Source: Qualys ThreatPROTECT

2 stories in the last 30d

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECTSep 9, 12:23 UTC · 6d agoVulnerability in the wildCVE-2026-81963 CVE-2026-85880 CVE-2026-58599+27 CVEs

Veeam Released Patches for Critical Vulnerability (CVE-2026-65641)

Veeam patched critical CVE-2026-65641 (CVSS 9.3) in Veeam ONE, exploitable by unauthenticated network attackers to coerce SMB authentication from the service account.

Veeam released patches for its Veeam ONE monitoring, reporting, and capacity planning software addressing CVE-2026-65641, rated critical with a CVSS score of 9.3. Successful exploitation allows an unauthenticated network attacker to coerce SMB authentication from the Veeam ONE service account, creating relay-style attack opportunities. Qualys ThreatPROTECT relayed the vendor advisory; administrators should apply the patches promptly. No in-the-wild exploitation is noted in the advisory.

Qualys ThreatPROTECTAug 31, 16:26 UTC · 15d agoVulnerability CVE-2026-65641

Source: Qualys ThreatPROTECT

Microsoft Patch Tuesday, September 2026 Security Update Review

Veeam Released Patches for Critical Vulnerability (CVE-2026-65641)