KEV B1
68 Patch Tuesday - September 2026
Microsoft confirms exploitation of a Windows ALPC vulnerability as a zero-day in the wild, while the rest of Patch Tuesday comprises a record 999 CVEs.
High
CVSS
7.8
EPSS
49%
What has changed?
Comparing 8 October 2026 with the previous day 7 October 2026.
Newly added
21 NEW A3
90 China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
The joint advisory provides an official international attribution of state-directed Chinese cyber activity and frames it as a long-term, cross-sector espionage campaign , relevant for strategic risk assessment, with no concrete patch reference.
Critical
NEW C3
85 Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
The report shows Russian-aligned APT groups are continuously evolving malware against Ukrainian manufacturing, energy, and transport companies, signaling a persistent threat to Europe's industrial base.
Critical
NEW C3
80 Chinese Inverters: Just One Hack Away from Blackout
The report shows that Chinese inverters in German solar systems pose a strategic risk to power grid security that goes beyond classic IT vulnerabilities.
Critical
NEW Flax Typhoon C1
80 FBI disrupts Chinese hacking tools used to breach critical infrastructure
The FBI seizure of Flax Typhoon domains shows that Chinese APTs constantly rebuild their infrastructure for attacks on critical infrastructure, which is also a strategic risk for European industrial partners.
Critical
NEW B3
80 Edge Infrastructure Under Siege: What Two Independent Datasets Reveal About Who's Exploiting Your Perimeter
The analysis shows that edge vulnerabilities are exploited by both state-sponsored and criminal actors, and high-priority CVEs remain unpatched even longer (median 146 days).
Critical
NEW B2
48 ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability
ZDI reports a vulnerability in Windows that can disclose NTLM responses through localized filenames, but only with user interaction and a low CVSS.
Medium
CVSS
6.5
EPSS
1%
NEW C3
20 FortiBleed Attackers Locking Victims Out of Fortinet Devices
The campaign remains active and now escalates by deleting accounts and passwords to lock out victims , this calls for continuous account and credential monitoring on the Fortinet devices beyond patching.
High
NEW C3
20 Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
The Wazza phishkit uses integrated filtering and session management features to specifically target manufacturing companies in the EU, making it an active, sector-specific threat.
High
A3
20 VMware Products: Multiple Vulnerabilities
The vulnerabilities in VMware ESXi and vCenter Server allow code execution and bypass of security measures, making the virtualization infrastructure vulnerable.
High
B3
20 ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability
The report points to an HTML injection flaw in Microsoft Office for which no CVE has been assigned yet and no active exploitation is known.
High
B3
20 ZDI-26-609: Linux Kernel Net Scheduler Packet Classifier Use-After-Free Local Privilege Escalation Vulnerability
The vulnerability requires local code execution and enables privilege escalation on Linux systems after an initial compromise.
High
B3
20 Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Attackers use Teams calls and chats instead of classic phishing emails to obtain credentials and MFA codes through trust-building.
High
A3
0 [UPDATE] OpenSSH: Multiple Vulnerabilities
The report summarizes multiple OpenSSH vulnerabilities without specific CVE IDs, complicating prioritization.
Medium
A3
0 Linux Kernel: Multiple Vulnerabilities
Medium
NEW A3
0 [UPDATE] cURL: Multiple Vulnerabilities
The BSI advisory contains no CVE IDs and no exploitation details, which complicates prioritization of the vulnerabilities.
Medium
NEW A3
0 [UPDATE] Linux Kernel: Multiple vulnerabilities allow denial of service and unspecified attack
Medium
A3
0 Google Chrome: Multiple Vulnerabilities
The report does not specify concrete CVE IDs or exploitation details; it serves as a general indication of Chrome security updates.
Medium
A3
0 Adobe Acrobat and Acrobat Reader: Multiple Vulnerabilities
Medium
NEW A3
0 CVE-2026-88647
Beyond the patch information, the report provides no additional insights into active attacks or affected sectors.
Medium
EPSS
0%
NEW C3
0 Veeam patches code execution vulnerability in Backup & Replication
Veeam Backup & Replication is a central system for data backup and recovery; code execution on this server directly endangers the integrity of the backups.
