Search: “patch”

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor

Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.

Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.

Help Net Security·Sep 9, 09:04 UTC · 7d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69730+4 CVEs

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.

CSO Online·Sep 9, 03:27 UTC · 7d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-69730+2 CVEs1

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow patched four AI Platform flaws, including three pre-authentication CVSS 10.0 issues enabling unauthenticated code execution, SQL injection, and privilege escalation.

ServiceNow released patches on August 27, 2026 for four AI Platform flaws: CVE-2026-18885 (code injection in the GraphQL Composite Data API), CVE-2026-18886 (improper access control enabling privilege escalation), and CVE-2026-74820 (SQL injection), all self-rated CVSS 10.0 and exploitable without authentication, plus CVE-2026-6876, an 8.7 sandbox escape. Updates were deployed to hosted instances, but self-hosted customers must patch affected Xanadu, Yokohama, Zurich, and Australia release lines themselves. ServiceNow says it is not aware of exploitation of the new flaws, and no public exploit code existed as of August 28, 2026; separately, Defused reported in-the-wild exploitation of the earlier CVE-2026-6875 (CVSS 9.5), later noting the captured payload matched Searchlight Cyber's PoC.

The Hacker News·Aug 28, 11:20 UTC · 19d agoVulnerability in the wildCVE-2026-18885CVE-2026-18886CVE-2026-74820+2 CVEs

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Microsoft's September Patch Tuesday fixed a record 974 flaws, including two Windows privilege-escalation zero-days actively exploited and added to CISA's KEV catalog.

Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities (999 including 25 non-Microsoft CVEs), with over 110 rated critical; 723 affect Windows and 111 affect Office. Two Windows privilege-escalation zero-days are actively exploited: CVE-2026-85880, an ALPC heap-based buffer overflow, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack, both allowing attackers to gain SYSTEM privileges. CISA added both flaws to its KEV catalog, giving federal civilian agencies until September 22, 2026 to apply fixes. Volexity, Proofpoint, MSTIC, and independent researchers were credited with the reports; notable additional fixes include network-reachable RCEs in Exchange, SharePoint, SQL Server, Remote Desktop Services, DNS, and DHCP.

The Hacker News·Sep 9, 04:41 UTC · 7d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+9 CVEs

Zyxel Firewalls Under Attack! Urgent Patching Required

The Hacker News·Jun 7, 03:58 UTC · Jun 7, 2023Exploit / PoC in the wildCVE-2023-33009CVE-2023-33010CVE-2023-28771+2 CVEs

Patch Tuesday - September 2026

Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.

Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.

Rapid7 Blog·Sep 8, 21:44 UTC · 7d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-85046+10 CVEs

Memcached - A Story of Failed Patching & Vulnerable Servers

Cisco Talos·Jul 17, 14:35 UTC · Jul 17, 2017RansomwareCVE-2016-8704CVE-2016-8706

Android’s September 2026 Updates Patch 180 Vulnerabilities

Google's September 2026 Android security updates patch 180 vulnerabilities including critical Wi-Fi memory corruption flaw CVE-2026-28662.

Google released September 2026 Android security updates addressing 180 vulnerabilities across two patch levels. The 2026-09-01 level fixes 95 bugs including 23 critical System component flaws enabling RCE, EoP, and DoS. The 2026-09-05 level addresses 85 additional defects in kernel and vendor components including a Wi-Fi memory corruption flaw (CVE-2026-28662) enabling remote code execution without privileges or user interaction.

SecurityWeek·Sep 9, 16:30 UTC · 6d agoAdvisoryCVE-2026-28662

Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.

Microsoft patched 974 vulnerabilities, its largest Patch Tuesday ever, including CVE-2026-85880, a heap buffer overflow in Windows ALPC allowing AppContainer sandbox escape to System, and CVE-2026-81963, a link-following flaw in the Windows Update Stack enabling local privilege escalation. Both were exploited as zero-days before the patch. ZDI's Dustin Childs says 20 of the fixed flaws are wormable, enabling unauthenticated remote code execution. The release also covers 723 Windows flaws and 222 Office bugs, plus fixes in Exchange, SharePoint, SQL Server, Azure and Exchange Server RCE (CVE-2026-55007).

SecurityWeek·Sep 8, 19:20 UTC · 7d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+5 CVEs

Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch

Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.

Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.

CSO Online·Sep 9, 02:22 UTC · 7d agoVulnerabilityCVE-2026-20274CVE-2026-20279

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker News·Sep 2, 10:21 UTC · 14d agoExploit / PoC in the wildCVE-2026-82078CVE-2026-815781

Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.

Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-68820CVE-2026-62832CVE-2026-72971+6 CVEs

September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)

Microsoft's September 2026 Patch Tuesday fixes a record 973 vulnerabilities, including 113 critical and two Windows privilege-escalation flaws already exploited in the wild.

