Week 38 · 9 Sep – 16 Sep 2026 · 45 items reviewed
Access control failures drive six of eleven exploited flaws this week
Forty-five items were reviewed between 9 and 16 September, and eleven of them have published exploitation. Five touch Microsoft 365, and none of those five have published exploitation. One publisher supplied 22 of the 45 items, so treat the shape of the week as partly a property of the source mix.
Start here
The 5 the ranking puts first. Exploitation evidence outranks a higher score without it; a Microsoft 365 match outranks everything else.
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
An unauthenticated remote attacker can bypass authentication and execute script files to obtain root on the system that manages your firewalls, so the firewall control plane itself is at risk.
Patch, and treat the whole window before the fix as unauthenticated exposure, asking what those endpoints returned rather than only whether they were reachable.
Authentication bypass · full reading and sourceIn the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Functions built for signed-in users, reachable by anyone. The harder problem is downstream: access logs that assume an identity may simply not have recorded the activity you are looking for.
What to do about it
Patch, and treat the whole window as unauthenticated exposure. Ask what those endpoints returned, not only whether they were reachable.
Publisher text. Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
An unauthenticated user can read arbitrary files through the repository commits API, and nobody traverses a directory for your logo; they go for configuration files and private keys.
Patch, then rotate every secret stored in a file that the process could open.
Path traversal · full reading and sourceIn the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Arbitrary file read outside the intended directory, sometimes write. Nobody traverses a directory to fetch your logo; they go for configuration files and private keys.
What to do about it
Patch, then rotate every secret stored in a file that process could open.
Publisher text. GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
Authentication worked but the check on what that identity may do did not, so file transfer and execution through an active remote session are possible without authorization or host confirmation.
Patch, then sample real access records for cross-boundary activity, because this class is usually discovered by a customer rather than by monitoring.
Authorization bypass · full reading and sourceIn the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Authentication worked; the check on what that identity may do did not. Ordinary users reach data and actions belonging to other tenants, other teams, or the administrator.
What to do about it
Patch, then sample real access records for cross-boundary reads. This class is usually discovered by a customer, not by monitoring.
Publisher text. ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
When the appliance is configured as an AAA virtual server or as a Gateway, an unauthenticated remote attacker may bypass authentication at the remote access front door.
Patch, and treat the whole window as unauthenticated exposure, remembering that access logs which assume an identity may not have recorded the activity you are looking for.
Authentication bypass · full reading and sourceIn the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Functions built for signed-in users, reachable by anyone. The harder problem is downstream: access logs that assume an identity may simply not have recorded the activity you are looking for.
What to do about it
Patch, and treat the whole window as unauthenticated exposure. Ask what those endpoints returned, not only whether they were reachable.
Publisher text. Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
An attacker can change the trusted RouterOS policy mask and escalate privilege, which turns a small foothold on the router into administrative reach.
Patch, then review privileged role assignments and sign-ins for the window before the fix landed, because escalation leaves grants behind it.
Privilege escalation · full reading and sourceIn the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
The step between a compromised low-value account and administrative reach. Alone it reads as minor; chained behind any foothold it is the entire incident.
What to do about it
Patch, then review privileged role assignments and sign-ins for the window before the fix landed. Escalation leaves grants behind it.
Publisher text. MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
The pattern
Six of the eleven exploited items this week are access-control failures. That means authentication, authorization or credential handling, not memory safety. This matters because that kind of bug rewards an attacker with no skill and no exploit development, which is why it tends to get used quickly. Privilege escalation is also the week's most common class overall, at 13 of 33 classified items. When a class repeats like this, the useful move is to check whether your own estate has the same shape of exposure, rather than only chasing the named products. Worth remembering too that 28 of the CVEs here are reported by a single publisher: single-source is not wrong, it is unconfirmed.
- 6 of 11 exploited items are access-control failures. Authentication, authorization, or credential handling — not memory safety. These reward an attacker with no skill and no exploit development, which is why they get used quickly.
