2026-83548CVE-2026-83549CVE-2026-823291