Microsoft patched 973 vulnerabilities this month, its largest Patch Tuesday ever and far above the previous record of 664 set in July 2026, with 113 rated critical. Two Important elevation-of-privilege flaws (CVSS 7.8) are confirmed exploited in the wild: CVE-2026-81963 in the Windows Update Stack (improper link resolution, affects Windows 11 and Server 2025) and CVE-2026-85880 in Windows ALPC (heap-based buffer overflow allowing sandbox escape to SYSTEM, affects Windows 10 and Server 2012-2022). Critical unauthenticated RCEs (CVSS 9.8) were also fixed in Skype for Business Server (CVE-2026-66302), Windows Message Queuing (CVE-2026-69579), and Windows RRAS (CVE-2026-69590). SANS urges prioritizing the two exploited EoP fixes, then patching exposed MSMQ, RRAS, and Skype for Business deployments.

SANS Internet Storm Center·Sep 8, 19:20 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-85880CVE-2026-66302+5 CVEs1

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECT·Sep 9, 12:23 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-85880CVE-2026-58599+27 CVEs

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited zero-days: CVE-2026-85880, an ALPC heap buffer overflow, and CVE-2026-81963 in the Windows Update Stack, both CVSS 7.8 local privilege escalations. It also addresses an unauthenticated Exchange RCE (CVE-2026-55007) triggered by Visio attachment content indexing under memory pressure, an RDP use-after-free (CVE-2026-69525, CVSS 9.8), and 20 wormable flaws in DNS, DHCP, SMB, Active Directory, and other components. ZDI attributed the rising volume partly to AI-assisted vulnerability discovery, noting no corresponding spike in active exploits yet.

Security Affairs·Sep 9, 07:03 UTC · 7d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-55007+3 CVEs1

GitLab Patches Critical Unauthenticated GraphQL Vulnerability

GitLab issued an emergency patch for a critical unauthenticated GraphQL flaw (CVE-2026-19478, CVSS 9.4) enabling remote modification or deletion of public projects.

GitLab patched CVE-2026-19478 (CVSS 9.4), an unauthenticated GraphQL directive flaw allowing remote modification or deletion of public projects and user data on self-managed servers. The emergency patch released August 17 covers versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, but no fixes exist for the 18.2-18.10 branches. A second issue, a CSRF weakness in GraphQL multiplex queries (CVE-2026-19650, CVSS 7.1), shipped in the same release. No exploitation or public PoC has been observed; the flaw was reported by hiimguardian through HackerOne.

Security Affairs·Aug 18, 08:44 UTC · 29d agoVulnerabilityCVE-2026-19478CVE-2026-196501

Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery

Microsoft patches 419 vulnerabilities in record-breaking Patch Tuesday; Windows Winsock zero-day CVE-2026-68820 is actively exploited by Lazarus Group.

Microsoft's August Patch Tuesday fixes 419 vulnerabilities (62 critical, 357 important), among the largest monthly counts on record, following 206 fixes in June and 622 in July as AI-assisted discovery drives unprecedented volume. Three flaws are zero-days; Windows Winsock bug CVE-2026-68820 is exploited in the wild by Lazarus Group in job-themed attacks using PDFs with a trojanised reader. CVE-2026-62832, publicly disclosed by researcher Nightmare Eclipse via the LegacyHive PoC, is also patched. Microsoft now lists bugs by product family instead of itemized CVEs, which defenders warn complicates triage.

The Record·Aug 12, 12:36 UTC · Aug 12, 2026Vulnerability in the wildCVE-2026-68820CVE-2026-62832

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security News·07:45 UTC · 7h agoVulnerability in the wildCVE-2026-62721

New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.

The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.

SecurityWeek·updated Sep 10, 12:18 UTC · 6d ago·first Sep 10, 07:09 UTC · 6d agoExploit / PoC 3 sourcesCVE-2026-50656CVE-2026-694141

Chrome 153 Patches Seventh Zero-Day of 2026

Google patches Chrome V8 zero-day CVE-2026-87491, exploited in the wild, marking the seventh exploited Chrome zero-day of 2026, in an update fixing 230 flaws.

Google released Chrome 153 with fixes for 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google says is being exploited in the wild. It is the seventh zero-day patched in Chrome in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046. The update also fixes five critical bugs (four in WebGL, one in Cast), 41 high-severity defects, and more than 180 medium/low issues, rolling out as 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux.

SecurityWeek·Sep 9, 09:45 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-2441CVE-2026-3909+4 CVEs

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputer·Sep 8, 18:18 UTC · 7d agoAdvisory in the wildCVE-2026-69805CVE-2026-58649CVE-2026-69806+27 CVEs1

SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.

SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.

