Search: “policy”

20 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 3751 Vulnerability 3440 Ransomware 3119 Policy & legal 2887 Data breach 2108 Malware 1723 Industry 1477 Threat actor 1447 Phishing & fraud 922 AI safety & security 330 AI tools & infra 248 Research 190 Advisory 172 AI research 158

SeverityAll critical 12084 high 3631 medium 2456 low 3218 info 986

HPE security advisory (AV26-909)

Canada's Cyber Centre relayed HPE advisories covering vulnerabilities in Aruba ClearPass Policy Manager and HPE IceWall products.

Canadian Centre for Cyber Security advisory AV26-909, dated September 10, 2026, flags vulnerabilities in HPE products disclosed on September 9, 2026. Affected products include Aruba ClearPass Policy Manager versions prior to or equal to 6.11.14 and 6.12.8, and multiple HPE IceWall versions and models. Bulletins cover multiple ClearPass vulnerabilities, a remote bypass of security restrictions in IceWall, and an IceWall denial-of-service vulnerability; administrators are urged to review the bulletins and apply updates.

Canadian Centre for Cyber Securityupdated Sep 16, 18:35 UTC · 13h agofirst Sep 10, 18:13 UTC · 6d agoAdvisory 2 sources

Microsoft releases Windows 10 KB5122878 extended security update

Microsoft shipped Windows 10 ESU update KB5122878, delivering the record September 2026 Patch Tuesday fixes, including patches for two actively exploited zero-days.

Microsoft released KB5122878 for Windows 10 Enterprise LTSC and ESU customers, moving builds 19045/19044 to .7725 with security and bug fixes. The update carries this month's record September 2026 Patch Tuesday set, which fixed 966 Microsoft vulnerabilities including two actively exploited zero-day flaws. It also fixes BitLocker recovery-key prompts and Remote Desktop audio redirection, and updates Secure Boot certificate rollout and Morocco time zone data. Microsoft reports no known issues with the update.

BleepingComputerSep 8, 18:49 UTC · 8d agoAdvisory in the wild1

Windows 11 cumulative updates KB5124008 & KB5122880 released

Microsoft shipped mandatory September 2026 Patch Tuesday cumulative updates KB5124008 and KB5122880 for Windows 11, fixing vulnerabilities and adding features.

Microsoft released Windows 11 KB5124008 (versions 25H2/24H2) and KB5122880 (23H2) cumulative updates containing the September 2026 Patch Tuesday security patches, described as covering 1,000 vulnerabilities discovered in previous months. The updates are mandatory and add features including movable and resizable taskbars, Start menu customization, a Windows Search option to hide Bing and Store web suggestions, and Administrator Protection, a just-in-time admin privilege feature that is off by default and configurable via Intune OMA-URI or Group Policy.

BleepingComputerSep 8, 17:57 UTC · 8d agoAdvisory1

Microsoft: Windows Server 2025 changes causing app crashes

Microsoft warns Windows Server 2025 memory-management changes crash AWE apps, including SQL Server with Lock Pages in Memory; disable LPIM as workaround.

Microsoft confirmed a known issue where Windows Server 2025 memory-management changes cause access violations, memory corruption, or unexpected termination in applications using Address Windowing Extensions (AWE). SQL Server running with the Lock Pages in Memory (LPIM) policy is affected, with symptoms including 0xC0000005 access violations, DBCC CHECKDB failures, crash dumps, and services stopping or restarting unexpectedly. Microsoft's temporary workaround is to disable the LPIM policy for the SQL Server service account or disable AWE in other affected apps, with a permanent fix promised in a future Windows update.

BleepingComputerSep 8, 11:57 UTC · 8d agoAdvisory1

CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

The Hacker NewsJun 22, 06:39 UTC · Jun 22, 2026Advisory CVE-2026-24858 CVE-2025-59718 CVE-2025-59719

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities

Cisco patched ACL Object Group Search bypass flaws in ASA and FTD firewall software that let unauthenticated attackers reach protected networks.

Cisco disclosed multiple vulnerabilities in the ACL Object Group Search implementation of Secure Firewall ASA and FTD Software, caused by a logic error in populating group access control policies. An unauthenticated remote attacker could send traffic that should be blocked through the device, bypassing configured access controls. Cisco has released software updates; no exploitation is mentioned.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 16h agoAdvisory 9 sources

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-81861

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-58113

Microsoft Confirms KB5002914 Update Breaks Copy and Paste on Excel

Microsoft confirms KB5002914 Excel security update silently breaks copy-paste in Excel 2016-2024, forcing admins to choose between usability and security fixes.

