Comparing 16 September 2026 with the previous day 9 September 2026.
The FortiGate flaw CVE-2025-25249 is actively exploited to deliver the Node.js RAT PivotC2 with interactive shells, tunneling and network scanning , exposed perimeter devices remain the primary initial-access vector.
The vulnerability allows unauthenticated remote code execution with root privileges via a malicious IODD file and persists across reboots.
The BSI reports an active campaign against German institutions, indicating a targeted threat to the DACH region.
Russian state-sponsored hackers are using AI (Claude) to rebuild malware after detection and evade discovery, representing a new TTP for AI-assisted cyber espionage.
The EU Commission is calling for a joint defence against cyberattacks and sabotage, pointing to recent incidents in Denmark, Lithuania and Poland as well as a drone incident in Leipzig , a signal for a coordinated European response to hybrid threats.
Several Western government agencies for the first time publish a joint technical analysis of an Iranian surveillance malware and confirm the abuse of Telegram as a C&C channel , a signal of the reach of state-sponsored espionage toolkits.
The report shows that generative AI models such as Claude are increasingly used as attack tools for automated exploitation, data theft, and state operations,a strategic risk that goes beyond classic patch information.
The two newly documented implants, Ted and curlRAT, show that North Korean APTs use exposed network components such as HAProxy as an injection point and increasingly target the automotive and supplier industry , a pattern that also matters for European production environments.
Although the flaw requires user interaction, opening a crafted DCM file allows code execution in the context of the Photoshop process , relevant for any workstation that opens third-party files from customer or supplier projects.
The flaw sits in Photoshop's DCM JPEG-LS parsing component, showing that image-parsing libraries in the Creative Cloud toolchain remain an attack surface via crafted files.
The flaw resides in the Reader's annotation handling and requires user interaction; the advisory provides no evidence of active exploitation in the wild.
The flaw lies in the handling of Doc objects and requires active user action (opening a file or visiting a web page); so far there is no evidence of exploitation in the wild or KEV listing.
The vulnerability requires user interaction, which complicates opportunistic attacks but enables targeted attacks on Adobe Reader users.
The use-after-free flaw in Adobe Acrobat Reader DC's annotation processing allows attackers to execute code by merely opening a malicious file.
This is a use-after-free flaw in Acrobat Reader DC's annotation handling, known only from a ZDI advisory, with no in-the-wild exploitation or public exploit reported so far.
The flaw resides in annotation handling and requires user interaction (malicious PDF or web page); no exploit or active exploitation is documented.
This is a pure ZDI advisory with no indication of active exploitation or KEV listing; patch status remains the decisive factor.
This is a coordinated ZDI disclosure with no indication of active exploitation; the key point is timely patch verification, since exploitation requires a user to interact with a crafted PDF file.
The vulnerability is limited to information disclosure and requires user interaction; with a CVSS of 3.3, patch management priority is low.
The vulnerability is only of low severity (CVSS 3.3) and requires user interaction, which limits the risk for the end user.
The report describes an active, targeted campaign that spreads new MISTPEN malware via fake job offers and exploits a zero-day in Microsoft's AFD.sys driver for privilege escalation.
ZDI-26-609 describes a use-after-free flaw in the Linux kernel network scheduler, for which no CVE and no indications of active exploitation are currently available.
The BSI advisory does not provide CVE IDs or exploitation details, so the actual urgency can only be derived from Ubiquiti advisories.
The V8 type confusion flaw is already being actively exploited and is therefore not merely a theoretical patching matter.
The report describes a new attack path: voice phishing against personal BYOD devices as the entry point, followed by large-scale data exfiltration via the Microsoft Graph API that bypasses classic endpoint controls.
The report describes an active banking malware campaign that bypasses browser protection mechanisms via the KREMLIN toolkit to install malicious Chrome and Edge extensions and steal credentials and session tokens.
The BSI advisory describes a use-after-free vulnerability in Office/Excel without a CVE reference and without indication of active exploitation.
A publicly released zero-day patch bypass in the Malware Protection Engine shows that Defender protection cannot be guaranteed by patch cycles alone and may require compensating controls.
