Cyber Threat Brief

Today: Microsoft breaks records with 974 vulnerabilities including two actively exploited zero-days (CVE-2026-85880, CVE-2026-81963), both CISA KEV deadline September 22. Chrome patches seventh 2026 zero-day in V8 engine. N-able N-central suffers maximum-severity pre-auth RCE actively exploited in MSP environments. Adobe Commerce zero-day StyleSmuggler enables unauthenticated RCE, attackers deploying backdoors since September 4.

Critical Alerts

Microsoft Patches Two Actively Exploited Zero-Days Among Record 974 CVEs

Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities, the largest release ever, including two actively exploited zero-days. CVE-2026-85880 (CVSS 7.8) is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) allowing low-privilege AppContainer code to escape the sandbox and reach SYSTEM privileges. CVE-2026-81963 (CVSS 7.8) is an improper link resolution flaw in Windows Update Stack enabling local attackers to escalate from low privileges to SYSTEM without user interaction. Both affect all supported Windows versions. CISA added both to the KEV catalog with remediation deadline September 22, 2026. Volexity, Proofpoint, and Microsoft's own MSTIC reported CVE-2026-85880. Airbus researcher Romain Deperne and MSTIC discovered CVE-2026-81963.

• Action: Deploy September 2026 patches immediately. Both flaws enable reliable post-compromise privilege escalation and are being exploited in the wild. Federal agencies must patch by September 22 per CISA BOD 26-04.
• Sources: The Hacker News | Dark Reading | SecurityWeek | CrowdStrike | CISA | Cyberscoop

Chrome 153 Patches Seventh Zero-Day of 2026

Google released Chrome 153 addressing 230 vulnerabilities including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine actively exploited in the wild. The medium-severity flaw allows remote attackers to execute arbitrary code inside the Chrome sandbox via crafted HTML pages. This is the seventh Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University discovered the flaw and received a $2,500 bounty. Five critical-severity vulnerabilities were also patched, including use-after-free and buffer overflow flaws in WebGL and Cast.

• Action: Update Chrome to version 153.0.8010.36/.37 (Windows/macOS) or 153.0.8010.36 (Linux) immediately. Navigate to More > Help > About Google Chrome and select Relaunch. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply fixes as available.
• Sources: The Hacker News | SecurityWeek

N-able N-central Pre-Auth RCE Actively Exploited

CISA added CVE-2026-86218 (CVSS 10.0) to the KEV catalog after active exploitation targeting N-able N-central production environments. The static code injection flaw enables pre-authentication remote code execution on N-central servers, a strategic target for attackers due to widespread MSP use. Huntress confirmed compromise of a fully patched N-central instance on September 4, 2026. N-able patched the flaw in version 2026.3 Hotfix 4 released September 5. Two additional vulnerabilities (CVE-2026-86206, CVE-2026-86207) patched the same day in Hotfix 3 can be chained for authentication bypass and System Administrator account creation. Limited historical logging prevents definitive attribution to a specific exploit. watchTowr successfully reproduced CVE-2026-86218 and warns the vulnerability enables changes that propagate across all connected systems. Federal agencies must patch by September 11, 2026.

• Action: Upgrade N-central to version 2026.3 Hotfix 4 immediately. Review environment for indicators of compromise and anomalous activity prior to patching. Compromise of N-central provides access to all connected computers and downstream systems across managed environments.
• Sources: The Hacker News | CISA

Adobe Commerce Zero-Day StyleSmuggler Exploited Since September 4

Adobe patched CVE-2026-75650 (CVSS 10.0), a code injection flaw in Adobe Commerce and Magento Open Source exploited in the wild since September 4, 2026. The vulnerability enables unauthenticated remote code execution by injecting code executed when Magento's standard 'Payment Transaction Failed Reminder' triggers, without user interaction. Sansec discovered the zero-day and reports multiple threat actors deploying backdoors and web shells. CISA added the flaw to the KEV catalog with September 11 remediation deadline. Adobe released urgent hotfixes Monday alongside patches for 170+ vulnerabilities across its product portfolio.

