60
Microsoft Patch Tuesday for May 2023 fixed 2 zero
60
Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs
Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited zero-days: CVE-2026-85880, an ALPC heap buffer overflow, and CVE-2026-81963 in the Windows Update Stack, both CVSS 7.8 local privilege escalations. It also addresses an unauthenticated Exchange RCE (CVE-2026-55007) triggered by Visio attachment content indexing under memory pressure, an RDP use-after-free (CVE-2026-69525, CVSS 9.8), and 20 wormable flaws in DNS, DHCP, SMB, Active Directory, and other components. ZDI attributed the rising volume partly to AI-assisted vulnerability discovery, noting no corresponding spike in active exploits yet.
88
U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.
CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.
72
Broadcom Patches Critical ESXi Vulnerability Enabling Host Code Execution
60
60
60
60
60
60
60
Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month
60
Ubiquiti Patches Critical UniFi OS Flaws Allowing Command Injection and Privilege Escalation
60
60
Fortinet Warned as Three Critical FortiSandbox Bugs Come Under Attack
60
CVE-2026-20262: CISCO Catalyst SD-WAN Flaw Under Active Targeted Exploitation
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
60
60
New cPanel vulnerabilities could allow file access and remote code execution
60
60
60
60
60
60