60
Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
90
57
57
60
60
50
60
60
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.
60
45
60
November 2018 Patch Tuesday: Microsoft fixes 63 flaws, one actively exploited zero-day
60
60
Public PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026
60
U.S. CISA adds a flaw in WatchGuard Fireware OS to its Known Exploited Vulnerabilities catalog
60
45
60
May 2018 Patch Tuesday: Microsoft fixes 2 zero-day flaws reportedly exploited by APT group
60
CISA adds five vulnerabilities in Juniper devices to its Known Exploited Vulnerabilities catalog
60
60
Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
60
Multiple flaws in Fortinet FortiOS fixed
60
60
60
60
60
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
March 2021 Patch Tuesday: Microsoft fixes yet another actively exploited IE zero-day
60
57
60
Microsoft Patches 5 Zero-Day Vulnerabilities Being Exploited in the Wild
60
60
60
Microsoft Releases Record
60
60
60
60
Critical Exchange Server Flaw (CVE-2024
60