60
60
60
60
60
60
May 2026 CVE Landscape
60
60
60
60
60
14th September – Threat Intelligence Report
Check Point weekly digest: Microsoft's record 974-vuln Patch Tuesday ships two actively exploited Windows zero-days; IDScan.net, Mathspace, Revolut suffer breaches.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited privilege-escalation zero-days, CVE-2026-85880 and CVE-2026-81963, plus 20 flaws allowing unauthenticated remote code execution. Disclosed breaches include IDScan.net (identity documents), Mathspace (over 1 million people via Metabase CVE-2026-72898), Revolut, and Florida DMV (ShinyHunters). GitLab fixed critical CVSS 10.0 path traversal CVE-2026-85706, and MikroTik fixed chainable RouterOS flaws CVE-2026-67276 and CVE-2026-86060. The report also covers the PuzzleMask LLM jailbreak technique, GoldFactory's Gigabud Android fraud, and the BlueMoon Chromium exploit chain (CVE-2026-85046).
78
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.
80
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60
Microsoft patches zero-day exploited by attackers (CVE-2023-28252)
60
60
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are exploiting two unauthenticated WordPress auth bypasses (CVE-2026-61979, CVE-2026-15981, max CVSS 9.8) in miniOrange SAML SSO to gain admin sessions.
Patchstack disclosed two flaws in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin: CVE-2026-15981 (CVSS 9.8) accepts malformed signatures because mo_saml_validate_signature() loosely checks the tri-state result of openssl_verify(), and CVE-2026-61979 (CVSS 8.1) enables privilege escalation via signature algorithm confusion. Both let unauthenticated attackers sign in as any WordPress user, including administrators; fixes shipped in Standard edition versions 17.0.6 and 17.0.5. DigitalOcean observed an attacker using the bypass to obtain an admin session cookie, opportunistic scanning is underway from six IP addresses, and PoC chaining code is public.
72
60
Zero-Click WhatsApp Account Takeover Hits iPhone Users Running iOS 16. No Linked Devices, No Warning
60
60
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
60
60
60
60
60
60
Second flaw found in Swiss election system could change 'valid votes into nonsense,' researchers say
60
60
60
60
60
Critical ScreenConnect flaw now actively exploited in attacks
CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.
ConnectWise's ScreenConnect flaw CVE-2026-84869, an improper privilege management and missing authorization bug, lets attackers with basic privileges transfer or execute files through active remote sessions in low-complexity attacks without user interaction. It is patched in ScreenConnect 26.6.5; CISA added it to the KEV catalog and ordered US federal agencies to secure systems within three days. Shadowserver tracks over 1,000 unpatched exposed instances, mostly in North America (758) and Europe (180). This is the fourth actively exploited ScreenConnect flaw since 2024; earlier issues were abused by Kimsuky and ransomware gangs.
82
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.
CVE-2026-5430 (CVSS 9.8-10.0), an improper cryptographic signature verification flaw in WSO2 API Manager, lets JWT authentication be bypassed with unsupported algorithms, enabling administrative account takeover. watchTowr honeypots captured forged JWT tokens with baked-in administrator privileges on September 13, 2026, which could expose API credentials, consumer keys, and secrets for every registered application. Affected products include WSO2 API Manager 4.1.0-4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Fixes are available via GitHub pull requests and subscription update levels, and users are urged to patch immediately.
78
Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
68
Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
MikroTik RouterOS SSH auth-bypass chain MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is actively exploited; patch to 7.24.2/7.23.5/6.49.21.
Attackers are actively exploiting a chain dubbed MikroTrick that combines CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass in RouterOS RSA public key verification, and CVE-2026-86060, an SSH session privilege escalation, giving full admin control of internet-exposed MikroTik devices without the private key. Exploitation began around September 2, 2026, a day before MikroTik's September 3 patches, with confirmed compromises including creation of an 'ops' account; attacks traced to IPs 82.192.72.4 (Leaseweb) and 103.102.31.18. Fixed versions include 7.25beta3, 7.24.2, 7.23.4, 7.23.5 and 6.49.21. Defenders should check logs for failed logins with username '-2' and inspect /system history for ssh:-2@<IP> entries attached to configuration changes.
88
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.
85
CVE-2026-16232: Check Point SmartConsole Auth Bypass
Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.
CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.
75
BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
Attackers used a BGP hijack to divert Softaculous traffic and push a malicious Virtualizor update granting root persistence on some hypervisors.
Virtualizor reported that a BGP hijack between August 28 20:57 UTC and August 30 06:10 UTC diverted Softaculous update traffic to an attacker-operated server holding a valid Let's Encrypt certificate. Installations checking for updates during the window could receive a malicious package that added an attacker SSH key to root, created a proxyuser account, and installed a Java payload persisted via a systemd service. Hosting provider AlbaHost confirmed 5 of its 34 Virtualizor hypervisors were root-compromised. Virtualizor shipped Patch 9 with a Security Analyzer on September 1, but cryptographic package signing remains future work.
74
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors exploit CVE-2026-82329, a default-config authentication bypass in JFrog Artifactory, to mint administrator tokens days after patch release.
watchTowr reports that CVE-2026-82329 (CVSS 9.8), an authentication bypass in JFrog Artifactory patched in version 7.161.20 on August 28, 2026, is being actively exploited as of September 1. The flaw, in JFrog Access, lets unauthenticated attackers abuse a 'phantom' join key on default configurations to forge access and mint administrator-level credentials. Observed activity includes admin token generation, user, group, and token enumeration, and backdoor user creation in limited cases, raising supply chain poisoning and lateral movement risks for the widely used artifact repository.
80