• Action: Apply Adobe Commerce/Magento patches immediately. Rotate encryption keys and all credentials protected with those keys including administrative passwords, database credentials, integration tokens, OAuth secrets, SSH/deploy keys, and API keys. Rotate credentials at the source, not only inside Magento. Rotating the encryption key alone does not invalidate anything an attacker already read.
• Sources: SecurityWeek | CISA

Business & Infrastructure Threats

SAP Patches CVSS 10.0 Kernel Flaw OVERPASS

SAP addressed CVE-2026-44756 (CVSS 10.0), a memory corruption flaw in SAP Extended Passport (EPP) Processing enabling unauthenticated remote code execution with SAP administrative privileges. Onapsis discovered the vulnerability, which stems from missing boundary validation during EPP data deserialization. The flaw is reachable from internet-facing web layers, SAP GUI layers, and RFC layers without requiring credentials. Successful exploitation permits reading SAP secure store for database credentials and password hashes, extracting stored credentials for lateral movement, modifying application data and system configuration, and reading live session data of logged-in users. SAP also patched CVE-2026-58240 (CVSS 9.8), a missing authentication flaw in NetWeaver Message Server dubbed S4GET, enabling unauthorized actions via public ports that cannot be firewalled without breaking end-user logon.

• Action: Apply SAP September 2026 security updates immediately. CVE-2026-44756 affects SAP kernel EPP processing across multiple protocols and components. CVE-2026-58240 affects SAP S/4HANA and potentially other ABAP-based products running 9.x kernel lines. Both flaws allow unauthenticated remote code execution and are present in default configurations.
• Source: The Hacker News

20 Wormable CVEs Create Network Contagion Risk

Microsoft's September release includes a cluster of 20 wormable remote code execution vulnerabilities enabling unauthenticated attackers to execute arbitrary code and self-propagate across enterprise networks. CVE-2026-69730 (CVSS 9.8), a Windows DNS Server use-after-free flaw, acts as a spiritual successor to SigRed (CVE-2020-1350), the 2020 maximum-severity DNS RCE that allowed Local System/Domain Administrator control. Trend Micro's Zero Day Initiative warns the cluster creates severe automated network contagion risk across enterprise environments. Additional critical wormable flaws affect Windows DHCP Server, MSMQ, NFS, and SSTP VPN services.

• Action: Prioritize patching internet-facing and internal infrastructure services running DNS, DHCP, MSMQ, NFS, and SSTP VPN. The 20-CVE wormable cluster enables zero-click RCE and network propagation without user interaction, similar to historical wormable vulnerabilities.
• Sources: Dark Reading | Talos

FreeIPA Critical Flaw Chain Enables Admin Credential Creation

Red Hat disclosed CVE-2026-76578 (CVSS 9.8), a critical flaw in FreeIPA allowing anonymous clients to create Kerberos identities and obtain administrator group membership. The flaw chains with CVE-2026-76560 (CVSS 7.5) in 389 Directory Server, where an access control rule intended to match "only the authenticated owner" compares client names as plain text, allowing empty names from unauthenticated clients to match empty stored values. Anonymous clients can create token entries with blank ownership fields, pass ownership checks, and write Kerberos identities and passwords. Red Hat reproduced the chain twice on default installations, most recently on a machine with no access. FreeIPA 4.13.4 fixes CVE-2026-76578. The attack creates reusable administrator credentials under attacker-chosen names and extends access to HTTP and Dogtag certificate authority services via Kerberos tickets containing authorization data.