Microsoft added a known issue to KB5002914, the September 8, 2026 Excel security update, where paste, autofill, and formula dragging fail silently with no error in Excel 2016, 2019, 2021, and 2024. The update addresses remote code execution and information disclosure flaws including CVE-2026-81399, CVE-2026-81390, and CVE-2026-81954. No hotfix date has been published as of September 15, 2026; the only widely confirmed recovery is uninstalling or rolling back KB5002914, which drops the month's Excel security fixes.

Cyber Security NewsSep 15, 09:25 UTC · 1d agoAdvisory 3 sources CVE-2026-81399 CVE-2026-81390 CVE-2026-819542

Microsoft releases emergency Windows updates to fix RDS failures

Microsoft released emergency out-of-band Windows updates fixing Remote Desktop Services failures and Hyper-V issues caused by September 2026 security patches.

Microsoft issued out-of-band updates on September 14, 2026 to fix Remote Desktop Services instability introduced by the September security updates, which caused RDP connection and sign-in failures and unresponsive servers. Updates include KB5129194 (Windows 11 26H1), KB5129195 (Windows 11 24H2/25H2), KB5129236 (Windows 10), KB5129235 (Windows Server 2025), and KB5129237 (Windows Server 2022). The Windows 11 updates also fix a Hyper-V Plan9 shared folder issue and some USB Audio Class 1.0 multichannel problems, though remaining USB audio issues await a fix. Admins had previously used Group Policy mitigations or uninstalled the security updates, which removed security protections.

BleepingComputerupdated Sep 15, 08:40 UTC · 1d agofirst Sep 14, 20:52 UTC · 2d agoAdvisory 3 sources2

NextGen Healthcare Mirth Connect

CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.

CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.

CISA Advisoriesupdated Sep 11, 13:08 UTC · 5d agofirst Sep 10, 12:00 UTC · 6d agoAdvisory 2 sources CVE-2026-82583 CVE-2026-78224 CVE-2026-82578

AVEVA Pipeline Integrity Monitor

CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.

CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-81821 CVE-2026-81822 CVE-2026-81823+1 CVEs

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA AdvisoriesSep 10, 12:00 UTC · 6d agoAdvisory CVE-2026-87020

Inductive Automation Ignition

CISA reports a permissions flaw (CVE-2026-77393, CVSS 8.8) in Inductive Automation Ignition <=8.1.53 letting authenticated users create projects; fixed in 8.1.54.

CISA republished Inductive Automation's advisory for CVE-2026-77393, an incorrect default permissions issue (CWE-276) in Ignition 8.1.53 and earlier. The Gateway "Create Project Role(s)" setting shipped blank, allowing any authenticated user who can execute gateway scripts to create projects. Ignition 8.1.54 restricts project creation to Designer sessions and the 8.3 series is unaffected. CISA notes no known public exploitation of this vulnerability.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory CVE-2026-77393

Rockwell Automation 1756-ENBT Module

Rockwell's 1756-ENBT ControlLogix EtherNet/IP bridge (all versions) is vulnerable to DoS via crafted CIP packets, crashing the module until manual restart.

CISA republished Rockwell Automation's advisory for CVE-2025-10478, a CWE-754 flaw affecting all versions of the 1756-ENBT ControlLogix EtherNet/IP bridge, scored CVSS 7.5. A crafted CIP packet can crash the module, and the device requires a restart to recover. Affected critical infrastructure sectors include critical manufacturing, food and agriculture, transportation systems, and water. No public exploitation has been reported; CISA recommends minimizing network exposure.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory 3 sources CVE-2025-10478

Tycon Systems TPDIN-Monitor-WEB3

CISA reports three flaws (hard-coded credentials, CSRF, missing authorization) in Tycon TPDIN-Monitor-WEB3 <=2.2.9 enabling MitM, credential theft, or device resets.

CISA published ICSA-26-246-08 for Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, covering CVE-2026-77847 (use of hard-coded credentials, CWE-798), CVE-2026-82712 (CSRF, CWE-352), and CVE-2026-82684 (missing authorization, CWE-862). Exploitation could enable man-in-the-middle attacks, factory resets, credential wiping, or extraction of system credentials, configurations, and flash contents; the CSRF issue scores CVSS 8.8. No public exploitation has been reported; CISA recommends isolating devices from business networks.

CISA AdvisoriesSep 3, 12:00 UTC · 13d agoAdvisory 2 sources CVE-2026-77847 CVE-2026-82712 CVE-2026-82684