Search: “security gateway”

7 stories in the last 24h

Microsoft's quarterly benchmark claims Defender missed 55.4% fewer high-severity email threats than the next-closest secure email gateway.

Microsoft published its fifth consecutive quarterly email security benchmark covering May through July 2026, reporting Defender missed 221 high-severity threats per 1,000 protected users, 55.4% fewer than the next-closest SEG vendor, and caught 92% of post-delivery malicious messages. Microsoft notes missed threats are rising across vendors as AI helps attackers craft more convincing impersonation attempts. The report also highlights product updates, including a redesigned AI model stack that reduced false negatives by roughly two-thirds and new prompt injection protection for Copilot and other AI systems that process email.

Microsoft Security BlogSep 17, 16:00 UTC · 22h agoIndustry

12 Best Multi-Cloud Security Platforms Compared (2026): Features & Pricing

A buyer's guide compares pricing and features of 12 multi-cloud security platforms including Wiz, Prisma Cloud, FortiCNAPP, and Defender for Cloud.

The GBHackers roundup profiles 12 multi-cloud security platforms, including Wiz, Fortinet FortiCNAPP, Palo Alto Prisma Cloud, Sysdig, Microsoft Defender for Cloud, Uptycs, and Check Point CloudGuard. It focuses on cross-cloud billing parity, connector fees, ELA absorption, and negotiation tactics for procurement teams. The article notes Ermetic has consolidated into Tenable Cloud Security and that Google's acquisition of Wiz is finalized.

GBHackers08:13 UTC · 5h agoTools 10 sources

New Check Point flaw lets hackers execute code with root privileges

Check Point patched CVE-2026-91843, a stack-based buffer overflow in Security Management Server logins enabling unauthenticated root remote code execution.

Check Point fixed CVE-2026-91843, a stack-based buffer overflow in the Security Management Server and Log Server login process that allows unauthenticated, low-complexity root RCE without user interaction. All Security Management Server deployments are vulnerable regardless of configuration. Fixes ship via LivePatch, with mitigation limiting SmartConsole Trusted Clients to trusted IPs, and attacks are detectable via 'Administrator failed to log in: Username too long' alerts. The new flaw is not yet flagged as exploited, though Check Point zero-days CVE-2026-50751 and CVE-2026-16232 are actively abused, including by a Qilin ransomware affiliate, and NCSC-NL urged fast patching of CVE-2026-85102 and CVE-2026-85103.

BleepingComputer09:34 UTC · 4h agoVulnerability 10 sources CVE-2026-91843 CVE-2026-85103 CVE-2026-85102+2 CVEs

Cisco patches max-severity ISE flaw, the second critical zero-day this week

Cisco emergency-patched actively exploited CVE-2026-76460 (CVSS 10.0), an unauthenticated API flaw granting root on ISE appliances; CISA added it to KEV.

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in a Cisco Identity Services Engine management API that lets unauthenticated attackers gain root privileges. It affects ISE and ISE-PIC in all configurations and is fixed in 3.1 Patch 12 through 3.5 Patch 4. CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirmed in-the-wild exploitation. A broader review fixed 21 critical ISE flaws plus high- and medium-severity issues, following earlier exploited firewall flaws CVE-2026-20079 and CVE-2026-20131.

CSO OnlineSep 17, 21:03 UTC · 17h agoExploit / PoC in the wildCVE-2026-76460 CVE-2026-20079 CVE-2026-201312· 2 reads

Cisco alerts customers to second actively exploited zero-day in as many days

Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.

Cisco disclosed CVE-2026-76460, exploited before patching and discovered during a technical support case, in an ISE API allowing remote unauthenticated root access; CISA quickly added it to KEV. It is the third actively exploited ISE flaw since June 2025, after CVE-2025-20337 and CVE-2025-20281. It is unrelated to CVE-2026-76461, the Secure Email Gateway zero-day disclosed days earlier. Cisco published IOCs, said no workarounds exist, and no threat actor has been attributed.

CyberScoopSep 17, 21:03 UTC · 17h agoExploit / PoC in the wild 26 sources CVE-2026-76460 CVE-2026-76461 CVE-2025-20337+1 CVEs

MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login

Bishop Fox's MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to gain unauthenticated admin control of internet-exposed MikroTik RouterOS devices, with compromise evidence.

MikroTrick chains CVE-2026-67279, an SSH rekeying flaw letting unauthenticated clients reach post-authentication functions, with CVE-2026-86060, where dash-prefixed usernames make a helper load a trusted identity record granting full administrator access on RouterOS 7.x builds. Bishop Fox reproduced full passwordless takeover and found configuration artifacts on internet-facing devices, indicating exploitation began before the flaws became public. Fixes shipped in RouterOS 6.49.21, 7.23.4, and 7.24.2; observed persistence includes a 'logrotate' script and 'daily-maint' scheduler recreating a privileged account with owner="0".

Cyber Security News09:59 UTC · 4h agoExploit / PoC in the wild 2 sources CVE-2026-67279 CVE-2026-86060

Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Accessnew

Four patched Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—let local attackers corrupt kernel memory and gain root privileges.

Researchers disclosed four Linux kernel privilege escalation vulnerabilities in long-standing networking code: DirtyAH6 (CVE-2026-80844) in IPv6 Authentication Header/XFRM processing, TUNderflow (CVE-2026-81000) in the TUN/TAP subsystem, PPPoEject (CVE-2026-68121), a use-after-free in PPP over Ethernet's pppoe_sendmsg(), and DiagSpill (CVE-2026-74469) in SCTP sock_diag reporting caused by a wrapping 16-bit transport counter. Most are local privilege escalation bugs, though IPv6 routers using AH transport mode face narrow remote denial-of-service risk, and one researcher demonstrated remote root access in a lab via memory grooming. Researcher Asim Viladi Oglu Manizada reported the issues to the kernel security team in mid-July, and coordinated patches are now available in stable branches including 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Restricting unprivileged user namespaces helps for three flaws but does not mitigate DiagSpill.

Cyber Security News13:13 UTC · 54m agoVulnerability 3 sources CVE-2026-80844 CVE-2026-81000 CVE-2026-68121+1 CVEs