Tag: vulnerability management
685 articles
Microsoft Bolsters Windows 10 with KB5122878 Security Update
Microsoft just dropped a major security update, KB5122878, for Windows 10, packing fixes for a whopping 966 vulnerabilities across its products - a must-install for anyone on long-term servicing and paid support tracks! If you're running Windows 10 Enterprise LTSC or part of the ESU program, you can easily grab the update through Windows Update.
Microsoft Patch Tuesday Disables Record 966 Flaws, Zero-Day Exploits
Microsoft just dropped a massive Patch Tuesday update, fixing a record-shattering 966 vulnerabilities, including two zero-day exploits that hackers are actively using to cause trouble. This September 2026 update is a big deal, with the most flaws patched in a single update ever.
Adobe patches exploited Magento zero-day used to backdoor servers
Adobe has rushed out an emergency patch to fix a critical Magento zero-day vulnerability, known as StyleSmuggler, that's been exploited by hackers to plant backdoors on servers since early September. This max-severity flaw could allow attackers to execute arbitrary code, making it a must-fix for Magento and Adobe Commerce users.
N-able Patches Remote Code Execution Flaw in N-central Platform
A critical vulnerability, CVE-2026-86218, was discovered in N-able's N-central platform, allowing unauthenticated attackers to execute code on the server - and a patch is now available in N-central 2026.3 Hotfix 4. Update now to prevent potential remote code execution attacks!
ConnectWise Discloses New ScreenConnect Flaw, Offers Mitigations
ConnectWise has uncovered a new vulnerability in its ScreenConnect platform that affects file transfer behavior in Remote Access Support and Access sessions, and is providing temporary mitigations until a patch is released later this week. To protect your systems, apply these manual workarounds now.
N-able Rushes Patch for Max-Severity RCE Flaw Under Attack
N-able has urgently released a hotfix to tackle a critical remote code execution flaw in its N-central platform, warning customers to patch immediately to protect their environment from potential attacks. With nearly 1,500 N-central servers exposed online, mainly in the US and Europe, swift action is crucial to prevent exploitation.
Broadcom Patches VMware Flaws That Expose Hosts to Code Execution
Broadcom has patched a critical VMware flaw that lets attackers with local admin access on a virtual machine execute code on the host, thanks to an integer-overflow vulnerability in the VMXNET3 virtual network adapter. This bug, tracked as CVE-2026-59346, earned a near-perfect CVSS score of 9.3, highlighting the severity of the threat.
Citrix NetScaler Flaw Exploited in Targeted Attacks
Citrix is urging customers to act fast to protect their NetScaler deployments from a critical flaw, known as CVE-2026-19490, that lets hackers bypass authentication and gain unauthorized access. To stay safe, review the security bulletin, check if your setup is vulnerable, and upgrade to the recommended build ASAP.
Plex Issues Urgent Patch for Multiple Undisclosed Flaws
Plex has just released a critical security update to patch multiple undisclosed flaws, urging users to upgrade to Plex Media Server 1.43.3 and Plex Desktop 1.115.0 ASAP to safeguard their devices. With over 360,000 devices exposed to the internet, swift action is crucial.
Cisco Discloses IOS XR Flaws, Urges Immediate Software Updates
Cisco is urging immediate action to protect against two critical vulnerabilities in its IOS XR operating system, with CVSS scores of 9.8 that could allow hackers to wreak havoc on your network. Update your software now to prevent potential security breaches!
Attackers Exploit Zero-Days in SonicWall SMA 1000 Appliances
SonicWall's SMA 1000 appliances are under attack, thanks to two newly disclosed zero-day vulnerabilities - CVE-2026-83548 and CVE-2026-83549 - that can be chained together for a complete network compromise. Attackers are already exploiting these flaws in the wild, prompting urgent patching advice from the vendor and cybersecurity authorities.
HPE Fixes Remote Code Execution Flaw in ArubaOS-CX
HPE has patched a critical flaw in ArubaOS-CX that could let hackers run malicious code with elevated privileges - and all they need to do is send specially crafted packets to an affected device. This remote code execution vulnerability, tracked as CVE-2026-73749, is a serious threat that demands immediate attention.