- msrc.microsoft.com supplied 22 of 45 items. A single publisher dominating a week is a property of the source mix, not of the threat landscape. Read the rest of the page knowing that.
- 28 CVEs here are reported by a single publisher. Single-source does not mean wrong, it means unconfirmed. Corroboration on this page requires two independent publisher domains naming the same CVE, and most items do not have it yet.
Worth a read
Pieces from the week that are not advisories: managed Microsoft 365 posture, agentic coding, and the occasional essay.
- Enforce GitHub Advanced Security configurationsagentic coding
Enterprise administrators can now stop organization and repository admins from overriding security settings defined at the enterprise level, which is the kind of central enforcement that keeps posture consistent.
github.blog - Inside OpenAI’s agentic software factoryagentic coding
A rare look inside a frontier lab where every engineer works with an unlimited token budget, and at where agentic tooling may take software engineering as a profession.
newsletter.pragmaticengineer.com - SHA-1 in HTTPS on GitHub sunsetagentic coding
GitHub has now disabled SHA-1 in HTTPS for github.com and partner CDNs, including Enterprise Cloud and Enterprise Cloud with Data Residency, so older clients and integrations may need checking.
github.blog - “We Think the Security Control Is Working” Is No Longer Good Enoughsecurity
Makes the case that point-in-time audits and sampled assessments are only snapshots, and that continuous control monitoring is what shows a control is working today.
securityweek.com
Everything else this week
Triage order, not severity order. Opening an item shows what its class puts at risk, what to do, the publisher text, and the link.
Exploited elsewhere
6Cisco Secure Email Gateway SQL Injection Vulnerability Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. In CISA KEVOfficial advisory2 publishers SQL injection · exposure, response and source
In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Read and usually write access to the application's database, including whatever credential material it stores about everyone who has ever used it.
What to do about it
Patch, then treat the contents as disclosed. Rotate secrets held in the database and diff the schema and account tables against known-good.
Publisher text. Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Google Chromium V8 Out of Bounds Write Vulnerability Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. In CISA KEVOfficial advisory2 publishers Detail and source
In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
Publisher text. Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. In CISA KEVOfficial advisory Authentication bypass · exposure, response and source
In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Functions built for signed-in users, reachable by anyone. The harder problem is downstream: access logs that assume an identity may simply not have recorded the activity you are looking for.
What to do about it
Patch, and treat the whole window as unauthenticated exposure. Ask what those endpoints returned, not only whether they were reachable.
Publisher text. MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. In CISA KEVOfficial advisory Memory corruption · exposure, response and source
In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Execution from crafted content. In a browser or document handler the delivery mechanism is a person doing their job — opening a page, opening an attachment.
What to do about it
Patch. Awareness training does not mitigate this class, and offering it as a compensating control wastes a change window.
Publisher text. Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
JFrog Artifactory Incorrect Authorization Vulnerability JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. In CISA KEVOfficial advisory Authorization bypass · exposure, response and source
In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Authentication worked; the check on what that identity may do did not. Ordinary users reach data and actions belonging to other tenants, other teams, or the administrator.
What to do about it
Patch, then sample real access records for cross-boundary reads. This class is usually discovered by a customer, not by monitoring.
Publisher text. JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
JFrog Artifactory Improper Authentication Vulnerability JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. In CISA KEVOfficial advisory Authentication bypass · exposure, response and source
In the CISA KEV catalogue, so exploitation is not hypothetical. US federal agencies get a binding deadline for these; everyone else gets a strong hint.
What it puts at risk
Functions built for signed-in users, reachable by anyone. The harder problem is downstream: access logs that assume an identity may simply not have recorded the activity you are looking for.
What to do about it
Patch, and treat the whole window as unauthenticated exposure. Ask what those endpoints returned, not only whether they were reachable.
Publisher text. JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Touches Microsoft 365, no exploitation published
5CVE-2026-65812 Microsoft Teams for Android Information Disclosure Vulnerability Corrected fix build number. Informational change only. Teams / SharePointOfficial advisory Information disclosure · exposure, response and source
Applicable to Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.