Cyber Security News·Sep 8, 11:19 UTC · 8d agoVulnerabilityCVE-2026-44756CVE-2026-58240CVE-2026-76969+17 CVEs

Product showcase: Cross-platform and third-party endpoint patching with Action1

Help Net Security·Mar 24, 00:00 UTC · Mar 24, 2026Ransomware in the wild

Microsoft Plugs Nearly 1,000 Security Holes

Microsoft's September Patch Tuesday fixes a record 974 flaws, including two actively exploited Windows zero-days and critical DNS and Windows Shell bugs.

Microsoft released fixes for 974 vulnerabilities, its largest-ever monthly patch batch, bringing the 2026 total above 2,600. Two zero-day privilege elevation flaws, CVE-2026-81963 and CVE-2026-85880, are being actively exploited. Critical bugs include CVE-2026-69730, an unauthenticated DNS weakness in Windows Server 2012 onward and Windows 10 deemed likely to be exploited, and CVE-2026-69829, a CVSS 9.8 Windows Shell remote code execution flaw requiring no privileges or user interaction. Microsoft and other vendors credit AI-assisted discovery for the growing patch volumes.

Krebs on Security·Sep 8, 21:44 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69730+1 CVEs

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...

JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 21:42 UTC · 7d agoVulnerabilityCVE-2026-63077

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help

High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.

Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.

Zscaler ThreatLabz·Sep 3, 20:19 UTC · 12d agoVulnerabilityCVE-2026-629112

Microsoft Shatters Patch Tuesday Record With 974 CVE Fixes in September 2026

Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two actively exploited Windows zero-days, CVE-2026-85880 and CVE-2026-81963.

Microsoft fixed a record 974 CVEs in its September 2026 Patch Tuesday, surpassing the previous record of 570 in July 2026, with Windows affected by 723 flaws and Office by 111, including 119 critical vulnerabilities. Two zero-days are actively exploited: CVE-2026-85880, a 7.8 heap-based buffer overflow in Windows ALPC allowing AppContainer privilege escalation, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack enabling local privilege escalation. Microsoft attributed the update surge partly to agentic AI tools used to discover zero-day vulnerabilities, and researchers highlighted critical RCE flaws in Windows DNS, DHCP and Deployment Services as priorities.

Infosecurity Magazine·Sep 9, 09:40 UTC · 7d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2026-62878+4 CVEs1

Microsoft patches a record 972 vulnerabilities, 112 of them critical

Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.

Microsoft's September 2026 release patched roughly 972 vulnerabilities (997 including ported Chromium fixes for Edge), a record, with 112 rated critical. Notable flaws include two zero-days: CVE-2026-81963 in the Windows update service and CVE-2026-85880 in the Windows Advanced Local Procedure, with no public information on exploitation breadth. Microsoft has fixed 2,760 vulnerabilities in 2026, more than double last year's total, which ZDI's Dustin Childs attributes to AI-assisted discovery becoming the 'new normal'.

Ars Technica · Security·Sep 8, 21:11 UTC · 7d agoVulnerabilityCVE-2026-81963CVE-2026-85880

Microsoft Patch Tuesday for August 2026 Fixed a Zero

Microsoft's August 2026 Patch Tuesday fixes 398 CVEs, including an actively exploited WinSock zero-day CVE-2026-68820 and wormable DNS RCE CVE-2026-62878.

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, .NET and other products, with 62 rated Critical. The actively exploited CVE-2026-68820 is a use-after-free in the Windows WinSock afd.sys driver that can yield SYSTEM privileges via a race condition. CVE-2026-62878 is a critical, wormable stack buffer overflow in Windows DNS Server allowing unauthenticated, remote code execution without user interaction. Other notable fixes include WDS TFTP RCE CVE-2026-62893, a QUIC flaw affecting roughly 13.5 million sites (CVE-2026-62815), an Exchange authentication bypass EoP demonstrated at Pwn2Own Berlin (CVE-2026-62911), and two TPM 2.0 reference implementation fixes.

Security Affairs·Aug 12, 06:49 UTC · Aug 12, 2026Advisory in the wildCVE-2026-68820CVE-2026-62878CVE-2026-62893+5 CVEs

Amasty patches dozens of Magento extensions, 2 critical

Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.

Extension vendor Amasty released fixes for a large batch of Magento and Adobe Commerce modules, with critical unauthenticated file upload flaws in Advanced Product Reviews and Gift Card that allow attackers to plant web shells and take full control of stores. Dozens of additional high-, medium- and low-severity extensions were also patched. The vendor says the release affects almost every Magento and Adobe Commerce store. A related Order Attributes flaw was previously exploited heavily, with Sansec Shield blocking over 12,000 attempts against 25% of Magento stores in three days.

