Wednesday, September 9, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Microsoft 40 critical 977
- Google 2 critical 328
- Adobe 6 critical 167
- WordPress 61
- Unknown 2 critical 40
- MongoDB 24
- Samsung Mobile 23
- Tanium 21
- n8n-io 14
- Okta 14
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Microsoft Expands Windows Family Safety With Built-In Age Verification and Parental Controls
Microsoft is expanding Windows Family Safety with account-based age verification, privacy-focused age signals, and improved parental controls. The company said the updates are designed to help Windows apps, games, services, and AI experiences provide protections that match a user’s age. The initiative uses the Microsoft account as the central identity layer for family safety on Windows. Microsoft accounts can identify whether a user is a child, teen, or adult, determine whether parental consent or controls apply, and record whether age verification has been completed. This model allows…
Also in Malwarebytes Labs SecurityWeek Infosecurity Magazine +3
-
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide range of data from compromised systems. This can include credential, session tokens, and API
Also in SecurityWeek Infosecurity Magazine Dark Reading +3
-
Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks
Google released the Android Security Bulletin for September 2026, addressing several critical vulnerabilities that could let attackers execute code remotely on affected devices. The update, published on September 8, includes security patch levels dated 2026-09-01 and 2026-09-05. Android users should install the latest available update as soon as their device manufacturer releases it. The most serious flaws affect the Android System component. Google said these critical vulnerabilities could lead to remote code execution, or RCE, without requiring additional execution privileges or user…
Also in SecurityWeek Infosecurity Magazine Infosecurity Magazine +3
-
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write in V8 in Google Chrome prior to
Also in The Record SecurityWeek Bleeping Computer +3
-
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP
Also in Infosecurity Magazine CCCS Alerts & Advisories
-
FBI puts its cyber strategy on paper
The first public cybersecurity strategy issued by the FBI "directs our teams, our field offices, our global presence" to align their efforts on countering malicious hackers and cybercrime groups, senior official Brett…
Also in Recorded Future Intelligence
-
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI
Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That’s why for its new CyberAgents Exchange registry, Tenable paired its exposure management expertise with OpenAI GPT Cyber models to create the CyberAgents Exchange AI Inspector. Key takeaways The Exchange Inspector combines Tenable’s exposure detection with OpenAI’s GPT Cyber models and with human oversight to rigorously vet submissions made to the CyberAgents Exchange. Securing AI agents requires analyzing a broad attack surface that includes…
Also in Microsoft Security
-
ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws
AVEVA and Rockwell Automation also released patches for vulnerabilities affecting industrial control system products.
Also in CCCS Alerts & Advisories
-
Ivanti Patches Critical Flaws Across Enterprise Security Products
Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws.
Also in CCCS Alerts & Advisories
-
CISA Warns of N-able N-central RCE Vulnerability Exploited in the Wild
The Cybersecurity and Infrastructure Security Agency has added a maximum-severity flaw in N-able’s N-central remote monitoring and management platform to its Known Exploited Vulnerabilities catalog, confirming that attackers are actively abusing the bug against real-world targets. The vulnerability, tracked as CVE-2026-86218 , carries a perfect CVSS score of 10.0 and allows unauthenticated remote code execution, making it one of the most dangerous flaws to hit the managed service provider ecosystem this year. CISA classifies CVE-2026-86218 as a static code injection vulnerability tied to…
Also in The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-82004 | Adobe Campaign ClassicAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An att… Attack
Exploitation
|
|||||||||
| CVE-2026-78234 | Red Hat build of Apache Camel - HawtIO 4Red Hat | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a… Attack
Exploitation
|
|||||||||
| CVE-2026-12645 | Ivanti Neurons for ITSMIvanti | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Attack
Exploitation
|
|||||||||
| CVE-2026-12646 | Ivanti Neurons for ITSMIvanti | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Attack
Exploitation
|
|||||||||
| CVE-2026-12647 | Ivanti Neurons for ITSMIvanti | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Attack
Exploitation
|
|||||||||
| CVE-2026-12650 | Neurons for ITSMIvanti | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. Attack
Exploitation
|
|||||||||
| CVE-2026-26084 | FortiSandbox PaaSFortinet | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive inf… Attack
Exploitation
|
|||||||||
| CVE-2026-83941 | Microsoft EntraMicrosoft | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isMissing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. Attack
Exploitation
|
|||||||||
| CVE-2026-19232 | Adobe Experience Manager as a Cloud ServiceAdobe | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAdobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or s… Attack
Exploitation
|
|||||||||
| CVE-2026-48273 | ColdFusion 2025Adobe | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker co… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day
A critical unauthenticated remote code execution (RCE) zero-day in Adobe Commerce and Magento Open Source, dubbed StyleSmuggler, has been actively exploited since September 4 with attacks observed three days before a vendor patch became available. Key takeaways CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source that can be triggered without authentication. Active exploitation of CVE-2026-75650 began on September 4, 2026, three days before Adobe released a hotfix, with multiple victim stores confirmed across different…
Also in CISA Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.