Search: “nss”

NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected

Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.

The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.

Cyber Security News·updated Sep 14, 09:43 UTC · 2d ago·first Sep 14, 05:11 UTC · 2d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103

Arm Mali G2-Ultra NX GPU: desktop-class mobile gameplay with AI-native graphics

Arm unveiled Mali G2-Ultra NX, its first AI-native mobile GPU with in-shader neural acceleration, third-gen ray tracing, and up to 24% higher benchmark performance.

Arm announced the Mali G2-Ultra NX, the first AI-native Mali GPU, integrating neural accelerators directly into shader cores alongside a new execution engine and third-generation hardware ray tracing. It introduces Neural Super Sampling (NSS), Neural Frame Rate Upscaling (NFRU), and Neural Super Sampling and Denoising (NSSD); the Neural Dawn demo with Sumo Digital showed up to 4x performance efficiency and 70% lower external memory traffic versus native rendering. Arm claims up to 24% higher benchmark performance, 13% lower DRAM traffic on ray tracing benchmarks, and up to 120 FPS with NFRU. Over 14 billion Mali GPUs have shipped to date.

Hacker News · AI·Sep 8, 04:06 UTC · 8d agoAI industryHN 71↑ · 53 comments1

Water sector example added to the NCSC’s Secure connectivity principles

NCSC UK adds a water sector example to its Secure Connectivity Principles, the first ICS community-authored content on its site.

The UK NCSC has added a water sector example to its Secure Connectivity Principles guidance. It is the first content authored by the Industrial Control System Community of Interest to appear on ncsc.gov.uk. The guidance helps ICS operators apply secure connectivity practices.

NCSC UK·Aug 11, 12:00 UTC · Aug 11, 2026Advisory

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber Security·Sep 11, 15:56 UTC · 4d agoAdvisory2

Ncsc Raises Alarms Prompt

The UK NCSC raised alarms about prompt injection risks in LLM-integrated systems, urging organizations deploying AI to review exposure.

The UK National Cyber Security Centre (NCSC) has raised alarms about prompt injection attacks against systems using large language models. The warning highlights how attackers can manipulate model instructions to bypass safeguards, exfiltrate data, or trigger unintended agent actions. Organizations deploying LLM-based features are advised to assess and mitigate their exposure to this technique.

Infosecurity Magazine·Aug 19, 00:00 UTC · 28d agoAI safety & security

Managing the cyber risk of agentic AI

UK NCSC guidance recommends safeguards, sandboxing, and active oversight to manage cyber risks of autonomous agentic AI systems.

The UK National Cyber Security Centre published guidance on managing the cyber risk of agentic AI systems. It recommends safeguards, sandboxing, and active human oversight to limit unintended autonomous activity while realizing the benefits of these systems. The publication is official national guidance for organizations deploying agentic AI.

NCSC UK·Aug 20, 12:00 UTC · 27d agoAdvisory

CISA Warns of N-able N-central RCE Vulnerability Exploited in the Wild

CISA added CVE-2026-86218, a CVSS 10.0 unauthenticated RCE in N-able N-central RMM, to its KEV catalog; on-premises admins must patch to 2026.3.1.14.

CISA added CVE-2026-86218, a CVSS 10.0 static code injection (CWE-96) enabling unauthenticated RCE in N-able N-central, to the Known Exploited Vulnerabilities catalog on September 8, 2026. The flaw affects all on-premises builds before 2026.3.1.14 across the 2025.4 through 2026.3 release lines; N-able shipped Hotfix 4 for 2026.3 on September 5-6, 2026. Huntress research indicates at least one customer's N-central instance was compromised on September 4, and federal civilian agencies must mitigate by September 11 under BOD 26-04. Hosted environments were patched server-side, but a compromised RMM server can serve as a single point of entry into entire MSP client bases.

