Vulnerabilities & Patching
Nine hundred seventy-four fixes. Two actively exploited zero-days. One record-breaking cycle. Microsoft's September 2026 Patch Tuesday is the largest single release it has ever shipped, and the volume is the problem: defenders need a triage order, not a to-do list of 974 items.
Vulnerabilities & Patching
N-able released N-central Hotfix 4 (build 2026.3.1.14) to close CVE-2026-86218, a maximum-severity unauthenticated remote code execution flaw. It is the fourth emergency hotfix in five weeks, and N-able's own notices disagree on whether the bug is already being exploited.
Vulnerabilities & Patching
Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that lets an unauthenticated remote attacker run code as root on 10 Silicon One-based Nexus 9000 switches, and shipped an IOS XR hardening release bundling seven CVEs, two rated 9.8, with no workaround for any version.
Weekly Roundup
The week's notable stories that didn't get a standalone piece: three critical WatchGuard firewall RCEs, active exploitation of Sangoma, Langflow, and Rails, nearly 22,000 exposed Exchange servers, a 9.5-million-patient cloud breach, and Windows turning on Memory Integrity by default.
Vulnerabilities & Patching
CISA added seven actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 2. A CVSS 10.0 SonicWall SMA 1000 SSRF leads the list, and defenders are already seeing reverse shells and cryptocurrency miners dropped through the other bugs.
Vulnerabilities & Patching
SonicWall shipped emergency hotfixes for two actively exploited SMA 1000 zero-days. CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 chain into unauthenticated remote code execution on internet-facing VPN gateways, and one national SOC rates further attacks almost certain.
Vulnerabilities & Patching
watchTowr has confirmed attackers are exploiting CVE-2026-82329, a critical (CVSS 9.8) authentication bypass in self-hosted JFrog Artifactory, to mint their own administrator tokens. JFrog patched the flaw on August 28, but internet-exposed servers should be treated as already compromised.
Vulnerabilities & Patching
CISA added a 2023 ownCloud flaw, CVE-2023-49105, to its Known Exploited Vulnerabilities catalog after a Chinese-speaking threat actor used it to steal nuclear records from a research body in the Philippines. Here is what ownCloud operators should verify now.
Cryptocurrency
Cosmos Labs says a critical balance-handling flaw in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2), assigned no CVE, was exploited to drain roughly $5.72 million from six blockchains between August 20 and 25, 2026. Here is what operators should do.
Vulnerabilities & Patching
ServiceNow released fixes for four ServiceNow AI Platform flaws, three rated CVSS 10.0 and reachable by an unauthenticated attacker to run code or SQL. It patched hosted instances; self-hosted customers and partners must apply the update themselves.
Vulnerabilities & Patching
PaperCut says attackers are actively exploiting two chained zero-days across every version of its NG and MF print-management software. The vendor shipped emergency Release 2 patches for v24, v25, and v26 and is urging defenders to patch or pull servers offline immediately.
Vulnerabilities & Patching
Attackers are opportunistically exploiting two unauthenticated bypasses in the miniOrange SAML 2.0 SSO plugin, CVE-2026-61979 and CVE-2026-15981, to sign in as any WordPress user including administrators. A silent, multi-edition patch means your dashboard may wrongly report you as safe.