What it puts at risk
Data reachable without the authorisation you believed was enforced. The exposure began when the code shipped, not when somebody noticed it.
What to do about it
Patch, then establish what was reachable and for how long. This class carries notification duties more often than it carries urgency.
Publisher text. Corrected fix build number. Informational change only.
Read the original at msrc.microsoft.com CVE record
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
CVE-2026-69559 Microsoft Teams for Android Information Disclosure Vulnerability Corrected fix build number. Informational change only. Teams / SharePointOfficial advisory Information disclosure · exposure, response and source
Applicable to Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.
What it puts at risk
Data reachable without the authorisation you believed was enforced. The exposure began when the code shipped, not when somebody noticed it.
What to do about it
Patch, then establish what was reachable and for how long. This class carries notification duties more often than it carries urgency.
Publisher text. Corrected fix build number. Informational change only.
Read the original at msrc.microsoft.com CVE record
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Passkey-themed social engineering leads to identity and cloud compromise In this article Attack chain overviewAttributionMitigation and protection guidanceLearn more Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume Microsoft Graph activity,… DefenderTeams / SharePointVendor research Detail and source
Applicable to Defender, Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.
Publisher text. In this article Attack chain overviewAttributionMitigation and protection guidanceLearn more Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and email collection through REST APIs. Microsoft Security Research assesses that this sequence is consistent with automated collection from compromised cloud identities using proxy-associated infrastructure, the activity has been observed since May 2026. The activity begins with identity-focused social engineering and impersonation infrastructure, proceeds through authentication persistence and cloud reconnaissance, and is followed by targeted data access and activity consistent with data collection and potential exfiltration. Domains, IP addresses, and hosting providers can change quickly, but the recurring sequence of identity compromise, persistence, reconnaissance, content discovery, and exfiltration provides a more durable basis for investigation. Defenders should investigate this sequence across identity, Microsoft Graph, SharePoint, OneDrive, and Exchange signals, then revoke sessions and remove unauthorized authentication methods for confirmed compromises. Attack chain overview Figure 1. Observed attack sequence showing identity compromise through social engineering, MFA persistence, Microsoft Graph reconnaissance, and cloud data collection/exfiltration. Step 1-2 : Initial access: Passkey and SSO lures The attack often begins with a seemingly routine call or message on a user’s personal phone number from someone claiming to be from the organization’s IT helpdesk. The caller creates a sense of urgency, explaining that a passkey, multifactor authentication (MFA), or single sign-on (SSO) configuration must be updated immediately to avoid disruption. Employees are directed to a website that closely resembles a legitimate Microsoft sign-in experience and may receive the link through SMS messages sent directly to their personal mobile phones. Despite the frequent use of passkey-themed lures, passkey enrollment is often not the actor’s true objective. Instead, the passkey narrative serves as a convincing pretext to guide victims through adversary-in-the-middle (AiTM) phishing or device-code authentication flows. In AiTM scenarios, the actor captures credentials and session tokens; in device code attacks, the victim unknowingly authorizes access on the actor’s behalf. This initial interaction may leave very little forensic evidence. If the victim opens the phishing link on a personal mobile device that is not onboarded to Microsoft Defender for Endpoint, the related activity may be absent from endpoint telemetry. In many investigations, the employee’s recollection of a phone call or text message becomes the earliest and sometimes the only evidence explaining how the compromise began. As a result, investigators must often reconstruct the attack by connecting these reports with subsequent sign-ins, device code authentication events, token activity, and authentication method changes. Reconnaissance on targeted organization The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms. Reusable domains, personalized targeting In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach. Using a trusted employee identity, they send similar passkey-themed messages through Microsoft Teams, making the request appear legitimate and significantly increasing the likelihood of engagement. To support these operations, the actors rapidly deploy convincing phishing infrastructure built around themes such as passkeys, SSO enrollment, account activation, and identity verification. A commonly observed technique involves registering generic domains and embedding the target org
Read the original at microsoft.com
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Detect and disrupt AI-themed attacks with Microsoft Defender Every wave of technology excitement creates a new opportunity for cyberattackers, and AI is no exception. Microsoft Threat Intelligence has published research showing a growing set of campaigns that impersonate popular AI platforms and tools, including ChatGPT, Microsoft Copilot, DeepSeek, and Claude.1 The goal is… DefenderVendor research Spoofing · exposure, response and source
Applicable to Defender. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.