• Action: Update FreeIPA to version 4.13.4 and apply 389 Directory Server patches immediately. The vulnerability chain works against untouched default installations and allows anonymous clients to create administrator-level Kerberos identities across Linux domains.
• Source: The Hacker News

Multi-Hop Google Redirect Phishing Campaign

KnowBe4 identified an ongoing phishing campaign chaining multiple Google services to evade email security gateways. The campaign uses three-hop redirect chains through Google Meet, DoubleClick, Google Custom Search, Google Image Search, Google Tag Manager, and Google Analytics, presenting trusted Google domains at every inspection point. Landing pages dynamically construct credential harvesting or ScreenConnect remote access installation from victim email addresses encoded in base64 within URL hash fragments, which browsers strip before sending requests, masking the pre-targeted nature. The campaign uses multilingual UI and displays live screenshots of victim corporate websites behind login prompts. Harvested credentials reach operator Telegram channels within seconds along with IP address, geolocation, browser string, and verified MX records.

• Action: Block IOCs at DNS filter, proxy, and SIEM level. Hunt for Telegram bot API traffic. Force credential resets for users receiving lures. Hunt for unauthorized ScreenConnect installations. Alert users that email addresses in URLs after # indicate pre-targeted phishing. KnowBe4's research includes full IOC list.
• Source: Dark Reading

Windows / AD Security

Microsoft Office Preview Pane Attack Surface

Microsoft Office received 22 Critical patches, including 12 exploitable via Preview Pane or Reading Pane. When enabled, merely previewing a crafted file triggers remote code execution without clicks, attachment opens, or macro prompts. This attack pattern eliminates social-engineering friction and has been historically favored by both commodity phishing and targeted intrusion operators. Identity-platform components face elevated risk with critical RCE vulnerabilities in Netlogon and Kerberos (CVE-2026-69676 CVSS 8.8). These protocols underpin domain authentication; Netlogon handles secure channel establishment between domain members and controllers while Kerberos issues authentication tickets for domain resources. Exploitation provides a foothold inside the authentication layer that every domain service trusts.

• Action: Deploy September patches for Office and identity platform components. Disable Preview Pane and Reading Pane in Outlook where feasible to eliminate zero-click attack surface. Review authentication logs for anomalous Netlogon and Kerberos activity.
• Source: CrowdStrike

Windows Hyper-V Guest-to-Host Escape Flaws

September patches include Windows Hyper-V vulnerabilities enabling guest-to-host escape, expanding exposure from a single compromised VM to the entire virtualization host and all co-resident guests. Hypervisor escapes have historically been high-value targets for advanced adversaries because they bypass the isolation boundary multi-tenant and segmented environments depend on. Additional Windows infrastructure vulnerabilities affect ALPC (CVE-2026-85880, actively exploited), Windows Update Stack (CVE-2026-81963, actively exploited), DNS Server (CVE-2026-69730 CVSS 9.8), DHCP Server (CVE-2026-69845, CVE-2026-72979), and Services for NFS (CVE-2026-69595 CVSS 9.8).

• Action: Prioritize Hyper-V patches for multi-tenant and segmented virtualization environments. Apply patches for core infrastructure services including DNS, DHCP, and NFS on domain controllers and infrastructure servers.
• Sources: CrowdStrike | Talos

Active Directory Rights Management Service (AD RMS) Research

Huntress published research on AD RMS, Microsoft's enterprise digital-rights management system. The investigation discovered four independent key-extraction paths and a 255-year non-rotatable private key (SLC certificate valid 2002-2258) with no rotation mechanism. Once the private key is extracted, it decrypts protected content indefinitely, past the certificate window entirely. The research covers AD RMS architecture, reconnaissance from ordinary domain accounts, service-group membership extraction paths, and offline document decryption. AD RMS is no longer in active development but remains fully supported in Windows Server 2025 and is deployed widely across enterprises that have not migrated to Azure Information Protection.