Cisco Discloses Critical Flaw in Nexus 9000 Switches
Cisco has uncovered a critical flaw in its Nexus 9000 switches, known as CVE-2026-20212, which could allow an unauthenticated attacker to remotely execute code as root. This vulnerability affects 10 specific models and has already been patched by the company.
Vulnerability Management Falters as CTEM Gains Traction
The sheer volume of vulnerabilities is overwhelming - just look at Microsoft's recent patch release with over 500 fixes, making it impossible to vet, prioritize, and deploy them safely. This strain on vulnerability management is only intensifying, with the National Vulnerability Database now backlogged and struggling to keep up with the soaring number of Common Vulnerabilities and Exposures.
MSPs Face Ransomware Onslaught, Seek Integrated Protection
MSPs are under siege from ransomware attacks, with 143 reported victims in 2025 alone, and it's clear that a robust defense requires more than just backup or endpoint detection - a comprehensive, integrated protection approach is needed. To stay safe, MSPs must bring together prevention, detection, response, and recovery into a cohesive, measurable service that delivers six critical outcomes.
SonicWall Zero-Days Exploited in Wild, Firm Urges Immediate Patching
SonicWall is urging immediate patching for two zero-day vulnerabilities in its SMA1000 appliances, which are being actively exploited in the wild by hackers. The more critical flaw, CVE-2026-83548, has a severity rating of 10.0 and can be triggered without authentication, putting sensitive data at risk.
Attackers Exploit JFrog Artifactory Flaw to Mint Admin Tokens
A critical flaw in JFrog Artifactory, known as CVE-2026-82329, allows attackers to easily gain admin access without needing authentication or user interaction, posing a huge risk to affected instances. This near-maximum-score vulnerability has already been patched in Artifactory version 7.161.20.
Unpatched Microsoft Exchange Servers Exposed to Hijack Attacks
Thousands of Microsoft Exchange servers remain vulnerable to a high-severity flaw, leaving 21,899 internet-facing systems open to hijack attacks that could give attackers control of every mailbox. This unpatched authentication-bypass vulnerability, CVE-2026-62911, was fixed by Microsoft in August, but many servers still haven't been updated.
Cosmos EVM Flaw Exploited to Drain Funds from Six Blockchains
Cosmos Labs revealed a critical flaw in the Cosmos EVM system was exploited to drain funds from six blockchains, after initially downplaying the bug's impact. The vulnerability was eventually patched on August 19, 2026, with a state-breaking update requiring coordinated network upgrades.
PaperCut Issues Second Patch as Hackers Exploit Flaws
PaperCut has released an updated emergency patch to tackle vulnerabilities that hackers are actively exploiting, working closely with security researchers to stay one step ahead. This new patch includes extra security measures to protect PaperCut NG and MF installations from attacks.
Vulnerability Management Scrambles to Keep Pace with AI-Driven Discovery
The National Vulnerability Database (NVD) is undergoing a major overhaul as it struggles to keep up with a staggering 30,000 reclassified vulnerabilities, now marked as "Not Scheduled" for further analysis, amid a surge in AI-driven discoveries. This change aims to help manage the overwhelming backlog through selective processing and automation.
Gitea Servers Exposed to Ongoing Code Execution Attacks
Thousands of Gitea servers remain vulnerable to code execution attacks, with 8393 Internet-exposed IPs still susceptible to CVE-2026-60004, a code injection bug that lets attackers execute arbitrary shell commands. This flaw can be easily exploited by anyone with write access to a repository, which is especially concerning since Gitea enables self-registration by default.
ZBT Routers Expose Critical Flaw with Factory-Installed Implants
Millions of ZBT routers are at risk due to a critical flaw caused by factory-installed implants that grant hackers root access to every device connected to them. This severe vulnerability, rated 9.3 out of 10, allows attackers to take full control with just a network connection.
CISA Warns of Persisting Vulnerabilities
Threat actors are still finding success by exploiting simple, preventable software weaknesses that have been known for years - and it's a problem that CISA says could have been designed out of products from the start. The agency's review reveals that decades-old bugs, like improper input validation, continue to plague the industry.