42
42
42
42
42
42
EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security
42
42
42
42
CVE-2026-34908: UniFi OS Auth Bypass Vulnerability
Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.
CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.
55
CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability
CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.
CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.
74
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.
Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.
78
Windows 11’s strongest security defenses can be bypassed without a screwdriver
Researchers found a script-only attack, 'Download More RAM', that rewrites DIMM configuration chips to bypass Windows 11 VBS and HVCI security boundaries.
Researchers at the University of Birmingham and Durham University showed that overwriting configuration data on unprotected DDR4/DDR5 module chips creates memory aliases that let attackers with existing privileged access defeat Virtualisation-based Security and HVCI, re-enable blocklisted drivers, kill EDR, and bypass group policy. Microsoft assigned CVE-2026-23670 and shipped mitigations in its April 2026 updates; systems with Secure Boot enabled are protected. Affected unprotected product lines are estimated at more than half of the high-performance consumer memory market and over 70% of the gaming segment.
55
42
42
42
42
47
42
42
42
42
42
42
42
42
42
42
47
42
42
42
42
42
42
42
42
42
42