Industry updates, security alerts, and analysis from an IT professional
A pre-auth stack overflow in the GS1900 web interface, patched in June, was used in August to pull configs and root hashes from 996 switches in 48 countries. CISA set a 24 September deadline.
An unauthenticated attacker can submit a workflow whose inline script task runs OS commands as the Conductor process, often root. Patched in 3.30.2; exploited in the wild since August, not yet in CISA KEV.
A hardcoded Cloudflare API key let an attacker deploy an edge Worker that rewrote Brevo's embedded scripts for five hours, serving ClickFix lures and a hidden WordPress backdoor to 100,000+ sites.
CISA put three Linux kernel bugs on KEV with a 21 September deadline: a kTLS record-handling flaw with a public root exploit, an AF_ALG race, and an ebtables SNAT out-of-bounds write.
Acronis confirms targeted exploitation of a permissions flaw in its cPanel & WHM backup plugin. One low-privileged tenant account reaches root-level backup operations. CISA's deadline is 19 September.
Cisco confirms in-the-wild exploitation of a CVSS 10.0 authentication bypass in Identity Services Engine. One crafted API request skips the login page and lands root. CISA's deadline is 19 September.
CISA's KEV catalog now marks the unauthenticated vCenter Syslog RCE CVE-2026-59310 as used in ransomware. A syslog write becomes root, then forged SSO tokens and Babuk-derived encryption on ESXi.
A SQL injection bug in Cisco Secure Email Gateway's mail parser gives unauthenticated attackers root from a single message. Cisco confirms exploitation; CISA set a 17 September deadline.
Two CVSS 9.8 bugs in Check Point's VPN certificate handling give unauthenticated remote code execution on gateways and management servers. Patches are out; NCSC-NL expects mass exploitation soon.
A CVSS 9.9 authorization flaw in the ScreenConnect client lets a remote session run files without confirmation. Huntress found it spreading like a worm; CISA set a 14 September deadline.
A CVSS 10.0 path traversal in GitLab's repository commits API lets unauthenticated attackers read server files. Probes began within a day; CISA set a 14 September deadline.
Fortinet's cw_acd CAPWAP daemon carries a critical unauthenticated overflow, CVE-2025-25249, exploited since July to deploy the PivotC2 RAT. CISA set a 12 September patch deadline.
Cisco confirms active exploitation of CVE-2026-20079. Talos describes three clusters and assesses—not definitively identifies—links to Sandworm and Qilin-related activity.
Microsoft's largest-ever Patch Tuesday fixes roughly 970 CVEs, including two exploited Windows zero-days now in CISA KEV and 20 wormable RCE bugs. Triage by exploitation, not CVSS.
A CVSS 10.0 unauthenticated RCE in Adobe Commerce and Magento was exploited for three days before Adobe's 7 September hotfix. Patch VULN-39341, then rotate the encryption key and every credential it protected.
A pre-auth RCE in N-able's RMM console was exploited before Hotfix 4 shipped. Upgrade on-prem servers to build 2026.3.1.14, then audit accounts, Take Control sessions and endpoints for tunnels.
CERT Polska disclosed six RouterOS flaws; two chain into unauthenticated SSH takeover, exploited since 2 September. Patch to 6.49.21, 7.23.4 or 7.24.2 and check for the flagged state.
Google's sixth exploited Chrome zero-day of 2026 is a V8 type confusion now in CISA KEV. Edge, Brave and Opera patched within two days; Electron apps and WebView2 bundles lag behind.
Any bearer token opened an authenticated MCP session on LiteLLM below 1.84.0. Wiz honeypots caught attackers probing it, mining Monero, and lifting provider keys from memory.
A pre-auth SSRF chained with a command injection gives attackers root on SMA1000 appliances. SonicWall confirmed exploitation on day one; CISA's deadline is September 5.
Attackers began forging administrator tokens on unpatched self-hosted Artifactory servers within days of the August 28 patch. Update, then audit tokens and accounts.
A high-severity authentication-bypass flaw in on-prem Exchange now has public exploit code, and Shadowserver counts almost 22,000 unpatched servers still reachable from the internet.
Microsoft details TerminalFix, a ClickFix variant that steers users to Windows Terminal, sideloads a DLL through a signed binary, and drops a Python reverse-tunnel implant for internal network access.
CISA added a two-year-old ownCloud authentication bypass to its KEV catalog on August 27 after attackers used it to steal nuclear-research files from a Philippine agency.