Cyber Security News·Sep 9, 13:31 UTC · 7d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-862071

NIS2 Compliance in the AI Age: Why Traditional Cybersecurity Isn’t Enough

Akamai argues NIS2 compliance is harder in the AI age, outlining four key challenges and urging network segmentation as essential.

An Akamai blog post claims achieving compliance with the EU's NIS2 directive is more challenging in the AI era and describes four key challenges organizations face. It argues traditional cybersecurity approaches are insufficient and positions network segmentation as essential for compliance. The piece is vendor commentary rather than new regulatory guidance or enforcement news.

Akamai Blog·Sep 9, 13:00 UTC · 7d agoIndustry

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

NCSC links disruptive cyber activity to internet-exposed systems and edge devices, urging OT owners to fix avoidable vulnerabilities and improve resilience.

The UK's NCSC issued guidance following disruptive cyber activity that highlights the risk to internet-exposed systems and edge devices. It encourages owners of operational technology to remediate avoidable vulnerabilities and invest in long-term cyber resilience. The notice underscores that exposed edge devices remain a common entry point for attackers against OT environments.

NCSC UK·Aug 27, 12:00 UTC · 20d agoAdvisory in the wild

U.S. CISA adds a N-able N-central flaw to its Known Exploited Vulnerabilities catalog

Security Affairs·Aug 4, 11:02 UTC · Aug 4, 2026Exploit / PoC in the wildCVE-2026-18577CVE-2026-18556

North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.

ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.

ANY.RUN·Aug 20, 07:58 UTC · 27d agoThreat actor

Critical N-able N-central Vulnerability and Active Exploitation

N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.

N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.

Huntress·Sep 6, 11:00 UTC · 10d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree

Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.

In a Help Net Security interview, Cohesity Global Field CISO Joye Purser lays out a vulnerability prioritization framework that puts active exploitation (KEV) first, then exploit likelihood (EPSS), then technical severity (CVSS), adjusted for asset exposure, business criticality, and compensating controls. She endorses 24-72 hour remediation targets for critical exploited internet-facing vulnerabilities and describes the organizational tradeoffs and emergency procedures needed to hit them. The interview also covers honeypot failure modes when deception systems are over-connected or over-trusted, and budget guidance recommending OT/IT segmentation, phishing-resistant MFA, and tested recovery for a 400-person manufacturer.

Help Net Security·Aug 31, 00:00 UTC · 16d agoIndustry

NCSC Urges Stronger Controls for Agentic AI Systems

UK's NCSC urges organizations to apply sandboxing, human oversight, and strict access controls when deploying autonomous AI agents.

The UK National Cyber Security Centre published guidance recommending stronger controls for autonomous agentic AI systems. Recommended measures include sandboxing, active human oversight, and tightly scoped access controls to limit unintended agent activity. The guidance aims to help organizations realize the benefits of agentic AI while managing its cyber risk.

Infosecurity Magazine·Aug 20, 12:45 UTC · 27d agoAI safety & security

NIS2 compliance: Fixing IAM and access control before the 2026 audit

EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.

EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.

Help Net Security·Sep 1, 00:00 UTC · 15d agoIndustry

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth RCE in N-able N-central, to KEV after N-able confirmed in-the-wild exploitation; patch by September 11.

CISA added CVE-2026-86218, a maximum-severity static code injection flaw enabling pre-authentication remote code execution in N-able N-central, to its Known Exploited Vulnerabilities catalog with a September 11, 2026 deadline for federal agencies. The flaw is fixed in N-central 2026.3 Hotfix 4 (released September 5), and N-able told customers it has been observed being exploited in the wild. Separately, Huntress is investigating the compromise of a fully patched customer N-central environment on September 4 and cannot yet confirm which flaw was used, while Rapid7-disclosed CVE-2026-86206 and CVE-2026-86207 can be chained by an unauthenticated attacker to create a rogue System Administrator account.

