December 2018 Patch Tuesday: Microsoft patches Windows zero-day exploited in the wild
60
May 2018 Patch Tuesday: Microsoft fixes 2 zero-day flaws reportedly exploited by APT group
60
Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
90
60
60
Microsoft Patch Tuesday fixes three flaws actively exploited in attacks in the wild
60
June 2021 Patch Tuesday: Microsoft fixes six actively exploited zero-days
60
Week in review: Windows zero-day exploited, Patch Tuesday forecast, selecting a compliance solution
60
August 2018 Microsoft Patch Tuesday fixes two flaws exploited in attacks in the wild
60
January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE
60
March 2021 Patch Tuesday: Microsoft fixes yet another actively exploited IE zero-day
60
60
August 2018 Patch Tuesday: Microsoft fixes two actively exploited zero-days
60
September 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
60
Microsoft discloses more than 130 vulnerabilities as part of July’s Patch Tuesday, four exploited in the wild
60
December 2019 Patch Tuesday: Microsoft fixes one actively exploited zero-day
60
February 2021 Patch Tuesday: Microsoft and Adobe fix exploited zero-days
60
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
60
First Microsoft Patch Tuesday zero-day of 2024 disclosed as part of group of 75 vulnerabilities
60
60
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
60
November 2019 Patch Tuesday: Actively exploited IE zero-day fixed
60
July 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
60
Patch Tuesday: 80+ vulnerabilities fixed, one exploited in the wild
60
November 2018 Patch Tuesday: Microsoft fixes 63 flaws, one actively exploited zero-day
60
Patch Tuesday: Microsoft fixes 5 actively exploited zero-days
60
September 2018 Patch Tuesday: Microsoft fixes actively exploited zero-day
60
60
October 2018 Patch Tuesday: Microsoft fixes 49 flaws, one APT-wielded zero-day
60
May 2024 Patch Tuesday: Microsoft fixes exploited zero-days (CVE-2024-30051, CVE-2024-30040)
60
Microsoft Patch Tuesday matches last year’s zero-day high with six actively exploited vulnerabilities
60
Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026
60
60
60
Week in review: Exploited Ivanti Connect Secure zero-day, Patch Tuesday forecast
60
60
60
Microsoft Releases Record
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60