Comparing 23 September 2026 with the previous day 22 September 2026.
A Chinese state actor is actively exploiting a Chrome and Windows zero-day chain through fake websites , the BlueMoon exploit kit is already in use, which goes beyond mere patch information.
The report highlights two Windows zero-day EoP vulnerabilities and an actively exploited Chrome V8 zero-day, while Microsoft Edge lags behind Chrome without its own browser advisories.
Beyond the mere patch information, the report highlights a window between the upstream fix and LTS delivery in which a public container-escape exploit is available for unpatched Ubuntu systems.
The report shows the concrete DACH implementation of the NIS2 Directive in Austria with new registration obligations and a central cybersecurity authority.
The analysis describes the concrete attack vector: a specially crafted HTTP/1.x request over a TLS connection that triggers a memory access exception in kernel context, leading to system termination or, in the worst case, code execution with kernel privileges.
Exploitation requires user interaction (opening a crafted DCM file), which favours attacks via email attachments or web downloads; exploitation in the wild has not been observed so far.
The flaw sits in the parser for the DCM/JPEG-LS format that is common in medical and document imaging and that Photoshop opens, so the attack vector is a crafted image file rather than network access.
The vulnerability requires user interaction and enables RCE in Adobe Photoshop when parsing DCM JPEG images.
The flaw requires user interaction and has not been reported as actively exploited so far, so the risk is primarily managed via patch timing and email/web filtering.
The flaw resides in the DigSig signature-verification component; since PDFs from email attachments or web downloads are the typical attack vector, merely opening a crafted file is enough to achieve code execution in the user context.
The report describes a newly published ZDI vulnerability with no indication of active exploitation or KEV listing; the attack requires a user to open a crafted file or web page.
The vulnerability requires user interaction, making it attractive for phishing attacks.
This is a targeted ZDI advisory with no indication of exploitation in the wild; exploitation strictly requires user interaction (opening a crafted file or visiting a malicious web page).
No evidence of active exploitation or KEV inclusion; exploitation requires user interaction.
The flaw requires user interaction and has no evidence of in-the-wild exploitation at publication time, so the risk stems primarily from the wide installation base of Adobe Reader on endpoints.
The vulnerability allows code execution simply by opening a crafted JPEG file or visiting a manipulated web page , a classic entry point for phishing campaigns against office users.
The report describes a new out-of-bounds write vulnerability in Adobe Acrobat Reader DC's annotation processing, rated CVSS 7.8 for RCE, requiring user interaction.
The flaw sits in the Reader's annotation handling and requires opening a crafted PDF or a malicious web page, which limits everyday exploitation risk but favours targeted spear-phishing.
Beyond the plain patch information, the report provides a concrete, reproducible exploitation path via a crafted BDC model XML file that grants an authenticated user execution rights on the SharePoint server.
The vulnerability has no CVE entry and requires user interaction, which limits exploitability but allows information disclosure.
The flaw requires pre-existing local code execution, so it acts primarily as a post-exploitation privilege-escalation tool rather than an initial attack vector.
The real lever is not the credential theft itself but the early-established MFA persistence via an actor-registered factor, which keeps the compromise alive even after credential resets.
The attack uses legitimate Teams external communication and remote monitoring and management tools instead of classic malware delivery, thereby bypassing email gateways and conventional attachment filtering.
The service harvested session tokens without stealing passwords or MFA codes, allowing even multi-factor-protected accounts to be taken over.
The report shows that device code phishing abuses a legitimate feature to bypass MFA and gain access to Microsoft 365 accounts without a password.
Two of the 972 patched vulnerabilities are already being exploited in the wild, so these zero-days must be prioritised immediately regardless of the overall patch volume.
The malware is distributed via fake job offers and exploits a previously unknown in-memory LPE vulnerability in the Windows AFD.sys driver, pointing to a state-sponsored actor.
The report highlights that the new Defender zero-day ShieldBreak bypasses an already patched Defender flaw, calling into question the effectiveness of the July patch.
The attack abuses Microsoft Teams as a trusted communication channel, rendering classic email gateways and filters ineffective so that detection must take place at the identity and collaboration layer.
For the first time, an obfuscation technique known from AI prompt-injection research (invisible Unicode tag characters U+E0000,U+E007F) is being used in a real phishing campaign to bypass classic email filters.
Exploitation requires local access, so the vulnerabilities are primarily relevant to attackers who have already gained a foothold as an escalation and persistence vector on Linux systems.
The report provides neither a CVE nor affected kernel versions, so no immediate patch mapping is possible.