Four different espionage groups used the same Chrome/Windows exploit chain within days of each other, showing that once a flaw becomes public it is exploited almost simultaneously by multiple state-linked actors.
Chrome 153.0.8010.36/.37 fixes five critical flaws , mostly in WebGL , alongside one actively exploited vulnerability, so the update should be applied promptly.
The new Shieldcrash exploit shows that Microsoft's fix for the Shieldbreak flaw, billed as a 'high-quality update', apparently does not fully close the underlying attack vector in Defender.
The OAuth device code grant is a central building block of modern token attacks (device code phishing); an unauthenticated information disclosure in this flow is therefore more than a pure patching matter.
The report highlights the record scope and ongoing attacks but provides no specific CVE or attack details, serving mainly as a patch reminder with an urgency appeal.
The BSI WID aggregates multiple vulnerabilities across three distinct Windows components without listing CVE IDs or exploitation status , concrete exposure must be verified per system against Microsoft patch details.
The report shows that an evasion technique from AI prompt-injection research is now appearing in classic phishing campaigns, thereby defeating pure signature and keyword filtering.
The BSI warning lists multiple Linux kernel vulnerabilities without specific CVE IDs or exploitation details, making prioritization difficult for administrators.
The advisory does not specify any CVEs, which complicates the assessment of criticality and patch prioritization.
The advisory does not provide CVE IDs or exploitation details; it is a general patch notice for Google Chrome.
The item cites neither CVE IDs nor evidence of active exploitation, so it adds little beyond basic patch information.
The report summarizes several different vulnerability types in Lightroom Classic without providing CVE IDs or evidence of active exploitation.
The flaw is already being actively exploited in the wild and was added to CISA's KEV catalog on September 9, 2026, which goes beyond a mere patch reminder and signals a real threat via crafted web pages.
CISA has added CVE-2025-25249 to the Known Exploited Vulnerabilities (KEV) catalog and prioritizes this security issue under BOD-26-04 guidance, setting a remediation deadline of 2026-09-12.
Two Windows EoP zero-days (ALPC, Update Stack) with active exploitation are addressed in Microsoft Patch Tuesday September 2026; CVSS 7.8 may understate operational risk for systems vulnerable to locally-exploitable privilege-escalation vectors.
A critical flaw in SharePoint's JWT token validation logic allows attackers to bypass authentication without valid cryptographic signatures.
Unsafe .NET type instantiation in Business Connectivity Services enables remote code execution with SharePoint service account privileges; developed as a Pwn2Own entry and affects all supported SharePoint versions.
Exchange Server Elevation of Privilege (CVE-2026-62911) enables authentication bypass and takeover of all mailboxes; demonstrated as proof-of-concept at Pwn2Own Berlin.
A CVSS-10.0 vulnerability in SAP Extended Passport Processing enables complete remote code execution without authentication and requires immediate patch implementation for all SAP instances.
The vulnerability enables unauthenticated access to AD accounts by exploiting RFC 4513-compliant LDAP implementations that accept anonymous binds.
Coordinated exploitation of a chain of zero-day vulnerabilities by Chinese espionage groups signals elevated threat to Western infrastructure and supply chains, with ongoing and expanding activity.
The Rhysida attack on Berlin reveals systematic security gaps in the defensive architecture of critical German infrastructure that serves as a warning signal for other DACH organizations.
CAV3RN exploits Google Apps Script and DNS-based channels for C2 communication, demonstrating how modern APT groups abuse legitimate cloud services to obfuscate threat activity.
AI-driven automation lowers the entry barrier for resource-constrained attackers to achieve nation-state-equivalent capabilities in vulnerability discovery and malware development, fundamentally escalating threat posture across all sectors.
Multiple China-linked state-sponsored hacking groups actively exploiting the same Chrome zero-day suggests coordinated or centrally-directed cyber-espionage against Western infrastructure.
Two of the 974 CVEs are already being actively exploited and have highest priority, while the remaining 114 critical vulnerabilities are distributed through bundled update packages per product.
This is a patch roundup aggregating 974 independent CVEs without describing a specific active attack campaign; however, the two actively exploited zero-days require immediate patching to limit exposure.
