60
60
60
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60
60
Adobe ColdFusion vulnerabilities exploited to deliver web shells (CVE-2023-29298, CVE-2023-38203)
60
60
CISA adds Microsoft, Apple bugs to exploited vulnerabilities catalog
60
47
35
60
60
60
60
55
60
35
60
60
47
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.
Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.
78
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
72
AI-driven bug hunting fuels record Microsoft Patch Tuesday
60
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
60
CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133)
60
Microsoft Issues Patches for SharePoint Zero
60
60
60
60
60
CVE-2025-10585 is the sixth actively exploited Chrome zero
60
60
55
60
60
Microsoft, Adobe, SAP deliver critical fixes for September 2025 Patch Tuesday
60
60
60
42
60