Joel Traber AG

Patch Tuesday - September 2026

The September Patch Tuesday contains an already actively exploited Windows ALPC EoP flaw and, with 999 CVEs, exceeds all previous Microsoft Patch Tuesdays.

Russian state hackers use new RedFlick technique to push malware

The report documents a new, previously undisclosed installation and execution technique (RedFlick) used by a Russian state actor, which complicates detection and defense against this campaign.

Russian APT Star Blizzard Uses 'RedFlick' Infection Chain in Recent Attacks

The report shows that Star Blizzard is scaling its phishing infrastructure with a new RedFlick infection chain and, after hijacking email accounts, now drops a dedicated backdoor (CosmicPulse) , moving beyond pure credential phishing toward persistent compromise of cloud identities.

CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

An unauthenticated attacker can trigger a memory fault in kernel context via a crafted HTTP/1.x request over TLS, potentially leading to code execution with kernel privileges.

September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs

The September patch cycle covers 972 CVEs, including two already exploited zero-days and 113 critical vulnerabilities, which drives prioritization of Windows and Office patches.

ZDI-26-676: Adobe Acrobat Reader DC DigSig Use-After-Free Remote Code Execution Vulnerability

ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

The report contains no indication of active exploitation or KEV listing; exploitation requires user interaction.

ZDI-26-673: Adobe Acrobat Pro DC Doc Object Use-After-Free Remote Code Execution Vulnerability

ZDI-26-665: Adobe Acrobat Reader DC Annots Report Use-After-Free Remote Code Execution Vulnerability

The ZDI advisory describes a use-after-free in Acrobat Reader DC's Annots Report parsing (CVSS 7.8) that is client-side only and requires opening a crafted PDF; no active exploitation is documented.

ZDI-26-667: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI-26-667 describes a use-after-free vulnerability in Adobe Acrobat Reader DC rated CVSS 7.8, but contains no indication of active exploitation.

ZDI-26-662: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI publishes a use-after-free flaw in Acrobat Reader DC's annotation handling (CVSS 7.8) with no patch reference or evidence of active exploitation provided in the advisory.

ZDI-26-664: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI-26-663: Adobe Acrobat Pro DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability

The vulnerability requires user interaction via a crafted DCM file or web page, making it suitable for targeted phishing or spear-phishing attacks against design and engineering workstations.

ZDI-26-677: Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability

This is a pure vulnerability disclosure with no indication of active exploitation; its added value lies in the file-based attack vector rather than a network perimeter exposure.

ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability

The vulnerability is an integer overflow in DCM JPEG image parsing that can be exploited by opening images from untrusted sources.

ZDI-26-671: Adobe Acrobat Reader DC Dialog Object Type Confusion Remote Code Execution Vulnerability

ZDI documents a type-confusion flaw in Adobe Acrobat Reader DC that leads to code execution with user interaction; active exploitation is not documented.

ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

The ZDI advisory describes a CVSS 7.8 vulnerability that requires user interaction and mentions neither a public exploit nor active exploitation in the wild.

ZDI-26-668: Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability

No evidence of active exploitation; the vulnerability has a low CVSS score and requires user interaction.

ZDI-26-672: Adobe Acrobat Reader DC PDF File Parsing Integer Underflow Information Disclosure Vulnerability

ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-26-666: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

SAP - Critical vulnerabilities threaten various applications

Unmasking EvilTokens: Getting to the root of device code phishing

The attack abuses Entra ID's legitimate device code authentication flow, so no password and no MFA prompt need to be compromised , restricting that flow is the central countermeasure.

Microsoft Disrupts EvilTokens Device Code Phishing Service

The report shows that device code phishing operates as a scalable phishing-as-a-service capability against Microsoft 365, and the takedown of individual domains is only a snapshot in an ongoing arms race.

ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability

ZDI published the vulnerability without a CVE ID, complicating tracking in patch management.

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

The campaign uses Teams chats and calls as a trusted communication channel to impersonate helpdesk staff, thereby bypassing email phishing filters and conventional awareness measures.

Eviltokens dismantled: 12,000 Microsoft accounts hijacked via AI phishing service

AI-powered phishing services such as Eviltokens can harvest Microsoft 365 session tokens at scale and thereby bypass MFA without stealing passwords.

17th August , Threat Intelligence Report

Beyond pure patch information, the report shows that CVE-2026-68820 is already actively exploited and allows local attackers to gain SYSTEM privileges, while macOS and several incidents outside the industry are also affected.

ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

The ZDI advisory describes an unauthenticated information disclosure in Microsoft Entra ID's OAuth Device Code Grant, rated CVSS 5.8 and without an assigned CVE.

CVE-2026-13224

The vulnerability requires valid administrator credentials, which limits the exploitation risk to compromised or malicious admin accounts.

[UPDATE] Linux Kernel: Multiple Vulnerabilities Allow Unspecified Attack

The updated BSI advisory provides neither CVE IDs nor attack vectors or exploitation status, so individual kernel vulnerabilities cannot be prioritised.

[UPDATE] Google Chrome / Microsoft Edge: Multiple Vulnerabilities

BSI updates its warning about multiple vulnerabilities in Chrome and Edge without providing specific CVE details or exploit status.

TeamViewer: Multiple Vulnerabilities

The BSI report on multiple TeamViewer vulnerabilities does not contain CVE IDs or information on active exploitation, making prioritization difficult.

Google Chrome: Multiple Vulnerabilities

[UPDATE] Linux Kernel: Multiple Vulnerabilities

[UPDATE] expat: Vulnerability allows Denial of Service

Adobe Acrobat and Acrobat Reader: Multiple Vulnerabilities

VMware products: multiple vulnerabilities

Microsoft Edge: Vulnerability allows code execution

Ubiquiti UnifiOS: Multiple Vulnerabilities

The BSI advisory bundles multiple vulnerabilities in Ubiquiti UnifiOS that together allow code execution, privilege escalation, and security bypass.

[UPDATE] Linux Kernel: Vulnerability allows privilege escalation and denial of service

The report provides neither CVE nor CVSS nor exploitation status, so it offers no prioritization beyond a general kernel warning.

Adobe Creative Cloud applications: Multiple vulnerabilities

Microsoft Edge: Multiple Vulnerabilities

The BSI report describes multiple Edge vulnerabilities without CVE IDs; relevant is user interaction (website or Office file) as the exploitation vector.