Sansec (Magento / e-commerce security)·Sep 9, 15:27 UTC · 6d agoVulnerability

Microsoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited

CISA confirms exploitation of two Windows zero-days among 973 Microsoft patches; 22,000 Exchange servers remain unpatched.

Microsoft's September Patch Tuesday sets a record with 973 vulnerabilities, and CISA confirms CVE-2026-81963 and CVE-2026-85880 are being exploited, giving federal agencies until September 22 to patch. Nightwing estimates over 22,000 corporate Exchange servers are unpatched against weaponized exploit code. Analysts describe CVE-2026-81963 as an early link in ransomware chains where phishing leads to privilege escalation, and note year-to-date Microsoft disclosures exceed 2,600 bugs.

The Record·Sep 8, 22:40 UTC · 7d agoExploit / PoC in the wildCVE-2026-81963CVE-2026-85880

FBI, UK gov’t urge orgs to patch Oracle E-Business vuln after alleged Clop campaign

The Record·Oct 6, 19:28 UTC · Oct 6, 2025Ransomware in the wildCVE-2025-61882

Organizations patch CISA KEV list bugs 3.5 times faster than others, researchers find

The Record·May 2, 21:30 UTC · May 2, 2024Exploit / PoC in the wildCVE-2024-29988CVE-2024-21412CVE-2023-7028

September 2021 Patch Tuesday forecast: It's new operating system season

Help Net Security·Nov 14, 08:00 UTC · Nov 14, 2023Vulnerability in the wildCVE-2021-404441

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security News·updated 14:47 UTC · 30m ago·first 09:40 UTC · 5h agoExploit / PoC in the wild 7 sourcesCVE-2026-58704CVE-2026-28662

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)

Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.

Google fixed 230 Chrome vulnerabilities in its stable channel update, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine being exploited in the wild. The flaw, reported by Jihyeon Jeong of Compsec Lab, Seoul National University, is the seventh Chrome zero-day patched by Google in 2026. It affects Chrome versions before 153.0.8010.36, and CISA added it to the Known Exploited Vulnerabilities Catalog urging patching before September 23, 2026. Users should upgrade to Chrome 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac); Qualys customers can detect vulnerable assets with QID 388666.

Qualys ThreatPROTECT·Sep 10, 05:14 UTC · 6d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-2441CVE-2026-3909+4 CVEs

September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including two actively exploited Windows elevation-of-privilege zero-days added to CISA's KEV catalog.

Microsoft's September 2026 Patch Tuesday release addresses 974 vulnerabilities, one of the largest monthly batch sizes. Two of the flaws are actively exploited zero-days, and both are Windows elevation-of-privilege vulnerabilities. CISA added both zero-days to its Known Exploited Vulnerabilities catalog, subjecting them to federal patching deadlines. SOCRadar's report provides a breakdown of the patched vulnerabilities by category.

SOCRadar·Sep 9, 11:20 UTC · 7d agoExploit / PoC in the wild

SAP Patches Maximum Severity “Overpass” Flaw

Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.

Onapsis Research Labs discovered CVE-2026-44756, a memory corruption flaw in SAP Extended Passport (EPP) processing caused by missing boundary validation during deserialization. The bug is reachable from the SAP GUI and RFC layers, is remotely exploitable without authentication by default, and could let attackers run arbitrary OS commands with SAP administrative privileges. No active exploitation was observed at publication. Onapsis also flagged critical S4GET bug CVE-2026-58240 (CVSS 9.8) in the S/4HANA Message Server, credential disclosure CVE-2026-76969 in SAP CAP, and improper access control CVE-2026-66768 in NetWeaver.

Infosecurity Magazine·Sep 9, 08:15 UTC · 7d agoVulnerabilityCVE-2026-44756CVE-2026-58240CVE-2026-76969+1 CVEs

Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks

Ivanti patched ten CVEs across EPMM, Neurons for ITSM and Sentry, including critical unauthenticated deserialization RCE; no active exploitation reported.

On September 8, 2026, Ivanti disclosed advisories covering ten CVEs in Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry. The most severe are two unauthenticated deserialization RCE flaws in Neurons for ITSM, CVE-2026-12744 and CVE-2026-12745 (CVSS 9.8), plus three missing-authorization RCE bugs rated 9.9 and three authenticated deserialization RCE flaws. EPMM has CVE-2026-18851 (CVSS 8.8), an authenticated privilege escalation flaw, and Sentry has CVE-2026-83527 (CVSS 8.1), an authentication bypass. Ivanti reports no evidence of active exploitation; cloud/SaaS ITSM was patched on August 9, 2026, while on-premises 2025.2 through 2026.1 require September 2026 patches.

Cyber Security News·Sep 8, 15:42 UTC · 7d agoVulnerabilityCVE-2026-18851CVE-2026-12744CVE-2026-12745+7 CVEs