ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “hotfix”

8 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 36Vulnerability 16Malware 3Advisory 3Phishing & fraud 1Threat actor 1Industry 1
SeverityAllcritical 30high 27medium 3low 0info 1

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

N-able shipped Hotfix 4 for a CVSS 10.0 unauthenticated RCE (CVE-2026-86218) in N-central RMM, with conflicting statements on exploitation.

N-able released 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a static code injection weakness (CWE-96) scored 10.0 on CVSS 4.0 that enables pre-authentication remote code execution on on-premises N-central RMM servers. Hosted NCOD instances are already patched; N-able's incident notice says the flaw was observed exploited in the wild while its release notes say exploitation is unconfirmed. Huntress, which has tracked N-central attacks since August, advises IP allowlisting, VPN-only access, or taking internet-reachable servers offline until patching. It is the fourth hotfix in five weeks, following fixes for CVE-2026-86206 and CVE-2026-86207, which CISA added to its Known Exploited Vulnerabilities catalog.

The Hacker News · 10d agoVulnerability in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+4 CVEs

N-able Releases Hotfix for Critical Remote Code Execution Vulnerability

N-able shipped Hotfix 4 patching CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-central, with no confirmed production exploitation yet.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw in N-able's N-central remote monitoring and management platform, disclosed September 6 with a maximum CVSS score of 10. It affects N-central versions before 2026.3.1.14 and is patched in N-central 2026.3 Hotfix 4. N-able says it has found no evidence of exploitation in production environments. It is the fifth N-able vulnerability disclosed in weeks, following two KEV-listed authentication bypasses and two internal API bypasses.

Infosecurity Magazine · 9d agoVulnerabilityCVE-2026-86218CVE-2026-18556CVE-2026-18577+2 CVEs

2026-012: Critical Vulnerabilities in Check Point Products

Check Point issued emergency hotfixes for two CVSS 9.8 flaws (CVE-2026-85102, CVE-2026-85103) enabling unauthenticated RCE on VPN-enabled gateways.

On 9 September 2026, Check Point released emergency security updates for CVE-2026-85102 (improper certificate-data validation in VPN negotiation) and CVE-2026-85103 (heap overflow in VPN certificate ASN.1 decoding), both CVSS 9.8, allowing unauthenticated remote code execution. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments configured with Remote Access or Site-to-Site VPN, spanning versions R80 through R82.10. CERT-EU advisory 2026-012 urges immediate hotfix application, prioritizing internet-facing and perimeter appliances.

CERT-EU Advisories · 7d agoVulnerabilityCVE-2026-85102CVE-2026-85103

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 Blog · 8d agoVulnerabilityCVE-2026-86206CVE-2026-86207CVE-2026-18577

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.

The Dutch NCSC assesses the likelihood and impact of exploitation as high for two critical Check Point VPN flaws, though no public PoC exploit has been reported. CVE-2026-85102 is improper validation of certificate data during VPN negotiation, and CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder; both enable remote code execution on Security Gateways, the latter also on Security Management Servers. Affected releases span R81.20, R82, R82.10, R81.10.x, R82.00.x and EoS versions R80 through R81.10, while R82.20 is unaffected. Check Point shipped fixes on September 9 via LivePatch Take 24 and Jumbo Hotfix Accumulator takes, and NCSC advises restricting Site-to-Site VPN rules to trusted IPs.

BleepingComputerupdated · 3h agofirst · 4d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-851032

N-able N-central HF4 Fixes Critical RCE After Series of Authentication Flaws

N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a critical pre-authentication RCE.

N-able shipped N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to patch CVE-2026-86218, a critical remote code execution vulnerability exploitable without authentication. The hotfix follows a series of authentication flaws discovered in the N-central platform. Organizations running N-central should apply the update promptly; the notice does not report active exploitation.

SOCRadar · 10d agoVulnerabilityCVE-2026-86218

Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections

Microsoft's September 2026 Windows 11 update KB5124008 breaks certificate-based Always On VPN on some enterprise clients, forcing admins to pause rollout.

Microsoft's September 8, 2026 cumulative update KB5124008 for Windows 11 24H2 (build 26100.9445) and 25H2 (build 26200.9445) breaks certificate-based Always On VPN tunnels on some enterprise clients, with connectivity restored after uninstalling the update and rebooting. The issue was first detailed on Microsoft Q&A on September 9 by an administrator using Intune-deployed VPN profiles with RRAS and NPS on Windows Server 2019. The same mandatory Patch Tuesday package fixes two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, so many teams are pausing only VPN cohorts rather than blocking the full rollout.

Cyber Security Newsupdated · 1d agofirst · 5d agoVulnerability in the wild 9 sourcesCVE-2026-81963CVE-2026-858802

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.

Plex released fixes in Plex Media Server 1.43.3 and Plex Desktop 1.115.0 for multiple undisclosed security flaws, with CVE identifiers requested and details not yet published. Censys data shows more than 360,000 devices expose the Plex Media Server web interface. Past Plex flaws saw real exploitation, including CVE-2020-5741 (CVSS 7.2), used to implant a keylogger on a LastPass employee's home computer during the 2022 breach, and CVE-2025-34158 (CVSS 8.5), an authentication bug patched in August 2025.

The Hacker News · 13d agoVulnerabilityCVE-2025-34158CVE-2020-5741