The advisory contains no CVE IDs or CVSS scores, which complicates patch prioritization.
The BSI advisory summarizes multiple local kernel vulnerabilities without CVE references, providing no concrete patch or exploit information.
The advisory contains no CVE IDs, no CVSS scores and no indication of active exploitation, and thus does not go beyond a generic patch reminder.
No changes in this category.
No changes in this category.
This is more than a patch notice: CISA confirms active in-the-wild exploitation of the Zyxel flaw, with attackers gaining command and SYSTEM access, and the item is raised alongside a Veeam vulnerability.
Microsoft initially classified the flaw merely as a spoofing bug with a CVSS score of 6.5, although it actually allows authenticated remote code execution , the real risk is therefore higher than the original score suggests.
Beyond the bare patch information, the advisory shows that mere network access is sufficient to drive the UniFi gateway into a denial-of-service state via an out-of-bounds write.
The report contains no details beyond the pure patch information; there are no indications of active exploitation, affected victim groups, or specific attack techniques.
The report provides no information beyond the plain CVE description, particularly no indication of active exploitation or attack campaigns.
The report describes a pure DoS vulnerability in UniFi gateways with no indication of active exploitation or strategic implications.
The vulnerability requires existing network access and only results in a denial of service on the gateway device; it is therefore an availability risk rather than a compromise risk for exposed UniFi edge devices.
The vulnerability requires network access and only affects certain UniFi gateway devices; exploitation results only in a denial of service, but a gateway failure can disrupt all downstream network connectivity.
The report shows that multiple Chinese APT groups use the same exploit kit for attacks on Chrome and Microsoft, indicating coordinated or shared infrastructure.
The report describes an active North Korean infiltration tactic using fake IT applicants that goes beyond patch management and affects personnel and supply chain integrity.
The report shows that a state-directed Chinese actor is deliberately compromising network and edge devices to exfiltrate data and to position itself for follow-on attacks , considerably more than a plain patch advisory.
Beyond the pure vulnerability description, the report provides no information on active exploitation, exploit availability, or threat actors.
The report contains no information about active exploitation, attackers, or strategic context, and thus does not go beyond the pure vulnerability information.
The BSI warns of critical vulnerabilities in various SAP applications without naming specific CVE IDs, indicating an aggregated security advisory.
This pure CVE report provides no information beyond patch details about active exploitation, threat actors, or affected sectors.
The EvilTokens service shows that AI-driven phishing-as-a-service industrialises authentication-token theft and business email compromise, undermining plain password- and MFA-based protections.
The report points to a critical remotely exploitable code execution vulnerability in OpenSSH for which no CVE details or exploit information are yet available.
The report shows that device-code phishing was operated as an industrialized, AI-assisted service that compromises Microsoft identities via token abuse , an active campaign signal beyond patch information.
Abuse of the legitimate device code flow enables token theft despite MFA, so stolen OAuth tokens remain valid even after a password change.
The report shows that device code phishing against Microsoft 365 was commercialized as a service and remains a viable attack vector even after the seizure of 50 websites and more than 150 domains.
Multiple vulnerabilities in ESXi and vCenter Server allow code execution, security bypass and denial of service at the hypervisor and management layer.
A zero-day exploit that bypasses Windows Defender demonstrates a new evasion technique that is difficult to detect without a patch.
A zero-day in Windows Defender prevents antivirus updates, thereby undermining the protection mechanism itself, which goes beyond a mere patch note.
An unpatched zero-day PoC blocks Defender updates by filling the disk, and the same researcher's earlier tools were already exploited in live attacks, significantly raising the risk of stale signature content.
BSI update on multiple vulnerabilities in Veeam Backup & Replication that allow privilege escalation and file manipulation; specific CVEs or exploitation status are not provided.
The BSI update contains no CVE reference and no exploitability details, which complicates prioritization for affected Linux systems.
The advisory summarizes multiple Linux kernel vulnerabilities without specific CVE IDs or exploitation evidence; it therefore provides no immediately actionable details.
The attack shows that registering external MFA providers in Entra ID itself becomes an attack surface: a privileged account can use it to capture plaintext passwords during regular logins, without any CVE or software vulnerability being required.
The updated BSI advisory bundles multiple kernel vulnerabilities without CVE IDs, making targeted prioritization and patch mapping more difficult.
The BSI report summarises Adobe's bundled patches for Acrobat and Reader; it names no specific CVE IDs and thus provides no added value beyond the patch information itself.
The report names no CVE, no patch status and no active exploitation; code execution requires visiting an attacker-controlled website.