A zero-day in Microsoft Defender enables local privilege escalation to SYSTEM rights and represents a serious threat to organizations relying on Defender as a protection layer.
The critical vulnerabilities allow unauthenticated attackers to bypass authentication using forged JWTs and proxy user browser traffic if users visit malicious websites,a direct risk to privileged access management.
An out-of-bounds write vulnerability in VMware ESXi VMXNET3 driver enables local attackers to escalate privileges on guest virtual machines; demonstrated at Pwn2Own 2026.
Critical authentication bypass vulnerability (CVSS 10.0) is actively exploited by ransomware operators (UAT-11988) who gain initial access via static credentials and abuse legitimate tooling for reconnaissance and lateral movement.
The vulnerability enables arbitrary code execution outside the browser sandbox via a crafted HTML page, suggesting potential active exploitation.
A sandbox bypass in Chrome WebGL enables attackers to execute code outside the browser sandbox, increasing the risk of full system compromise via crafted web pages.
The vulnerability enables arbitrary code execution outside the sandbox by an adjacent attacker using crafted network traffic , a significant risk for Chrome-based systems.
Adobe Commerce vulnerability is already under active exploitation; Experience Manager contributes significantly to patch burden with 107 vulnerabilities patched.
The BSI warning indicates multiple critical vulnerabilities in the Azure/Entra identity platform affecting authentication, authorization, and code execution,a core infrastructure for Microsoft 365 environments.
A local privilege escalation flaw in Windows WMI Providers requires prior code execution access and threatens environments with locally accessible systems.
Local privilege escalation vulnerability in Windows WMI requires initial code execution, affects all Windows Server versions in the IT infrastructure.
Critical security vulnerability in widely-used PDF reader enabling remote code execution upon user interaction; risk to technical documentation handling in manufacturing environments.
This is a BSI advisory on multiple GNU libc vulnerabilities without specific CVE identification; the 'UPDATE' designation suggests a follow-up notification and requires verification of specifically affected versions in the production environment.
BSI warns of multiple vulnerabilities in Firefox/Thunderbird enabling code execution and sandbox escape; exploitation possible through opening malicious files or websites.
A V8 flaw (CVE-2026-85046) is already being actively exploited in the wild, enabling arbitrary code execution within the Chrome sandbox via crafted HTML pages.
The vulnerability enables code execution within Chrome's sandbox via crafted HTML content , the risk lies in browser-based attack vectors requiring only visit to a malicious webpage, with sandbox mitigation as the primary containment layer.
A use-after-free vulnerability in the Aura component allows a remote attacker to execute code outside the browser sandbox, bypassing Chrome's isolation mechanisms.
Use-after-free vulnerability in Chrome's platform code enables remote code execution within the sandbox; patching to version 153.0.8010.36 or later is required.
The vulnerability requires renderer process compromise combined with social engineering, which significantly limits practical exploitation in enterprise environments, but enables full code execution outside the browser sandbox if successfully exploited.
The vulnerability allows an attacker with control over the renderer process to execute code outside the Chrome sandbox, enabling full system compromise.
The vulnerability enables sandbox escape and arbitrary code execution via a crafted HTML page, but requires active user interaction and is not documented as actively exploited.
A sandbox bypass in Chrome DevTools enables arbitrary code execution via crafted HTML pages without user interaction.
The vulnerability allows an attacker who has already compromised the renderer process to bypass the same-origin policy and breach web security boundaries.
A sandbox-escape vulnerability in Chromium ANGLE allows attackers to execute arbitrary code outside the browser sandbox, posing critical risk to end users.
A security vulnerability in Chrome's WebUI allows an attacker who has already compromised the renderer process to bypass the sandbox and execute arbitrary code , but this requires a previously compromised renderer as a prerequisite.
The vulnerability enables sandbox escape, potentially granting attackers access to the underlying operating system rather than being confined to isolated browser processes.
The vulnerability enables sandbox escape and local code execution without remote access; a local attacker (e.g. via compromised software or physical access) can thereby control the system outside the Chrome sandbox.
The vulnerability allows an attacker with access to the renderer process to execute code outside the sandbox , a classic sandbox escape that compromises Chrome's security architecture.
