Comparing 26 September 2026 with the previous day 25 September 2026.
CISA confirms active exploitation: the SharePoint RCE CVE-2026-65660 is being attacked in the wild, and the RouterOS flaw CVE-2026-67279 is chained with CVE-2026-86060 into the 'MikroTrick' exploit chain that yields full unauthenticated access.
The case shows that the Cyclops Blink infrastructure disrupted by the FBI in 2022 is not dead: a Russian military APT combines multiple Cisco flaws to plant an upgraded botnet variant on exposed edge devices.
The vulnerability requires local access; exploitation assumes an already compromised system or malicious local user.
The vulnerability requires local access and allows privilege escalation; exploitation requires already compromised access.
Unlike third-party vulnerable drivers, BTR.sys is a built-in Windows component and is therefore not covered by the Microsoft Vulnerable Driver Blocklist, making it a living-off-the-land driver for attackers with administrative rights.
The update does not list specific CVE IDs but summarizes multiple vulnerabilities in both browsers.
The report summarizes multiple unspecified Linux kernel vulnerabilities that can lead to DoS and memory leaks, without concrete CVE or patch details.
No changes in this category.
No changes in this category.
An unusual warning: Kiteworks urges customers to avoid the platform after government agencies warned of an attacker , an indication of a targeted APT campaign against file transfer services.
The report shows that automated, agentic attacks specifically abuse Azure service principals for privilege escalation, resource destruction and credential collection , a new attack vector beyond classic ransomware.
The quarterly report shows that ICS/OT environments are increasingly targeted with spyware, ransomware and nation-state backdoors (e.g. NightLedger, CoolClient) , a strategic view of the OT threat landscape that goes beyond pure patch information.
The advisory bundles vulnerabilities across numerous Windows and Exchange versions without naming individual CVEs, CVSS scores, or an exploitation status.
The report does not name CVE IDs, severity scores, or exploitation evidence, so it is only a general vulnerability warning for PRTG.
Without a CVE number and attack details, it remains unclear which sudo version is affected and whether the flaw is already actively exploited.
The report describes a race condition caused by uninitialized memory in the cpufreq subsystem, occurring only with CONFIG_CPUMASK_OFFSTACK=y during sysfs publication.
The report contains no indication of active exploitation or attacker TTPs and does not go beyond patch information.
Beyond the pure patch information, the report provides no indications of active exploitation or attacker TTPs.
The update reports several unspecified vulnerabilities in the Linux kernel that enable local attacks.
The advisory updates a previously known vulnerability in util-linux that allows a locally logged-in attacker to escalate privileges on Linux systems; a CVE number or details on active exploitation are missing.