U.S. CISA adds Dahua IP Camera, Linux Kernel and Microsoft Exchange Server bugs to its Known Exploited Vulnerabilities catalog
60
60
60
CISA adds 8 vulnerabilities to its Known Exploited Vulnerabilities Catalog
60
Network Security Trends: November 2021 to January 2022
60
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.
85
60
Public PoC Released for Critical libssh2 CVE-2026-55200 Client
60
60
60
60
50
60
60
Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities
60
Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High
60
60
60
60
60
Google fixed second actively exploited Chrome zero
60
60
Apple fixes four zero-days under attack
60
60
60
60
60
60
Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
60
60
60
60
57
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
Proofpoint and Volexity report that multiple espionage clusters share the BlueMoon exploit kit, chaining Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC local privilege escalation CVE-2026-85880. Proofpoint observed spearphishing use since August 28 by JungleBamboo (APT31), while Volexity saw UTA0560 targeting NGOs from September 1; UNK_LateNight hit US aerospace/defense with ShadowPad and UNK_DoubleCheck targeted Vietnamese manufacturers. The kit's maintainers reverse-engineer public Chromium fixes before stable Chrome releases, and Proofpoint suspects the ALPC exploit has existed since 2025.
85
Chrome 153 Patches Seventh Zero-Day of 2026
Google patches Chrome V8 zero-day CVE-2026-87491, exploited in the wild, marking the seventh exploited Chrome zero-day of 2026, in an update fixing 230 flaws.
Google released Chrome 153 with fixes for 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google says is being exploited in the wild. It is the seventh zero-day patched in Chrome in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046. The update also fixes five critical bugs (four in WebGL, one in Cast), 41 high-severity defects, and more than 180 medium/low issues, rolling out as 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux.
72
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
82
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.
Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).
85
2026-007: Critical Vulnerability in Windows Netlogon
Actively exploited CVSS 9.8 Windows Netlogon flaw lets unauthenticated attackers execute code with SYSTEM privileges on domain controllers.
Microsoft's May 2026 advisory describes CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon (CVSS 9.8) that allows unauthenticated remote code execution with SYSTEM privileges on domain controllers via specially crafted packets. The Centre for Cybersecurity Belgium reports the flaw is currently being exploited by threat actors. All Windows Server versions from 2012 through 2025 acting as domain controllers are affected and require the May updates.
88
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.
CISA added CVE-2026-75650 (Adobe Commerce and Magento, improper neutralization in a template engine), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow), and CVE-2026-86218 (N-able N-central static code injection) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on exposed assets that grant total control post-exploitation and check for pre-patch compromise. All organizations are encouraged to prioritize these flaws in risk-based patching.
72
Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
82