Search: “baseline”

4 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI research 118 Industry 41 Research 32 AI safety & security 26 Model release 15 Tools 10 AI industry 10 AI tools & infra 10 Advisory 6 Threat actor 5 AI policy 4 Vulnerability 4 Exploit / PoC 3 Policy & legal 3

SeverityAll critical 1 high 12 medium 9 low 1 info 268

Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins

Microsoft's September Windows 11 cumulative update KB5124008 breaks Active Directory domain trust on domain-joined machines, blocking logins despite valid credentials.

Microsoft is investigating community reports that KB5124008, the September 8, 2026 cumulative update for Windows 11 24H2/25H2 (builds 26100.9445/26200.9445), breaks the AD secure channel, causing 'The user name or password is incorrect' errors on interactive logon. Admins reproduced the failure consistently and observed nltest error 1786 (ERROR_NO_TRUST_LSA_SECRET) plus domain controller Event 4625 with status 0xC000006D over NTLM. The problem is suspected in Machine Identity Isolation, a Credential Guard capability that moves machine-account secrets into virtualization-based security, and disabling it via registry value, Group Policy, or Intune baseline restored trust. The September 14 out-of-band update KB5129195 does not address the domain trust issue, and Microsoft's release notes do not list it as a known problem.

Cyber Security News00:29 UTC · 7h agoVulnerability 2 sources

CVE-2026-34908: UniFi OS Auth Bypass Vulnerability

Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.

CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.

Web discovery (articles for new exploits & KEV entries)Sep 8, 21:57 UTC · 8d agoVulnerability CVE-2026-34908

CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.

Web discovery (articles for new exploits & KEV entries)Sep 7, 19:42 UTC · 9d agoVulnerability 3 sources CVE-2026-505221

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help

High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.

Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.

Zscaler ThreatLabzSep 3, 20:19 UTC · 13d agoVulnerability CVE-2026-629112