60
60
Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.
88
60
60
60
60
60
Kaspersky Security Bulletin 2020
60
60
60
Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)
Actively exploited Citrix NetScaler flaw CVE-2026-8452, patched in June, now added to CISA KEV; attackers deploy web shells and run discovery commands.
CISA added CVE-2026-8452, a memory overflow vulnerability in Citrix NetScaler ADC/Gateway, to its Known Exploited Vulnerabilities catalog on August 26, 2026, giving federal agencies until August 29 to remediate. Citrix disclosed and patched the flaw on June 30, 2026 in versions 14.1-72.61, 13.1-63.18, and 13.1-37.272. watchTowr Labs found the flaw can be chained into unauthenticated remote code execution and released a PoC on August 14. Previdian and Defused reported exploitation with web shells named x.php and z.php from at least three unique source IPs.
82
60
60
Cisco, Hitachi, Microsoft, and Progress Flaws Actively Exploited—CISA Sounds Alarm
60
March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero
60
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week
60
Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
60
60
Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs
60
60
September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)
Microsoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including 113 critical and two Windows privilege-escalation flaws already exploited in the wild.
Microsoft patched 973 vulnerabilities this month, its largest Patch Tuesday ever and far above the previous record of 664 set in July 2026, with 113 rated critical. Two Important elevation-of-privilege flaws (CVSS 7.8) are confirmed exploited in the wild: CVE-2026-81963 in the Windows Update Stack (improper link resolution, affects Windows 11 and Server 2025) and CVE-2026-85880 in Windows ALPC (heap-based buffer overflow allowing sandbox escape to SYSTEM, affects Windows 10 and Server 2012-2022). Critical unauthenticated RCEs (CVSS 9.8) were also fixed in Skype for Business Server (CVE-2026-66302), Windows Message Queuing (CVE-2026-69579), and Windows RRAS (CVE-2026-69590). SANS urges prioritizing the two exploited EoP fixes, then patching exposed MSMQ, RRAS, and Skype for Business deployments.
78
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.
Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.
80
60
60
60
60
60
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.
80
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
82
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
60
60
Imperva Data Security Fabric provides data-centric protection for enterprise data lakes built on AWS
60
60
60
Microsoft patches 80+ vulnerabilities, six flagged as "more likely" to be exploited
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
60
60