60
60
60
60
Ongoing exploitation of Cisco Catalyst SD
60
60
57
60
57
60
60
60
57
57
60
60
60
60
60
60
60
60
60
45
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth RCE in N-able N-central, to KEV after N-able confirmed in-the-wild exploitation; patch by September 11.
CISA added CVE-2026-86218, a maximum-severity static code injection flaw enabling pre-authentication remote code execution in N-able N-central, to its Known Exploited Vulnerabilities catalog with a September 11, 2026 deadline for federal agencies. The flaw is fixed in N-central 2026.3 Hotfix 4 (released September 5), and N-able told customers it has been observed being exploited in the wild. Separately, Huntress is investigating the compromise of a fully patched customer N-central environment on September 4 and cannot yet confirm which flaw was used, while Rapid7-disclosed CVE-2026-86206 and CVE-2026-86207 can be chained by an unauthenticated attacker to create a rogue System Administrator account.
84
45
57
60
Cisco Confirms Active Exploitation of Two Catalyst SD
60
60
45
60
60
60
60
60
60
Week in review: Chrome zero-day is actually in libwebp, Sony hacking rumours
60
57
60