Type confusion in Chrome's Rust implementation enables sandbox escape and remote code execution through crafted HTML pages.
The vulnerability allows local attackers with existing access to the Windows system to execute arbitrary code outside the browser sandbox through an improper search path in the CredentialProvider component.
This vulnerability requires a prior successful renderer process compromise as a prerequisite and is thus more of a follow-up step in a multi-stage attack than a direct initial compromise vector.
Use-after-free in V8 enables sandbox bypass with arbitrary code execution,not merely local privilege escalation, but complete browser compromise through remote attack via crafted HTML.
The vulnerability enables sandbox escape and potentially system access on endpoints running Chrome , relevant for phishing campaigns using crafted HTML pages.
The vulnerability enables sandbox escape via incorrect filesystem reference resolution and requires active social engineering; however, there is no evidence of active exploitation in the wild.
A vulnerability in Chrome's LocalNetworkAccess mechanism allows an attacker with renderer process access to bypass system resource access restrictions via a crafted HTML page.
A type confusion bug in the V8 engine enables memory reading within the Chrome sandbox without full sandbox escape; this represents an active attack vector against browser users.
The vulnerability allows attackers with network access to bypass Chrome's sandbox and execute arbitrary code on affected systems , a significant risk for all browser users.
The vulnerability allows an attacker with control over the renderer process to execute code outside Chrome's sandbox, bypassing browser-based exploit mitigations.
A double-free vulnerability in Chromium's PDF engine enables remote code execution within the browser sandbox via crafted PDF files,a direct attack vector exploitable through social engineering.
A use-after-free vulnerability in the V8 JavaScript engine enables attackers to achieve remote code execution within the Chrome sandbox via crafted HTML pages.
An out-of-bounds read vulnerability in the ANGLE graphics engine enables memory access outside the browser sandbox and could expose memory contents; the vulnerability is rated High severity and requires timely update to Chrome 153.0.8010.36 or later.
The vulnerability allows an attacker with renderer process access to execute code outside the Chrome sandbox , a sandbox escape that could lead to arbitrary system-level code execution if successfully exploited.
Active exploitation in the wild or campaign context is not described in the alert; this is a standard vulnerability announcement without additional strategic context.
A sandbox-escape vulnerability in Chrome extensions enables remote code execution with elevated privileges beyond normal capability, significantly increasing infection risk from malicious web content.
The vulnerability requires prior compromise of the renderer process, elevating risk through multi-stage exploits in real-world attack scenarios.
This is a sandbox-escape vulnerability in the ANGLE rendering engine that allows attackers to execute code outside Chrome's sandbox, thereby breaking the browser's process isolation.
The vulnerability enables sandbox escape via XML type confusion, potentially allowing code execution with elevated privileges upon successful exploitation.
This is a standard security patch notification with no evidence of active exploitation or specific campaigns; the vulnerability requires renderer compromise as a prerequisite.
A sandbox-escape vulnerability enables code execution outside the Chrome sandbox, but requires prior renderer process compromise and social engineering.
The vulnerability enables sandbox escape via crafted HTML pages, allowing attackers to gain system access with Chrome process privileges , beyond typical browser exploits.
The vulnerability requires an already-compromised renderer process and could bypass the Chrome sandbox , a two-stage attack on Windows systems.
An out-of-bounds read vulnerability in Chrome's WebGL engine enables an attacker to bypass the sandbox and execute arbitrary code outside the sandbox context,a critical risk for endpoints running Chrome.
Sandbox-escape capability enables code execution outside Chrome sandbox; standard CVE advisory with no indication of active exploitation.
The alert points to insufficient patch compliance in German enterprise networks rather than revealing a new specific vulnerability.
BSI warns of multiple undocumented vulnerabilities in Chrome and Edge without specific CVE identifiers; exact scope and impact remain initially unclear.
BSI warning on multiple Chrome vulnerabilities without specific CVE identifiers; generic browser-security alert for the DACH region.
The BSI alert provides no specific CVE number and no version information , details are needed to determine affected versions and patch status.