• Action: Review AD RMS deployments for service-group membership and key access controls. Consider migration to Azure Information Protection where enhanced capabilities justify transition. AD RMS private key compromise enables indefinite decryption of protected content across the 255-year certificate validity window with no rotation path.
• Source: Huntress

General Security News

Microsoft Defender ShieldBreak Patch Bypass (ShieldCrash)

Security researcher Chaotic Eclipse released a proof-of-concept zero-day demonstrating CVE-2026-69414 (ShieldBreak) patch bypass. The vulnerability, dubbed ShieldCrash, triggers the exact problem Microsoft attempted to fix. Under specific conditions, arbitrary file read as SYSTEM remains possible on latest Windows versions. Microsoft patched CVE-2026-69414 in Malware Protection Engine version 1.1.26080.3. The researcher previously disclosed exploits for CrowdStrike Falcon (FalconFlank), Kaspersky (HardBreacher, patched), Avast (PrettyPrague, patched), and NVIDIA (GreenSection).

• Action: Monitor for Microsoft Malware Protection Engine updates addressing ShieldCrash. Verify Malware Protection Engine version 1.1.26080.3 or later is deployed. Microsoft automatically updates the engine for default configurations.
• Source: The Hacker News

Patch Priority

• Windows: CVE-2026-85880, CVE-2026-81963 (both actively exploited, CISA KEV deadline September 22)
• Chrome: Version 153 for CVE-2026-87491 (seventh 2026 zero-day, actively exploited)
• N-able N-central: Version 2026.3 Hotfix 4 for CVE-2026-86218 (CVSS 10.0, active exploitation, MSP environments)
• Adobe Commerce/Magento: CVE-2026-75650 (CVSS 10.0, StyleSmuggler, exploited since September 4, rotate encryption keys)
• SAP: CVE-2026-44756 (CVSS 10.0, OVERPASS kernel flaw), CVE-2026-58240 (S4GET NetWeaver flaw)

Vulnerability Disclosures

Microsoft September 2026: 974 CVEs

The September release includes 723 Windows vulnerabilities, 111 Office, 111 Office 2016, 62 SQL Server, and 22 Developer Tools. Over 110 are critical severity. Elevation of privilege (438 CVEs, 45%), remote code execution (260 CVEs, 25%), and information disclosure (175 CVEs, 18%) account for nearly 90% of flaws. Notable vulnerabilities include CVE-2026-55007 (CVSS 8.1) Exchange Server double free RCE, CVE-2026-80097 (CVSS 8.6) Microsoft Authenticator improper authentication, CVE-2026-69465 (CVSS 8.8) SharePoint missing authorization, CVE-2026-69380 (CVSS 8.1) Exchange Server EoP enabling low-privilege attackers to impersonate users and hijack mailboxes, CVE-2026-69829 (CVSS 9.8) Windows Shell RCE, CVE-2026-69595 (CVSS 9.8) Windows Services for NFS RCE, and CVE-2026-78510 (CVSS 9.8) Microsoft Word RCE. Cisco Talos released Snort rules for prominent vulnerabilities.

• Sources: The Hacker News | Dark Reading | Talos

Adobe September 2026: 170+ CVEs

Adobe addressed over 170 vulnerabilities including CVE-2026-75650 (Commerce/Magento zero-day), CVE-2026-82004 (CVSS 10.0) Campaign Classic OS command injection RCE, CVE-2026-48273 (CVSS 9.9) and CVE-2026-75746 (CVSS 9.1) ColdFusion code execution flaws, 107 Experience Manager vulnerabilities, 32 Acrobat Reader flaws, 8 Photoshop issues, 3 Illustrator bugs, and 1 Animate vulnerability. All priority 1 updates should be applied within three days.

• Source: SecurityWeek

Trends & Context

AI-assisted vulnerability discovery continues driving record-breaking patch volumes. Microsoft's 974-CVE September release follows 457 in August, 663 in July, 220 in June, and 161 in May. Trend Micro's Dustin Childs notes AI-assisted discovery is "the industry's new normal, completely outstripping human patching capacities." However, the surge in disclosed vulnerabilities has not yet correlated with increased active exploitation. CISA's addition of four KEV entries (two Microsoft, one Adobe Commerce, one N-able) represents targeted exploitation rather than widespread automated exploitation of the expanded attack surface. The challenge for defenders shifts from discovering vulnerabilities to prioritizing remediation based on actual risk exposure and exploitation likelihood rather than attempting to patch everything.