Comparing 1 October 2026 with the previous day 30 September 2026.
CVE-2023-42793 is actively exploited by APT29 for supply-chain attacks, underlining its strategic relevance for Swiss industrial companies with software suppliers.
The vulnerability is a local privilege escalation in the DirectX graphics kernel and is therefore primarily relevant as a building block in attack chains after an attacker has already gained a foothold.
The analysis reveals two previously undocumented DPRK implants and an attack path abusing the HAProxy filter API, underscoring North Korean groups' continued willingness to target industry-adjacent supply chains.
The flaw is a ZDI-coordinated disclosure rated CVSS 7.8 for which neither exploit code nor in-the-wild exploitation is documented so far, with the fix arriving through Adobe's regular security bulletin.
Beyond the pure patch information, the report provides no indication of active exploitation or technical details.
Beyond the pure patch information, the report shows that in addition to remote code execution, bypassing session access restrictions is also possible, which expands the attack surface beyond classic RCE.
The report provides neither a CVE identifier nor a CVSS score or any indication of active exploitation, so the concrete urgency cannot be derived from the BSI text alone.
The zero-day nature suggests exploitation occurred prior to the patch release.
Device code phishing abuses Microsoft Entra ID's legitimate device code flow to bypass MFA, with the victim authorizing the attacker's sign-in on a genuine Microsoft page.
The report summarizes several unspecified vulnerabilities in Microsoft Edge and serves as a general patch reminder without providing specific CVEs or exploitation details.
The report is an update without new CVE details or evidence of active exploitation; the local attack surface remains.
No changes in this category.
No changes in this category.
The September Patch Tuesday contains an already actively exploited Windows ALPC EoP flaw and, with 999 CVEs, exceeds all previous Microsoft Patch Tuesdays.
The report documents a new, previously undisclosed installation and execution technique (RedFlick) used by a Russian state actor, which complicates detection and defense against this campaign.
The report shows that Star Blizzard is scaling its phishing infrastructure with a new RedFlick infection chain and, after hijacking email accounts, now drops a dedicated backdoor (CosmicPulse) , moving beyond pure credential phishing toward persistent compromise of cloud identities.
An unauthenticated attacker can trigger a memory fault in kernel context via a crafted HTTP/1.x request over TLS, potentially leading to code execution with kernel privileges.
The September patch cycle covers 972 CVEs, including two already exploited zero-days and 113 critical vulnerabilities, which drives prioritization of Windows and Office patches.
The report contains no indication of active exploitation or KEV listing; exploitation requires user interaction.
The ZDI advisory describes a use-after-free in Acrobat Reader DC's Annots Report parsing (CVSS 7.8) that is client-side only and requires opening a crafted PDF; no active exploitation is documented.
ZDI-26-667 describes a use-after-free vulnerability in Adobe Acrobat Reader DC rated CVSS 7.8, but contains no indication of active exploitation.
ZDI publishes a use-after-free flaw in Acrobat Reader DC's annotation handling (CVSS 7.8) with no patch reference or evidence of active exploitation provided in the advisory.
The vulnerability requires user interaction via a crafted DCM file or web page, making it suitable for targeted phishing or spear-phishing attacks against design and engineering workstations.
This is a pure vulnerability disclosure with no indication of active exploitation; its added value lies in the file-based attack vector rather than a network perimeter exposure.
The vulnerability is an integer overflow in DCM JPEG image parsing that can be exploited by opening images from untrusted sources.
ZDI documents a type-confusion flaw in Adobe Acrobat Reader DC that leads to code execution with user interaction; active exploitation is not documented.
The ZDI advisory describes a CVSS 7.8 vulnerability that requires user interaction and mentions neither a public exploit nor active exploitation in the wild.
No evidence of active exploitation; the vulnerability has a low CVSS score and requires user interaction.
The attack abuses Entra ID's legitimate device code authentication flow, so no password and no MFA prompt need to be compromised , restricting that flow is the central countermeasure.
The report shows that device code phishing operates as a scalable phishing-as-a-service capability against Microsoft 365, and the takedown of individual domains is only a snapshot in an ongoing arms race.
ZDI published the vulnerability without a CVE ID, complicating tracking in patch management.
The campaign uses Teams chats and calls as a trusted communication channel to impersonate helpdesk staff, thereby bypassing email phishing filters and conventional awareness measures.
AI-powered phishing services such as Eviltokens can harvest Microsoft 365 session tokens at scale and thereby bypass MFA without stealing passwords.
Beyond pure patch information, the report shows that CVE-2026-68820 is already actively exploited and allows local attackers to gain SYSTEM privileges, while macOS and several incidents outside the industry are also affected.
The ZDI advisory describes an unauthenticated information disclosure in Microsoft Entra ID's OAuth Device Code Grant, rated CVSS 5.8 and without an assigned CVE.
The vulnerability requires valid administrator credentials, which limits the exploitation risk to compromised or malicious admin accounts.
The updated BSI advisory provides neither CVE IDs nor attack vectors or exploitation status, so individual kernel vulnerabilities cannot be prioritised.
BSI updates its warning about multiple vulnerabilities in Chrome and Edge without providing specific CVE details or exploit status.
The BSI report on multiple TeamViewer vulnerabilities does not contain CVE IDs or information on active exploitation, making prioritization difficult.
The BSI advisory bundles multiple vulnerabilities in Ubiquiti UnifiOS that together allow code execution, privilege escalation, and security bypass.
The report provides neither CVE nor CVSS nor exploitation status, so it offers no prioritization beyond a general kernel warning.
The BSI report describes multiple Edge vulnerabilities without CVE IDs; relevant is user interaction (website or Office file) as the exploitation vector.