The Hacker News·Sep 9, 04:27 UTC · 7d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207

[Control Systems] National Instruments security advisory (AV26-856)

Canada's Cyber Centre relayed National Instruments advisories for memory corruption, out-of-bounds read, and out-of-bounds write flaws in LabVIEW versions.

The Canadian Centre for Cyber Security published control systems advisory AV26-856 covering National Instruments LabVIEW. Affected versions include releases before 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1. The flaws include memory corruption, an integer conversion out-of-bounds read, and an integer overflow out-of-bounds write. Users and administrators are urged to review the links and apply NI security updates.

Canadian Centre for Cyber Security·Aug 28, 12:16 UTC · 19d agoAdvisory

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.

NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.

Cyber Security News·Sep 15, 17:04 UTC · 21h agoAdvisory1

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.

Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.

Security Affairs·updated Sep 15, 20:46 UTC · 17h ago·first Sep 15, 13:00 UTC · 1d agoExploit / PoC in the wild 15 sourcesCVE-2026-764615· 2 reads

Coast Guard says it is monitoring cyberattack that disrupted North Carolina's ports

CyberScoop·Aug 7, 14:24 UTC · Aug 7, 2026Exploit / PoC in the wild

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories·Sep 15, 12:00 UTC · 1d agoAdvisory

ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

Zero Day Initiative disclosed an unauthenticated information disclosure vulnerability (CVSS 5.8) in Microsoft Azure Entra ID's OAuth device code grant flow.

ZDI published advisory ZDI-26-629 describing an information disclosure vulnerability in Microsoft Azure Entra ID related to the OAuth device code grant. Remote attackers can disclose sensitive information without authentication. ZDI assigned a CVSS 3.1 score of 5.8; no CVE identifier is listed in the advisory text.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisory1

Back-to-back N-able bugs send admins on a patching spree

CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.

N-able disclosed CVE-2026-86218 on September 6, a pre-authentication remote code execution flaw with CVSS 10.0 in its N-central RMM platform, and both N-able and Huntress report it is being exploited in the wild. It follows Huntress's disclosure of an exploit chain combining CVE-2026-86206 and CVE-2026-86207 that bypasses access controls to create unauthorized administrative accounts, investigated after a September 4 compromise of a fully patched customer environment. N-able has applied mitigations to all hosted N-central instances; on-premises customers must upgrade to Hotfix 4 (build 2026.3.1.14) immediately.

CSO Online·Sep 7, 11:53 UTC · 9d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

Privilege escalation from IIS AppPool to NT Authority/SYSTEM

A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.

A technical write-up details a Windows privilege escalation path that moves an IIS application pool identity to NT AUTHORITY/SYSTEM by abusing the Active Directory Certificate Services RPC endpoint. The technique chains the restricted IIS AppPool service context with AD CS access to reach SYSTEM on the host. The post is relevant for defenders mapping privilege escalation paths on Windows web servers.

Lobsters · security·Aug 31, 12:36 UTC · 16d agoResearch

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker News·Sep 3, 15:52 UTC · 12d agoVulnerabilityCVE-2026-20212CVE-2026-20274CVE-2026-20279+5 CVEs

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks

Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.

Cisco confirmed in August 2026 that CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center, is being actively exploited, allowing remote attackers to execute scripts and commands as root via crafted HTTP requests to the web interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch by September 12, 2026. Shared IOCs, identical hot fixes, and a July 23 log entry suggest CVE-2026-20079 was used alongside the separately exploited static-credential flaw CVE-2026-20316 in the same attacks. Cisco released patches and cloud fixes, warns hot fixes do not remediate already-compromised devices, and says there are no workarounds.

BleepingComputer·updated Sep 14, 09:27 UTC · 2d ago·first Sep 9, 21:40 UTC · 6d agoExploit / PoC in the wild 14 sourcesCVE-2026-20079CVE-2026-20316

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CR·Sep 9, 07:03 UTC · 7d agoResearch