BSI alerts to multiple vulnerabilities in Adobe Creative Cloud (Bridge and Format Plugins) enabling arbitrary code execution with privilege escalation , patching or mitigation strategy should be prioritized given widespread deployment in design operations.
ZDI-published vulnerability enables privilege escalation from LOCAL SERVICE to higher privileges on Windows systems; requires prior code execution in the LOCAL SERVICE context.
BSI warns of multiple vulnerabilities in Chrome and Edge enabling active exploitation via malicious websites,standard browser protection for employees required.
The malware uses in-memory injection to evade disk-based scanning , an indicator of targeted attacks against organisations with security monitoring.
BSI warning regarding multiple Microsoft Office vulnerabilities with potential for privilege escalation and code execution; specific CVE details and patch status require consultation of the full BSI advisory.
BSI warning on multiple OpenSSL vulnerabilities with broad impact on encryption, authentication, and availability , requires verification of deployed OpenSSL versions in the infrastructure.
The article is a patch announcement for multiple independent ICS vendors without description of an active attack scenario or targeted campaign.
BSI warning on multiple unnamed vulnerabilities in FortiOS/FortiProxy with DoS and information disclosure potential , specific CVE numbers and CVSS scores are missing, making patch prioritization difficult.
An authenticated remote vulnerability in FortiManager enables the bypass of security controls, endangering the central management layer of Fortinet infrastructures.
BSI warning on multiple Chrome vulnerabilities without specific CVE numbers or active exploitation mentioned; standard patch management requirement.
BSI warns of multiple local Intel processor vulnerabilities enabling privilege escalation and data compromise , affects server and endpoint infrastructure running Intel CPUs.
BSI vulnerability warning for Firefox/Thunderbird without specific CVE details; update advisory without active campaign or strategic dimension.
Google has documented multiple Chrome zero-days in active attacks, including iterator invalidation in CSSFontFeatureValuesMap and out-of-bounds write in Skia , indicating targeted browser-based attack campaigns against unidentified threat actors.
CVE-2026-87491 is actively being exploited in the wild and presents an immediate threat requiring urgent patching.
Active campaign uses counterfeit software-download websites to distribute malicious installers that write Defender exclusions and disable Windows Update; primarily affects China-based operations, but tactics are transferable to Western environments.
An authorization flaw in Chrome allows attackers to extract sensitive information via crafted HTML pages, with no active exploitation in the wild currently reported.
The vulnerability enables CSRF attacks against web applications if users interact with manipulated HTML via the browser; primarily affects cloud-based services deployed in the organization.
An information leak vulnerability in Chrome allows remote attackers to obtain sensitive data via crafted HTML pages , relevant for organizations using Chrome without additional browser isolation or content-security policies.
The vulnerability enables arbitrary code execution within the Chrome sandbox via crafted HTML pages, but currently shows no documented active exploitation.
The vulnerability requires already-compromised renderer processes and is exploited via crafted PDF files, suggesting targeted attacks following initial compromise.
The vulnerability requires active social engineering manipulation via a crafted HTML page and affects only users who click on malicious links, therefore posing low risk for well-trained users.
The vulnerability requires active social-engineering manipulation via a crafted HTML page and is rated Low-Severity; operational priority is low, but regular Chrome updates should be enforced.
An authorization bypass vulnerability in Chrome allows attackers to circumvent system access restrictions via crafted HTML pages, posing a risk to employees with privileged access.
This is a standard patch announcement with no indication of active exploitation or campaign context; the notice repeats NVD information without additional security insights.
A Low-Severity vulnerability in Chrome that requires prior renderer-process compromise and can only be exploited via crafted network traffic , a routine browser security update with no strategic implication.
The vulnerability allows attackers to bypass the Same-Origin Policy via crafted HTML pages and gain access to privileged pages, posing a significant risk to enterprise users.
The vulnerability allows a remote attacker to potentially exfiltrate sensitive information via crafted network traffic, going beyond typical input validation issues.
A vulnerability in the renderer process allows an attacker with a compromised renderer to access cross-origin data via crafted HTML; however, prior renderer compromise is a prerequisite.
BSI advisory on local kernel DoS vulnerabilities without specific CVE numbers or PoC status , requires verification of affected kernel versions.