Microsoft Releases Record
60
60
U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog
60
60
Microsoft Patches Six Zero-Day Security Holes
60
Microsoft Condemns
60
60
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
60
60
60
4 New BlueKeep-like 'Wormable' Windows Remote Desktop Flaws Discovered
60
60
60
Microsoft patches actively exploited Exchange, Excel zero-days (CVE-2021-42321, CVE-2021-42292)
60
60
60
When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence details attacks on exposed AI workloads exploiting LiteLLM gateways for credential harvesting, persistence, and cryptomining.
Microsoft Threat Intelligence examines attacks targeting exposed AI workloads, including exploitation of LiteLLM gateway deployments. Post-exploitation activity includes credential harvesting, establishing persistence, and cryptomining. The post urges defenders to secure AI infrastructure gateways and control points; the available text does not name threat actors, CVEs, or provide IOCs.
60
60
60
Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
90
60
60
60
60
50
Microsoft patches four exploited zero-days, but lags with fixes for a fifth (CVE-2023-36884)
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
45
60
50
60
60
Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026
60
60
Exchange Servers targeted via zero-day exploits, have yours been hit?
60
60
Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM
Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.
Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.
60
Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.
CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.
72