Medium
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
18 Star Blizzard B3
85 Star Blizzard refines phishing and malware delivery with the RedFlick technique
The shift to compromised legitimate websites as phishing infrastructure and to password-protected container attachments (ZIP/RAR/VHDX) combined with the new RedFlick delivery technique significantly undermines signature- and URL-based detection.
Critical
C3
78 'NeedyMantis' Provides Long-Term Access to Compromised Networks
A previously unknown China-based malware framework grants long-term, stealthy access to compromised networks , a sign of espionage rather than extortion.
Critical
NEW Hafnium C3
75 US posts $10 million reward for accused Chinese ‘Hafnium’ hacker
The US has issued a bounty for an alleged Chinese Hafnium hacker, underscoring the ongoing threat from state-directed Chinese cyber operations.
Critical
B2
56 Windows Exploitation Techniques: Dangling COM Object Registrations
A public working exploit shows that CVE-2026-66804 is only an incomplete fix of the 'Dark Elevator' COM registration bug (CVE-2026-50343), so dangling CLSID entries under HKEY_CLASSES_ROOT must be re-verified for completeness.
Medium
CVSS
7.8
EPSS
0%
NEW C3
50 FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
US authorities confirm an ongoing, global campaign to harvest Fortinet credentials and explicitly warn operators of two product types , this goes beyond a pure patch notice, since no CVE is the underlying vector.
High
NEW A2
21 CVE-2026-106583
The report describes an injection vulnerability in OpenSSH via special characters in the username, with no evidence of active exploitation.
Low
CVSS
2.5
EPSS
0%
NEW A3
20 CVE-2025-64393
Beyond the pure patch information, the report describes that a Backup Viewer account can be abused to execute code with SYSTEM privileges on the backup server, without evidence of active exploitation.
High
EPSS
0%
NEW C3
20 FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The campaign exploits reused or leaked credentials and legacy SHA-256 password storage on FortiGate devices, meaning even patched systems remain compromiseable through weak or reused credentials.
High
NEW C3
20 FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
The FBI confirms that FortiBleed is not a closed patching case but an ongoing campaign in which attackers harvest credentials from exposed FortiGate VPNs and lock out legitimate administrators.
High
PAYLOAD B3
15 Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
The report shows that ransomware groups increasingly abuse Active Directory Group Policy for enterprise-wide payload distribution, bypassing conventional endpoint protections.
High
NEW A3
0 CVE-2025-64392
Beyond the plain patch information, the alert shows that exploitation requires an active action by a portal user opening a crafted link, so the attack vector lies in the browser context of the Enterprise Manager web interface rather than in the backup data path itself.
Medium
EPSS
0%
NEW A3
0 CVE-2026-93026
An attacker holding only the low-privileged Backup Viewer role can modify the Enterprise Manager master key and stored antivirus update credentials, thereby compromising the trust basis of the entire backup and recovery chain.
Medium
EPSS
0%
NEW A3
0 CVE-2026-58069
The flaw breaks Veeam Cloud Connect's tenant boundary: an authenticated tenant can reach arbitrary files on the service provider host, undermining the trust architecture between customer and service provider.
Medium
EPSS
0%
NEW A3
0 OpenSSH: Multiple Vulnerabilities
The advisory lacks CVE IDs and technical details, so prioritization is only possible via the general OpenSSH patch status.
Medium
NEW A3
0 [UPDATE] Linux Kernel: Multiple vulnerabilities allow denial of service
The BSI report contains no CVE IDs, which makes targeted prioritization and patch mapping for affected Linux systems difficult.
Medium
A3
0 [UPDATE] 7-Zip: Vulnerability allows bypassing security precautions
The report updates an existing warning but provides no details on affected versions or exploitation.
Medium
NEW B3
0 Microsoft, Adobe, Apple, and Foxit vulnerabilities
Medium
A3
0 [UPDATE] OpenSSH: Multiple Vulnerabilities
The report bundles multiple OpenSSH vulnerabilities that allow denial of service, information disclosure, file manipulation, and bypassing of security measures.
Medium