What it puts at risk
Content or identity that convincingly appears to come from someone trusted. The flaw is technical; the loss is a person acting reasonably on something designed to look reasonable.
What to do about it
Patch, and show the teams that actually get targeted — finance, executive assistants, the service desk — what the convincing version looks like.
Publisher text. Every wave of technology excitement creates a new opportunity for cyberattackers, and AI is no exception. Microsoft Threat Intelligence has published research showing a growing set of campaigns that impersonate popular AI platforms and tools, including ChatGPT, Microsoft Copilot, DeepSeek, and Claude.1 The goal is to make phishing, search-driven malware campaigns, and malvertising—which is malicious advertising that uses online ads to lure users to harmful sites, downloads, or redirect chains—more convincing. A ChatGPT-themed phishing campaign sent up to 100,000 emails in a single day, tricking users into updating their ChatGPT Plus payment information and stealing personal and credit card data. These campaigns do not represent a compromise of the AI services being referenced. They represent something more familiar—cyberattackers doing what they have always done: borrowing trust. Right now, AI brands can carry significant trust and curiosity, making them attractive themes for cyberattackers to exploit. Prevent and disrupt cyberthreats with Microsoft Defender Understanding why this trend matters and what it means for security teams is critical to shaping a modern protection strategy. The tactics are the same ones cyberattackers have always refined: urgency, curiosity, and impersonation of something familiar to lower a user’s guard. What has changed is the wrapper. A message about a new model release, a policy update from a familiar AI assistant, or a plugin that promises to make the workday easier is today’s version of the fake invoice or the shipping notification. AI-themed lures deserve attention not because they are a passing trend tied to one product cycle, but because AI remains a genuine source of excitement and urgency for employees and consumers alike, and cyberattackers are exploiting the human instinct to explore what is new, useful, or urgent. The attack pattern is evolving Microsoft’s research team recently observed several AI brand campaigns including: A ChatGPT-themed phishing kit built to harvest credit card data. A Claude-themed campaign that harvested credentials and access tokens through adversary-in-the-middle (AiTM) techniques. Malvertising for a fake AI Windows plugin that delivered the Vidar stealer. Fraudulent DeepSeek installers distributed through GitHub. In one case, an initial access broker tracked as Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, a sign of how quickly this tactic is being commoditized across the criminal ecosystem. Figure 1. Snippet of the top portion of the email impersonating ChatGPT and enticing users to click on the link. What ties these campaigns together is not sophistication in the traditional sense. It is patience and precision in exploiting a moment. Threat actors are capitalizing on anticipated launches and emerging trends, layering multi-stage redirection chains and disposable infrastructure to slip past both users and defenses. That has real implications for security leaders: it means these incidents cannot be evaluated one surface at a time. A single AI-themed lure can begin as an email, become a malicious link, trigger a suspicious download, and end as an identity or endpoint compromise. Organizations that assess each of those as an isolated event are always a step behind. Organizations that connect them see the full shape of the cyberattack, often early enough to stop it. Turning AI lures into dead ends with Microsoft Defender In practice, protection starts before the user ever engages with the lure. Microsoft Defender’s anti-phishing policies can help detect spoofing and impersonation attempts, including user and domain impersonation, first-contact messages, mailbox intelligence signals, and other suspicious sender characteristics. For an AI-themed lure, that might look like a fake “Copilot policy update,” a spoofed support notice, or a lookalike domain designed to make a credential collection page feel legitimate. If the campaign relies on links, Defender’s Safe Links provides URL scanning a
Read the original at microsoft.com
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data Threat actors are leveraging Microsoft's Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters. Entra IDDefenderIntuneExchangeTeams / SharePointEstablished reporting Detail and source
Applicable to Entra ID, Defender, Intune, Exchange, Teams / SharePoint. Nobody has published exploitation yet, so this belongs in the next planned change window rather than tonight.
Publisher text. Threat actors are leveraging Microsoft's Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters.
Read the original at darkreading.com
Exposure and response are Digest interpretation of the vulnerability class, not claims made by the publisher. Confirm against the source before acting.
Also reviewed this week
29- 9.8Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command ExecutionCVE-2026-76461thehackernews.com
- 8.8Chromium: CVE-2026-85046 Type confusion in V8CVE-2026-85046msrc.microsoft.com
- 8.8Chromium CVE-2026-87491: Out of bounds write in V8CVE-2026-87491msrc.microsoft.com
- 8.8CVE-2026-78517 Microsoft Office Word Remote Code Execution VulnerabilityCVE-2026-78517msrc.microsoft.com
- 8.8CVE-2026-73006 DirectWrite Remote Code Execution VulnerabilityCVE-2026-73006msrc.microsoft.com
- 8.6CVE-2026-80097 Microsoft Authenticator Elevation of Privilege VulnerabilityCVE-2026-80097msrc.microsoft.com
- 8.5CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVthehackernews.com
- 8.1What Zero-Day Response Should Be in the Post-Mythos Erableepingcomputer.com
- 8.0CVE-2026-69619 Windows exFAT File System Elevation of Privilege VulnerabilityCVE-2026-69619msrc.microsoft.com
- 8.0CVE-2026-69714 Windows Device Association Service Elevation of Privilege VulnerabilityCVE-2026-69714msrc.microsoft.com
- 7.8CVE-2026-81963 Windows Update Stack Elevation of Privilege VulnerabilityCVE-2026-81963msrc.microsoft.com
- 7.8CVE-2026-68841 Windows NTFS Elevation of Privilege VulnerabilityCVE-2026-68841msrc.microsoft.com
- 7.8CVE-2026-69608 Microsoft Windows Search Component Elevation of Privilege VulnerabilityCVE-2026-69608msrc.microsoft.com
- 7.8CVE-2026-80075 Windows Work Folders Elevation of Privilege VulnerabilityCVE-2026-80075msrc.microsoft.com
- 7.8CVE-2026-61923 Windows Display Enhancement Service Elevation of Privilege VulnerabilityCVE-2026-61923msrc.microsoft.com
- 7.0Auto-resolution and analysis updates in Copilot code reviewgithub.blog
- 7.0CVE-2026-68824 Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityCVE-2026-68824msrc.microsoft.com
- 7.0CVE-2026-68847 Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityCVE-2026-68847msrc.microsoft.com
- 7.0CVE-2026-69605 Microsoft Install Service Elevation of Privilege VulnerabilityCVE-2026-69605msrc.microsoft.com
- 7.0CVE-2026-62753 Windows HTTP.sys Elevation of Privilege VulnerabilityCVE-2026-62753msrc.microsoft.com
- 6.2Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploitdarkreading.com
- 5.7CVE-2026-69416 Windows DHCP Server Denial of Service VulnerabilityCVE-2026-69416msrc.microsoft.com
- 5.6CISA: Critical VMware RCE flaw now exploited by ransomware gangsbleepingcomputer.com
- 5.5CVE-2026-69406 Windows Kernel Information Disclosure VulnerabilityCVE-2026-69406msrc.microsoft.com
- 5.5CVE-2026-69286 Windows USB Audio Class Driver Information Disclosure VulnerabilityCVE-2026-69286msrc.microsoft.com
- 5.5CVE-2026-69321 Windows Power Dependency Coordinator Tampering VulnerabilityCVE-2026-69321msrc.microsoft.com
- 5.0SpiderSilk Hunts External Threats With AI-Based Scannerdarkreading.com
- 5.0China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGEthehackernews.com
- 5.0Cisco patches Secure Email Gateway zero-day exploited in attacksbleepingcomputer.com